/*
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
*/
#include <stdio.h>
-#include "ssl_locl.h"
+#include "ssl_local.h"
#include "internal/packet.h"
#include <openssl/bio.h>
#include <openssl/objects.h>
#include <openssl/evp.h>
#include <openssl/x509.h>
+#include <openssl/x509v3.h>
#include <openssl/pem.h>
static int ssl_set_cert(CERT *c, X509 *x509);
| SSL_EXT_TLS1_2_SERVER_HELLO \
| SSL_EXT_IGNORE_ON_RESUMPTION)
+#define NAME_PREFIX1 "SERVERINFO FOR "
+#define NAME_PREFIX2 "SERVERINFOV2 FOR "
+
int SSL_use_certificate(SSL *ssl, X509 *x)
{
int rv;
if (x == NULL) {
- SSLerr(SSL_F_SSL_USE_CERTIFICATE, ERR_R_PASSED_NULL_PARAMETER);
+ ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER);
return 0;
}
+
rv = ssl_security_cert(ssl, NULL, x, 0, 1);
if (rv != 1) {
- SSLerr(SSL_F_SSL_USE_CERTIFICATE, rv);
+ ERR_raise(ERR_LIB_SSL, rv);
return 0;
}
int j;
BIO *in;
int ret = 0;
- X509 *x = NULL;
+ X509 *cert = NULL, *x = NULL;
in = BIO_new(BIO_s_file());
if (in == NULL) {
- SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, ERR_R_BUF_LIB);
+ ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB);
goto end;
}
if (BIO_read_filename(in, file) <= 0) {
- SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, ERR_R_SYS_LIB);
+ ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB);
+ goto end;
+ }
+
+ if (type != SSL_FILETYPE_ASN1 && type != SSL_FILETYPE_PEM) {
+ ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE);
+ goto end;
+ }
+ x = X509_new_ex(ssl->ctx->libctx, ssl->ctx->propq);
+ if (x == NULL) {
+ ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
goto end;
}
if (type == SSL_FILETYPE_ASN1) {
j = ERR_R_ASN1_LIB;
- x = d2i_X509_bio(in, NULL);
+ cert = d2i_X509_bio(in, &x);
} else if (type == SSL_FILETYPE_PEM) {
j = ERR_R_PEM_LIB;
- x = PEM_read_bio_X509(in, NULL, ssl->default_passwd_callback,
- ssl->default_passwd_callback_userdata);
+ cert = PEM_read_bio_X509(in, &x, ssl->default_passwd_callback,
+ ssl->default_passwd_callback_userdata);
} else {
- SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, SSL_R_BAD_SSL_FILETYPE);
+ ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE);
goto end;
}
- if (x == NULL) {
- SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, j);
+ if (cert == NULL) {
+ ERR_raise(ERR_LIB_SSL, j);
goto end;
}
X509 *x;
int ret;
- x = d2i_X509(NULL, &d, (long)len);
+ x = X509_new_ex(ssl->ctx->libctx, ssl->ctx->propq);
if (x == NULL) {
- SSLerr(SSL_F_SSL_USE_CERTIFICATE_ASN1, ERR_R_ASN1_LIB);
+ ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
return 0;
}
- ret = SSL_use_certificate(ssl, x);
- X509_free(x);
- return ret;
-}
-
-#ifndef OPENSSL_NO_RSA
-int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa)
-{
- EVP_PKEY *pkey;
- int ret;
-
- if (rsa == NULL) {
- SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER);
- return 0;
- }
- if ((pkey = EVP_PKEY_new()) == NULL) {
- SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY, ERR_R_EVP_LIB);
+ if (d2i_X509(&x, &d, (long)len)== NULL) {
+ X509_free(x);
+ ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB);
return 0;
}
- RSA_up_ref(rsa);
- if (EVP_PKEY_assign_RSA(pkey, rsa) <= 0) {
- RSA_free(rsa);
- EVP_PKEY_free(pkey);
- return 0;
- }
-
- ret = ssl_set_pkey(ssl->cert, pkey);
- EVP_PKEY_free(pkey);
+ ret = SSL_use_certificate(ssl, x);
+ X509_free(x);
return ret;
}
-#endif
static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
{
size_t i;
if (ssl_cert_lookup_by_pkey(pkey, &i) == NULL) {
- SSLerr(SSL_F_SSL_SET_PKEY, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
+ ERR_raise(ERR_LIB_SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
return 0;
}
- if (c->pkeys[i].x509 != NULL) {
- EVP_PKEY *pktmp;
- pktmp = X509_get0_pubkey(c->pkeys[i].x509);
- if (pktmp == NULL) {
- SSLerr(SSL_F_SSL_SET_PKEY, ERR_R_MALLOC_FAILURE);
- return 0;
- }
- /*
- * The return code from EVP_PKEY_copy_parameters is deliberately
- * ignored. Some EVP_PKEY types cannot do this.
