Make TLS 1.2 ciphers work again.

[openssl.git] / ssl / ssl_cert.c

diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c
index 95478141a8a8b5058ee89da43e85bde9c61d53fa..a0da7d3741ac112fba250bac6b48168fcf9f2029 100644 (file)
--- a/ssl/ssl_cert.c
+++ b/ssl/ssl_cert.c
@@ -321,18 +321,12 @@ CERT *ssl_cert_dup(CERT *cert)
 
                if (cpk->chain)
                        {
-                       int j;
-                       rpk->chain = sk_X509_dup(cpk->chain);
+                       rpk->chain = X509_chain_up_ref(cpk->chain);
                        if (!rpk->chain)
                                {
                                SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_MALLOC_FAILURE);
                                goto err;
                                }
-                       for (j = 0; j < sk_X509_num(rpk->chain); j++)
-                               {
-                               X509 *x = sk_X509_value(rpk->chain, j);
-                               CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
-                               }
                        }
                rpk->valid_flags = 0;
                 if (cert->pkeys[i].authz != NULL)
@@ -415,6 +409,8 @@ CERT *ssl_cert_dup(CERT *cert)
                ret->chain_store = cert->chain_store;
                }
 
+       ret->ciphers_raw = NULL;
+
        return(ret);
        
 #if !defined(OPENSSL_NO_DH) || !defined(OPENSSL_NO_ECDH)
@@ -467,7 +463,8 @@ void ssl_cert_clear_certs(CERT *c)
                 if (cpk->authz != NULL)
                        OPENSSL_free(cpk->authz);
 #endif
-               cpk->valid_flags = 0;
+               /* Clear all flags apart from explicit sign */
+               cpk->valid_flags &= CERT_PKEY_EXPLICIT_SIGN;
                }
        }
 
@@ -516,6 +513,8 @@ void ssl_cert_free(CERT *c)
                X509_STORE_free(c->verify_store);
        if (c->chain_store)
                X509_STORE_free(c->chain_store);
+       if (c->ciphers_raw)
+               OPENSSL_free(c->ciphers_raw);
        OPENSSL_free(c);
        }
 
@@ -561,18 +560,11 @@ int ssl_cert_set0_chain(CERT *c, STACK_OF(X509) *chain)
 int ssl_cert_set1_chain(CERT *c, STACK_OF(X509) *chain)
        {
        STACK_OF(X509) *dchain;
-       X509 *x;
-       int i;
        if (!chain)
                return ssl_cert_set0_chain(c, NULL);
-       dchain = sk_X509_dup(chain);
+       dchain = X509_chain_up_ref(chain);
        if (!dchain)
                return 0;
-       for (i = 0; i < sk_X509_num(dchain); i++)
-               {
-               x = sk_X509_value(dchain, i);
-               CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
-               }
        if (!ssl_cert_set0_chain(c, dchain))
                {
                sk_X509_pop_free(dchain, X509_free);
@@ -704,6 +696,8 @@ int ssl_verify_cert_chain(SSL *s,STACK_OF(X509) *sk)
                SSLerr(SSL_F_SSL_VERIFY_CERT_CHAIN,ERR_R_X509_LIB);
                return(0);
                }
+       /* Set suite B flags if needed */
+       X509_STORE_CTX_set_flags(&ctx, tls1_suiteb(s));
 #if 0
        if (SSL_get_verify_depth(s) >= 0)
                X509_STORE_CTX_set_depth(&ctx, SSL_get_verify_depth(s));
@@ -1163,6 +1157,8 @@ int ssl_build_cert_chain(CERT *c, X509_STORE *chain_store, int flags)
                SSLerr(SSL_F_SSL_BUILD_CERT_CHAIN, ERR_R_X509_LIB);
                return 0;
                }
+       /* Set suite B flags if needed */
+       X509_STORE_CTX_set_flags(&xs_ctx, c->cert_flags & SSL_CERT_FLAG_SUITEB_128_LOS);
 
        i = X509_verify_cert(&xs_ctx);
        if (i > 0)