Remainder of SSL purpose and trust code: trust and purpose setting in

[openssl.git] / ssl / ssl_lib.c

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index c72f0ee402cae397b55c5fe2bace17148556d7af..3bd8d158c90e2c3a7245735d1a6082914a840dbb 100644 (file)
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -61,6 +61,7 @@
 #include <stdio.h>
 #include <openssl/objects.h>
 #include <openssl/lhash.h>
+#include <openssl/x509v3.h>
 #include "ssl_locl.h"
 
 char *SSL_version_str=OPENSSL_VERSION_TEXT;
@@ -201,6 +202,8 @@ SSL *SSL_new(SSL_CTX *ctx)
        s->verify_mode=ctx->verify_mode;
        s->verify_depth=ctx->verify_depth;
        s->verify_callback=ctx->default_verify_callback;
+       s->purpose = ctx->purpose;
+       s->trust = ctx->trust;
        CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
        s->ctx=ctx;
 
@@ -215,6 +218,7 @@ SSL *SSL_new(SSL_CTX *ctx)
        s->references=1;
        s->server=(ctx->method->ssl_accept == ssl_undefined_function)?0:1;
        s->options=ctx->options;
+       s->mode=ctx->mode;
        SSL_clear(s);
 
        CRYPTO_new_ex_data(ssl_meth,(char *)s,&s->ex_data);
@@ -261,6 +265,46 @@ int SSL_set_session_id_context(SSL *ssl,const unsigned char *sid_ctx,
     return 1;
     }
 
+int SSL_CTX_set_purpose(SSL_CTX *s, int purpose)
+{
+       if(X509_PURPOSE_get_by_id(purpose) == -1) {
+               SSLerr(SSL_F_SSL_CTX_SET_PURPOSE, SSL_R_INVALID_PURPOSE);
+               return 0;
+       }
+       s->purpose = purpose;
+       return 1;
+}
+
+int SSL_set_purpose(SSL *s, int purpose)
+{
+       if(X509_PURPOSE_get_by_id(purpose) == -1) {
+               SSLerr(SSL_F_SSL_SET_PURPOSE, SSL_R_INVALID_PURPOSE);
+               return 0;
+       }
+       s->purpose = purpose;
+       return 1;
+}
+       
+int SSL_CTX_set_trust(SSL_CTX *s, int trust)
+{
+       if(X509_TRUST_get_by_id(trust) == -1) {
+               SSLerr(SSL_F_SSL_CTX_SET_TRUST, SSL_R_INVALID_TRUST);
+               return 0;
+       }
+       s->trust = trust;
+       return 1;
+}
+
+int SSL_set_trust(SSL *s, int trust)
+{
+       if(X509_TRUST_get_by_id(trust) == -1) {
+               SSLerr(SSL_F_SSL_SET_TRUST, SSL_R_INVALID_TRUST);
+               return 0;
+       }
+       s->trust = trust;
+       return 1;
+}
+
 void SSL_free(SSL *s)
        {
        int i;
@@ -575,7 +619,10 @@ int SSL_check_private_key(SSL *ssl)
                return(0);
                }
        if (ssl->cert == NULL)
-               return(SSL_CTX_check_private_key(ssl->ctx));
+               {
+                SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED);
+               return 0;
+               }
        if (ssl->cert->key->x509 == NULL)
                {
                SSLerr(SSL_F_SSL_CHECK_PRIVATE_KEY,SSL_R_NO_CERTIFICATE_ASSIGNED);
@@ -695,6 +742,8 @@ long SSL_ctrl(SSL *s,int cmd,long larg,char *parg)
                return(l);
        case SSL_CTRL_OPTIONS:
                return(s->options|=larg);
+       case SSL_CTRL_MODE:
+               return(s->mode|=larg);
        default:
                return(s->method->ssl_ctrl(s,cmd,larg,parg));
                }
@@ -752,6 +801,8 @@ long SSL_CTX_ctrl(SSL_CTX *ctx,int cmd,long larg,char *parg)
                return(ctx->stats.sess_cache_full);
        case SSL_CTRL_OPTIONS:
                return(ctx->options|=larg);
+       case SSL_CTRL_MODE:
+               return(ctx->mode|=larg);
        default:
                return(ctx->method->ssl_ctx_ctrl(ctx,cmd,larg,parg));
                }
@@ -1027,6 +1078,7 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
                goto err;
 
        ret->default_passwd_callback=NULL;
+       ret->default_passwd_callback_userdata=NULL;
        ret->client_cert_cb=NULL;
 
        ret->sessions=lh_new(SSL_SESSION_hash,SSL_SESSION_cmp);
@@ -1068,6 +1120,12 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *meth)
        ret->extra_certs=NULL;
        ret->comp_methods=SSL_COMP_get_compression_methods();
 
