1 files changed, 89 insertions, 58 deletions

diff --git a/src/lib/libtls/tls_conninfo.c b/src/lib/libtls/tls_conninfo.c
index 281af79866..5882a19cee 100644
--- a/src/lib/libtls/tls_conninfo.c
+++ b/src/lib/libtls/tls_conninfo.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls_conninfo.c,v 1.10 2016/08/22 14:55:59 jsing Exp $ */
+/* $OpenBSD: tls_conninfo.c,v 1.11 2016/08/22 17:12:35 jsing Exp $ */
 /*
  * Copyright (c) 2015 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2015 Bob Beck <beck@openbsd.org>
@@ -120,34 +120,57 @@ tls_get_peer_cert_subject(struct tls *ctx, char **subject)
 }
 
 static int
-tls_get_peer_cert_times(struct tls *ctx, time_t *notbefore, time_t *notafter)
+tls_get_peer_cert_times(struct tls *ctx, time_t *notbefore,
+    time_t *notafter)
 {
         struct tm before_tm, after_tm;
         ASN1_TIME *before, *after;
-        int rv = -1;
+
+        if (ctx->ssl_peer_cert == NULL)
+                return (-1);
 
         memset(&before_tm, 0, sizeof(before_tm));
         memset(&after_tm, 0, sizeof(after_tm));
 
-        if (ctx->ssl_peer_cert != NULL) {
-                if ((before = X509_get_notBefore(ctx->ssl_peer_cert)) == NULL)
-                        goto err;
-                if ((after = X509_get_notAfter(ctx->ssl_peer_cert)) == NULL)
-                        goto err;
-                if (asn1_time_parse(before->data, before->length, &before_tm, 0)
-                    == -1)
-                        goto err;
-                if (asn1_time_parse(after->data, after->length, &after_tm, 0)
-                    == -1)
-                        goto err;
-                if ((*notbefore = timegm(&before_tm)) == -1)
-                        goto err;
-                if ((*notafter = timegm(&after_tm)) == -1)
-                        goto err;
-        }
-        rv = 0;
+        if ((before = X509_get_notBefore(ctx->ssl_peer_cert)) == NULL)
+                goto err;
+        if ((after = X509_get_notAfter(ctx->ssl_peer_cert)) == NULL)
+                goto err;
+        if (asn1_time_parse(before->data, before->length, &before_tm, 0) == -1)
+                goto err;
+        if (asn1_time_parse(after->data, after->length, &after_tm, 0) == -1)
+                goto err;
+        if ((*notbefore = timegm(&before_tm)) == -1)
+                goto err;
+        if ((*notafter = timegm(&after_tm)) == -1)
+                goto err;
+
+        return (0);
+
  err:
-        return (rv);
+        return (-1);
+}
+
+static int
+tls_get_peer_cert_info(struct tls *ctx)
+{
+        if (ctx->ssl_peer_cert == NULL)
+                return (0);
+
+        if (tls_get_peer_cert_hash(ctx, &ctx->conninfo->hash) == -1)
+                goto err;
+        if (tls_get_peer_cert_subject(ctx, &ctx->conninfo->subject) == -1)
+                goto err;
+        if (tls_get_peer_cert_issuer(ctx, &ctx->conninfo->issuer) == -1)
+                goto err;
+        if (tls_get_peer_cert_times(ctx, &ctx->conninfo->notbefore,
+            &ctx->conninfo->notafter) == -1)
+                goto err;
+
+        return (0);
+
+ err:
+        return (-1);
 }
 
 static int
@@ -171,63 +194,71 @@ tls_conninfo_alpn_proto(struct tls *ctx)
 }
 
 int
-tls_get_conninfo(struct tls *ctx)
+tls_conninfo_populate(struct tls *ctx)
 {
-        const char * tmp;
+        const char *tmp;
 
-        if (ctx->ssl_peer_cert != NULL) {
-                if (tls_get_peer_cert_hash(ctx, &ctx->conninfo->hash) == -1)
-                        goto err;
-                if (tls_get_peer_cert_subject(ctx, &ctx->conninfo->subject)
-                    == -1)
-                        goto err;
-                if (tls_get_peer_cert_issuer(ctx, &ctx->conninfo->issuer) == -1)
-                        goto err;
-                if (tls_get_peer_cert_times(ctx, &ctx->conninfo->notbefore,
-                    &ctx->conninfo->notafter) == -1)
-                        goto err;
-        }
-        if ((tmp = SSL_get_version(ctx->ssl_conn)) == NULL)
+        tls_conninfo_free(ctx->conninfo);
+
+        if ((ctx->conninfo = calloc(1, sizeof(struct tls_conninfo))) == NULL) {
+                tls_set_errorx(ctx, "out of memory");
                 goto err;
-        ctx->conninfo->version = strdup(tmp);
-        if (ctx->conninfo->version == NULL)
+        }
+
+        if (tls_conninfo_alpn_proto(ctx) == -1)
                 goto err;
+
         if ((tmp = SSL_get_cipher(ctx->ssl_conn)) == NULL)
                 goto err;
         ctx->conninfo->cipher = strdup(tmp);
         if (ctx->conninfo->cipher == NULL)
                 goto err;
-        if (tls_conninfo_alpn_proto(ctx) == -1)
-                goto err;
+
         if (ctx->servername != NULL) {
                 if ((ctx->conninfo->servername =
                     strdup(ctx->servername)) == NULL)
                         goto err;
         }
 
+        if ((tmp = SSL_get_version(ctx->ssl_conn)) == NULL)
+                goto err;
+        ctx->conninfo->version = strdup(tmp);
+        if (ctx->conninfo->version == NULL)
+                goto err;
+
+        if (tls_get_peer_cert_info(ctx) == -1)
+                goto err;
+
         return (0);
-err:
-        tls_free_conninfo(ctx->conninfo);
+
+ err:
+        tls_conninfo_free(ctx->conninfo);
+        ctx->conninfo = NULL;
+
         return (-1);
 }
 
 void
-tls_free_conninfo(struct tls_conninfo *conninfo)
+tls_conninfo_free(struct tls_conninfo *conninfo)
 {
-        if (conninfo != NULL) {
-                free(conninfo->alpn);
-                conninfo->alpn = NULL;
-                free(conninfo->hash);
-                conninfo->hash = NULL;
-                free(conninfo->subject);
-                conninfo->subject = NULL;
-                free(conninfo->issuer);
-                conninfo->issuer = NULL;
-                free(conninfo->version);
-                conninfo->version = NULL;
-                free(conninfo->cipher);
-                conninfo->cipher = NULL;
-        }
+        if (conninfo == NULL)
+                return;
+
+        free(conninfo->alpn);
+        conninfo->alpn = NULL;
+        free(conninfo->cipher);
+        conninfo->cipher = NULL;
+        free(conninfo->version);
+        conninfo->version = NULL;
+
+        free(conninfo->hash);
+        conninfo->hash = NULL;
+        free(conninfo->issuer);
+        conninfo->issuer = NULL;
+        free(conninfo->subject);
+        conninfo->subject = NULL;
+
+        free(conninfo);
 }
 
 const char *
@@ -253,7 +284,7 @@ tls_conn_servername(struct tls *ctx)
                 return (NULL);
         return (ctx->conninfo->servername);
 }
- 
+
 const char *
 tls_conn_version(struct tls *ctx)
 {