[openssl-commits] [openssl] master update
Dr. Stephen Henson
steve at openssl.org
Mon Jun 22 12:55:38 UTC 2015
The branch master has been updated
via 389ebcecae2575188a4ff9566389ce694352be43 (commit)
via c34b0f9930563f905412a00b6d8a7280c83eb811 (commit)
via 8df53b7a7cf00908747e5730b19fe8fed8937b38 (commit)
via a273c6eeee6690d7061d3e647a5e648bbd3a997a (commit)
via 8d92c1f8a381a3be7fe5b3a2c2aa9bfce22f5c72 (commit)
from 7fba8407cc72e09dbd8d768100617286b0740b03 (commit)
- Log -----------------------------------------------------------------
commit 389ebcecae2575188a4ff9566389ce694352be43
Author: Dr. Stephen Henson <steve at openssl.org>
Date: Sun Jun 21 19:42:04 2015 +0100
Remove SESS_CERT entirely.
Reviewed-by: Richard Levitte <levitte at openssl.org>
commit c34b0f9930563f905412a00b6d8a7280c83eb811
Author: Dr. Stephen Henson <steve at openssl.org>
Date: Sun Jun 21 19:34:33 2015 +0100
Move peer chain to SSL_SESSION structure.
Reviewed-by: Richard Levitte <levitte at openssl.org>
commit 8df53b7a7cf00908747e5730b19fe8fed8937b38
Author: Dr. Stephen Henson <steve at openssl.org>
Date: Sun Jun 21 19:18:50 2015 +0100
Remove unnuecessary ifdefs.
If RSA or DSA is disabled we will never use a ciphersuite with
RSA/DSA authentication as it is already filtered out by the cipher
list logic.
Reviewed-by: Richard Levitte <levitte at openssl.org>
commit a273c6eeee6690d7061d3e647a5e648bbd3a997a
Author: Dr. Stephen Henson <steve at openssl.org>
Date: Sun Jun 21 19:08:57 2015 +0100
Remove certificates from sess_cert
As numerous comments indicate the certificate and key array is not an
appopriate structure to store the peers certificate: so remove it and
just the s->session->peer instead.
Reviewed-by: Richard Levitte <levitte at openssl.org>
commit 8d92c1f8a381a3be7fe5b3a2c2aa9bfce22f5c72
Author: Dr. Stephen Henson <steve at openssl.org>
Date: Sun Jun 21 16:26:08 2015 +0100
Remove peer temp keys from SESS_CERT
Reviewed-by: Richard Levitte <levitte at openssl.org>
-----------------------------------------------------------------------
Summary of changes:
ssl/s3_clnt.c | 170 +++++++++++++--------------------------------------------
ssl/s3_lib.c | 35 ++++++++----
ssl/s3_srvr.c | 15 +----
ssl/ssl_cert.c | 70 ------------------------
ssl/ssl_lib.c | 5 +-
ssl/ssl_locl.h | 49 ++++++-----------
ssl/ssl_sess.c | 5 +-
7 files changed, 84 insertions(+), 265 deletions(-)
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 935a621..6b4c860 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -1243,7 +1243,6 @@ int ssl3_get_server_certificate(SSL *s)
const unsigned char *q, *p;
unsigned char *d;
STACK_OF(X509) *sk = NULL;
- SESS_CERT *sc;
EVP_PKEY *pkey = NULL;
n = s->method->ssl_get_message(s,
@@ -1322,14 +1321,7 @@ int ssl3_get_server_certificate(SSL *s)
goto f_err;
}
- sc = ssl_sess_cert_new();
- if (sc == NULL)
- goto err;
-
- ssl_sess_cert_free(s->session->sess_cert);
- s->session->sess_cert = sc;
-
- sc->cert_chain = sk;
+ s->session->peer_chain = sk;
/*
* Inconsistency alert: cert_chain does include the peer's certificate,
* which we don't include in s3_srvr.c
@@ -1367,15 +1359,7 @@ int ssl3_get_server_certificate(SSL *s)
SSL_R_WRONG_CERTIFICATE_TYPE);
goto f_err;
}
- sc->peer_cert_type = i;
- CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
- /*
- * Why would the following ever happen? We just created sc a couple
- * of lines ago.
