1 files changed, 75 insertions, 37 deletions

diff --git a/src/lib/libssl/ssl_rsa.c b/src/lib/libssl/ssl_rsa.c
index 27113eba50..fb0bd4d045 100644
--- a/src/lib/libssl/ssl_rsa.c
+++ b/src/lib/libssl/ssl_rsa.c
@@ -131,7 +131,7 @@ end:
         }
 #endif
 
-int SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len)
+int SSL_use_certificate_ASN1(SSL *ssl, unsigned char *d, int len)
         {
         X509 *x;
         int ret;
@@ -181,7 +181,7 @@ int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa)
 
 static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
         {
-        int i;
+        int i,ok=0,bad=0;
 
         i=ssl_cert_type(NULL,pkey);
         if (i < 0)
@@ -202,18 +202,47 @@ static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
                 /* Don't check the public/private key, this is mostly
                  * for smart cards. */
                 if ((pkey->type == EVP_PKEY_RSA) &&
-                        (RSA_flags(pkey->pkey.rsa) & RSA_METHOD_FLAG_NO_CHECK))
-                        ;
+                        (RSA_flags(pkey->pkey.rsa) &
+                         RSA_METHOD_FLAG_NO_CHECK))
+                         ok=1;
                 else
 #endif
-                if (!X509_check_private_key(c->pkeys[i].x509,pkey))
+                     if (!X509_check_private_key(c->pkeys[i].x509,pkey))
                         {
-                        X509_free(c->pkeys[i].x509);
-                        c->pkeys[i].x509 = NULL;
-                        return 0;
+                        if ((i == SSL_PKEY_DH_RSA) || (i == SSL_PKEY_DH_DSA))
+                                {
+                                i=(i == SSL_PKEY_DH_RSA)?
+                                        SSL_PKEY_DH_DSA:SSL_PKEY_DH_RSA;
+
+                                if (c->pkeys[i].x509 == NULL)
+                                        ok=1;
+                                else
+                                        {
+                                        if (!X509_check_private_key(
+                                                c->pkeys[i].x509,pkey))
+                                                bad=1;
+                                        else
+                                                ok=1;
+                                        }
+                                }
+                        else
+                                bad=1;
                         }
+                else
+                        ok=1;
+                }
+        else
+                ok=1;
+
+        if (bad)
+                {
+                X509_free(c->pkeys[i].x509);
+                c->pkeys[i].x509=NULL;
+                return(0);
                 }
 
+        ERR_clear_error(); /* make sure no error from X509_check_private_key()
+                            * is left if we have chosen to ignore it */
         if (c->pkeys[i].privatekey != NULL)
                 EVP_PKEY_free(c->pkeys[i].privatekey);
         CRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY);
@@ -335,11 +364,6 @@ int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type)
                 pkey=PEM_read_bio_PrivateKey(in,NULL,
                         ssl->ctx->default_passwd_callback,ssl->ctx->default_passwd_callback_userdata);
                 }
-        else if (type == SSL_FILETYPE_ASN1)
-                {
-                j = ERR_R_ASN1_LIB;
-                pkey = d2i_PrivateKey_bio(in,NULL);
-                }
         else
                 {
                 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
@@ -358,10 +382,10 @@ end:
         }
 #endif
 
-int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, const unsigned char *d, long len)
+int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, unsigned char *d, long len)
         {
         int ret;
-        const unsigned char *p;
+        unsigned char *p;
         EVP_PKEY *pkey;
 
         p=d;
@@ -394,7 +418,7 @@ int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x)
 static int ssl_set_cert(CERT *c, X509 *x)
         {
         EVP_PKEY *pkey;
-        int i;
+        int i,ok=0,bad=0;
 
         pkey=X509_get_pubkey(x);
         if (pkey == NULL)
@@ -422,23 +446,44 @@ static int ssl_set_cert(CERT *c, X509 *x)
                 if ((c->pkeys[i].privatekey->type == EVP_PKEY_RSA) &&
                         (RSA_flags(c->pkeys[i].privatekey->pkey.rsa) &
                          RSA_METHOD_FLAG_NO_CHECK))
-                         ;
+                         ok=1;
                 else
-#endif /* OPENSSL_NO_RSA */
+#endif
+                {
                 if (!X509_check_private_key(x,c->pkeys[i].privatekey))
                         {
-                        /* don't fail for a cert/key mismatch, just free
-                         * current private key (when switching to a different
-                         * cert & key, first this function should be used,
-                         * then ssl_set_pkey */
-                        EVP_PKEY_free(c->pkeys[i].privatekey);
-                        c->pkeys[i].privatekey=NULL;
-                        /* clear error queue */
-                        ERR_clear_error();
+                        if ((i == SSL_PKEY_DH_RSA) || (i == SSL_PKEY_DH_DSA))
+                                {
+                                i=(i == SSL_PKEY_DH_RSA)?
+                                        SSL_PKEY_DH_DSA:SSL_PKEY_DH_RSA;
+
+                                if (c->pkeys[i].privatekey == NULL)
+                                        ok=1;
+                                else
+                                        {
+                                        if (!X509_check_private_key(x,
+                                                c->pkeys[i].privatekey))
+                                                bad=1;
+                                        else
+                                                ok=1;
+                                        }
+                                }
+                        else
+                                bad=1;
                         }
+                else
+                        ok=1;
+                } /* OPENSSL_NO_RSA */
                 }
+        else
+                ok=1;
 
         EVP_PKEY_free(pkey);
+        if (bad)
+                {
+                EVP_PKEY_free(c->pkeys[i].privatekey);
+                c->pkeys[i].privatekey=NULL;
+                }
 
         if (c->pkeys[i].x509 != NULL)
                 X509_free(c->pkeys[i].x509);
@@ -500,7 +545,7 @@ end:
         }
 #endif
 
-int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, const unsigned char *d)
+int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len, unsigned char *d)
         {
         X509 *x;
         int ret;
@@ -595,7 +640,7 @@ end:
         }
 #endif
 
-int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d, long len)
+int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, unsigned char *d, long len)
         {
         int ret;
         const unsigned char *p;
@@ -654,11 +699,6 @@ int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type)
                 pkey=PEM_read_bio_PrivateKey(in,NULL,
                         ctx->default_passwd_callback,ctx->default_passwd_callback_userdata);
                 }
-        else if (type == SSL_FILETYPE_ASN1)
-                {
-                j = ERR_R_ASN1_LIB;
-                pkey = d2i_PrivateKey_bio(in,NULL);
-                }
         else
                 {
                 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE,SSL_R_BAD_SSL_FILETYPE);
@@ -677,11 +717,11 @@ end:
         }
 #endif
 
-int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, const unsigned char *d,
+int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx, unsigned char *d,
              long len)
         {
         int ret;
-        const unsigned char *p;
+        unsigned char *p;
         EVP_PKEY *pkey;
 
         p=d;
@@ -708,8 +748,6 @@ int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file)
         int ret=0;
         X509 *x=NULL;
 
-        ERR_clear_error(); /* clear error stack for SSL_CTX_use_certificate() */
-
         in=BIO_new(BIO_s_file_internal());
         if (in == NULL)
                 {