2 * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
12 #include <openssl/bio.h>
13 #include <openssl/objects.h>
14 #include <openssl/evp.h>
15 #include <openssl/x509.h>
16 #include <openssl/pem.h>
18 static int ssl_set_cert(CERT *c, X509 *x509);
19 static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey);
20 int SSL_use_certificate(SSL *ssl, X509 *x)
24 SSLerr(SSL_F_SSL_USE_CERTIFICATE, ERR_R_PASSED_NULL_PARAMETER);
27 rv = ssl_security_cert(ssl, NULL, x, 0, 1);
29 SSLerr(SSL_F_SSL_USE_CERTIFICATE, rv);
33 return (ssl_set_cert(ssl->cert, x));
36 #ifndef OPENSSL_NO_STDIO
37 int SSL_use_certificate_file(SSL *ssl, const char *file, int type)
44 in = BIO_new(BIO_s_file());
46 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, ERR_R_BUF_LIB);
50 if (BIO_read_filename(in, file) <= 0) {
51 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, ERR_R_SYS_LIB);
54 if (type == SSL_FILETYPE_ASN1) {
56 x = d2i_X509_bio(in, NULL);
57 } else if (type == SSL_FILETYPE_PEM) {
59 x = PEM_read_bio_X509(in, NULL, ssl->ctx->default_passwd_callback,
60 ssl->ctx->default_passwd_callback_userdata);
62 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, SSL_R_BAD_SSL_FILETYPE);
67 SSLerr(SSL_F_SSL_USE_CERTIFICATE_FILE, j);
71 ret = SSL_use_certificate(ssl, x);
79 int SSL_use_certificate_ASN1(SSL *ssl, const unsigned char *d, int len)
84 x = d2i_X509(NULL, &d, (long)len);
86 SSLerr(SSL_F_SSL_USE_CERTIFICATE_ASN1, ERR_R_ASN1_LIB);
90 ret = SSL_use_certificate(ssl, x);
95 #ifndef OPENSSL_NO_RSA
96 int SSL_use_RSAPrivateKey(SSL *ssl, RSA *rsa)
102 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER);
105 if ((pkey = EVP_PKEY_new()) == NULL) {
106 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY, ERR_R_EVP_LIB);
111 if (EVP_PKEY_assign_RSA(pkey, rsa) <= 0) {
116 ret = ssl_set_pkey(ssl->cert, pkey);
122 static int ssl_set_pkey(CERT *c, EVP_PKEY *pkey)
125 i = ssl_cert_type(NULL, pkey);
127 SSLerr(SSL_F_SSL_SET_PKEY, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
131 if (c->pkeys[i].x509 != NULL) {
133 pktmp = X509_get0_pubkey(c->pkeys[i].x509);
135 SSLerr(SSL_F_SSL_SET_PKEY, ERR_R_MALLOC_FAILURE);
139 * The return code from EVP_PKEY_copy_parameters is deliberately
140 * ignored. Some EVP_PKEY types cannot do this.
