generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

add support for client certificate callbak, fix memory leak

Browse Source
This commit is contained in:
Dr. Stephen Henson 2012-07-03 14:53:27 +00:00
parent 87adf1fa96
commit 3208fc59db
2 changed files with 25 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
apps/s_cb.c
View File

@ -1192,11 +1192,16 @@ int args_excert(char ***pargs, int *pargc,
{
char *arg = **pargs, *argn = (*pargs)[1];
SSL_EXCERT *exc = *pexc;
if (!exc && !ssl_excert_prepend(&exc))
if (!exc)
{
BIO_printf(err, "Error initialising xcert\n");
*badarg = 1;
goto err;
if (ssl_excert_prepend(&exc))
*pexc = exc;
else
{
BIO_printf(err, "Error initialising xcert\n");
*badarg = 1;
goto err;
}
}
if (strcmp(arg, "-xcert") == 0)
{

16
apps/s_client.c
View File

@ -558,6 +558,7 @@ int MAIN(int, char **);
int MAIN(int argc, char **argv)
{
unsigned int off=0, clr=0;
int cert_flags=0;
SSL *con=NULL;
#ifndef OPENSSL_NO_KRB5
KSSL_CTX *kctx;
@ -628,6 +629,7 @@ int MAIN(int argc, char **argv)
int srp_lateuser = 0;
SRP_ARG srp_arg = {NULL,NULL,0,0,0,1024};
#endif
SSL_EXCERT *exc = NULL;
meth=SSLv23_client_method();
@ -715,6 +717,12 @@ int MAIN(int argc, char **argv)
}
else if (strcmp(*argv,"-verify_return_error") == 0)
verify_return_error = 1;
else if (args_excert(&argv, &argc, &badarg, bio_err, &exc))
{
if (badarg)
goto bad;
continue;
}
else if (strcmp(*argv,"-prexit") == 0)
prexit=1;
else if (strcmp(*argv,"-crlf") == 0)
@ -994,6 +1002,8 @@ int MAIN(int argc, char **argv)
keymatexportlen=atoi(*(++argv));
if (keymatexportlen == 0) goto bad;
}
else if (strcmp(*argv, "-cert_strict") == 0)
cert_flags |= SSL_CERT_FLAG_TLS_STRICT;
else
{
BIO_printf(bio_err,"unknown option %s\n",*argv);
@ -1099,6 +1109,9 @@ bad:
}
}
if (!load_excert(&exc, bio_err))
goto end;
if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL
&& !RAND_status())
{
@ -1174,6 +1187,8 @@ bad:
if (clr)
SSL_CTX_clear_options(ctx, clr);
if (cert_flags) SSL_CTX_set_cert_flags(ctx, cert_flags);
if (exc) ssl_ctx_set_excert(ctx, exc);
/* DTLS: partial reads end up discarding unread UDP bytes :-(
* Setting read ahead solves this problem.
*/
@ -1957,6 +1972,7 @@ end:
EVP_PKEY_free(key);
if (pass)
OPENSSL_free(pass);
ssl_excert_free(exc);
if (cbuf != NULL) { OPENSSL_cleanse(cbuf,BUFSIZZ); OPENSSL_free(cbuf); }
if (sbuf != NULL) { OPENSSL_cleanse(sbuf,BUFSIZZ); OPENSSL_free(sbuf); }
if (mbuf != NULL) { OPENSSL_cleanse(mbuf,BUFSIZZ); OPENSSL_free(mbuf); }