Backport ssl client auth ENGINE support to 0.9.8.

diff --git a/crypto/engine/eng_all.c b/crypto/engine/eng_all.c
index 46f35fa2ad786d0aab1dd52cc7933de01cd66343..d29cd57dc2f1abb93b147240126c49150a42075f 100644 (file)
--- a/crypto/engine/eng_all.c
+++ b/crypto/engine/eng_all.c
@@ -107,9 +107,9 @@ void ENGINE_load_builtin_engines(void)
 #if defined(__OpenBSD__) || defined(__FreeBSD__)
        ENGINE_load_cryptodev();
 #endif
-#endif
 #if defined(OPENSSL_SYS_WIN32) && !defined(OPENSSL_NO_CAPIENG)
        ENGINE_load_capi();
+#endif
 #endif
        }
 

diff --git a/crypto/engine/eng_err.c b/crypto/engine/eng_err.c
index 369f2e22d3bc4b2b4d138bad8ccb5b4d99aa97b9..574ffbb5c012e1052c34c77842ce98782b172cfa 100644 (file)
--- a/crypto/engine/eng_err.c
+++ b/crypto/engine/eng_err.c
@@ -1,6 +1,6 @@
 /* crypto/engine/eng_err.c */
 /* ====================================================================
- * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2008 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -92,6 +92,7 @@ static ERR_STRING_DATA ENGINE_str_functs[]=
 {ERR_FUNC(ENGINE_F_ENGINE_LIST_REMOVE),        "ENGINE_LIST_REMOVE"},
 {ERR_FUNC(ENGINE_F_ENGINE_LOAD_PRIVATE_KEY),   "ENGINE_load_private_key"},
 {ERR_FUNC(ENGINE_F_ENGINE_LOAD_PUBLIC_KEY),    "ENGINE_load_public_key"},
+{ERR_FUNC(ENGINE_F_ENGINE_LOAD_SSL_CLIENT_CERT),       "ENGINE_load_ssl_client_cert"},
 {ERR_FUNC(ENGINE_F_ENGINE_NEW),        "ENGINE_new"},
 {ERR_FUNC(ENGINE_F_ENGINE_REMOVE),     "ENGINE_remove"},
 {ERR_FUNC(ENGINE_F_ENGINE_SET_DEFAULT_STRING), "ENGINE_set_default_string"},

diff --git a/crypto/engine/eng_int.h b/crypto/engine/eng_int.h
index a5b1edebf4b9be6789cc5f7023eecf07f6d7ea09..a66f107a44d08f994b270d58e0e3c6595f4f0185 100644 (file)
--- a/crypto/engine/eng_int.h
+++ b/crypto/engine/eng_int.h
@@ -170,6 +170,8 @@ struct engine_st
        ENGINE_LOAD_KEY_PTR load_privkey;
        ENGINE_LOAD_KEY_PTR load_pubkey;
 
+       ENGINE_SSL_CLIENT_CERT_PTR load_ssl_client_cert;
+
        const ENGINE_CMD_DEFN *cmd_defns;
        int flags;
        /* reference count on the structure itself */

diff --git a/crypto/engine/eng_pkey.c b/crypto/engine/eng_pkey.c
index bc8b21abec5a6225faeb7f9df1d2baa9edd6386a..1dfa2e366451e9436c30f052d2e36faf2522c628 100644 (file)
--- a/crypto/engine/eng_pkey.c
+++ b/crypto/engine/eng_pkey.c
@@ -69,6 +69,13 @@ int ENGINE_set_load_pubkey_function(ENGINE *e, ENGINE_LOAD_KEY_PTR loadpub_f)
        return 1;
        }
 