142 EVP_PKEY_copy_parameters(pktmp, pkey);
145 #ifndef OPENSSL_NO_RSA
147 * Don't check the public/private key, this is mostly for smart
150 if (EVP_PKEY_id(pkey) == EVP_PKEY_RSA
151 && RSA_flags(EVP_PKEY_get0_RSA(pkey)) & RSA_METHOD_FLAG_NO_CHECK);
154 if (!X509_check_private_key(c->pkeys[i].x509, pkey)) {
155 X509_free(c->pkeys[i].x509);
156 c->pkeys[i].x509 = NULL;
161 EVP_PKEY_free(c->pkeys[i].privatekey);
162 EVP_PKEY_up_ref(pkey);
163 c->pkeys[i].privatekey = pkey;
164 c->key = &(c->pkeys[i]);
168 #ifndef OPENSSL_NO_RSA
169 # ifndef OPENSSL_NO_STDIO
170 int SSL_use_RSAPrivateKey_file(SSL *ssl, const char *file, int type)
176 in = BIO_new(BIO_s_file());
178 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, ERR_R_BUF_LIB);
182 if (BIO_read_filename(in, file) <= 0) {
183 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, ERR_R_SYS_LIB);
186 if (type == SSL_FILETYPE_ASN1) {
188 rsa = d2i_RSAPrivateKey_bio(in, NULL);
189 } else if (type == SSL_FILETYPE_PEM) {
191 rsa = PEM_read_bio_RSAPrivateKey(in, NULL,
192 ssl->ctx->default_passwd_callback,
194 ctx->default_passwd_callback_userdata);
196 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE);
200 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_FILE, j);
203 ret = SSL_use_RSAPrivateKey(ssl, rsa);
211 int SSL_use_RSAPrivateKey_ASN1(SSL *ssl, const unsigned char *d, long len)
214 const unsigned char *p;
218 if ((rsa = d2i_RSAPrivateKey(NULL, &p, (long)len)) == NULL) {
219 SSLerr(SSL_F_SSL_USE_RSAPRIVATEKEY_ASN1, ERR_R_ASN1_LIB);
223 ret = SSL_use_RSAPrivateKey(ssl, rsa);
227 #endif /* !OPENSSL_NO_RSA */
229 int SSL_use_PrivateKey(SSL *ssl, EVP_PKEY *pkey)
234 SSLerr(SSL_F_SSL_USE_PRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER);
237 ret = ssl_set_pkey(ssl->cert, pkey);
241 #ifndef OPENSSL_NO_STDIO
242 int SSL_use_PrivateKey_file(SSL *ssl, const char *file, int type)
246 EVP_PKEY *pkey = NULL;
248 in = BIO_new(BIO_s_file());
250 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, ERR_R_BUF_LIB);
254 if (BIO_read_filename(in, file) <= 0) {
255 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, ERR_R_SYS_LIB);
258 if (type == SSL_FILETYPE_PEM) {
260 pkey = PEM_read_bio_PrivateKey(in, NULL,
261 ssl->ctx->default_passwd_callback,
263 ctx->default_passwd_callback_userdata);
264 } else if (type == SSL_FILETYPE_ASN1) {
266 pkey = d2i_PrivateKey_bio(in, NULL);
268 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE);
272 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_FILE, j);
275 ret = SSL_use_PrivateKey(ssl, pkey);
283 int SSL_use_PrivateKey_ASN1(int type, SSL *ssl, const unsigned char *d,
287 const unsigned char *p;
291 if ((pkey = d2i_PrivateKey(type, NULL, &p, (long)len)) == NULL) {
292 SSLerr(SSL_F_SSL_USE_PRIVATEKEY_ASN1, ERR_R_ASN1_LIB);
296 ret = SSL_use_PrivateKey(ssl, pkey);
301 int SSL_CTX_use_certificate(SSL_CTX *ctx, X509 *x)
305 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE, ERR_R_PASSED_NULL_PARAMETER);
308 rv = ssl_security_cert(NULL, ctx, x, 0, 1);
310 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE, rv);
313 return (ssl_set_cert(ctx->cert, x));
316 static int ssl_set_cert(CERT *c, X509 *x)
321 pkey = X509_get0_pubkey(x);
323 SSLerr(SSL_F_SSL_SET_CERT, SSL_R_X509_LIB);
327 i = ssl_cert_type(x, pkey);
329 SSLerr(SSL_F_SSL_SET_CERT, SSL_R_UNKNOWN_CERTIFICATE_TYPE);
332 #ifndef OPENSSL_NO_EC
333 if (i == SSL_PKEY_ECC && !EC_KEY_can_sign(EVP_PKEY_get0_EC_KEY(pkey))) {
334 SSLerr(SSL_F_SSL_SET_CERT, SSL_R_ECC_CERT_NOT_FOR_SIGNING);
338 if (c->pkeys[i].privatekey != NULL) {
340 * The return code from EVP_PKEY_copy_parameters is deliberately
341 * ignored. Some EVP_PKEY types cannot do this.
