diff options
Diffstat (limited to 'src/lib/libtls/tls_client.c')
-rw-r--r-- | src/lib/libtls/tls_client.c | 34 |
1 files changed, 17 insertions, 17 deletions
diff --git a/src/lib/libtls/tls_client.c b/src/lib/libtls/tls_client.c index 241c506676..168a7089fc 100644 --- a/src/lib/libtls/tls_client.c +++ b/src/lib/libtls/tls_client.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: tls_client.c,v 1.20 2015/08/27 14:34:46 jsing Exp $ */ | 1 | /* $OpenBSD: tls_client.c,v 1.21 2015/08/27 15:26:50 jsing Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> | 3 | * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> |
4 | * | 4 | * |
@@ -95,12 +95,12 @@ tls_connect_servername(struct tls *ctx, const char *host, const char *port, | |||
95 | int rv = -1, s = -1, ret; | 95 | int rv = -1, s = -1, ret; |
96 | 96 | ||
97 | if ((ctx->flags & TLS_CLIENT) == 0) { | 97 | if ((ctx->flags & TLS_CLIENT) == 0) { |
98 | tls_set_error(ctx, "not a client context"); | 98 | tls_set_errorx(ctx, "not a client context"); |
99 | goto err; | 99 | goto err; |
100 | } | 100 | } |
101 | 101 | ||
102 | if (host == NULL) { | 102 | if (host == NULL) { |
103 | tls_set_error(ctx, "host not specified"); | 103 | tls_set_errorx(ctx, "host not specified"); |
104 | goto err; | 104 | goto err; |
105 | } | 105 | } |
106 | 106 | ||
@@ -111,7 +111,7 @@ tls_connect_servername(struct tls *ctx, const char *host, const char *port, | |||
111 | if ((p = (char *)port) == NULL) { | 111 | if ((p = (char *)port) == NULL) { |
112 | ret = tls_host_port(host, &hs, &ps); | 112 | ret = tls_host_port(host, &hs, &ps); |
113 | if (ret == -1) { | 113 | if (ret == -1) { |
114 | tls_set_error(ctx, "memory allocation failure"); | 114 | tls_set_errorx(ctx, "memory allocation failure"); |
115 | goto err; | 115 | goto err; |
116 | } | 116 | } |
117 | if (ret != 0) | 117 | if (ret != 0) |
@@ -169,7 +169,7 @@ tls_connect_fds(struct tls *ctx, int fd_read, int fd_write, | |||
169 | int ret, err; | 169 | int ret, err; |
170 | 170 | ||
171 | if ((ctx->flags & TLS_CLIENT) == 0) { | 171 | if ((ctx->flags & TLS_CLIENT) == 0) { |
172 | tls_set_error(ctx, "not a client context"); | 172 | tls_set_errorx(ctx, "not a client context"); |
173 | goto err; | 173 | goto err; |
174 | } | 174 | } |
175 | 175 | ||
@@ -177,12 +177,12 @@ tls_connect_fds(struct tls *ctx, int fd_read, int fd_write, | |||
177 | goto connecting; | 177 | goto connecting; |
178 | 178 | ||
179 | if (fd_read < 0 || fd_write < 0) { | 179 | if (fd_read < 0 || fd_write < 0) { |
180 | tls_set_error(ctx, "invalid file descriptors"); | 180 | tls_set_errorx(ctx, "invalid file descriptors"); |
181 | return (-1); | 181 | return (-1); |
182 | } | 182 | } |
183 | 183 | ||
184 | if ((ctx->ssl_ctx = SSL_CTX_new(SSLv23_client_method())) == NULL) { | 184 | if ((ctx->ssl_ctx = SSL_CTX_new(SSLv23_client_method())) == NULL) { |
185 | tls_set_error(ctx, "ssl context failure"); | 185 | tls_set_errorx(ctx, "ssl context failure"); |
186 | goto err; | 186 | goto err; |
187 | } | 187 | } |
188 | 188 | ||
@@ -191,7 +191,7 @@ tls_connect_fds(struct tls *ctx, int fd_read, int fd_write, | |||
191 | 191 | ||
192 | if (ctx->config->verify_name) { | 192 | if (ctx->config->verify_name) { |
193 | if (servername == NULL) { | 193 | if (servername == NULL) { |
194 | tls_set_error(ctx, "server name not specified"); | 194 | tls_set_errorx(ctx, "server name not specified"); |
195 | goto err; | 195 | goto err; |
196 | } | 196 | } |
197 | } | 197 | } |
@@ -201,19 +201,19 @@ tls_connect_fds(struct tls *ctx, int fd_read, int fd_write, | |||
201 | 201 | ||
202 | if (ctx->config->ca_mem != NULL) { | 202 | if (ctx->config->ca_mem != NULL) { |
203 | if (ctx->config->ca_len > INT_MAX) { | 203 | if (ctx->config->ca_len > INT_MAX) { |
