-/* ssl/ssl_rsa.c */
/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
* All rights reserved.
*
int ret = 0;
X509 *x = NULL;
- in = BIO_new(BIO_s_file_internal());
+ in = BIO_new(BIO_s_file());
if (in == NULL) {
SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, ERR_R_BUF_LIB);
goto end;
}
RSA_up_ref(rsa);
- EVP_PKEY_assign_RSA(pkey, rsa);
+ if (EVP_PKEY_assign_RSA(pkey, rsa) <= 0) {
+ RSA_free(rsa);
+ return 0;
+ }
ret = ssl_set_pkey(ssl->cert, pkey);
EVP_PKEY_free(pkey);
static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
{
int i;
- /*
- * Special case for DH: check two DH certificate types for a match. This
- * means for DH certificates we must set the certificate first.
- */
- if (pkey->type == EVP_PKEY_DH) {
- X509 *x;
- i = -1;
- x = c->pkeys[SSL_PKEY_DH_RSA].x509;
- if (x && X509_check_private_key(x, pkey))
- i = SSL_PKEY_DH_RSA;
- x = c->pkeys[SSL_PKEY_DH_DSA].x509;
- if (i == -1 && x && X509_check_private_key(x, pkey))
- i = SSL_PKEY_DH_DSA;
- ERR_clear_error();
- } else
- i = ssl_cert_type(NULL, pkey);
+ i = ssl_cert_type(NULL, pkey);
if (i < 0) {
SSLerr(SSL_F_SSL_SET_PKEY, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
return (0);
if (c->pkeys[i].x509 != NULL) {
EVP_PKEY *pktmp;
- pktmp = X509_get_pubkey(c->pkeys[i].x509);
+ pktmp = X509_get0_pubkey(c->pkeys[i].x509);
+ if (pktmp == NULL) {
+ SSLerr(SSL_F_SSL_SET_PKEY, ERR_R_MALLOC_FAILURE);
+ return 0;
+ }
+ /*
+ * The return code from EVP_PKEY_copy_parameters is deliberately
+ * ignored. Some EVP_PKEY types cannot do this.
+ */
EVP_PKEY_copy_parameters(pktmp, pkey);
- EVP_PKEY_free(pktmp);
ERR_clear_error();
#ifndef OPENSSL_NO_RSA
* Don't check the public/private key, this is mostly for smart
* cards.
*/
- if ((pkey->type == EVP_PKEY_RSA) &&
- (RSA_flags(pkey->pkey.rsa) & RSA_METHOD_FLAG_NO_CHECK)) ;
+ if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA
+ && RSA_flags(EVP_PKEY_get0_RSA(pkey)) & RSA_METHOD_FLAG_NO_CHECK);
else
#endif
if (!X509_check_private_key(c->pkeys[i].x509, pkey)) {
}
EVP_PKEY_free(c->pkeys[i].privatekey);
- CRYPTO_add(&pkey->references, 1, CRYPTO_LOCK_EVP_PKEY);
+ EVP_PKEY_up_ref(pkey);
c->pkeys[i].privatekey = pkey;
c->key = &(c->pkeys[i]);
return (1);
BIO *in;
RSA *rsa = NULL;
- in = BIO_new(BIO_s_file_internal());
+ in = BIO_new(BIO_s_file());
if (in == NULL) {
SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, ERR_R_BUF_LIB);
goto end;
BIO *in;
EVP_PKEY *pkey = NULL;
- in = BIO_new(BIO_s_file_internal());
+ in = BIO_new(BIO_s_file());
if (in == NULL) {
SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, ERR_R_BUF_LIB);
goto end;
EVP_PKEY *pkey;
int i;
- pkey = X509_get_pubkey(x);
+ pkey = X509_get0_pubkey(x);
if (pkey == NULL) {
SSLerr(SSL_F_SSL_SET_CERT, SSL_R_X509_LIB);
return (0);
i = ssl_cert_type(x, pkey);
if (i < 0) {
SSLerr(SSL_F_SSL_SET_CERT, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
- EVP_PKEY_free(pkey);
- return (0);
+ return 0;
}
-
+#ifndef OPENSSL_NO_EC
+ if (i == SSL_PKEY_ECC && !EC_KEY_can_sign(EVP_PKEY_get0_EC_KEY(pkey))) {
+ SSLerr(SSL_F_SSL_SET_CERT, SSL_R_ECC_CERT_NOT_FOR_SIGNING);
+ return 0;
+ }
+#endif
if (c->pkeys[i].privatekey != NULL) {
+ /*
+ * The return code from EVP_PKEY_copy_parameters is deliberately
+ * ignored. Some EVP_PKEY types cannot do this.
+ */
EVP_PKEY_copy_parameters(pkey, c->pkeys[i].privatekey);
ERR_clear_error();
* Don't check the public/private key, this is mostly for smart
* cards.