- */
- X509_free(sc->peer_pkeys[i].x509);
- sc->peer_pkeys[i].x509 = x;
- sc->peer_key = &(sc->peer_pkeys[i]);
+ s->session->peer_type = i;
X509_free(s->session->peer);
CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
@@ -1454,7 +1438,6 @@ int ssl3_get_key_exchange(SSL *s)
* problems later.
*/
if (alg_k & SSL_kPSK) {
- s->session->sess_cert = ssl_sess_cert_new();
OPENSSL_free(s->ctx->psk_identity_hint);
s->ctx->psk_identity_hint = NULL;
}
@@ -1464,22 +1447,19 @@ int ssl3_get_key_exchange(SSL *s)
}
param = p = (unsigned char *)s->init_msg;
- if (s->session->sess_cert != NULL) {
+
#ifndef OPENSSL_NO_RSA
- RSA_free(s->session->sess_cert->peer_rsa_tmp);
- s->session->sess_cert->peer_rsa_tmp = NULL;
+ RSA_free(s->s3->peer_rsa_tmp);
+ s->s3->peer_rsa_tmp = NULL;
#endif
#ifndef OPENSSL_NO_DH
- DH_free(s->session->sess_cert->peer_dh_tmp);
- s->session->sess_cert->peer_dh_tmp = NULL;
+ DH_free(s->s3->peer_dh_tmp);
+ s->s3->peer_dh_tmp = NULL;
#endif
#ifndef OPENSSL_NO_EC
- EC_KEY_free(s->session->sess_cert->peer_ecdh_tmp);
- s->session->sess_cert->peer_ecdh_tmp = NULL;
+ EC_KEY_free(s->s3->peer_ecdh_tmp);
+ s->s3->peer_ecdh_tmp = NULL;
#endif
- } else {
- s->session->sess_cert = ssl_sess_cert_new();
- }
/* Total length of the parameters including the length prefix */
param_len = 0;
@@ -1625,21 +1605,8 @@ int ssl3_get_key_exchange(SSL *s)
}
/* We must check if there is a certificate */
-# ifndef OPENSSL_NO_RSA
- if (alg_a & SSL_aRSA)
- pkey =
- X509_get_pubkey(s->session->
- sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
-# else
- if (0) ;
-# endif
-# ifndef OPENSSL_NO_DSA
- else if (alg_a & SSL_aDSS)
- pkey =
- X509_get_pubkey(s->session->
- sess_cert->peer_pkeys[SSL_PKEY_DSA_SIGN].
- x509);
-# endif
+ if (alg_a & (SSL_aRSA|SSL_aDSS))
+ pkey = X509_get_pubkey(s->session->peer);
} else
#endif /* !OPENSSL_NO_SRP */
#ifndef OPENSSL_NO_RSA
@@ -1697,9 +1664,7 @@ int ssl3_get_key_exchange(SSL *s)
/* this should be because we are using an export cipher */
if (alg_a & SSL_aRSA)
- pkey =
- X509_get_pubkey(s->session->
- sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
+ pkey = X509_get_pubkey(s->session->peer);
else {
SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
goto err;
@@ -1711,7 +1676,7 @@ int ssl3_get_key_exchange(SSL *s)
goto f_err;
}
- s->session->sess_cert->peer_rsa_tmp = rsa;
+ s->s3->peer_rsa_tmp = rsa;
rsa = NULL;
}
#else /* OPENSSL_NO_RSA */
@@ -1789,24 +1754,11 @@ int ssl3_get_key_exchange(SSL *s)
SSLerr(SSL_F_SSL3_GET_KEY_EXCHANGE, SSL_R_DH_KEY_TOO_SMALL);
goto f_err;
}
-# ifndef OPENSSL_NO_RSA
- if (alg_a & SSL_aRSA)
- pkey =
- X509_get_pubkey(s->session->
- sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
-# else
- if (0) ;
-# endif
-# ifndef OPENSSL_NO_DSA
- else if (alg_a & SSL_aDSS)
- pkey =
- X509_get_pubkey(s->session->
- sess_cert->peer_pkeys[SSL_PKEY_DSA_SIGN].
