generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Minor enhancement to PR#2836 fix. Instead of modifying SSL_get_certificate

Browse Source 
change the current certificate (in s->cert->key) to the one used and then
SSL_get_certificate and SSL_get_privatekey will automatically work.
This commit is contained in:
Dr. Stephen Henson 2012-09-11 13:34:08 +00:00
parent 2daceb0342
commit e5db9c3b67
3 changed files with 14 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGES
View File

@ -347,8 +347,8 @@
Changes between 1.0.1 and 1.0.2 [xx XXX xxxx] Changes between 1.0.1 and 1.0.2 [xx XXX xxxx]
*) Call OCSP Stapling callback after ciphersuite has been chosen, so *) Call OCSP Stapling callback after ciphersuite has been chosen, so
the right response is stapled. Also change SSL_get_certificate() the right response is stapled. Also change current certificate to
so it returns the certificate actually sent. the certificate actually sent.
See http://rt.openssl.org/Ticket/Display.html?id=2836. See http://rt.openssl.org/Ticket/Display.html?id=2836.
[Rob Stradling <rob.stradling@comodo.com>] [Rob Stradling <rob.stradling@comodo.com>]

8
ssl/ssl_lib.c
View File

@ -2833,14 +2833,6 @@ void ssl_clear_cipher_ctx(SSL *s)
/* Fix this function so that it takes an optional type parameter */ /* Fix this function so that it takes an optional type parameter */
X509 *SSL_get_certificate(const SSL *s) X509 *SSL_get_certificate(const SSL *s)
{ {
if (s->server)
{
CERT_PKEY *certpkey;
certpkey = ssl_get_server_send_pkey(s);
if (certpkey && certpkey->x509)
return certpkey->x509;
}
if (s->cert != NULL) if (s->cert != NULL)
return(s->cert->key->x509); return(s->cert->key->x509);
else else

12
ssl/t1_lib.c
View File

@ -2755,6 +2755,18 @@ int ssl_check_clienthello_tlsext_late(SSL *s)
if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb) if ((s->tlsext_status_type != -1) && s->ctx && s->ctx->tlsext_status_cb)
{ {
int r; int r;
CERT_PKEY *certpkey;
certpkey = ssl_get_server_send_pkey(s);
/* If no certificate can't return certificate status */
if (certpkey == NULL)
{
s->tlsext_status_expected = 0;
return 1;
}
/* Set current certificate to one we will use so
* SSL_get_certificate et al can pick it up.
*/
s->cert->key = certpkey;
r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg); r = s->ctx->tlsext_status_cb(s, s->ctx->tlsext_status_arg);
switch (r) switch (r)
{ {