From b8fcd25d8f670b12fe45071e4f1134aeee9e91c9 Mon Sep 17 00:00:00 2001 From: jsing <> Date: Wed, 18 Apr 2018 16:29:11 +0000 Subject: Limit tls_config_clear_keys() to only clearing private keys. This was inadvertently clearing the keypair, which includes the OCSP staple and pubkey hash - if an application called tls_configure() followed by tls_config_clear_keys(), this would prevent OCSP staples from working. ok beck@ --- src/lib/libtls/tls_config.c | 7 ++----- src/lib/libtls/tls_internal.h | 3 ++- src/lib/libtls/tls_keypair.c | 4 ++-- 3 files changed, 6 insertions(+), 8 deletions(-) (limited to 'src/lib') diff --git a/src/lib/libtls/tls_config.c b/src/lib/libtls/tls_config.c index d32176fe6e..6094c74265 100644 --- a/src/lib/libtls/tls_config.c +++ b/src/lib/libtls/tls_config.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls_config.c,v 1.51 2018/03/20 15:40:10 jsing Exp $ */ +/* $OpenBSD: tls_config.c,v 1.51.2.1 2018/04/18 16:29:11 jsing Exp $ */ /* * Copyright (c) 2014 Joel Sing * @@ -189,10 +189,7 @@ tls_config_clear_keys(struct tls_config *config) struct tls_keypair *kp; for (kp = config->keypair; kp != NULL; kp = kp->next) - tls_keypair_clear(kp); - - tls_config_set_ca_mem(config, NULL, 0); - tls_config_set_crl_mem(config, NULL, 0); + tls_keypair_clear_key(kp); } int diff --git a/src/lib/libtls/tls_internal.h b/src/lib/libtls/tls_internal.h index 0d7e2289d3..1746a1aabc 100644 --- a/src/lib/libtls/tls_internal.h +++ b/src/lib/libtls/tls_internal.h @@ -1,4 +1,4 @@ -/* $OpenBSD: tls_internal.h,v 1.71 2018/03/19 16:34:47 jsing Exp $ */ +/* $OpenBSD: tls_internal.h,v 1.71.2.1 2018/04/18 16:29:11 jsing Exp $ */ /* * Copyright (c) 2014 Jeremie Courreges-Anglas * Copyright (c) 2014 Joel Sing @@ -199,6 +199,7 @@ int tls_set_mem(char **_dest, size_t *_destlen, const void *_src, int tls_set_string(const char **_dest, const char *_src); struct tls_keypair *tls_keypair_new(void); +void tls_keypair_clear_key(struct tls_keypair *_keypair); void tls_keypair_clear(struct tls_keypair *_keypair); void tls_keypair_free(struct tls_keypair *_keypair); int tls_keypair_set_cert_file(struct tls_keypair *_keypair, diff --git a/src/lib/libtls/tls_keypair.c b/src/lib/libtls/tls_keypair.c index 03e7f4ad76..64048cf6a2 100644 --- a/src/lib/libtls/tls_keypair.c +++ b/src/lib/libtls/tls_keypair.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls_keypair.c,v 1.5 2018/02/10 04:57:35 jsing Exp $ */ +/* $OpenBSD: tls_keypair.c,v 1.5.2.1 2018/04/18 16:29:11 jsing Exp $ */ /* * Copyright (c) 2014 Joel Sing * @@ -29,7 +29,7 @@ tls_keypair_new(void) return calloc(1, sizeof(struct tls_keypair)); } -static void +void tls_keypair_clear_key(struct tls_keypair *keypair) { freezero(keypair->key_mem, keypair->key_len); -- cgit v1.2.3-55-g6feb