From b50052dbe822271c9d7b2559a38a127fca87e4ab Mon Sep 17 00:00:00 2001 From: Todd Short Date: Tue, 31 Mar 2015 16:20:03 -0400 Subject: [PATCH] Add SSL_CTX_set1_cert_store() For convenience, combine getting a new ref for the new SSL_CTX with assigning the store and freeing the old one. Reviewed-by: Matt Caswell Reviewed-by: Rich Salz (Merged from https://github.com/openssl/openssl/pull/1755) --- doc/man3/SSL_CTX_set_cert_store.pod | 18 +++++++++++++++++- doc/man7/ssl.pod | 2 ++ include/openssl/ssl.h | 1 + ssl/ssl_lib.c | 7 +++++++ util/libssl.num | 1 + 5 files changed, 28 insertions(+), 1 deletion(-) diff --git a/doc/man3/SSL_CTX_set_cert_store.pod b/doc/man3/SSL_CTX_set_cert_store.pod index 7f7a794bdf..28e855f451 100644 --- a/doc/man3/SSL_CTX_set_cert_store.pod +++ b/doc/man3/SSL_CTX_set_cert_store.pod @@ -2,13 +2,14 @@ =head1 NAME -SSL_CTX_set_cert_store, SSL_CTX_get_cert_store - manipulate X509 certificate verification storage +SSL_CTX_set_cert_store, SSL_CTX_set1_cert_store, SSL_CTX_get_cert_store - manipulate X509 certificate verification storage =head1 SYNOPSIS #include void SSL_CTX_set_cert_store(SSL_CTX *ctx, X509_STORE *store); + void SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store); X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *ctx); =head1 DESCRIPTION @@ -17,6 +18,10 @@ SSL_CTX_set_cert_store() sets/replaces the certificate verification storage of B to/with B. If another X509_STORE object is currently set in B, it will be X509_STORE_free()ed. +SSL_CTX_set1_cert_store() sets/replaces the certificate verification storage +of B to/with B. The B's reference count is incremented. +If another X509_STORE object is currently set in B, it will be X509_STORE_free()ed. + SSL_CTX_get_cert_store() returns a pointer to the current certificate verification storage. @@ -42,6 +47,15 @@ L family of functions. This document must therefore be updated when documentation about the X509_STORE object and its handling becomes available. +SSL_CTX_set_cert_store() does not increment the B's reference +count, so it should not be used to assign an X509_STORE that is owned +by another SSL_CTX. + +To share X509_STOREs between two SSL_CTXs, use SSL_CTX_get_cert_store() +to get the X509_STORE from the first SSL_CTX, and then use +SSL_CTX_set1_cert_store() to assign to the second SSL_CTX and +increment the reference count of the X509_STORE. + =head1 RESTRICTIONS The X509_STORE structure used by an SSL_CTX is used for verifying peer @@ -53,6 +67,8 @@ functions such as SSL_CTX_set1_verify_cert_store() instead. SSL_CTX_set_cert_store() does not return diagnostic output. +SSL_CTX_set1_cert_store() does not return diagnostic output. + SSL_CTX_get_cert_store() returns the current setting. =head1 SEE ALSO diff --git a/doc/man7/ssl.pod b/doc/man7/ssl.pod index b67edbc467..ce163f4df0 100644 --- a/doc/man7/ssl.pod +++ b/doc/man7/ssl.pod @@ -320,6 +320,8 @@ protocol context defined in the B structure. =item void B(SSL_CTX *ctx, X509_STORE *cs); +=item void B(SSL_CTX *ctx, X509_STORE *cs); + =item void B(SSL_CTX *ctx, int (*cb)(), char *arg) =item int B(SSL_CTX *ctx, char *str); diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h index 7e626e0fe7..20013dbfe8 100644 --- a/include/openssl/ssl.h +++ b/include/openssl/ssl.h @@ -1308,6 +1308,7 @@ __owur long SSL_CTX_set_timeout(SSL_CTX *ctx, long t); __owur long SSL_CTX_get_timeout(const SSL_CTX *ctx); __owur X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *); void SSL_CTX_set_cert_store(SSL_CTX *, X509_STORE *); +void SSL_CTX_set1_cert_store(SSL_CTX *, X509_STORE *); __owur int SSL_want(const SSL *s); __owur int SSL_clear(SSL *s); diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c index bd0fbf8101..8bf872beec 100644 --- a/ssl/ssl_lib.c +++ b/ssl/ssl_lib.c @@ -3553,6 +3553,13 @@ void SSL_CTX_set_cert_store(SSL_CTX *ctx, X509_STORE *store) ctx->cert_store = store; } +void SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store) +{ + if (store != NULL) + X509_STORE_up_ref(store); + SSL_CTX_set_cert_store(ctx, store); +} + int SSL_want(const SSL *s) { return (s->rwstate); diff --git a/util/libssl.num b/util/libssl.num index 200629f74b..7e004796b6 100644 --- a/util/libssl.num +++ b/util/libssl.num @@ -403,3 +403,4 @@ SSL_dane_clear_flags 403 1_1_0 EXIST::FUNCTION: SSL_SESSION_get0_cipher 404 1_1_0 EXIST::FUNCTION: SSL_SESSION_get0_id_context 405 1_1_0 EXIST::FUNCTION: SSL_SESSION_set1_id 406 1_1_0 EXIST::FUNCTION: +SSL_CTX_set1_cert_store 407 1_1_1 EXIST::FUNCTION: -- 2.25.1