+int ENGINE_set_load_ssl_client_cert_function(ENGINE *e,
+                               ENGINE_SSL_CLIENT_CERT_PTR loadssl_f)
+       {
+       e->load_ssl_client_cert = loadssl_f;
+       return 1;
+       }
+
 ENGINE_LOAD_KEY_PTR ENGINE_get_load_privkey_function(const ENGINE *e)
        {
        return e->load_privkey;
@@ -79,6 +86,11 @@ ENGINE_LOAD_KEY_PTR ENGINE_get_load_pubkey_function(const ENGINE *e)
        return e->load_pubkey;
        }
 
+ENGINE_SSL_CLIENT_CERT_PTR ENGINE_get_ssl_client_cert_function(const ENGINE *e)
+       {
+       return e->load_ssl_client_cert;
+       }
+
 /* API functions to load public/private keys */
 
 EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id,
@@ -152,3 +164,33 @@ EVP_PKEY *ENGINE_load_public_key(ENGINE *e, const char *key_id,
                }
        return pkey;
        }
+
+int ENGINE_load_ssl_client_cert(ENGINE *e, SSL *s,
+       STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **ppkey,
+       STACK_OF(X509) **pother, UI_METHOD *ui_method, void *callback_data)
+       {
+
+       if(e == NULL)
+               {
+               ENGINEerr(ENGINE_F_ENGINE_LOAD_SSL_CLIENT_CERT,
+                       ERR_R_PASSED_NULL_PARAMETER);
+               return 0;
+               }
+       CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+       if(e->funct_ref == 0)
+               {
+               CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+               ENGINEerr(ENGINE_F_ENGINE_LOAD_SSL_CLIENT_CERT,
+                       ENGINE_R_NOT_INITIALISED);
+               return 0;
+               }
+       CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+       if (!e->load_ssl_client_cert)
+               {
+               ENGINEerr(ENGINE_F_ENGINE_LOAD_SSL_CLIENT_CERT,
+                       ENGINE_R_NO_LOAD_FUNCTION);
+               return 0;
+               }
+       return e->load_ssl_client_cert(e, s, ca_dn, pcert, ppkey, pother,
+                                       ui_method, callback_data);
+       }

diff --git a/crypto/engine/engine.h b/crypto/engine/engine.h
index 5c6e7063fab3f59c2119f742e082f6aef7f152b9..f503595eceb724d9c118657d98162f3064ed7bbf 100644 (file)
--- a/crypto/engine/engine.h
+++ b/crypto/engine/engine.h
@@ -93,6 +93,8 @@
 #include <openssl/err.h>
 #endif
 
+#include <openssl/x509.h>
+
 #include <openssl/ossl_typ.h>
 #include <openssl/symhacks.h>
 
