diff options
| author |   djm <djm@openbsd.org> | 2009-01-05 21:36:37 +0000 |
|---|---|---|
| committer | djm <djm@openbsd.org> | 2009-01-05 21:36:37 +0000 |
| commit | 8214bb003f591cff80401f6649ee13ec96a00866 (patch) | |
| tree | cf9ad15d0f4ad517b261e29d2edfe1bf6cb57361 /lib/libssl/src/ssl/ssl_lib.c | |
| parent | - clear some confusion, the chip supports vlan tag insertion/stripping, (diff) | |
| download | wireguard-openbsd-8214bb003f591cff80401f6649ee13ec96a00866.tar.xz wireguard-openbsd-8214bb003f591cff80401f6649ee13ec96a00866.zip | |
update to openssl-0.9.8i; tested by several, especially krw@
Diffstat (limited to 'lib/libssl/src/ssl/ssl_lib.c')
| -rw-r--r-- | lib/libssl/src/ssl/ssl_lib.c | 36 |
1 files changed, 36 insertions, 0 deletions
diff --git a/lib/libssl/src/ssl/ssl_lib.c b/lib/libssl/src/ssl/ssl_lib.c index 31f63183575..1ac7d6f951c 100644 --- a/lib/libssl/src/ssl/ssl_lib.c +++ b/lib/libssl/src/ssl/ssl_lib.c @@ -130,6 +130,9 @@ #ifndef OPENSSL_NO_DH #include <openssl/dh.h> #endif +#ifndef OPENSSL_NO_ENGINE +#include <openssl/engine.h> +#endif const char *SSL_version_str=OPENSSL_VERSION_TEXT; @@ -1390,6 +1393,14 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *meth) return(NULL); } +#ifdef OPENSSL_FIPS + if (FIPS_mode() && (meth->version < TLS1_VERSION)) + { + SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE); + return NULL; + } +#endif + if (SSL_get_ex_data_X509_STORE_CTX_idx() < 0) { SSLerr(SSL_F_SSL_CTX_NEW,SSL_R_X509_VERIFICATION_SETUP_PROBLEMS); @@ -1510,6 +1521,27 @@ SSL_CTX *SSL_CTX_new(SSL_METHOD *meth) #endif +#ifndef OPENSSL_NO_ENGINE + ret->client_cert_engine = NULL; +#ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO +#define eng_strx(x) #x +#define eng_str(x) eng_strx(x) + /* Use specific client engine automatically... ignore errors */ + { + ENGINE *eng; + eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO)); + if (!eng) + { + ERR_clear_error(); + ENGINE_load_builtin_engines(); + eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO)); + } + if (!eng || !SSL_CTX_set_client_cert_engine(ret, eng)) + ERR_clear_error(); + } +#endif +#endif + return(ret); err: SSLerr(SSL_F_SSL_CTX_NEW,ERR_R_MALLOC_FAILURE); @@ -1580,6 +1612,10 @@ void SSL_CTX_free(SSL_CTX *a) #else a->comp_methods = NULL; #endif +#ifndef OPENSSL_NO_ENGINE + if (a->client_cert_engine) + ENGINE_finish(a->client_cert_engine); +#endif OPENSSL_free(a); } |