Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

tls: Add a method to set OpenSSL certificate #426

Merged
merged 2 commits into from
Jul 8, 2022
Merged

tls: Add a method to set OpenSSL certificate #426

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
78e4a93
tls: Added a method to set OpenSSL TLS certificate.
Lastique Jul 7, 2022
8128fbc
tls: Avoid using OpenSSL internal type names.
Lastique Jul 7, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion include/re_tls.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,13 +4,20 @@
* Copyright (C) 2010 Creytiv.com
*/

#ifdef USE_OPENSSL
#include <openssl/ossl_typ.h>
#endif

struct tls;
struct tls_conn;
struct tcp_conn;
struct udp_sock;

#ifndef USE_OPENSSL
struct ssl_ctx_st;

typedef struct ssl_ctx_st SSL_CTX;
#endif


/** Defines the TLS method */
Expand Down Expand Up @@ -122,5 +129,7 @@ void dtls_recv_packet(struct dtls_sock *sock, const struct sa *src,


#ifdef USE_OPENSSL
struct ssl_ctx_st *tls_openssl_context(const struct tls *tls);
SSL_CTX *tls_openssl_context(const struct tls *tls);
int tls_set_certificate_openssl(struct tls *tls, X509* cert, EVP_PKEY* pkey,
bool up_ref);
#endif
53 changes: 51 additions & 2 deletions src/tls/openssl/tls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -708,6 +708,55 @@ int tls_set_selfsigned_rsa(struct tls *tls, const char *cn, size_t bits)
return err;
}

/**
* Set the certificate and private key on a TLS context
*
* @param tls TLS Context
* @param cert Certificate
* @param pkey Private key
* @param up_ref If true, increment reference count of the certificate if
* successfully set.
* If false, the reference count is not incremented and
* the ownership of the certificate is passed to the TLS
* context.
*
* @return 0 if success, otherwise errorcode
*/
int tls_set_certificate_openssl(struct tls *tls, X509* cert, EVP_PKEY* pkey,
bool up_ref)
{
int r, err = ENOMEM;

if (!tls || !cert || !pkey)
return EINVAL;

r = SSL_CTX_use_certificate(tls->ctx, cert);
if (r != 1)
goto out;

r = SSL_CTX_use_PrivateKey(tls->ctx, pkey);
if (r != 1) {
DEBUG_WARNING("set_certificate_openssl: use_PrivateKey"
" failed\n");
goto out;
}

if (tls->cert)
X509_free(tls->cert);

tls->cert = cert;

if (up_ref)
X509_up_ref(tls->cert);

err = 0;

out:
if (err)
ERR_clear_error();

return err;
}

/**
* Set the certificate and private key on a TLS context
Expand Down Expand Up @@ -1294,7 +1343,7 @@ void tls_flush_error(void)
*
* @return OpenSSL context
*/
struct ssl_ctx_st *tls_openssl_context(const struct tls *tls)
SSL_CTX *tls_openssl_context(const struct tls *tls)
{
return tls ? tls->ctx : NULL;
}
Expand Down Expand Up @@ -1592,7 +1641,7 @@ static bool remove_handler(struct le *le, void *arg)
}


static void session_remove_cb(struct ssl_ctx_st *ctx, SSL_SESSION *sess)
static void session_remove_cb(SSL_CTX *ctx, SSL_SESSION *sess)
{
struct tls *tls = SSL_SESSION_get_ex_data(sess, 0);
(void) ctx;
Expand Down