- */
- EVP_PKEY_copy_parameters(pktmp, pkey);
- ERR_clear_error();
-
-#ifndef OPENSSL_NO_RSA
- /*
- * Don't check the public/private key, this is mostly for smart
- * cards.
- */
- if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA
- && RSA_flags(EVP_PKEY_get0_RSA(pkey)) & RSA_METHOD_FLAG_NO_CHECK) ;
- else
-#endif
- if (!X509_check_private_key(c->pkeys[i].x509, pkey)) {
- X509_free(c->pkeys[i].x509);
- c->pkeys[i].x509 = NULL;
- return 0;
- }
- }
+ if (c->pkeys[i].x509 != NULL
+ && !X509_check_private_key(c->pkeys[i].x509, pkey))
+ return 0;
EVP_PKEY_free(c->pkeys[i].privatekey);
EVP_PKEY_up_ref(pkey);
return 1;
}
-#ifndef OPENSSL_NO_RSA
-int SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type)
-{
- int j, ret = 0;
- BIO *in;
- RSA *rsa = NULL;
-
- in = BIO_new(BIO_s_file());
- if (in == NULL) {
- SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, ERR_R_BUF_LIB);
- goto end;
- }
-
- if (BIO_read_filename(in, file) <= 0) {
- SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, ERR_R_SYS_LIB);
- goto end;
- }
- if (type == SSL_FILETYPE_ASN1) {
- j = ERR_R_ASN1_LIB;
- rsa = d2i_RSAPrivateKey_bio(in, NULL);
- } else if (type == SSL_FILETYPE_PEM) {
- j = ERR_R_PEM_LIB;
- rsa = PEM_read_bio_RSAPrivateKey(in, NULL,
- ssl->default_passwd_callback,
- ssl->default_passwd_callback_userdata);
- } else {
- SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE);
- goto end;
- }
- if (rsa == NULL) {
- SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, j);
- goto end;
- }
- ret = SSL_use_RSAPrivateKey(ssl, rsa);
- RSA_free(rsa);
- end:
- BIO_free(in);
- return ret;
-}
-
-int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, const unsigned char *d, long len)
-{
- int ret;
- const unsigned char *p;
- RSA *rsa;
-
- p = d;
- if ((rsa = d2i_RSAPrivateKey(NULL, &p, (long)len)) == NULL) {
- SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1, ERR_R_ASN1_LIB);
- return 0;
- }
-
- ret = SSL_use_RSAPrivateKey(ssl, rsa);
- RSA_free(rsa);
- return ret;
-}
-#endif /* !OPENSSL_NO_RSA */
-
int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey)
{
int ret;
if (pkey == NULL) {
- SSLerr(SSL_F_SSL_USE_PRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER);
+ ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER);
return 0;
}
ret = ssl_set_pkey(ssl->cert, pkey);
in = BIO_new(BIO_s_file());
if (in == NULL) {
- SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, ERR_R_BUF_LIB);
+ ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB);
goto end;
}
if (BIO_read_filename(in, file) <= 0) {
- SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, ERR_R_SYS_LIB);
+ ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB);
goto end;
}
if (type == SSL_FILETYPE_PEM) {
j = ERR_R_PEM_LIB;
- pkey = PEM_read_bio_PrivateKey(in, NULL,
- ssl->default_passwd_callback,
- ssl->default_passwd_callback_userdata);
+ pkey = PEM_read_bio_PrivateKey_ex(in, NULL,
+ ssl->default_passwd_callback,
+ ssl->default_passwd_callback_userdata,
+ ssl->ctx->libctx,
+ ssl->ctx->propq);
} else if (type == SSL_FILETYPE_ASN1) {
j = ERR_R_ASN1_LIB;
- pkey = d2i_PrivateKey_bio(in, NULL);
+ pkey = d2i_PrivateKey_ex_bio(in, NULL, ssl->ctx->libctx,
+ ssl->ctx->propq);
} else {
- SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE);
+ ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE);
goto end;
}
if (pkey == NULL) {
- SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, j);
+ ERR_raise(ERR_LIB_SSL, j);
goto end;
}
ret = SSL_use_PrivateKey(ssl, pkey);
EVP_PKEY *pkey;
p = d;
- if ((pkey = d2i_PrivateKey(type, NULL, &p, (long)len)) == NULL) {
- SSLerr(SSL_F_SSL_USE_PRIVATEKEY_ASN1, ERR_R_ASN1_LIB);
+ if ((pkey = d2i_PrivateKey_ex(type, NULL, &p, (long)len, ssl->ctx->libctx,
+ ssl->ctx->propq)) == NULL) {
+ ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB);
return 0;
}
{
int rv;
if (x == NULL) {
- SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE, ERR_R_PASSED_NULL_PARAMETER);
+ ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER);
return 0;
}
+
rv = ssl_security_cert(NULL, ctx, x, 0, 1);
if (rv != 1) {
- SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE, rv);
+ ERR_raise(ERR_LIB_SSL, rv);
return 0;
}
return ssl_set_cert(ctx->cert, x);
pkey = X509_get0_pubkey(x);
if (pkey == NULL) {
- SSLerr(SSL_F_SSL_SET_CERT, SSL_R_X509_LIB);
+ ERR_raise(ERR_LIB_SSL, SSL_R_X509_LIB);
return 0;
}
if (ssl_cert_lookup_by_pkey(pkey, &i) == NULL) {
- SSLerr(SSL_F_SSL_SET_CERT, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
+ ERR_raise(ERR_LIB_SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
return 0;
}
-#ifndef OPENSSL_NO_EC
- if (i == SSL_PKEY_ECC && !EC_KEY_can_sign(EVP_PKEY_get0_EC_KEY(pkey))) {
- SSLerr(SSL_F_SSL_SET_CERT, SSL_R_ECC_CERT_NOT_FOR_SIGNING);
+
+ if (i == SSL_PKEY_ECC && !EVP_PKEY_can_sign(pkey)) {
+ ERR_raise(ERR_LIB_SSL, SSL_R_ECC_CERT_NOT_FOR_SIGNING);
return 0;
}
-#endif
+
if (c->pkeys[i].privatekey != NULL) {
/*
* The return code from EVP_PKEY_copy_parameters is deliberately
EVP_PKEY_copy_parameters(pkey, c->pkeys[i].privatekey);
ERR_clear_error();
-#ifndef OPENSSL_NO_RSA
- /*
- * Don't check the public/private key, this is mostly for smart
- * cards.