343 EVP_PKEY_copy_parameters(pkey, c->pkeys[i].privatekey);
346 #ifndef OPENSSL_NO_RSA
348 * Don't check the public/private key, this is mostly for smart
351 if (EVP_PKEY_id(c->pkeys[i].privatekey) == EVP_PKEY_RSA
352 && RSA_flags(EVP_PKEY_get0_RSA(c->pkeys[i].privatekey)) &
353 RSA_METHOD_FLAG_NO_CHECK) ;
355 #endif /* OPENSSL_NO_RSA */
356 if (!X509_check_private_key(x, c->pkeys[i].privatekey)) {
358 * don't fail for a cert/key mismatch, just free current private
359 * key (when switching to a different cert & key, first this
360 * function should be used, then ssl_set_pkey
362 EVP_PKEY_free(c->pkeys[i].privatekey);
363 c->pkeys[i].privatekey = NULL;
364 /* clear error queue */
369 X509_free(c->pkeys[i].x509);
371 c->pkeys[i].x509 = x;
372 c->key = &(c->pkeys[i]);
377 #ifndef OPENSSL_NO_STDIO
378 int SSL_CTX_use_certificate_file(SSL_CTX *ctx, const char *file, int type)
385 in = BIO_new(BIO_s_file());
387 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, ERR_R_BUF_LIB);
391 if (BIO_read_filename(in, file) <= 0) {
392 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, ERR_R_SYS_LIB);
395 if (type == SSL_FILETYPE_ASN1) {
397 x = d2i_X509_bio(in, NULL);
398 } else if (type == SSL_FILETYPE_PEM) {
400 x = PEM_read_bio_X509(in, NULL, ctx->default_passwd_callback,
401 ctx->default_passwd_callback_userdata);
403 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, SSL_R_BAD_SSL_FILETYPE);
408 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_FILE, j);
412 ret = SSL_CTX_use_certificate(ctx, x);
420 int SSL_CTX_use_certificate_ASN1(SSL_CTX *ctx, int len,
421 const unsigned char *d)
426 x = d2i_X509(NULL, &d, (long)len);
428 SSLerr(SSL_F_SSL_CTX_USE_CERTIFICATE_ASN1, ERR_R_ASN1_LIB);
432 ret = SSL_CTX_use_certificate(ctx, x);
437 #ifndef OPENSSL_NO_RSA
438 int SSL_CTX_use_RSAPrivateKey(SSL_CTX *ctx, RSA *rsa)
444 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER);
447 if ((pkey = EVP_PKEY_new()) == NULL) {
448 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY, ERR_R_EVP_LIB);
453 if (EVP_PKEY_assign_RSA(pkey, rsa) <= 0) {
458 ret = ssl_set_pkey(ctx->cert, pkey);
463 # ifndef OPENSSL_NO_STDIO
464 int SSL_CTX_use_RSAPrivateKey_file(SSL_CTX *ctx, const char *file, int type)
470 in = BIO_new(BIO_s_file());
472 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, ERR_R_BUF_LIB);
476 if (BIO_read_filename(in, file) <= 0) {
477 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, ERR_R_SYS_LIB);
480 if (type == SSL_FILETYPE_ASN1) {
482 rsa = d2i_RSAPrivateKey_bio(in, NULL);
483 } else if (type == SSL_FILETYPE_PEM) {
485 rsa = PEM_read_bio_RSAPrivateKey(in, NULL,
486 ctx->default_passwd_callback,
487 ctx->default_passwd_callback_userdata);
489 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE);
493 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_FILE, j);
496 ret = SSL_CTX_use_RSAPrivateKey(ctx, rsa);
504 int SSL_CTX_use_RSAPrivateKey_ASN1(SSL_CTX *ctx, const unsigned char *d,
508 const unsigned char *p;
512 if ((rsa = d2i_RSAPrivateKey(NULL, &p, (long)len)) == NULL) {
513 SSLerr(SSL_F_SSL_CTX_USE_RSAPRIVATEKEY_ASN1, ERR_R_ASN1_LIB);