- x509);
-# endif
+ if (alg_a & (SSL_aRSA|SSL_aDSS))
+ pkey = X509_get_pubkey(s->session->peer);
/* else anonymous DH, so no certificate or pkey. */
- s->session->sess_cert->peer_dh_tmp = dh;
+ s->s3->peer_dh_tmp = dh;
dh = NULL;
}
#endif /* !OPENSSL_NO_DH */
@@ -1905,19 +1857,15 @@ int ssl3_get_key_exchange(SSL *s)
if (0) ;
# ifndef OPENSSL_NO_RSA
else if (alg_a & SSL_aRSA)
- pkey =
- X509_get_pubkey(s->session->
- sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].x509);
+ pkey = X509_get_pubkey(s->session->peer);
# endif
# ifndef OPENSSL_NO_EC
else if (alg_a & SSL_aECDSA)
- pkey =
- X509_get_pubkey(s->session->
- sess_cert->peer_pkeys[SSL_PKEY_ECC].x509);
+ pkey = X509_get_pubkey(s->session->peer);
# endif
/* else anonymous ECDH, so no certificate or pkey. */
EC_KEY_set_public_key(ecdh, srvr_ecpoint);
- s->session->sess_cert->peer_ecdh_tmp = ecdh;
+ s->s3->peer_ecdh_tmp = ecdh;
ecdh = NULL;
BN_CTX_free(bn_ctx);
bn_ctx = NULL;
@@ -2437,7 +2385,7 @@ int ssl3_send_client_key_exchange(SSL *s)
if (!pms)
goto memerr;
- if (s->session->sess_cert == NULL) {
+ if (s->session->peer == NULL) {
/*
* We should always have a server certificate with SSL_kRSA.
*/
@@ -2446,13 +2394,10 @@ int ssl3_send_client_key_exchange(SSL *s)
goto err;
}
- if (s->session->sess_cert->peer_rsa_tmp != NULL)
- rsa = s->session->sess_cert->peer_rsa_tmp;
+ if (s->s3->peer_rsa_tmp != NULL)
+ rsa = s->s3->peer_rsa_tmp;
else {
- pkey =
- X509_get_pubkey(s->session->
- sess_cert->peer_pkeys[SSL_PKEY_RSA_ENC].
- x509);
+ pkey = X509_get_pubkey(s->session->peer);
if ((pkey == NULL) || (pkey->type != EVP_PKEY_RSA)
|| (pkey->pkey.rsa == NULL)) {
SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
@@ -2495,24 +2440,13 @@ int ssl3_send_client_key_exchange(SSL *s)
#ifndef OPENSSL_NO_DH
else if (alg_k & (SSL_kDHE | SSL_kDHr | SSL_kDHd)) {
DH *dh_srvr, *dh_clnt;
- SESS_CERT *scert = s->session->sess_cert;
-
- if (scert == NULL) {
- ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE);
- SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
- SSL_R_UNEXPECTED_MESSAGE);
- goto err;
- }
-
- if (scert->peer_dh_tmp != NULL)
- dh_srvr = scert->peer_dh_tmp;
+ if (s->s3->peer_dh_tmp != NULL)
+ dh_srvr = s->s3->peer_dh_tmp;
else {
/* we get them from the cert */
- int idx = scert->peer_cert_type;
EVP_PKEY *spkey = NULL;
dh_srvr = NULL;
- if (idx >= 0)
- spkey = X509_get_pubkey(scert->peer_pkeys[idx].x509);
+ spkey = X509_get_pubkey(s->session->peer);
if (spkey) {
dh_srvr = EVP_PKEY_get1_DH(spkey);
EVP_PKEY_free(spkey);
@@ -2558,7 +2492,7 @@ int ssl3_send_client_key_exchange(SSL *s)
*/
n = DH_compute_key(pms, dh_srvr->pub_key, dh_clnt);
- if (scert->peer_dh_tmp == NULL)
+ if (s->s3->peer_dh_tmp == NULL)
DH_free(dh_srvr);
if (n <= 0) {
@@ -2588,14 +2522,6 @@ int ssl3_send_client_key_exchange(SSL *s)
EC_KEY *tkey;
int ecdh_clnt_cert = 0;
int field_size = 0;
-
- if (s->session->sess_cert == NULL) {
- ssl3_send_alert(s, SSL3_AL_FATAL, SSL_AD_UNEXPECTED_MESSAGE);
- SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
- SSL_R_UNEXPECTED_MESSAGE);
- goto err;
- }
-
/*
* Did we send out the client's ECDH share for use in premaster
* computation as part of client certificate? If so, set