- */
- if (EVP_PKEY_id(c->pkeys[i].privatekey) == EVP_PKEY_RSA
- && RSA_flags(EVP_PKEY_get0_RSA(c->pkeys[i].privatekey)) &
- RSA_METHOD_FLAG_NO_CHECK) ;
- else
-#endif /* OPENSSL_NO_RSA */
if (!X509_check_private_key(x, c->pkeys[i].privatekey)) {
/*
* don't fail for a cert/key mismatch, just free current private
int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type)
{
- int j;
+ int j = SSL_R_BAD_VALUE;
BIO *in;
int ret = 0;
- X509 *x = NULL;
+ X509 *x = NULL, *cert = NULL;
in = BIO_new(BIO_s_file());
if (in == NULL) {
- SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, ERR_R_BUF_LIB);
+ ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB);
goto end;
}
if (BIO_read_filename(in, file) <= 0) {
- SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, ERR_R_SYS_LIB);
+ ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB);
+ goto end;
+ }
+ if (type != SSL_FILETYPE_ASN1 && type != SSL_FILETYPE_PEM) {
+ ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE);
+ goto end;
+ }
+ x = X509_new_ex(ctx->libctx, ctx->propq);
+ if (x == NULL) {
+ ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
goto end;
}
if (type == SSL_FILETYPE_ASN1) {
j = ERR_R_ASN1_LIB;
- x = d2i_X509_bio(in, NULL);
+ cert = d2i_X509_bio(in, &x);
} else if (type == SSL_FILETYPE_PEM) {
j = ERR_R_PEM_LIB;
- x = PEM_read_bio_X509(in, NULL, ctx->default_passwd_callback,
- ctx->default_passwd_callback_userdata);
- } else {
- SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, SSL_R_BAD_SSL_FILETYPE);
- goto end;
+ cert = PEM_read_bio_X509(in, &x, ctx->default_passwd_callback,
+ ctx->default_passwd_callback_userdata);
}
-
- if (x == NULL) {
- SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, j);
+ if (cert == NULL) {
+ ERR_raise(ERR_LIB_SSL, j);
goto end;
}
X509 *x;
int ret;
- x = d2i_X509(NULL, &d, (long)len);
+ x = X509_new_ex(ctx->libctx, ctx->propq);
if (x == NULL) {
- SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1, ERR_R_ASN1_LIB);
+ ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
return 0;
}
- ret = SSL_CTX_use_certificate(ctx, x);
- X509_free(x);
- return ret;
-}
-
-#ifndef OPENSSL_NO_RSA
-int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa)
-{
- int ret;
- EVP_PKEY *pkey;
-
- if (rsa == NULL) {
- SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER);
- return 0;
- }
- if ((pkey = EVP_PKEY_new()) == NULL) {
- SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY, ERR_R_EVP_LIB);
+ if (d2i_X509(&x, &d, (long)len) == NULL) {
+ X509_free(x);
+ ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB);
return 0;
}
- RSA_up_ref(rsa);
- if (EVP_PKEY_assign_RSA(pkey, rsa) <= 0) {
- RSA_free(rsa);
- EVP_PKEY_free(pkey);
- return 0;
- }
-
- ret = ssl_set_pkey(ctx->cert, pkey);
- EVP_PKEY_free(pkey);
- return ret;
-}
-
-int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type)
-{
- int j, ret = 0;
- BIO *in;
- RSA *rsa = NULL;
-
- in = BIO_new(BIO_s_file());
- if (in == NULL) {
- SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, ERR_R_BUF_LIB);
- goto end;
- }
-
- if (BIO_read_filename(in, file) <= 0) {
- SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, ERR_R_SYS_LIB);
- goto end;
- }
- if (type == SSL_FILETYPE_ASN1) {
- j = ERR_R_ASN1_LIB;
- rsa = d2i_RSAPrivateKey_bio(in, NULL);
- } else if (type == SSL_FILETYPE_PEM) {
- j = ERR_R_PEM_LIB;
- rsa = PEM_read_bio_RSAPrivateKey(in, NULL,
- ctx->default_passwd_callback,
- ctx->default_passwd_callback_userdata);
- } else {
- SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE);
- goto end;
- }
- if (rsa == NULL) {
- SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, j);
- goto end;
- }
- ret = SSL_CTX_use_RSAPrivateKey(ctx, rsa);
