summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorjsing <>2016-07-07 14:09:03 +0000
committerjsing <>2016-07-07 14:09:03 +0000
commit025e7d6501957fe925241c7e73c233c203a19711 (patch)
tree558129ff06641d4ec1f2b513a089cb94c039b319
parent73283ebee852e1dff85c7bf61a66fcacb7eb122b (diff)
downloadopenbsd-025e7d6501957fe925241c7e73c233c203a19711.tar.gz
openbsd-025e7d6501957fe925241c7e73c233c203a19711.tar.bz2
openbsd-025e7d6501957fe925241c7e73c233c203a19711.zip
Revert previous - it introduces problems with a common privsep use case.
Diffstat
-rw-r--r--src/lib/libtls/tls.c23
-rw-r--r--src/lib/libtls/tls_config.c79
-rw-r--r--src/lib/libtls/tls_internal.h5
3 files changed, 35 insertions, 72 deletions
diff --git a/src/lib/libtls/tls.c b/src/lib/libtls/tls.c
index e0464ec8b1..857b8d0811 100644
--- a/src/lib/libtls/tls.c
+++ b/src/lib/libtls/tls.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: tls.c,v 1.40 2016/07/06 16:16:36 jsing Exp $ */ 1/* $OpenBSD: tls.c,v 1.41 2016/07/07 14:09:03 jsing Exp $ */
2/* 2/*
3 * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
4 * 4 *
@@ -216,7 +216,9 @@ tls_configure_keypair(struct tls *ctx, SSL_CTX *ssl_ctx,
216 216
217 if (!required && 217 if (!required &&
218 keypair->cert_mem == NULL && 218 keypair->cert_mem == NULL &&
219 keypair->key_mem == NULL) 219 keypair->key_mem == NULL &&
220 keypair->cert_file == NULL &&
221 keypair->key_file == NULL)
220 return(0); 222 return(0);
221 223
222 if (keypair->cert_mem != NULL) { 224 if (keypair->cert_mem != NULL) {
@@ -258,6 +260,21 @@ tls_configure_keypair(struct tls *ctx, SSL_CTX *ssl_ctx,
258 pkey = NULL; 260 pkey = NULL;
259 } 261 }
260 262
263 if (keypair->cert_file != NULL) {
264 if (SSL_CTX_use_certificate_chain_file(ssl_ctx,
265 keypair->cert_file) != 1) {
266 tls_set_errorx(ctx, "failed to load certificate file");
267 goto err;
268 }
269 }
270 if (keypair->key_file != NULL) {
271 if (SSL_CTX_use_PrivateKey_file(ssl_ctx,
272 keypair->key_file, SSL_FILETYPE_PEM) != 1) {
273 tls_set_errorx(ctx, "failed to load private key file");
274 goto err;
275 }
276 }
277
261 if (SSL_CTX_check_private_key(ssl_ctx) != 1) { 278 if (SSL_CTX_check_private_key(ssl_ctx) != 1) {
262 tls_set_errorx(ctx, "private/public key mismatch"); 279 tls_set_errorx(ctx, "private/public key mismatch");
263 goto err; 280 goto err;
@@ -329,7 +346,7 @@ tls_configure_ssl_verify(struct tls *ctx, int verify)
329 goto err; 346 goto err;
330 } 347 }
331 } else if (SSL_CTX_load_verify_locations(ctx->ssl_ctx, 348 } else if (SSL_CTX_load_verify_locations(ctx->ssl_ctx,
332 NULL, ctx->config->ca_path) != 1) { 349 ctx->config->ca_file, ctx->config->ca_path) != 1) {
333 tls_set_errorx(ctx, "ssl verify setup failure"); 350 tls_set_errorx(ctx, "ssl verify setup failure");
334 goto err; 351 goto err;
335 } 352 }
diff --git a/src/lib/libtls/tls_config.c b/src/lib/libtls/tls_config.c
index a348b826d5..6b47eeb8d1 100644
--- a/src/lib/libtls/tls_config.c
+++ b/src/lib/libtls/tls_config.c
@@ -1,4 +1,4 @@
1/* $OpenBSD: tls_config.c,v 1.20 2016/07/06 16:47:18 jsing Exp $ */ 1/* $OpenBSD: tls_config.c,v 1.21 2016/07/07 14:09:03 jsing Exp $ */
