A mirror of https://github.com/libressl/openbsd.git https://git.lua4.win/openbsd/atom?h=OPENBSD_6_8_BASE 2018-04-07T16:35:34+00:00 2018-04-07T16:35:34+00:00 jsing 2018-04-07T16:35:34+00:00 urn:sha1:111c0ba098842c9337026115c4d68b9a0f312b9d Previously this incorrectly called tls_keypair_clear(), which results in the private key being cleared, along with the certificate, OCSP staple and pubkey hash. This breaks OCSP stapling if tls_config_clear_keys() is called following tls_configure(), as is done by httpd. Fix this by calling tls_keypair_clear_key() so that only the private key is cleared, leaving the other public data untouched. While here, remove tls_keypair_clear() and fold the necessary parts into tls_keypair_free(). ok beck@ 2018-02-10T04:57:35+00:00 jsing 2018-02-10T04:57:35+00:00 urn:sha1:351d578b1eacfbf1586f49fbbabbdb4e7efdbf5c The keypair pubkey hash was being generated and set in the keypair when the TLS context was being configured. This code should not be messing around with the keypair contents, since it is part of the config (and not the context). Instead, generate the pubkey hash and store it in the keypair when the certificate is configured. This means that we are guaranteed to have the pubkey hash and as a side benefit, we identify bad certificate content when it is provided, instead of during the context configuration. ok beck@ 2018-02-08T10:19:31+00:00 jsing 2018-02-08T10:19:31+00:00 urn:sha1:1f7ca2478ab23918c94907b989d2935db2a2b660 rolling its own certificate loading. This also means we get better error reporting on failure. 2018-02-08T10:03:19+00:00 jsing 2018-02-08T10:03:19+00:00 urn:sha1:3201cd5485a2044378dd20e89b032881dfe85945 2018-02-08T08:09:10+00:00 jsing 2018-02-08T08:09:10+00:00 urn:sha1:169a82f69bb622c8d6cdf124436cc79c42fd9138 2018-02-08T05:56:49+00:00 jsing 2018-02-08T05:56:49+00:00 urn:sha1:8a01a8361d1add29153f53a3721130f62d3d4389 in multiple locations. ok beck@