@@ -2624,13 +2550,11 @@ int ssl3_send_client_key_exchange(SSL *s)
*/
}
- if (s->session->sess_cert->peer_ecdh_tmp != NULL) {
- tkey = s->session->sess_cert->peer_ecdh_tmp;
+ if (s->s3->peer_ecdh_tmp != NULL) {
+ tkey = s->s3->peer_ecdh_tmp;
} else {
/* Get the Server Public Key from Cert */
- srvr_pub_pkey =
- X509_get_pubkey(s->session->
- sess_cert->peer_pkeys[SSL_PKEY_ECC].x509);
+ srvr_pub_pkey = X509_get_pubkey(s->session->peer);
if ((srvr_pub_pkey == NULL)
|| (srvr_pub_pkey->type != EVP_PKEY_EC)
|| (srvr_pub_pkey->pkey.ec == NULL)) {
@@ -2758,7 +2682,6 @@ int ssl3_send_client_key_exchange(SSL *s)
X509 *peer_cert;
size_t msglen;
unsigned int md_len;
- int keytype;
unsigned char shared_ukm[32], tmp[256];
EVP_MD_CTX *ukm_hash;
EVP_PKEY *pub_key;
@@ -2771,13 +2694,7 @@ int ssl3_send_client_key_exchange(SSL *s)
/*
* Get server sertificate PKEY and create ctx from it
*/
- peer_cert =
- s->session->
- sess_cert->peer_pkeys[(keytype = SSL_PKEY_GOST01)].x509;
- if (!peer_cert)
- peer_cert =
- s->session->
- sess_cert->peer_pkeys[(keytype = SSL_PKEY_GOST94)].x509;
+ peer_cert = s->session->peer;
if (!peer_cert) {
SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,
SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER);
@@ -3218,15 +3135,14 @@ static int ssl3_check_client_certificate(SSL *s)
alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
/* See if we can use client certificate for fixed DH */
if (alg_k & (SSL_kDHr | SSL_kDHd)) {
- SESS_CERT *scert = s->session->sess_cert;
- int i = scert->peer_cert_type;
+ int i = s->session->peer_type;
EVP_PKEY *clkey = NULL, *spkey = NULL;
clkey = s->cert->key->privatekey;
/* If client key not DH assume it can be used */
if (EVP_PKEY_id(clkey) != EVP_PKEY_DH)
return 1;
if (i >= 0)
- spkey = X509_get_pubkey(scert->peer_pkeys[i].x509);
+ spkey = X509_get_pubkey(s->session->peer);
if (spkey) {
/* Compare server and client parameters */
i = EVP_PKEY_cmp_parameters(clkey, spkey);
@@ -3335,7 +3251,6 @@ int ssl3_check_cert_and_algorithm(SSL *s)
long alg_k, alg_a;
EVP_PKEY *pkey = NULL;
int pkey_bits;
- SESS_CERT *sc;
#ifndef OPENSSL_NO_RSA
RSA *rsa;
#endif
@@ -3350,25 +3265,19 @@ int ssl3_check_cert_and_algorithm(SSL *s)
/* we don't have a certificate */
if ((alg_a & SSL_aNULL) || (alg_k & SSL_kPSK))
return (1);
-
- sc = s->session->sess_cert;
- if (sc == NULL) {
- SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, ERR_R_INTERNAL_ERROR);
- goto err;
- }
#ifndef OPENSSL_NO_RSA
- rsa = s->session->sess_cert->peer_rsa_tmp;
+ rsa = s->s3->peer_rsa_tmp;
#endif
#ifndef OPENSSL_NO_DH
- dh = s->session->sess_cert->peer_dh_tmp;
+ dh = s->s3->peer_dh_tmp;
#endif
/* This is the passed certificate */
- idx = sc->peer_cert_type;
+ idx = s->session->peer_type;
#ifndef OPENSSL_NO_EC
if (idx == SSL_PKEY_ECC) {
- if (ssl_check_srvr_ecc_cert_and_alg(sc->peer_pkeys[idx].x509, s) == 0) {
+ if (ssl_check_srvr_ecc_cert_and_alg(s->session->peer, s) == 0) {
/* check failed */
SSLerr(SSL_F_SSL3_CHECK_CERT_AND_ALGORITHM, SSL_R_BAD_ECC_CERT);
goto f_err;
@@ -3384,9 +3293,9 @@ int ssl3_check_cert_and_algorithm(SSL *s)
goto f_err;
}
#endif
- pkey = X509_get_pubkey(sc->peer_pkeys[idx].x509);
+ pkey = X509_get_pubkey(s->session->peer);
pkey_bits = EVP_PKEY_bits(pkey);