517 ret = SSL_CTX_use_RSAPrivateKey(ctx, rsa);
521 #endif /* !OPENSSL_NO_RSA */
523 int SSL_CTX_use_PrivateKey(SSL_CTX *ctx, EVP_PKEY *pkey)
526 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY, ERR_R_PASSED_NULL_PARAMETER);
529 return (ssl_set_pkey(ctx->cert, pkey));
532 #ifndef OPENSSL_NO_STDIO
533 int SSL_CTX_use_PrivateKey_file(SSL_CTX *ctx, const char *file, int type)
537 EVP_PKEY *pkey = NULL;
539 in = BIO_new(BIO_s_file());
541 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, ERR_R_BUF_LIB);
545 if (BIO_read_filename(in, file) <= 0) {
546 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, ERR_R_SYS_LIB);
549 if (type == SSL_FILETYPE_PEM) {
551 pkey = PEM_read_bio_PrivateKey(in, NULL,
552 ctx->default_passwd_callback,
553 ctx->default_passwd_callback_userdata);
554 } else if (type == SSL_FILETYPE_ASN1) {
556 pkey = d2i_PrivateKey_bio(in, NULL);
558 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, SSL_R_BAD_SSL_FILETYPE);
562 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_FILE, j);
565 ret = SSL_CTX_use_PrivateKey(ctx, pkey);
573 int SSL_CTX_use_PrivateKey_ASN1(int type, SSL_CTX *ctx,
574 const unsigned char *d, long len)
577 const unsigned char *p;
581 if ((pkey = d2i_PrivateKey(type, NULL, &p, (long)len)) == NULL) {
582 SSLerr(SSL_F_SSL_CTX_USE_PRIVATEKEY_ASN1, ERR_R_ASN1_LIB);
586 ret = SSL_CTX_use_PrivateKey(ctx, pkey);
591 #ifndef OPENSSL_NO_STDIO
593 * Read a file that contains our certificate in "PEM" format, possibly
594 * followed by a sequence of CA certificates that should be sent to the peer
595 * in the Certificate message.
597 static int use_certificate_chain_file(SSL_CTX *ctx, SSL *ssl, const char *file)
602 pem_password_cb *passwd_callback;
603 void *passwd_callback_userdata;
605 ERR_clear_error(); /* clear error stack for
606 * SSL_CTX_use_certificate() */
609 passwd_callback = ctx->default_passwd_callback;
610 passwd_callback_userdata = ctx->default_passwd_callback_userdata;
612 passwd_callback = ssl->default_passwd_callback;
613 passwd_callback_userdata = ssl->default_passwd_callback_userdata;
616 in = BIO_new(BIO_s_file());
618 SSLerr(SSL_F_USE_CERTIFICATE_CHAIN_FILE, ERR_R_BUF_LIB);
622 if (BIO_read_filename(in, file) <= 0) {
623 SSLerr(SSL_F_USE_CERTIFICATE_CHAIN_FILE, ERR_R_SYS_LIB);
627 x = PEM_read_bio_X509_AUX(in, NULL, passwd_callback,
628 passwd_callback_userdata);
630 SSLerr(SSL_F_USE_CERTIFICATE_CHAIN_FILE, ERR_R_PEM_LIB);
635 ret = SSL_CTX_use_certificate(ctx, x);
637 ret = SSL_use_certificate(ssl, x);
639 if (ERR_peek_error() != 0)
640 ret = 0; /* Key/certificate mismatch doesn't imply
644 * If we could set up our certificate, now proceed to the CA
652 r = SSL_CTX_clear_chain_certs(ctx);
654 r = SSL_clear_chain_certs(ssl);
661 while ((ca = PEM_read_bio_X509(in, NULL, passwd_callback,
662 passwd_callback_userdata))
665 r = SSL_CTX_add0_chain_cert(ctx, ca);
667 r = SSL_add0_chain_cert(ssl, ca);
669 * Note that we must not free ca if it was successfully added to
670 * the chain (while we must free the main certificate, since its
671 * reference count is increased by SSL_CTX_use_certificate).
