handle CertificateFile more cleanly

properly distribute the certificates between the SSL context's trust
store and our host cert list.

as a drive-by, clean up some nasty type casts at the cost of including
a second OpenSSL header into socket.h.
This commit is contained in:
Oswald Buddenhagen 2020-07-29 20:23:54 +02:00
parent cfaa4848dd
commit 481c12a8b3
4 changed files with 32 additions and 10 deletions

View File

@ -172,6 +172,7 @@ int ATTR_PRINTFLIKE(2, 0) nfvasprintf( char **str, const char *fmt, va_list va )
int ATTR_PRINTFLIKE(2, 3) nfasprintf( char **str, const char *fmt, ... );
int ATTR_PRINTFLIKE(3, 4) nfsnprintf( char *buf, int blen, const char *fmt, ... );
void ATTR_NORETURN oob( void );
void ATTR_NORETURN oom( void );
char *expand_strdup( const char *s );

View File

@ -194,7 +194,6 @@ verify_cert_host( const server_conf_t *conf, conn_t *sock )
int i;
long err;
X509 *cert;
STACK_OF(X509_OBJECT) *trusted;
cert = SSL_get_peer_certificate( sock->ssl );
if (!cert) {
@ -202,9 +201,8 @@ verify_cert_host( const server_conf_t *conf, conn_t *sock )
return -1;
}
trusted = (STACK_OF(X509_OBJECT) *)sock->conf->trusted_certs;
for (i = 0; i < sk_X509_OBJECT_num( trusted ); i++) {
if (!X509_cmp( cert, X509_OBJECT_get0_X509( sk_X509_OBJECT_value( trusted, i ) ) )) {
for (i = 0; i < sk_X509_num( sock->conf->trusted_certs ); i++) {
if (!X509_cmp( cert, sk_X509_value( sock->conf->trusted_certs, i ) )) {
X509_free( cert );
return 0;
}
@ -273,11 +271,33 @@ DIAG_POP
return 0;
}
if (conf->cert_file && !SSL_CTX_load_verify_locations( mconf->SSLContext, conf->cert_file, NULL )) {
print_ssl_errors( "loading certificate file '%s'", conf->cert_file );
return 0;
if (!(mconf->trusted_certs = sk_X509_new_null()))
oom();
if (conf->cert_file) {
X509_STORE *store;
if (!(store = X509_STORE_new()))
oom();
if (!X509_STORE_load_locations( store, conf->cert_file, NULL )) {
print_ssl_errors( "loading certificate file '%s'", conf->cert_file );
return 0;
}
STACK_OF(X509_OBJECT) *objs = X509_STORE_get0_objects( store );
for (int i = 0; i < sk_X509_OBJECT_num( objs ); i++) {
X509 *cert = X509_OBJECT_get0_X509( sk_X509_OBJECT_value( objs, i ) );
if (cert) {
if (X509_check_ca( cert )) {
if (!X509_STORE_add_cert( SSL_CTX_get_cert_store( mconf->SSLContext ), cert ))
oom();
} else {
X509_up_ref( cert ); // Locking failure assumed impossible
if (!sk_X509_push( mconf->trusted_certs, cert ))
oom();
}
}
}
X509_STORE_free( store );
}
mconf->trusted_certs = (_STACK *)sk_X509_OBJECT_dup( X509_STORE_get0_objects( SSL_CTX_get_cert_store( mconf->SSLContext ) ) );
if (mconf->system_certs && !SSL_CTX_set_default_verify_paths( mconf->SSLContext )) {
ulong err;
while ((err = ERR_get_error()))

View File

@ -31,6 +31,7 @@
#ifdef HAVE_LIBSSL
# include <openssl/ssl.h>
# include <openssl/x509.h>
enum {
TLSv1 = 4,
@ -55,7 +56,7 @@ typedef struct {
/* these are actually variables and are leaked at the end */
char ssl_ctx_valid;
_STACK *trusted_certs;
STACK_OF(X509) *trusted_certs;
SSL_CTX *SSLContext;
#endif
} server_conf_t;

View File

@ -353,7 +353,7 @@ nfsnprintf( char *buf, int blen, const char *fmt, ... )
return ret;
}
static void ATTR_NORETURN
void
oom( void )
{
fputs( "Fatal: Out of memory\n", stderr );