- i = X509_certificate_type(sc->peer_pkeys[idx].x509, pkey);
+ i = X509_certificate_type(s->session->peer, pkey);
EVP_PKEY_free(pkey);
/* Check that we have a certificate if we require one */
@@ -3492,7 +3401,6 @@ int ssl3_check_cert_and_algorithm(SSL *s)
return (1);
f_err:
ssl3_send_alert(s, SSL3_AL_FATAL, al);
- err:
return (0);
}
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 0307801..6febd4e 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -2894,11 +2894,17 @@ void ssl3_free(SSL *s)
return;
ssl3_cleanup_key_block(s);
+
+#ifndef OPENSSL_NO_RSA
+ RSA_free(s->s3->peer_rsa_tmp);
+#endif
#ifndef OPENSSL_NO_DH
DH_free(s->s3->tmp.dh);
+ DH_free(s->s3->peer_dh_tmp);
#endif
#ifndef OPENSSL_NO_EC
EC_KEY_free(s->s3->tmp.ecdh);
+ EC_KEY_free(s->s3->peer_ecdh_tmp);
#endif
sk_X509_NAME_pop_free(s->s3->tmp.ca_names, X509_NAME_free);
@@ -2929,13 +2935,22 @@ void ssl3_clear(SSL *s)
OPENSSL_free(s->s3->tmp.peer_sigalgs);
s->s3->tmp.peer_sigalgs = NULL;
+#ifndef OPENSSL_NO_RSA
+ RSA_free(s->s3->peer_rsa_tmp);
+ s->s3->peer_rsa_tmp = NULL;
+#endif
+
#ifndef OPENSSL_NO_DH
DH_free(s->s3->tmp.dh);
s->s3->tmp.dh = NULL;
+ DH_free(s->s3->peer_dh_tmp);
+ s->s3->peer_dh_tmp = NULL;
#endif
#ifndef OPENSSL_NO_EC
EC_KEY_free(s->s3->tmp.ecdh);
s->s3->tmp.ecdh = NULL;
+ EC_KEY_free(s->s3->peer_ecdh_tmp);
+ s->s3->peer_ecdh_tmp = NULL;
s->s3->is_probably_safari = 0;
#endif /* !OPENSSL_NO_EC */
@@ -3312,7 +3327,7 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
case SSL_CTRL_GET_PEER_SIGNATURE_NID:
if (SSL_USE_SIGALGS(s)) {
- if (s->session && s->session->sess_cert) {
+ if (s->session) {
const EVP_MD *sig;
sig = s->s3->tmp.peer_md;
if (sig) {
@@ -3327,31 +3342,29 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
return 0;
case SSL_CTRL_GET_SERVER_TMP_KEY:
- if (s->server || !s->session || !s->session->sess_cert)
+ if (s->server || !s->session)
return 0;
else {
- SESS_CERT *sc;
EVP_PKEY *ptmp;
int rv = 0;
- sc = s->session->sess_cert;
#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DH) && !defined(OPENSSL_NO_EC)
- if (!sc->peer_rsa_tmp && !sc->peer_dh_tmp && !sc->peer_ecdh_tmp)
+ if (!s->s3->peer_rsa_tmp && !s->s3->peer_dh_tmp && !s->s3->peer_ecdh_tmp)
return 0;
#endif
ptmp = EVP_PKEY_new();
if (!ptmp)
return 0;
#ifndef OPENSSL_NO_RSA
- else if (sc->peer_rsa_tmp)
- rv = EVP_PKEY_set1_RSA(ptmp, sc->peer_rsa_tmp);
+ else if (s->s3->peer_rsa_tmp)
+ rv = EVP_PKEY_set1_RSA(ptmp, s->s3->peer_rsa_tmp);
#endif
#ifndef OPENSSL_NO_DH
- else if (sc->peer_dh_tmp)
- rv = EVP_PKEY_set1_DH(ptmp, sc->peer_dh_tmp);
+ else if (s->s3->peer_dh_tmp)
+ rv = EVP_PKEY_set1_DH(ptmp, s->s3->peer_dh_tmp);
#endif
#ifndef OPENSSL_NO_EC
- else if (sc->peer_ecdh_tmp)
- rv = EVP_PKEY_set1_EC_KEY(ptmp, sc->peer_ecdh_tmp);
+ else if (s->s3->peer_ecdh_tmp)
+ rv = EVP_PKEY_set1_EC_KEY(ptmp, s->s3->peer_ecdh_tmp);
#endif
if (rv) {
*(EVP_PKEY **)parg = ptmp;
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 90a67d1..b98beac 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -3195,19 +3195,8 @@ int ssl3_get_client_certificate(SSL *s)
s->session->peer = sk_X509_shift(sk);
s->session->verify_result = s->verify_result;
- /*
- * With the current implementation, sess_cert will always be NULL when we
- * arrive here.
