moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2024-11-16 06:25:03 -05:00
Code Issues Releases Wiki Activity

openssl: do not use file BIOs if not requested

Browse Source 
Moves the file handling BIO calls to the branch of the code where they
are actually used.

Closes #3339
This commit is contained in:
Gergely Nagy 2018-12-03 17:34:57 +01:00 committed by Daniel Stenberg
parent 8ad9e5915a
commit 08efa19e6a
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 13 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
lib/vtls/openssl.c
View File

@ -3321,20 +3321,8 @@ static CURLcode servercert(struct connectdata *conn,
/* we've been asked to gather certificate info! */ /* we've been asked to gather certificate info! */
(void)get_cert_chain(conn, connssl); (void)get_cert_chain(conn, connssl);
fp = BIO_new(BIO_s_file());
if(fp == NULL) {
failf(data,
"BIO_new return NULL, " OSSL_PACKAGE
" error %s",
ossl_strerror(ERR_get_error(), error_buffer,
sizeof(error_buffer)) );
BIO_free(mem);
return CURLE_OUT_OF_MEMORY;
}
BACKEND->server_cert = SSL_get_peer_certificate(BACKEND->handle); BACKEND->server_cert = SSL_get_peer_certificate(BACKEND->handle);
if(!BACKEND->server_cert) { if(!BACKEND->server_cert) {
BIO_free(fp);
BIO_free(mem); BIO_free(mem);
if(!strict) if(!strict)
return CURLE_OK; return CURLE_OK;
@ -3369,7 +3357,6 @@ static CURLcode servercert(struct connectdata *conn,
if(SSL_CONN_CONFIG(verifyhost)) { if(SSL_CONN_CONFIG(verifyhost)) {
result = verifyhost(conn, BACKEND->server_cert); result = verifyhost(conn, BACKEND->server_cert);
if(result) { if(result) {
BIO_free(fp);
X509_free(BACKEND->server_cert); X509_free(BACKEND->server_cert);
BACKEND->server_cert = NULL; BACKEND->server_cert = NULL;
return result; return result;
@ -3391,6 +3378,18 @@ static CURLcode servercert(struct connectdata *conn,
/* e.g. match issuer name with provided issuer certificate */ /* e.g. match issuer name with provided issuer certificate */
if(SSL_SET_OPTION(issuercert)) { if(SSL_SET_OPTION(issuercert)) {
fp = BIO_new(BIO_s_file());
if(fp == NULL) {
failf(data,
"BIO_new return NULL, " OSSL_PACKAGE
" error %s",
ossl_strerror(ERR_get_error(), error_buffer,
sizeof(error_buffer)) );
X509_free(BACKEND->server_cert);
BACKEND->server_cert = NULL;
return CURLE_OUT_OF_MEMORY;
}
if(BIO_read_filename(fp, SSL_SET_OPTION(issuercert)) <= 0) { if(BIO_read_filename(fp, SSL_SET_OPTION(issuercert)) <= 0) {
if(strict) if(strict)
failf(data, "SSL: Unable to open issuer cert (%s)", failf(data, "SSL: Unable to open issuer cert (%s)",
@ -3426,6 +3425,7 @@ static CURLcode servercert(struct connectdata *conn,
infof(data, " SSL certificate issuer check ok (%s)\n", infof(data, " SSL certificate issuer check ok (%s)\n",
SSL_SET_OPTION(issuercert)); SSL_SET_OPTION(issuercert));
BIO_free(fp);
X509_free(issuer); X509_free(issuer);
} }
@ -3454,7 +3454,6 @@ static CURLcode servercert(struct connectdata *conn,
if(SSL_CONN_CONFIG(verifystatus)) { if(SSL_CONN_CONFIG(verifystatus)) {
result = verifystatus(conn, connssl); result = verifystatus(conn, connssl);
if(result) { if(result) {
BIO_free(fp);
X509_free(BACKEND->server_cert); X509_free(BACKEND->server_cert);
BACKEND->server_cert = NULL; BACKEND->server_cert = NULL;
return result; return result;
@ -3474,7 +3473,6 @@ static CURLcode servercert(struct connectdata *conn,
failf(data, "SSL: public key does not match pinned public key!"); failf(data, "SSL: public key does not match pinned public key!");
} }
BIO_free(fp);
X509_free(BACKEND->server_cert); X509_free(BACKEND->server_cert);
BACKEND->server_cert = NULL; BACKEND->server_cert = NULL;
connssl->connecting_state = ssl_connect_done; connssl->connecting_state = ssl_connect_done;