generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

add support for client certificate callbak, fix memory leak

Browse Source 
(backport from HEAD)
This commit is contained in:
Dr. Stephen Henson 2012-12-26 14:47:31 +00:00
parent 731abd3bd7
commit aa5c5eb4c1
2 changed files with 25 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
apps/s_cb.c
View File

@ -1194,12 +1194,17 @@ int args_excert(char ***pargs, int *pargc,
{ {
char *arg = **pargs, *argn = (*pargs)[1]; char *arg = **pargs, *argn = (*pargs)[1];
SSL_EXCERT *exc = *pexc; SSL_EXCERT *exc = *pexc;
if (!exc && !ssl_excert_prepend(&exc)) if (!exc)
{
if (ssl_excert_prepend(&exc))
*pexc = exc;
else
{ {
BIO_printf(err, "Error initialising xcert\n"); BIO_printf(err, "Error initialising xcert\n");
*badarg = 1; *badarg = 1;
goto err; goto err;
} }
}
if (strcmp(arg, "-xcert") == 0) if (strcmp(arg, "-xcert") == 0)
{ {
if (!argn) if (!argn)

16
apps/s_client.c
View File

@ -557,6 +557,7 @@ int MAIN(int, char **);
int MAIN(int argc, char **argv) int MAIN(int argc, char **argv)
{ {
unsigned int off=0, clr=0; unsigned int off=0, clr=0;
int cert_flags=0;
SSL *con=NULL; SSL *con=NULL;
#ifndef OPENSSL_NO_KRB5 #ifndef OPENSSL_NO_KRB5
KSSL_CTX *kctx; KSSL_CTX *kctx;
@ -627,6 +628,7 @@ int MAIN(int argc, char **argv)
int srp_lateuser = 0; int srp_lateuser = 0;
SRP_ARG srp_arg = {NULL,NULL,0,0,0,1024}; SRP_ARG srp_arg = {NULL,NULL,0,0,0,1024};
#endif #endif
SSL_EXCERT *exc = NULL;
meth=SSLv23_client_method(); meth=SSLv23_client_method();
@ -714,6 +716,12 @@ int MAIN(int argc, char **argv)
} }
else if (strcmp(*argv,"-verify_return_error") == 0) else if (strcmp(*argv,"-verify_return_error") == 0)
verify_return_error = 1; verify_return_error = 1;
else if (args_excert(&argv, &argc, &badarg, bio_err, &exc))
{
if (badarg)
goto bad;
continue;
}
else if (strcmp(*argv,"-prexit") == 0) else if (strcmp(*argv,"-prexit") == 0)
prexit=1; prexit=1;
else if (strcmp(*argv,"-crlf") == 0) else if (strcmp(*argv,"-crlf") == 0)
@ -984,6 +992,8 @@ int MAIN(int argc, char **argv)
keymatexportlen=atoi(*(++argv)); keymatexportlen=atoi(*(++argv));
if (keymatexportlen == 0) goto bad; if (keymatexportlen == 0) goto bad;
} }
else if (strcmp(*argv, "-cert_strict") == 0)
cert_flags |= SSL_CERT_FLAG_TLS_STRICT;
else else
{ {
BIO_printf(bio_err,"unknown option %s\n",*argv); BIO_printf(bio_err,"unknown option %s\n",*argv);
@ -1088,6 +1098,9 @@ bad:
} }
} }
if (!load_excert(&exc, bio_err))
goto end;
if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL if (!app_RAND_load_file(NULL, bio_err, 1) && inrand == NULL
&& !RAND_status()) && !RAND_status())
{ {
@ -1163,6 +1176,8 @@ bad:
if (clr) if (clr)
SSL_CTX_clear_options(ctx, clr); SSL_CTX_clear_options(ctx, clr);
if (cert_flags) SSL_CTX_set_cert_flags(ctx, cert_flags);
if (exc) ssl_ctx_set_excert(ctx, exc);
/* DTLS: partial reads end up discarding unread UDP bytes :-( /* DTLS: partial reads end up discarding unread UDP bytes :-(
* Setting read ahead solves this problem. * Setting read ahead solves this problem.
*/ */
@ -1945,6 +1960,7 @@ end:
EVP_PKEY_free(key); EVP_PKEY_free(key);
if (pass) if (pass)
OPENSSL_free(pass); OPENSSL_free(pass);
ssl_excert_free(exc);
if (vpm) if (vpm)
X509_VERIFY_PARAM_free(vpm); X509_VERIFY_PARAM_free(vpm);
if (cbuf != NULL) { OPENSSL_cleanse(cbuf,BUFSIZZ); OPENSSL_free(cbuf); } if (cbuf != NULL) { OPENSSL_cleanse(cbuf,BUFSIZZ); OPENSSL_free(cbuf); }