*/
- if ((c->pkeys[i].privatekey->type == EVP_PKEY_RSA) &&
- (RSA_flags(c->pkeys[i].privatekey->pkey.rsa) &
- RSA_METHOD_FLAG_NO_CHECK)) ;
+ if (EVP_PKEY_id(c->pkeys[i].privatekey) == EVP_PKEY_RSA
+ && RSA_flags(EVP_PKEY_get0_RSA(c->pkeys[i].privatekey)) &
+ RSA_METHOD_FLAG_NO_CHECK) ;
else
#endif /* OPENSSL_NO_RSA */
if (!X509_check_private_key(x, c->pkeys[i].privatekey)) {
}
}
- EVP_PKEY_free(pkey);
-
X509_free(c->pkeys[i].x509);
- CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
+ X509_up_ref(x);
c->pkeys[i].x509 = x;
c->key = &(c->pkeys[i]);
- return (1);
+ return 1;
}
#ifndef OPENSSL_NO_STDIO
int ret = 0;
X509 *x = NULL;
- in = BIO_new(BIO_s_file_internal());
+ in = BIO_new(BIO_s_file());
if (in == NULL) {
SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, ERR_R_BUF_LIB);
goto end;
}
RSA_up_ref(rsa);
- EVP_PKEY_assign_RSA(pkey, rsa);
+ if (EVP_PKEY_assign_RSA(pkey, rsa) <= 0) {
+ RSA_free(rsa);
+ return 0;
+ }
ret = ssl_set_pkey(ctx->cert, pkey);
EVP_PKEY_free(pkey);
BIO *in;
RSA *rsa = NULL;
- in = BIO_new(BIO_s_file_internal());
+ in = BIO_new(BIO_s_file());
if (in == NULL) {
SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, ERR_R_BUF_LIB);
goto end;
BIO *in;
EVP_PKEY *pkey = NULL;
- in = BIO_new(BIO_s_file_internal());
+ in = BIO_new(BIO_s_file());
if (in == NULL) {
SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, ERR_R_BUF_LIB);
goto end;
BIO *in;
int ret = 0;
X509 *x = NULL;
+ pem_password_cb *passwd_callback;
+ void *passwd_callback_userdata;
ERR_clear_error(); /* clear error stack for
* SSL_CTX_use_certificate() */
- in = BIO_new(BIO_s_file_internal());
+ if (ctx != NULL) {
+ passwd_callback = ctx->default_passwd_callback;
+ passwd_callback_userdata = ctx->default_passwd_callback_userdata;
+ } else {
+ passwd_callback = ssl->default_passwd_callback;
+ passwd_callback_userdata = ssl->default_passwd_callback_userdata;
+ }
+
+ in = BIO_new(BIO_s_file());
if (in == NULL) {
SSLerr(SSL_F_USE_CERTIFICATE_CHAIN_FILE, ERR_R_BUF_LIB);
goto end;
goto end;
}
- x = PEM_read_bio_X509_AUX(in, NULL, ctx->default_passwd_callback,
- ctx->default_passwd_callback_userdata);
+ x = PEM_read_bio_X509_AUX(in, NULL, passwd_callback,
+ passwd_callback_userdata);
if (x == NULL) {
SSLerr(SSL_F_USE_CERTIFICATE_CHAIN_FILE, ERR_R_PEM_LIB);
goto end;
goto end;
}
- while ((ca = PEM_read_bio_X509(in, NULL,
- ctx->default_passwd_callback,
- ctx->default_passwd_callback_userdata))
- != NULL) {
+ while ((ca = PEM_read_bio_X509(in, NULL, passwd_callback,
+ passwd_callback_userdata))
+ != NULL) {
if (ctx)
r = SSL_CTX_add0_chain_cert(ctx, ca);
else
*extension_data = NULL;
*extension_length = 0;
if (serverinfo == NULL || serverinfo_length == 0)
- return 0;
+ return -1;
for (;;) {
unsigned int type = 0;
size_t len = 0;
/* end of serverinfo */
if (serverinfo_length == 0)
- return -1; /* Extension not found */
+ return 0; /* Extension not found */
/* read 2-byte type field */
if (serverinfo_length < 2)
- return 0; /* Error */
+ return -1; /* Error */
type = (serverinfo[0] << 8) + serverinfo[1];
serverinfo += 2;
serverinfo_length -= 2;
/* read 2-byte len field */
if (serverinfo_length < 2)
- return 0; /* Error */
+ return -1; /* Error */
len = (serverinfo[0] << 8) + serverinfo[1];
serverinfo += 2;
serverinfo_length -= 2;
if (len > serverinfo_length)
- return 0; /* Error */
+ return -1; /* Error */
if (type == extension_type) {
*extension_data = serverinfo;
/* Find the relevant extension from the serverinfo */
int retval = serverinfo_find_extension(serverinfo, serverinfo_length,
ext_type, out, outlen);
+ if (retval == -1) {
+ *al = SSL_AD_DECODE_ERROR;
+ return -1; /* Error */
+ }
if (retval == 0)
- return 0; /* Error */
- if (retval == -1)
- return -1; /* No extension found, don't send extension */
+ return 0; /* No extension found, don't send extension */
return 1; /* Send extension */
}
return -1; /* No serverinfo data found, don't send
return 1;
}
-#ifndef OPENSSL_NO_STDIO
int SSL_CTX_use_serverinfo_file(SSL_CTX *ctx, const char *file)
{
unsigned char *serverinfo = NULL;
goto end;
}
- bin = BIO_new(BIO_s_file_internal());
+ bin = BIO_new(BIO_s_file());
if (bin == NULL) {
SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_BUF_LIB);
goto end;
BIO_free(bin);
return ret;
}
-#endif /* OPENSSL_NO_STDIO */
projects / openssl.git / blobdiff