diff options
Diffstat (limited to 'src/lib/libtls/tls_client.c')
| -rw-r--r-- | src/lib/libtls/tls_client.c | 34 |
1 files changed, 17 insertions, 17 deletions
diff --git a/src/lib/libtls/tls_client.c b/src/lib/libtls/tls_client.c index 241c506676..168a7089fc 100644 --- a/src/lib/libtls/tls_client.c +++ b/src/lib/libtls/tls_client.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: tls_client.c,v 1.20 2015/08/27 14:34:46 jsing Exp $ */ | 1 | /* $OpenBSD: tls_client.c,v 1.21 2015/08/27 15:26:50 jsing Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> | 3 | * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> |
| 4 | * | 4 | * |
| @@ -95,12 +95,12 @@ tls_connect_servername(struct tls *ctx, const char *host, const char *port, | |||
| 95 | int rv = -1, s = -1, ret; | 95 | int rv = -1, s = -1, ret; |
| 96 | 96 | ||
| 97 | if ((ctx->flags & TLS_CLIENT) == 0) { | 97 | if ((ctx->flags & TLS_CLIENT) == 0) { |
| 98 | tls_set_error(ctx, "not a client context"); | 98 | tls_set_errorx(ctx, "not a client context"); |
| 99 | goto err; | 99 | goto err; |
| 100 | } | 100 | } |
| 101 | 101 | ||
| 102 | if (host == NULL) { | 102 | if (host == NULL) { |
| 103 | tls_set_error(ctx, "host not specified"); | 103 | tls_set_errorx(ctx, "host not specified"); |
| 104 | goto err; | 104 | goto err; |
| 105 | } | 105 | } |
| 106 | 106 | ||
| @@ -111,7 +111,7 @@ tls_connect_servername(struct tls *ctx, const char *host, const char *port, | |||
| 111 | if ((p = (char *)port) == NULL) { | 111 | if ((p = (char *)port) == NULL) { |
| 112 | ret = tls_host_port(host, &hs, &ps); | 112 | ret = tls_host_port(host, &hs, &ps); |
| 113 | if (ret == -1) { | 113 | if (ret == -1) { |
| 114 | tls_set_error(ctx, "memory allocation failure"); | 114 | tls_set_errorx(ctx, "memory allocation failure"); |
| 115 | goto err; | 115 | goto err; |
| 116 | } | 116 | } |
| 117 | if (ret != 0) | 117 | if (ret != 0) |
| @@ -169,7 +169,7 @@ tls_connect_fds(struct tls *ctx, int fd_read, int fd_write, | |||
| 169 | int ret, err; | 169 | int ret, err; |
| 170 | 170 | ||
| 171 | if ((ctx->flags & TLS_CLIENT) == 0) { | 171 | if ((ctx->flags & TLS_CLIENT) == 0) { |
| 172 | tls_set_error(ctx, "not a client context"); | 172 | tls_set_errorx(ctx, "not a client context"); |
| 173 | goto err; | 173 | goto err; |
| 174 | } | 174 | } |
| 175 | 175 | ||
| @@ -177,12 +177,12 @@ tls_connect_fds(struct tls *ctx, int fd_read, int fd_write, | |||
| 177 | goto connecting; | 177 | goto connecting; |
| 178 | 178 | ||
| 179 | if (fd_read < 0 || fd_write < 0) { | 179 | if (fd_read < 0 || fd_write < 0) { |
| 180 | tls_set_error(ctx, "invalid file descriptors"); | 180 | tls_set_errorx(ctx, "invalid file descriptors"); |
| 181 | return (-1); | 181 | return (-1); |
| 182 | } | 182 | } |
| 183 | 183 | ||
| 184 | if ((ctx->ssl_ctx = SSL_CTX_new(SSLv23_client_method())) == NULL) { | 184 | if ((ctx->ssl_ctx = SSL_CTX_new(SSLv23_client_method())) == NULL) { |
| 185 | tls_set_error(ctx, "ssl context failure"); | 185 | tls_set_errorx(ctx, "ssl context failure"); |
| 186 | goto err; | 186 | goto err; |
| 187 | } | 187 | } |
| 188 | 188 | ||
| @@ -191,7 +191,7 @@ tls_connect_fds(struct tls *ctx, int fd_read, int fd_write, | |||
| 191 | 191 | ||
| 192 | if (ctx->config->verify_name) { | 192 | if (ctx->config->verify_name) { |
| 193 | if (servername == NULL) { | 193 | if (servername == NULL) { |
| 194 | tls_set_error(ctx, "server name not specified"); | 194 | tls_set_errorx(ctx, "server name not specified"); |
| 195 | goto err; | 195 | goto err; |
| 196 | } | 196 | } |
| 197 | } | 197 | } |
| @@ -201,19 +201,19 @@ tls_connect_fds(struct tls *ctx, int fd_read, int fd_write, | |||
| 201 | 201 | ||
| 202 | if (ctx->config->ca_mem != NULL) { | 202 | if (ctx->config->ca_mem != NULL) { |
| 203 | if (ctx->config->ca_len > INT_MAX) { | 203 | if (ctx->config->ca_len > INT_MAX) { |