2/* 2/*
3 * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
4 * 4 *
@@ -15,13 +15,9 @@
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */ 16 */
17 17
18#include <sys/stat.h>
19
20#include <ctype.h> 18#include <ctype.h>
21#include <errno.h> 19#include <errno.h>
22#include <fcntl.h>
23#include <stdlib.h> 20#include <stdlib.h>
24#include <unistd.h>
25 21
26#include <tls.h> 22#include <tls.h>
27#include "tls_internal.h" 23#include "tls_internal.h"
@@ -61,53 +57,6 @@ set_mem(char **dest, size_t *destlen, const void *src, size_t srclen)
61 return 0; 57 return 0;
62} 58}
63 59
64static int
65load_file(struct tls_error *error, const char *filetype, const char *filename,
66 char **buf, size_t *len)
67{
68 struct stat st;
69 int fd = -1;
70
71 free(*buf);
72 *buf = NULL;
73 *len = 0;
74
75 if ((fd = open(filename, O_RDONLY)) == -1) {
76 tls_error_set(error, "failed to open %s file '%s'",
77 filetype, filename);
78 goto fail;
79 }
80 if (fstat(fd, &st) != 0) {
81 tls_error_set(error, "failed to stat %s file '%s'",
82 filetype, filename);
83 goto fail;
84 }
85 *len = (size_t)st.st_size;
86 if ((*buf = malloc(*len)) == NULL) {
87 tls_error_set(error, "failed to allocate buffer for "
88 "%s file '%s'", filetype, filename);
89 goto fail;
90 }
91 if (read(fd, *buf, *len) != *len) {
92 tls_error_set(error, "failed to read %s file '%s'",
93 filetype, filename);
94 goto fail;
95 }
96 close(fd);
97 return 0;
98
99 fail:
100 if (fd != -1)
101 close(fd);
102 if (*buf != NULL)
103 explicit_bzero(*buf, *len);
104 free(*buf);
105 *buf = NULL;
106 *len = 0;
107
108 return -1;
109}
110
111static struct tls_keypair * 60static struct tls_keypair *
112tls_keypair_new() 61tls_keypair_new()
113{ 62{
@@ -115,11 +64,9 @@ tls_keypair_new()
115} 64}
116 65
117static int 66static int
118tls_keypair_set_cert_file(struct tls_keypair *keypair, struct tls_error *error, 67tls_keypair_set_cert_file(struct tls_keypair *keypair, const char *cert_file)
119 const char *cert_file)
120{ 68{
121 return load_file(error, "certificate", cert_file, &keypair->cert_mem, 69 return set_string(&keypair->cert_file, cert_file);
122 &keypair->cert_len);
123} 70}
124 71
125static int 72static int
@@ -130,13 +77,9 @@ tls_keypair_set_cert_mem(struct tls_keypair *keypair, const uint8_t *cert,
130} 77}
131 78
132static int 79static int
133tls_keypair_set_key_file(struct tls_keypair *keypair, struct tls_error *error, 80tls_keypair_set_key_file(struct tls_keypair *keypair, const char *key_file)
134 const char *key_file)
135{ 81{
136 if (keypair->key_mem != NULL) 82 return set_string(&keypair->key_file, key_file);
137 explicit_bzero(keypair->key_mem, keypair->key_len);
138 return load_file(error, "key", key_file, &keypair->key_mem,
139 &keypair->key_len);
140} 83}
141 84
142static int 85static int
@@ -163,7 +106,9 @@ tls_keypair_free(struct tls_keypair *keypair)
163 106
164 tls_keypair_clear(keypair); 107 tls_keypair_clear(keypair);
165 108
109 free((char *)keypair->cert_file);
166 free(keypair->cert_mem); 110 free(keypair->cert_mem);
111 free((char *)keypair->key_file);
167 free(keypair->key_mem); 112 free(keypair->key_mem);