- */
- if (s->session->sess_cert == NULL) {
- s->session->sess_cert = ssl_sess_cert_new();
- if (s->session->sess_cert == NULL) {
- SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE, ERR_R_MALLOC_FAILURE);
- goto done;
- }
- }
- sk_X509_pop_free(s->session->sess_cert->cert_chain, X509_free);
- s->session->sess_cert->cert_chain = sk;
+ sk_X509_pop_free(s->session->peer_chain, X509_free);
+ s->session->peer_chain = sk;
/*
* Inconsistency alert: cert_chain does *not* include the peer's own
* certificate, while we do include it in s3_clnt.c
diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c
index 6b39e25..5e9b8ff 100644
--- a/ssl/ssl_cert.c
+++ b/ssl/ssl_cert.c
@@ -519,76 +519,6 @@ void ssl_cert_set_cert_cb(CERT *c, int (*cb) (SSL *ssl, void *arg), void *arg)
c->cert_cb_arg = arg;
}
-SESS_CERT *ssl_sess_cert_new(void)
-{
- SESS_CERT *ret;
-
- ret = OPENSSL_malloc(sizeof(*ret));
- if (ret == NULL) {
- SSLerr(SSL_F_SSL_SESS_CERT_NEW, ERR_R_MALLOC_FAILURE);
- return NULL;
- }
-
- memset(ret, 0, sizeof(*ret));
- ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]);
- ret->references = 1;
-
- return ret;
-}
-
-void ssl_sess_cert_free(SESS_CERT *sc)
-{
- int i;
-
- if (sc == NULL)
- return;
-
- i = CRYPTO_add(&sc->references, -1, CRYPTO_LOCK_SSL_SESS_CERT);
-#ifdef REF_PRINT
- REF_PRINT("SESS_CERT", sc);
-#endif
- if (i > 0)
- return;
-#ifdef REF_CHECK
- if (i < 0) {
- fprintf(stderr, "ssl_sess_cert_free, bad reference count\n");
- abort(); /* ok */
- }
-#endif
-
- /* i == 0 */
- sk_X509_pop_free(sc->cert_chain, X509_free);
- for (i = 0; i < SSL_PKEY_NUM; i++) {
- X509_free(sc->peer_pkeys[i].x509);
-#if 0
- /*
- * We don't have the peer's private key. This line is just
- * here as a reminder that we're still using a not-quite-appropriate
- * data structure.
- */
- EVP_PKEY_free(sc->peer_pkeys[i].privatekey);
-#endif
- }
-
-#ifndef OPENSSL_NO_RSA
- RSA_free(sc->peer_rsa_tmp);
-#endif
-#ifndef OPENSSL_NO_DH
- DH_free(sc->peer_dh_tmp);
-#endif
-#ifndef OPENSSL_NO_EC
- EC_KEY_free(sc->peer_ecdh_tmp);
-#endif
-
- OPENSSL_free(sc);
-}
-
-int ssl_set_peer_cert_type(SESS_CERT *sc, int type)
-{
- sc->peer_cert_type = type;
- return (1);
-}
-
int ssl_verify_cert_chain(SSL *s, STACK_OF(X509) *sk)
{
X509 *x;
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 5c814fd..ceba30f 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -834,11 +834,10 @@ STACK_OF(X509) *SSL_get_peer_cert_chain(const SSL *s)
{
STACK_OF(X509) *r;
- if ((s == NULL) || (s->session == NULL)
- || (s->session->sess_cert == NULL))
+ if ((s == NULL) || (s->session == NULL))
r = NULL;
else
- r = s->session->sess_cert->cert_chain;
+ r = s->session->peer_chain;
/*
* If we are a client, cert_chain includes the peer's own certificate; if
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index 3252631..f1046c5 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -624,15 +624,11 @@ struct ssl_session_st {
* to disable session caching and tickets.