- RSA_free(rsa);
- end:
- BIO_free(in);
- return ret;
-}
-
-int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d,
- long len)
-{
- int ret;
- const unsigned char *p;
- RSA *rsa;
-
- p = d;
- if ((rsa = d2i_RSAPrivateKey(NULL, &p, (long)len)) == NULL) {
- SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1, ERR_R_ASN1_LIB);
- return 0;
- }
-
- ret = SSL_CTX_use_RSAPrivateKey(ctx, rsa);
- RSA_free(rsa);
+ ret = SSL_CTX_use_certificate(ctx, x);
+ X509_free(x);
return ret;
}
-#endif /* !OPENSSL_NO_RSA */
int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey)
{
if (pkey == NULL) {
- SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER);
+ ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER);
return 0;
}
return ssl_set_pkey(ctx->cert, pkey);
in = BIO_new(BIO_s_file());
if (in == NULL) {
- SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, ERR_R_BUF_LIB);
+ ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB);
goto end;
}
if (BIO_read_filename(in, file) <= 0) {
- SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, ERR_R_SYS_LIB);
+ ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB);
goto end;
}
if (type == SSL_FILETYPE_PEM) {
j = ERR_R_PEM_LIB;
- pkey = PEM_read_bio_PrivateKey(in, NULL,
+ pkey = PEM_read_bio_PrivateKey_ex(in, NULL,
ctx->default_passwd_callback,
- ctx->default_passwd_callback_userdata);
+ ctx->default_passwd_callback_userdata,
+ ctx->libctx, ctx->propq);
} else if (type == SSL_FILETYPE_ASN1) {
j = ERR_R_ASN1_LIB;
- pkey = d2i_PrivateKey_bio(in, NULL);
+ pkey = d2i_PrivateKey_ex_bio(in, NULL, ctx->libctx, ctx->propq);
} else {
- SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE);
+ ERR_raise(ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE);
goto end;
}
if (pkey == NULL) {
- SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, j);
+ ERR_raise(ERR_LIB_SSL, j);
goto end;
}
ret = SSL_CTX_use_PrivateKey(ctx, pkey);
EVP_PKEY *pkey;
p = d;
- if ((pkey = d2i_PrivateKey(type, NULL, &p, (long)len)) == NULL) {
- SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1, ERR_R_ASN1_LIB);
+ if ((pkey = d2i_PrivateKey_ex(type, NULL, &p, (long)len, ctx->libctx,
+ ctx->propq)) == NULL) {
+ ERR_raise(ERR_LIB_SSL, ERR_R_ASN1_LIB);
return 0;
}
X509 *x = NULL;
pem_password_cb *passwd_callback;
void *passwd_callback_userdata;
+ SSL_CTX *real_ctx = (ssl == NULL) ? ctx : ssl->ctx;
+
+ if (ctx == NULL && ssl == NULL)
+ return 0;
ERR_clear_error(); /* clear error stack for
* SSL_CTX_use_certificate() */
in = BIO_new(BIO_s_file());
if (in == NULL) {
- SSLerr(SSL_F_USE_CERTIFICATE_CHAIN_FILE, ERR_R_BUF_LIB);
+ ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB);
goto end;
}
if (BIO_read_filename(in, file) <= 0) {
- SSLerr(SSL_F_USE_CERTIFICATE_CHAIN_FILE, ERR_R_SYS_LIB);
+ ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB);
goto end;
}
- x = PEM_read_bio_X509_AUX(in, NULL, passwd_callback,
- passwd_callback_userdata);
+ x = X509_new_ex(real_ctx->libctx, real_ctx->propq);
if (x == NULL) {
- SSLerr(SSL_F_USE_CERTIFICATE_CHAIN_FILE, ERR_R_PEM_LIB);
+ ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
+ goto end;
+ }
+ if (PEM_read_bio_X509_AUX(in, &x, passwd_callback,
+ passwd_callback_userdata) == NULL) {
+ ERR_raise(ERR_LIB_SSL, ERR_R_PEM_LIB);
goto end;
}
goto end;
}
- while ((ca = PEM_read_bio_X509(in, NULL, passwd_callback,
- passwd_callback_userdata))
- != NULL) {
- if (ctx)
- r = SSL_CTX_add0_chain_cert(ctx, ca);
- else
- r = SSL_add0_chain_cert(ssl, ca);
- /*
- * Note that we must not free ca if it was successfully added to
- * the chain (while we must free the main certificate, since its
- * reference count is increased by SSL_CTX_use_certificate).