204 | tls_set_error(ctx, "ca too long"); | 204 | tls_set_errorx(ctx, "ca too long"); |
205 | goto err; | 205 | goto err; |
206 | } | 206 | } |
207 | 207 | ||
208 | if (SSL_CTX_load_verify_mem(ctx->ssl_ctx, | 208 | if (SSL_CTX_load_verify_mem(ctx->ssl_ctx, |
209 | ctx->config->ca_mem, ctx->config->ca_len) != 1) { | 209 | ctx->config->ca_mem, ctx->config->ca_len) != 1) { |
210 | tls_set_error(ctx, | 210 | tls_set_errorx(ctx, |
211 | "ssl verify memory setup failure"); | 211 | "ssl verify memory setup failure"); |
212 | goto err; | 212 | goto err; |
213 | } | 213 | } |
214 | } else if (SSL_CTX_load_verify_locations(ctx->ssl_ctx, | 214 | } else if (SSL_CTX_load_verify_locations(ctx->ssl_ctx, |
215 | ctx->config->ca_file, ctx->config->ca_path) != 1) { | 215 | ctx->config->ca_file, ctx->config->ca_path) != 1) { |
216 | tls_set_error(ctx, "ssl verify setup failure"); | 216 | tls_set_errorx(ctx, "ssl verify setup failure"); |
217 | goto err; | 217 | goto err; |
218 | } | 218 | } |
219 | if (ctx->config->verify_depth >= 0) | 219 | if (ctx->config->verify_depth >= 0) |
@@ -222,16 +222,16 @@ tls_connect_fds(struct tls *ctx, int fd_read, int fd_write, | |||
222 | } | 222 | } |
223 | 223 | ||
224 | if ((ctx->ssl_conn = SSL_new(ctx->ssl_ctx)) == NULL) { | 224 | if ((ctx->ssl_conn = SSL_new(ctx->ssl_ctx)) == NULL) { |
225 | tls_set_error(ctx, "ssl connection failure"); | 225 | tls_set_errorx(ctx, "ssl connection failure"); |
226 | goto err; | 226 | goto err; |
227 | } | 227 | } |
228 | if (SSL_set_app_data(ctx->ssl_conn, ctx) != 1) { | 228 | if (SSL_set_app_data(ctx->ssl_conn, ctx) != 1) { |
229 | tls_set_error(ctx, "ssl application data failure"); | 229 | tls_set_errorx(ctx, "ssl application data failure"); |
230 | goto err; | 230 | goto err; |
231 | } | 231 | } |
232 | if (SSL_set_rfd(ctx->ssl_conn, fd_read) != 1 || | 232 | if (SSL_set_rfd(ctx->ssl_conn, fd_read) != 1 || |
233 | SSL_set_wfd(ctx->ssl_conn, fd_write) != 1) { | 233 | SSL_set_wfd(ctx->ssl_conn, fd_write) != 1) { |
234 | tls_set_error(ctx, "ssl file descriptor failure"); | 234 | tls_set_errorx(ctx, "ssl file descriptor failure"); |
235 | goto err; | 235 | goto err; |
236 | } | 236 | } |
237 | 237 | ||
@@ -243,7 +243,7 @@ tls_connect_fds(struct tls *ctx, int fd_read, int fd_write, | |||
243 | inet_pton(AF_INET, servername, &addrbuf) != 1 && | 243 | inet_pton(AF_INET, servername, &addrbuf) != 1 && |
244 | inet_pton(AF_INET6, servername, &addrbuf) != 1) { | 244 | inet_pton(AF_INET6, servername, &addrbuf) != 1) { |
245 | if (SSL_set_tlsext_host_name(ctx->ssl_conn, servername) == 0) { | 245 | if (SSL_set_tlsext_host_name(ctx->ssl_conn, servername) == 0) { |
246 | tls_set_error(ctx, "server name indication failure"); | 246 | tls_set_errorx(ctx, "server name indication failure"); |
247 | goto err; | 247 | goto err; |
248 | } | 248 | } |
249 | } | 249 | } |
@@ -262,12 +262,12 @@ connecting: | |||
262 | if (ctx->config->verify_name) { | 262 | if (ctx->config->verify_name) { |
263 | cert = SSL_get_peer_certificate(ctx->ssl_conn); | 263 | cert = SSL_get_peer_certificate(ctx->ssl_conn); |
264 | if (cert == NULL) { | 264 | if (cert == NULL) { |
265 | tls_set_error(ctx, "no server certificate"); | 265 | tls_set_errorx(ctx, "no server certificate"); |
266 | goto err; | 266 | goto err; |
267 | } | 267 | } |
268 | if ((ret = tls_check_servername(ctx, cert, servername)) != 0) { | 268 | if ((ret = tls_check_servername(ctx, cert, servername)) != 0) { |
269 | if (ret != -2) | 269 | if (ret != -2) |
270 | tls_set_error(ctx, "name `%s' not present in" | 270 | tls_set_errorx(ctx, "name `%s' not present in" |
271 | " server certificate", servername); | 271 | " server certificate", servername); |
272 | goto err; | 272 | goto err; |
273 | } | 273 | } |