| 204 | tls_set_error(ctx, "ca too long"); | 204 | tls_set_errorx(ctx, "ca too long"); |
| 205 | goto err; | 205 | goto err; |
| 206 | } | 206 | } |
| 207 | 207 | ||
| 208 | if (SSL_CTX_load_verify_mem(ctx->ssl_ctx, | 208 | if (SSL_CTX_load_verify_mem(ctx->ssl_ctx, |
| 209 | ctx->config->ca_mem, ctx->config->ca_len) != 1) { | 209 | ctx->config->ca_mem, ctx->config->ca_len) != 1) { |
| 210 | tls_set_error(ctx, | 210 | tls_set_errorx(ctx, |
| 211 | "ssl verify memory setup failure"); | 211 | "ssl verify memory setup failure"); |
| 212 | goto err; | 212 | goto err; |
| 213 | } | 213 | } |
| 214 | } else if (SSL_CTX_load_verify_locations(ctx->ssl_ctx, | 214 | } else if (SSL_CTX_load_verify_locations(ctx->ssl_ctx, |
| 215 | ctx->config->ca_file, ctx->config->ca_path) != 1) { | 215 | ctx->config->ca_file, ctx->config->ca_path) != 1) { |
| 216 | tls_set_error(ctx, "ssl verify setup failure"); | 216 | tls_set_errorx(ctx, "ssl verify setup failure"); |
| 217 | goto err; | 217 | goto err; |
| 218 | } | 218 | } |
| 219 | if (ctx->config->verify_depth >= 0) | 219 | if (ctx->config->verify_depth >= 0) |
| @@ -222,16 +222,16 @@ tls_connect_fds(struct tls *ctx, int fd_read, int fd_write, | |||
| 222 | } | 222 | } |
| 223 | 223 | ||
| 224 | if ((ctx->ssl_conn = SSL_new(ctx->ssl_ctx)) == NULL) { | 224 | if ((ctx->ssl_conn = SSL_new(ctx->ssl_ctx)) == NULL) { |
| 225 | tls_set_error(ctx, "ssl connection failure"); | 225 | tls_set_errorx(ctx, "ssl connection failure"); |
| 226 | goto err; | 226 | goto err; |
| 227 | } | 227 | } |
| 228 | if (SSL_set_app_data(ctx->ssl_conn, ctx) != 1) { | 228 | if (SSL_set_app_data(ctx->ssl_conn, ctx) != 1) { |
| 229 | tls_set_error(ctx, "ssl application data failure"); | 229 | tls_set_errorx(ctx, "ssl application data failure"); |
| 230 | goto err; | 230 | goto err; |
| 231 | } | 231 | } |
| 232 | if (SSL_set_rfd(ctx->ssl_conn, fd_read) != 1 || | 232 | if (SSL_set_rfd(ctx->ssl_conn, fd_read) != 1 || |
| 233 | SSL_set_wfd(ctx->ssl_conn, fd_write) != 1) { | 233 | SSL_set_wfd(ctx->ssl_conn, fd_write) != 1) { |
| 234 | tls_set_error(ctx, "ssl file descriptor failure"); | 234 | tls_set_errorx(ctx, "ssl file descriptor failure"); |
| 235 | goto err; | 235 | goto err; |
| 236 | } | 236 | } |
| 237 | 237 | ||
| @@ -243,7 +243,7 @@ tls_connect_fds(struct tls *ctx, int fd_read, int fd_write, | |||
| 243 | inet_pton(AF_INET, servername, &addrbuf) != 1 && | 243 | inet_pton(AF_INET, servername, &addrbuf) != 1 && |
| 244 | inet_pton(AF_INET6, servername, &addrbuf) != 1) { | 244 | inet_pton(AF_INET6, servername, &addrbuf) != 1) { |
| 245 | if (SSL_set_tlsext_host_name(ctx->ssl_conn, servername) == 0) { | 245 | if (SSL_set_tlsext_host_name(ctx->ssl_conn, servername) == 0) { |
| 246 | tls_set_error(ctx, "server name indication failure"); | 246 | tls_set_errorx(ctx, "server name indication failure"); |
| 247 | goto err; | 247 | goto err; |
| 248 | } | 248 | } |
| 249 | } | 249 | } |
| @@ -262,12 +262,12 @@ connecting: | |||
| 262 | if (ctx->config->verify_name) { | 262 | if (ctx->config->verify_name) { |
| 263 | cert = SSL_get_peer_certificate(ctx->ssl_conn); | 263 | cert = SSL_get_peer_certificate(ctx->ssl_conn); |
| 264 | if (cert == NULL) { | 264 | if (cert == NULL) { |
| 265 | tls_set_error(ctx, "no server certificate"); | 265 | tls_set_errorx(ctx, "no server certificate"); |
| 266 | goto err; | 266 | goto err; |
| 267 | } | 267 | } |
| 268 | if ((ret = tls_check_servername(ctx, cert, servername)) != 0) { | 268 | if ((ret = tls_check_servername(ctx, cert, servername)) != 0) { |
| 269 | if (ret != -2) | 269 | if (ret != -2) |
| 270 | tls_set_error(ctx, "name `%s' not present in" | 270 | tls_set_errorx(ctx, "name `%s' not present in" |
| 271 | " server certificate", servername); | 271 | " server certificate", servername); |
| 272 | goto err; | 272 | goto err; |
| 273 | } | 273 | } |