*/
int not_resumable;
- /* The cert is the certificate used to establish this connection */
- struct sess_cert_st /* SESS_CERT */ *sess_cert;
- /*
- * This is the cert for the other end. On clients, it will be the same as
- * sess_cert->peer_key->x509 (the latter is not enough as sess_cert is
- * not retained in the external representation of sessions, see
- * ssl_asn1.c).
- */
+ /* This is the cert and type for the other end. */
X509 *peer;
+ int peer_type;
+ /* Certificate chain of peer */
+ STACK_OF(X509) *peer_chain;
/*
* when app_verify_callback accepts a session where the peer's
* certificate is not ok, we must remember the error for session reuse:
@@ -1340,6 +1336,18 @@ typedef struct ssl3_state_st {
*/
char is_probably_safari;
# endif /* !OPENSSL_NO_EC */
+
+ /* For clients: peer temporary key */
+# ifndef OPENSSL_NO_RSA
+ RSA *peer_rsa_tmp;
+# endif
+# ifndef OPENSSL_NO_DH
+ DH *peer_dh_tmp;
+# endif
+# ifndef OPENSSL_NO_EC
+ EC_KEY *peer_ecdh_tmp;
+# endif
+
} SSL3_STATE;
@@ -1578,28 +1586,6 @@ typedef struct cert_st {
int references; /* >1 only if SSL_copy_session_id is used */
} CERT;
-typedef struct sess_cert_st {
- STACK_OF(X509) *cert_chain; /* as received from peer */
- /* The 'peer_...' members are used only by clients. */
- int peer_cert_type;
- CERT_PKEY *peer_key; /* points to an element of peer_pkeys (never
- * NULL!) */
- CERT_PKEY peer_pkeys[SSL_PKEY_NUM];
- /*
- * Obviously we don't have the private keys of these, so maybe we
- * shouldn't even use the CERT_PKEY type here.
- */
-# ifndef OPENSSL_NO_RSA
- RSA *peer_rsa_tmp; /* not used for SSL 2 */
-# endif
-# ifndef OPENSSL_NO_DH
- DH *peer_dh_tmp; /* not used for SSL 2 */
-# endif
-# ifndef OPENSSL_NO_EC
- EC_KEY *peer_ecdh_tmp;
-# endif
- int references; /* actually always 1 at the moment */
-} SESS_CERT;
/* Structure containing decoded values of signature algorithms extension */
struct tls_sigalgs_st {
/* NID of hash algorithm */
@@ -1854,9 +1840,6 @@ __owur CERT *ssl_cert_new(void);
__owur CERT *ssl_cert_dup(CERT *cert);
void ssl_cert_clear_certs(CERT *c);
void ssl_cert_free(CERT *c);
-__owur SESS_CERT *ssl_sess_cert_new(void);
-void ssl_sess_cert_free(SESS_CERT *sc);
-__owur int ssl_set_peer_cert_type(SESS_CERT *c, int type);
__owur int ssl_get_new_session(SSL *s, int session);
__owur int ssl_get_prev_session(SSL *s, unsigned char *session, int len,
const unsigned char *limit);
diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index c639e53..03c6ac0 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -265,9 +265,6 @@ SSL_SESSION *ssl_session_dup(SSL_SESSION *src, int ticket)
dest->references = 1;
- if (src->sess_cert != NULL)
- CRYPTO_add(&src->sess_cert->references, 1, CRYPTO_LOCK_SSL_SESS_CERT);
-
if (src->peer != NULL)
CRYPTO_add(&src->peer->references, 1, CRYPTO_LOCK_X509);
@@ -843,8 +840,8 @@ void SSL_SESSION_free(SSL_SESSION *ss)
OPENSSL_cleanse(ss->master_key, sizeof ss->master_key);
OPENSSL_cleanse(ss->session_id, sizeof ss->session_id);
- ssl_sess_cert_free(ss->sess_cert);
X509_free(ss->peer);
+ sk_X509_pop_free(ss->peer_chain, X509_free);
sk_SSL_CIPHER_free(ss->ciphers);
OPENSSL_free(ss->tlsext_hostname);
OPENSSL_free(ss->tlsext_tick);
More information about the openssl-commits
mailing list