Move the keypair pubkey hash handling code to during config.

The keypair pubkey hash was being generated and set in the keypair when the
TLS context was being configured. This code should not be messing around
with the keypair contents, since it is part of the config (and not the
context).

Instead, generate the pubkey hash and store it in the keypair when the
certificate is configured. This means that we are guaranteed to have the
pubkey hash and as a side benefit, we identify bad certificate content
when it is provided, instead of during the context configuration.

ok beck@

1 files changed, 29 insertions, 4 deletions

diff --git a/src/lib/libtls/tls.c b/src/lib/libtls/tls.c
index 0e206e2c7e..8f2c7dde05 100644
--- a/src/lib/libtls/tls.c
+++ b/src/lib/libtls/tls.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls.c,v 1.74 2018/02/08 10:19:31 jsing Exp $ */
+/* $OpenBSD: tls.c,v 1.75 2018/02/10 04:57:35 jsing Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -291,6 +291,34 @@ tls_cert_hash(X509 *cert, char **hash)
 }
 
 int
+tls_cert_pubkey_hash(X509 *cert, char **hash)
+{
+        char d[EVP_MAX_MD_SIZE], *dhex = NULL;
+        int dlen, rv = -1;
+
+        free(*hash);
+        *hash = NULL;
+
+        if (X509_pubkey_digest(cert, EVP_sha256(), d, &dlen) != 1)
+                goto err;
+
+        if (tls_hex_string(d, dlen, &dhex, NULL) != 0)
+                goto err;
+
+        if (asprintf(hash, "SHA256:%s", dhex) == -1) {
+                *hash = NULL;
+                goto err;
+        }
+
+        rv = 0;
+
+ err:
+        free(dhex);
+
+        return (rv);
+}
+
+int
 tls_configure_ssl_keypair(struct tls *ctx, SSL_CTX *ssl_ctx,
     struct tls_keypair *keypair, int required)
 {
@@ -313,9 +341,6 @@ tls_configure_ssl_keypair(struct tls *ctx, SSL_CTX *ssl_ctx,
                         tls_set_errorx(ctx, "failed to load certificate");
                         goto err;
                 }
-                if (tls_keypair_pubkey_hash(keypair, &ctx->error,
-                    &keypair->pubkey_hash) == -1)
-                        goto err;
         }
 
         if (keypair->key_mem != NULL) {