Always load CA, key and certificate files at the time the configuration

function is called. This simplifies code and results in a single memory
based code path being used to provide data to libssl. Errors that occur
when accessing the specified file are now detected and propagated
immediately. Since the file access now occurs when the configuration
function is called, we now play nicely with privsep/pledge.

ok beck@ bluhm@ doug@

1 files changed, 3 insertions, 20 deletions

diff --git a/src/lib/libtls/tls.c b/src/lib/libtls/tls.c
index 783d320a9d..e0464ec8b1 100644
--- a/src/lib/libtls/tls.c
+++ b/src/lib/libtls/tls.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls.c,v 1.39 2016/07/06 02:32:57 jsing Exp $ */
+/* $OpenBSD: tls.c,v 1.40 2016/07/06 16:16:36 jsing Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -216,9 +216,7 @@ tls_configure_keypair(struct tls *ctx, SSL_CTX *ssl_ctx,
 
         if (!required &&
             keypair->cert_mem == NULL &&
-            keypair->key_mem == NULL &&
-            keypair->cert_file == NULL &&
-            keypair->key_file == NULL)
+            keypair->key_mem == NULL)
                 return(0);
 
         if (keypair->cert_mem != NULL) {
@@ -260,21 +258,6 @@ tls_configure_keypair(struct tls *ctx, SSL_CTX *ssl_ctx,
                 pkey = NULL;
         }
 
-        if (keypair->cert_file != NULL) {
-                if (SSL_CTX_use_certificate_chain_file(ssl_ctx,
-                    keypair->cert_file) != 1) {
-                        tls_set_errorx(ctx, "failed to load certificate file");
-                        goto err;
-                }
-        }
-        if (keypair->key_file != NULL) {
-                if (SSL_CTX_use_PrivateKey_file(ssl_ctx,
-                    keypair->key_file, SSL_FILETYPE_PEM) != 1) {
-                        tls_set_errorx(ctx, "failed to load private key file");
-                        goto err;
-                }
-        }
-
         if (SSL_CTX_check_private_key(ssl_ctx) != 1) {
                 tls_set_errorx(ctx, "private/public key mismatch");
                 goto err;
@@ -346,7 +329,7 @@ tls_configure_ssl_verify(struct tls *ctx, int verify)
                         goto err;
                 }
         } else if (SSL_CTX_load_verify_locations(ctx->ssl_ctx,
-            ctx->config->ca_file, ctx->config->ca_path) != 1) {
+            NULL, ctx->config->ca_path) != 1) {
                 tls_set_errorx(ctx, "ssl verify setup failure");
                 goto err;
         }