168 113
169 free(keypair); 114 free(keypair);
@@ -221,6 +166,7 @@ tls_config_free(struct tls_config *config)
221 166
222 free(config->error.msg); 167 free(config->error.msg);
223 168
169 free((char *)config->ca_file);
224 free((char *)config->ca_mem); 170 free((char *)config->ca_mem);
225 free((char *)config->ca_path); 171 free((char *)config->ca_path);
226 free((char *)config->ciphers); 172 free((char *)config->ciphers);
@@ -306,8 +252,7 @@ tls_config_parse_protocols(uint32_t *protocols, const char *protostr)
306int 252int
307tls_config_set_ca_file(struct tls_config *config, const char *ca_file) 253tls_config_set_ca_file(struct tls_config *config, const char *ca_file)
308{ 254{
309 return load_file(&config->error, "CA", ca_file, &config->ca_mem, 255 return set_string(&config->ca_file, ca_file);
310 &config->ca_len);
311} 256}
312 257
313int 258int
@@ -325,8 +270,7 @@ tls_config_set_ca_mem(struct tls_config *config, const uint8_t *ca, size_t len)
325int 270int
326tls_config_set_cert_file(struct tls_config *config, const char *cert_file) 271tls_config_set_cert_file(struct tls_config *config, const char *cert_file)
327{ 272{
328 return tls_keypair_set_cert_file(config->keypair, &config->error, 273 return tls_keypair_set_cert_file(config->keypair, cert_file);
329 cert_file);
330} 274}
331 275
332int 276int
@@ -409,8 +353,7 @@ tls_config_set_ecdhecurve(struct tls_config *config, const char *name)
409int 353int
410tls_config_set_key_file(struct tls_config *config, const char *key_file) 354tls_config_set_key_file(struct tls_config *config, const char *key_file)
411{ 355{
412 return tls_keypair_set_key_file(config->keypair, &config->error, 356 return tls_keypair_set_key_file(config->keypair, key_file);
413 key_file);
414} 357}
415 358
416int 359int
diff --git a/src/lib/libtls/tls_internal.h b/src/lib/libtls/tls_internal.h
index b7a1530c96..886ee1151f 100644
--- a/src/lib/libtls/tls_internal.h
+++ b/src/lib/libtls/tls_internal.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: tls_internal.h,v 1.30 2016/07/06 16:16:36 jsing Exp $ */ 1/* $OpenBSD: tls_internal.h,v 1.31 2016/07/07 14:09:03 jsing Exp $ */
2/* 2/*
3 * Copyright (c) 2014 Jeremie Courreges-Anglas <jca@openbsd.org> 3 * Copyright (c) 2014 Jeremie Courreges-Anglas <jca@openbsd.org>
4 * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> 4 * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
@@ -42,8 +42,10 @@ struct tls_error {
42struct tls_keypair { 42struct tls_keypair {
43 struct tls_keypair *next; 43 struct tls_keypair *next;
44 44
45 const char *cert_file;
45 char *cert_mem; 46 char *cert_mem;
46 size_t cert_len; 47 size_t cert_len;
48 const char *key_file;
47 char *key_mem; 49 char *key_mem;
48 size_t key_len; 50 size_t key_len;
49}; 51};
@@ -51,6 +53,7 @@ struct tls_keypair {
51struct tls_config { 53struct tls_config {
52 struct tls_error error; 54 struct tls_error error;
53 55
56 const char *ca_file;
54 const char *ca_path; 57 const char *ca_path;
55 char *ca_mem; 58 char *ca_mem;
56 size_t ca_len; 59 size_t ca_len;
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-22 03:14:21 +0000