- */
- if (!r) {
- X509_free(ca);
- ret = 0;
+ while (1) {
+ ca = X509_new_ex(real_ctx->libctx, real_ctx->propq);
+ if (ca == NULL) {
+ ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
goto end;
}
+ if (PEM_read_bio_X509(in, &ca, passwd_callback,
+ passwd_callback_userdata) != NULL) {
+ if (ctx)
+ r = SSL_CTX_add0_chain_cert(ctx, ca);
+ else
+ r = SSL_add0_chain_cert(ssl, ca);
+ /*
+ * Note that we must not free ca if it was successfully added to
+ * the chain (while we must free the main certificate, since its
+ * reference count is increased by SSL_CTX_use_certificate).
+ */
+ if (!r) {
+ X509_free(ca);
+ ret = 0;
+ goto end;
+ }
+ } else {
+ X509_free(ca);
+ break;
+ }
}
/* When the while loop ends, it's usually just EOF. */
err = ERR_peek_last_error();
unsigned char *new_serverinfo;
if (ctx == NULL || serverinfo == NULL || serverinfo_length == 0) {
- SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_EX, ERR_R_PASSED_NULL_PARAMETER);
+ ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER);
return 0;
}
if (!serverinfo_process_buffer(version, serverinfo, serverinfo_length,
NULL)) {
- SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_EX, SSL_R_INVALID_SERVERINFO_DATA);
+ ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_SERVERINFO_DATA);
return 0;
}
if (ctx->cert->key == NULL) {
- SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_EX, ERR_R_INTERNAL_ERROR);
+ ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
return 0;
}
new_serverinfo = OPENSSL_realloc(ctx->cert->key->serverinfo,
serverinfo_length);
if (new_serverinfo == NULL) {
- SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_EX, ERR_R_MALLOC_FAILURE);
+ ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
return 0;
}
ctx->cert->key->serverinfo = new_serverinfo;
*/
if (!serverinfo_process_buffer(version, serverinfo, serverinfo_length,
ctx)) {
- SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_EX, SSL_R_INVALID_SERVERINFO_DATA);
+ ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_SERVERINFO_DATA);
return 0;
}
return 1;
long extension_length = 0;
char *name = NULL;
char *header = NULL;
- char namePrefix1[] = "SERVERINFO FOR ";
- char namePrefix2[] = "SERVERINFOV2 FOR ";
+ unsigned int name_len;
int ret = 0;
BIO *bin = NULL;
size_t num_extensions = 0, contextoff = 0;
if (ctx == NULL || file == NULL) {
- SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_PASSED_NULL_PARAMETER);
+ ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER);
goto end;
}
bin = BIO_new(BIO_s_file());
if (bin == NULL) {
- SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_BUF_LIB);
+ ERR_raise(ERR_LIB_SSL, ERR_R_BUF_LIB);
goto end;
}
if (BIO_read_filename(bin, file) <= 0) {
- SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_SYS_LIB);
+ ERR_raise(ERR_LIB_SSL, ERR_R_SYS_LIB);
goto end;
}
* There must be at least one extension in this file
*/
if (num_extensions == 0) {
- SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE,
- SSL_R_NO_PEM_EXTENSIONS);
+ ERR_raise(ERR_LIB_SSL, SSL_R_NO_PEM_EXTENSIONS);
goto end;
} else /* End of file, we're done */
break;
}
/* Check that PEM name starts with "BEGIN SERVERINFO FOR " */
- if (strlen(name) < strlen(namePrefix1)) {
- SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, SSL_R_PEM_NAME_TOO_SHORT);
+ name_len = strlen(name);
+ if (name_len < sizeof(NAME_PREFIX1) - 1) {
+ ERR_raise(ERR_LIB_SSL, SSL_R_PEM_NAME_TOO_SHORT);
goto end;
}
- if (strncmp(name, namePrefix1, strlen(namePrefix1)) == 0) {
+ if (HAS_PREFIX(name, NAME_PREFIX1)) {