@@ -278,6 +280,9 @@ typedef int (*ENGINE_CTRL_FUNC_PTR)(ENGINE *, int, long, void *, void (*f)(void)
 /* Generic load_key function pointer */
 typedef EVP_PKEY * (*ENGINE_LOAD_KEY_PTR)(ENGINE *, const char *,
        UI_METHOD *ui_method, void *callback_data);
+typedef int (*ENGINE_SSL_CLIENT_CERT_PTR)(ENGINE *, SSL *ssl,
+       STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **pkey,
+       STACK_OF(X509) **pother, UI_METHOD *ui_method, void *callback_data);
 /* These callback types are for an ENGINE's handler for cipher and digest logic.
  * These handlers have these prototypes;
  *   int foo(ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid);
@@ -462,6 +467,8 @@ int ENGINE_set_finish_function(ENGINE *e, ENGINE_GEN_INT_FUNC_PTR finish_f);
 int ENGINE_set_ctrl_function(ENGINE *e, ENGINE_CTRL_FUNC_PTR ctrl_f);
 int ENGINE_set_load_privkey_function(ENGINE *e, ENGINE_LOAD_KEY_PTR loadpriv_f);
 int ENGINE_set_load_pubkey_function(ENGINE *e, ENGINE_LOAD_KEY_PTR loadpub_f);
+int ENGINE_set_load_ssl_client_cert_function(ENGINE *e,
+                               ENGINE_SSL_CLIENT_CERT_PTR loadssl_f);
 int ENGINE_set_ciphers(ENGINE *e, ENGINE_CIPHERS_PTR f);
 int ENGINE_set_digests(ENGINE *e, ENGINE_DIGESTS_PTR f);
 int ENGINE_set_flags(ENGINE *e, int flags);
@@ -497,6 +504,7 @@ ENGINE_GEN_INT_FUNC_PTR ENGINE_get_finish_function(const ENGINE *e);
 ENGINE_CTRL_FUNC_PTR ENGINE_get_ctrl_function(const ENGINE *e);
 ENGINE_LOAD_KEY_PTR ENGINE_get_load_privkey_function(const ENGINE *e);
 ENGINE_LOAD_KEY_PTR ENGINE_get_load_pubkey_function(const ENGINE *e);
+ENGINE_SSL_CLIENT_CERT_PTR ENGINE_get_ssl_client_cert_function(const ENGINE *e);
 ENGINE_CIPHERS_PTR ENGINE_get_ciphers(const ENGINE *e);
 ENGINE_DIGESTS_PTR ENGINE_get_digests(const ENGINE *e);
 const EVP_CIPHER *ENGINE_get_cipher(ENGINE *e, int nid);
@@ -532,6 +540,10 @@ EVP_PKEY *ENGINE_load_private_key(ENGINE *e, const char *key_id,
        UI_METHOD *ui_method, void *callback_data);
 EVP_PKEY *ENGINE_load_public_key(ENGINE *e, const char *key_id,
        UI_METHOD *ui_method, void *callback_data);
+int ENGINE_load_ssl_client_cert(ENGINE *e, SSL *s,
+       STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **ppkey,
+       STACK_OF(X509) **pother,
+       UI_METHOD *ui_method, void *callback_data);
 
 /* This returns a pointer for the current ENGINE structure that
  * is (by default) performing any RSA operations. The value returned
@@ -726,6 +738,7 @@ void ERR_load_ENGINE_strings(void);
 #define ENGINE_F_ENGINE_LIST_REMOVE                     121
 #define ENGINE_F_ENGINE_LOAD_PRIVATE_KEY                150
 #define ENGINE_F_ENGINE_LOAD_PUBLIC_KEY                         151
+#define ENGINE_F_ENGINE_LOAD_SSL_CLIENT_CERT            192
 #define ENGINE_F_ENGINE_NEW                             122
 #define ENGINE_F_ENGINE_REMOVE                          123
 #define ENGINE_F_ENGINE_SET_DEFAULT_STRING              189

diff --git a/crypto/ossl_typ.h b/crypto/ossl_typ.h
index 345fb1dc4d6c0a49e4180e2cc3bd185a585468bc..734200428f6de3fe96c3a56bfa2c9a50d54b6e1d 100644 (file)
--- a/crypto/ossl_typ.h
+++ b/crypto/ossl_typ.h
@@ -140,6 +140,8 @@ typedef struct X509_crl_st X509_CRL;
 typedef struct X509_name_st X509_NAME;
 typedef struct x509_store_st X509_STORE;
 typedef struct x509_store_ctx_st X509_STORE_CTX;
+typedef struct ssl_st SSL;
+typedef struct ssl_ctx_st SSL_CTX;
 
 typedef struct v3_ext_ctx X509V3_CTX;
 typedef struct conf_st CONF;

diff --git a/ssl/ssl.h b/ssl/ssl.h
index 6df921f3c18360c96c6ac4c492dd443d1bb5cb36..07a4e0a6826925f7bb18d18548f01804067ad0b1 100644 (file)
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -361,9 +361,6 @@ typedef struct ssl_cipher_st
 
 DECLARE_STACK_OF(SSL_CIPHER)
 
-typedef struct ssl_st SSL;
-typedef struct ssl_ctx_st SSL_CTX;
-
 /* Used to hold functions for SSLv2 or SSLv3/TLSv1 functions */
 typedef struct ssl_method_st
        {