+       /* Initialise X509 tables: otherwise some certificate operations
+        * wont work. This is a non op if called more than once.
+        */
+
+       X509_init();
+
        return(ret);
 err:
        SSLerr(SSL_F_SSL_CTX_NEW,ERR_R_MALLOC_FAILURE);
@@ -1126,10 +1184,20 @@ void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb)
        ctx->default_passwd_callback=cb;
        }
 
+void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx,void *u)
+       {
+       ctx->default_passwd_callback_userdata=u;
+       }
+
 void SSL_CTX_set_cert_verify_callback(SSL_CTX *ctx,int (*cb)(),char *arg)
        {
+       /* now
+        *     int (*cb)(X509_STORE_CTX *),
+        * but should be
+        *     int (*cb)(X509_STORE_CTX *, void *arg)
+        */
        ctx->app_verify_callback=cb;
-       ctx->app_verify_arg=arg;
+       ctx->app_verify_arg=arg; /* never used */
        }
 
 void SSL_CTX_set_verify(SSL_CTX *ctx,int mode,int (*cb)(int, X509_STORE_CTX *))
@@ -1250,13 +1318,13 @@ X509 *ssl_get_server_send_cert(SSL *s)
        {
        unsigned long alg,mask,kalg;
        CERT *c;
-       int i,export;
+       int i,is_export;
 
        c=s->cert;
        ssl_set_cert_masks(c, s->s3->tmp.new_cipher);
        alg=s->s3->tmp.new_cipher->algorithms;
-       export=SSL_IS_EXPORT(alg);
-       mask=export?c->export_mask:c->mask;
+       is_export=SSL_IS_EXPORT(alg);
+       mask=is_export?c->export_mask:c->mask;
        kalg=alg&(SSL_MKEY_MASK|SSL_AUTH_MASK);
 
        if      (kalg & SSL_kDHr)
@@ -1695,7 +1763,7 @@ int ssl_init_wbio_buffer(SSL *s,int push)
                if (s->bbio == s->wbio)
                        s->wbio=BIO_pop(s->wbio);
                }
-       BIO_reset(bbio);
+       (void)BIO_reset(bbio);
 /*     if (!BIO_set_write_buffer_size(bbio,16*1024)) */
        if (!BIO_set_read_buffer_size(bbio,1))
                {
@@ -1877,13 +1945,14 @@ int SSL_want(SSL *s)
  */
 
 #ifndef NO_RSA
-void SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx,RSA *(*cb)(SSL *ssl,int export,
+void SSL_CTX_set_tmp_rsa_callback(SSL_CTX *ctx,RSA *(*cb)(SSL *ssl,
+                                                         int is_export,
                                                          int keylength))
     { SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_RSA_CB,0,(char *)cb); }
 #endif
 
 #ifndef NO_RSA
-void SSL_set_tmp_rsa_callback(SSL *ssl,RSA *(*cb)(SSL *ssl,int export,
+void SSL_set_tmp_rsa_callback(SSL *ssl,RSA *(*cb)(SSL *ssl,int is_export,
                                                          int keylength))
     { SSL_ctrl(ssl,SSL_CTRL_SET_TMP_RSA_CB,0,(char *)cb); }
 #endif
@@ -1892,14 +1961,14 @@ void SSL_set_tmp_rsa_callback(SSL *ssl,RSA *(*cb)(SSL *ssl,int export,
 /*!
  * \brief The RSA temporary key callback function.
  * \param ssl the SSL session.
- * \param export \c TRUE if the temp RSA key is for an export ciphersuite.
- * \param keylength if \c export is \c TRUE, then \c keylength is the size of
- * the required key in bits.
+ * \param is_export \c TRUE if the temp RSA key is for an export ciphersuite.
+ * \param keylength if \c is_export is \c TRUE, then \c keylength is the size
+ * of the required key in bits.
  * \return the temporary RSA key.
  * \sa SSL_CTX_set_tmp_rsa_callback, SSL_set_tmp_rsa_callback
  */
 
-RSA *cb(SSL *ssl,int export,int keylength)
+RSA *cb(SSL *ssl,int is_export,int keylength)
     {}
 #endif
 
@@ -1910,11 +1979,11 @@ RSA *cb(SSL *ssl,int export,int keylength)
  */
 
 #ifndef NO_DH
-void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,DH *(*dh)(SSL *ssl,int export,
+void SSL_CTX_set_tmp_dh_callback(SSL_CTX *ctx,DH *(*dh)(SSL *ssl,int is_export,
                                                        int keylength))
     { SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TMP_DH_CB,0,(char *)dh); }
 
-void SSL_set_tmp_dh_callback(SSL *ssl,DH *(*dh)(SSL *ssl,int export,
+void SSL_set_tmp_dh_callback(SSL *ssl,DH *(*dh)(SSL *ssl,int is_export,
                                                        int keylength))
     { SSL_ctrl(ssl,SSL_CTRL_SET_TMP_DH_CB,0,(char *)dh); }
 #endif