679 /* When the while loop ends, it's usually just EOF. */
680 err = ERR_peek_last_error();
681 if (ERR_GET_LIB(err) == ERR_LIB_PEM
682 && ERR_GET_REASON(err) == PEM_R_NO_START_LINE)
685 ret = 0; /* some real error */
694 int SSL_CTX_use_certificate_chain_file(SSL_CTX *ctx, const char *file)
696 return use_certificate_chain_file(ctx, NULL, file);
699 int SSL_use_certificate_chain_file(SSL *ssl, const char *file)
701 return use_certificate_chain_file(NULL, ssl, file);
705 static int serverinfo_find_extension(const unsigned char *serverinfo,
706 size_t serverinfo_length,
707 unsigned int extension_type,
708 const unsigned char **extension_data,
709 size_t *extension_length)
711 *extension_data = NULL;
712 *extension_length = 0;
713 if (serverinfo == NULL || serverinfo_length == 0)
716 unsigned int type = 0;
719 /* end of serverinfo */
720 if (serverinfo_length == 0)
721 return 0; /* Extension not found */
723 /* read 2-byte type field */
724 if (serverinfo_length < 2)
725 return -1; /* Error */
726 type = (serverinfo[0] << 8) + serverinfo[1];
728 serverinfo_length -= 2;
730 /* read 2-byte len field */
731 if (serverinfo_length < 2)
732 return -1; /* Error */
733 len = (serverinfo[0] << 8) + serverinfo[1];
735 serverinfo_length -= 2;
737 if (len > serverinfo_length)
738 return -1; /* Error */
740 if (type == extension_type) {
741 *extension_data = serverinfo;
742 *extension_length = len;
743 return 1; /* Success */
747 serverinfo_length -= len;
752 static int serverinfo_srv_parse_cb(SSL *s, unsigned int ext_type,
753 const unsigned char *in,
754 size_t inlen, int *al, void *arg)
758 *al = SSL_AD_DECODE_ERROR;
765 static int serverinfo_srv_add_cb(SSL *s, unsigned int ext_type,
766 const unsigned char **out, size_t *outlen,
769 const unsigned char *serverinfo = NULL;
770 size_t serverinfo_length = 0;
772 /* Is there serverinfo data for the chosen server cert? */
773 if ((ssl_get_server_cert_serverinfo(s, &serverinfo,
774 &serverinfo_length)) != 0) {
775 /* Find the relevant extension from the serverinfo */
776 int retval = serverinfo_find_extension(serverinfo, serverinfo_length,
777 ext_type, out, outlen);
779 *al = SSL_AD_DECODE_ERROR;
780 return -1; /* Error */
783 return 0; /* No extension found, don't send extension */
784 return 1; /* Send extension */
786 return 0; /* No serverinfo data found, don't send
791 * With a NULL context, this function just checks that the serverinfo data
792 * parses correctly. With a non-NULL context, it registers callbacks for
793 * the included extensions.