version = SSL_SERVERINFOV1;
} else {
- if (strlen(name) < strlen(namePrefix2)) {
- SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE,
- SSL_R_PEM_NAME_TOO_SHORT);
+ if (name_len < sizeof(NAME_PREFIX2) - 1) {
+ ERR_raise(ERR_LIB_SSL, SSL_R_PEM_NAME_TOO_SHORT);
goto end;
}
- if (strncmp(name, namePrefix2, strlen(namePrefix2)) != 0) {
- SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE,
- SSL_R_PEM_NAME_BAD_PREFIX);
+ if (!HAS_PREFIX(name, NAME_PREFIX2)) {
+ ERR_raise(ERR_LIB_SSL, SSL_R_PEM_NAME_BAD_PREFIX);
goto end;
}
version = SSL_SERVERINFOV2;
if (extension_length < 4
|| (extension[2] << 8) + extension[3]
!= extension_length - 4) {
- SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, SSL_R_BAD_DATA);
+ ERR_raise(ERR_LIB_SSL, SSL_R_BAD_DATA);
goto end;
}
/*
if (extension_length < 8
|| (extension[6] << 8) + extension[7]
!= extension_length - 8) {
- SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, SSL_R_BAD_DATA);
+ ERR_raise(ERR_LIB_SSL, SSL_R_BAD_DATA);
goto end;
}
}
tmp = OPENSSL_realloc(serverinfo, serverinfo_length + extension_length
+ contextoff);
if (tmp == NULL) {
- SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_MALLOC_FAILURE);
+ ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
goto end;
}
serverinfo = tmp;
/* Do all security checks before anything else */
rv = ssl_security_cert(ssl, ctx, x509, 0, 1);
if (rv != 1) {
- SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, rv);
+ ERR_raise(ERR_LIB_SSL, rv);
goto out;
}
for (j = 0; j < sk_X509_num(chain); j++) {
rv = ssl_security_cert(ssl, ctx, sk_X509_value(chain, j), 0, 0);
if (rv != 1) {
- SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, rv);
+ ERR_raise(ERR_LIB_SSL, rv);
goto out;
}
}
if (EVP_PKEY_missing_parameters(privatekey)) {
if (EVP_PKEY_missing_parameters(pubkey)) {
/* nobody has parameters? - error */
- SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, SSL_R_MISSING_PARAMETERS);
+ ERR_raise(ERR_LIB_SSL, SSL_R_MISSING_PARAMETERS);
goto out;
} else {
/* copy to privatekey from pubkey */
EVP_PKEY_copy_parameters(pubkey, privatekey);
} /* else both have parameters */
- /* Copied from ssl_set_cert/pkey */
-#ifndef OPENSSL_NO_RSA
- if ((EVP_PKEY_id(privatekey) == EVP_PKEY_RSA) &&
- ((RSA_flags(EVP_PKEY_get0_RSA(privatekey)) & RSA_METHOD_FLAG_NO_CHECK)))
- /* no-op */ ;
- else
-#endif
/* check that key <-> cert match */
- if (EVP_PKEY_cmp(pubkey, privatekey) != 1) {
- SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, SSL_R_PRIVATE_KEY_MISMATCH);
+ if (EVP_PKEY_eq(pubkey, privatekey) != 1) {
+ ERR_raise(ERR_LIB_SSL, SSL_R_PRIVATE_KEY_MISMATCH);
goto out;
}
}
if (ssl_cert_lookup_by_pkey(pubkey, &i) == NULL) {
- SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
+ ERR_raise(ERR_LIB_SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
goto out;
}
|| c->pkeys[i].privatekey != NULL
|| c->pkeys[i].chain != NULL)) {
/* No override, and something already there */
- SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, SSL_R_NOT_REPLACING_CERTIFICATE);
+ ERR_raise(ERR_LIB_SSL, SSL_R_NOT_REPLACING_CERTIFICATE);
goto out;
}
if (chain != NULL) {
dup_chain = X509_chain_up_ref(chain);
if (dup_chain == NULL) {
- SSLerr(SSL_F_SSL_SET_CERT_AND_KEY, ERR_R_MALLOC_FAILURE);
+ ERR_raise(ERR_LIB_SSL, ERR_R_MALLOC_FAILURE);
goto out;
}
}
- sk_X509_pop_free(c->pkeys[i].chain, X509_free);
+ OSSL_STACK_OF_X509_free(c->pkeys[i].chain);
c->pkeys[i].chain = dup_chain;
X509_free(c->pkeys[i].x509);
projects / openssl.git / blobdiff