generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Preserve digests for SNI.

Browse Source 
SSL_set_SSL_CTX is normally called for SNI after ClientHello has
received and the digest to use for each certificate has been decided.
The original ssl->cert contains the negotiated digests and is now
copied to the new ssl->cert.

PR: 3560
Reviewed-by: Tim Hudson <tjh@openssl.org>
This commit is contained in:
Dr. Stephen Henson 2014-10-10 13:18:09 +01:00
parent bf3e200eb4
commit 4e05aedbca
1 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
ssl/ssl_lib.c
View File

@ -2944,15 +2944,26 @@ SSL_CTX *SSL_get_SSL_CTX(const SSL *ssl)
SSL_CTX *SSL_set_SSL_CTX(SSL *ssl, SSL_CTX* ctx)
{
CERT *ocert = ssl->cert;
if (ssl->ctx == ctx)
return ssl->ctx;
#ifndef OPENSSL_NO_TLSEXT
if (ctx == NULL)
ctx = ssl->initial_ctx;
#endif
if (ssl->cert != NULL)
ssl_cert_free(ssl->cert);
ssl->cert = ssl_cert_dup(ctx->cert);
if (ocert != NULL)
{
int i;
/* Copy negotiated digests from original */
for (i = 0; i < SSL_PKEY_NUM; i++)
{
CERT_PKEY *cpk = ocert->pkeys + i;
CERT_PKEY *rpk = ssl->cert->pkeys + i;
rpk->digest = cpk->digest;
}
ssl_cert_free(ocert);
}
CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
if (ssl->ctx != NULL)
SSL_CTX_free(ssl->ctx); /* decrement reference count */