795 static int serverinfo_process_buffer(const unsigned char *serverinfo,
796 size_t serverinfo_length, SSL_CTX *ctx)
798 if (serverinfo == NULL || serverinfo_length == 0)
801 unsigned int ext_type = 0;
804 /* end of serverinfo */
805 if (serverinfo_length == 0)
808 /* read 2-byte type field */
809 if (serverinfo_length < 2)
811 /* FIXME: check for types we understand explicitly? */
813 /* Register callbacks for extensions */
814 ext_type = (serverinfo[0] << 8) + serverinfo[1];
816 int have_ext_cbs = 0;
818 custom_ext_methods *exts = &ctx->cert->srv_ext;
819 custom_ext_method *meth = exts->meths;
821 for (i = 0; i < exts->meths_count; i++, meth++) {
822 if (ext_type == meth->ext_type) {
828 if (!have_ext_cbs && !SSL_CTX_add_server_custom_ext(ctx, ext_type,
829 serverinfo_srv_add_cb,
831 serverinfo_srv_parse_cb,
837 serverinfo_length -= 2;
839 /* read 2-byte len field */
840 if (serverinfo_length < 2)
842 len = (serverinfo[0] << 8) + serverinfo[1];
844 serverinfo_length -= 2;
846 if (len > serverinfo_length)
850 serverinfo_length -= len;
854 int SSL_CTX_use_serverinfo(SSL_CTX *ctx, const unsigned char *serverinfo,
855 size_t serverinfo_length)
857 unsigned char *new_serverinfo;
859 if (ctx == NULL || serverinfo == NULL || serverinfo_length == 0) {
860 SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO, ERR_R_PASSED_NULL_PARAMETER);
863 if (!serverinfo_process_buffer(serverinfo, serverinfo_length, NULL)) {
864 SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO, SSL_R_INVALID_SERVERINFO_DATA);
867 if (ctx->cert->key == NULL) {
868 SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO, ERR_R_INTERNAL_ERROR);
871 new_serverinfo = OPENSSL_realloc(ctx->cert->key->serverinfo,
873 if (new_serverinfo == NULL) {
874 SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO, ERR_R_MALLOC_FAILURE);
877 ctx->cert->key->serverinfo = new_serverinfo;
878 memcpy(ctx->cert->key->serverinfo, serverinfo, serverinfo_length);
879 ctx->cert->key->serverinfo_length = serverinfo_length;
882 * Now that the serverinfo is validated and stored, go ahead and
883 * register callbacks.
885 if (!serverinfo_process_buffer(serverinfo, serverinfo_length, ctx)) {
886 SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO, SSL_R_INVALID_SERVERINFO_DATA);
892 int SSL_CTX_use_serverinfo_file(SSL_CTX *ctx, const char *file)
894 unsigned char *serverinfo = NULL;
896 size_t serverinfo_length = 0;
897 unsigned char *extension = 0;
898 long extension_length = 0;
901 char namePrefix[] = "SERVERINFO FOR ";
904 size_t num_extensions = 0;
906 if (ctx == NULL || file == NULL) {
907 SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE,
908 ERR_R_PASSED_NULL_PARAMETER);
912 bin = BIO_new(BIO_s_file());
914 SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_BUF_LIB);
917 if (BIO_read_filename(bin, file) <= 0) {
918 SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_SYS_LIB);
922 for (num_extensions = 0;; num_extensions++) {
923 if (PEM_read_bio(bin, &name, &header, &extension, &extension_length)
926 * There must be at least one extension in this file
928 if (num_extensions == 0) {
929 SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE,
930 SSL_R_NO_PEM_EXTENSIONS);
932 } else /* End of file, we're done */
935 /* Check that PEM name starts with "BEGIN SERVERINFO FOR " */
936 if (strlen(name) < strlen(namePrefix)) {
937 SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE,
938 SSL_R_PEM_NAME_TOO_SHORT);
941 if (strncmp(name, namePrefix, strlen(namePrefix)) != 0) {
942 SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE,
943 SSL_R_PEM_NAME_BAD_PREFIX);
947 * Check that the decoded PEM data is plausible (valid length field)
949 if (extension_length < 4
950 || (extension[2] << 8) + extension[3] != extension_length - 4) {
951 SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, SSL_R_BAD_DATA);
954 /* Append the decoded extension to the serverinfo buffer */
956 OPENSSL_realloc(serverinfo, serverinfo_length + extension_length);
958 SSLerr(SSL_F_SSL_CTX_USE_SERVERINFO_FILE, ERR_R_MALLOC_FAILURE);
962 memcpy(serverinfo + serverinfo_length, extension, extension_length);
963 serverinfo_length += extension_length;
967 OPENSSL_free(header);
969 OPENSSL_free(extension);
973 ret = SSL_CTX_use_serverinfo(ctx, serverinfo, serverinfo_length);
975 /* SSL_CTX_use_serverinfo makes a local copy of the serverinfo. */
977 OPENSSL_free(header);
978 OPENSSL_free(extension);
979 OPENSSL_free(serverinfo);