diff options
| author |   jsing <jsing@openbsd.org> | 2020-01-02 06:37:13 +0000 |
|---|---|---|
| committer | jsing <jsing@openbsd.org> | 2020-01-02 06:37:13 +0000 |
| commit | 8c9e35fd772fea1c1af107983fe95fec2bc98139 (patch) | |
| tree | 7dae85a6d9ed474fa9ee2a3d2fa06a190d85fb60 /lib/libssl/ssl.h | |
| parent | Provide TLSEXT_TYPE_* aliases for TLS 1.3. (diff) | |
| download | wireguard-openbsd-8c9e35fd772fea1c1af107983fe95fec2bc98139.tar.xz wireguard-openbsd-8c9e35fd772fea1c1af107983fe95fec2bc98139.zip | |
Revise SSL_CTX_get_extra_chain_certs() to match OpenSSL behaviour.
In OpenSSL, SSL_CTX_get_extra_chain_certs() really means return extra
certs, unless there are none, in which case return the chain associated
with the certificate. If you really just want the extra certs, including
knowing if there are no extra certs, then you need to call
SSL_CTX_get_extra_chain_certs_only()! And to make this even more
entertaining, these functions are not documented in any OpenSSL release.
Reported by sephiroth-j on github, since the difference in behaviour
apparently breaks OCSP stapling with nginx.
ok beck@ inoguchi@ tb@
Diffstat (limited to 'lib/libssl/ssl.h')
| -rw-r--r-- | lib/libssl/ssl.h | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/lib/libssl/ssl.h b/lib/libssl/ssl.h index fc89b0ef6e9..521fb537deb 100644 --- a/lib/libssl/ssl.h +++ b/lib/libssl/ssl.h @@ -1,4 +1,4 @@ -/* $OpenBSD: ssl.h,v 1.166 2019/04/04 15:03:21 jsing Exp $ */ +/* $OpenBSD: ssl.h,v 1.167 2020/01/02 06:37:13 jsing Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -1219,12 +1219,14 @@ int SSL_set_max_proto_version(SSL *ssl, uint16_t version); #define SSL_set1_curves_list SSL_set1_groups_list #endif -#define SSL_CTX_add_extra_chain_cert(ctx,x509) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_EXTRA_CHAIN_CERT,0,(char *)x509) -#define SSL_CTX_get_extra_chain_certs(ctx,px509) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_GET_EXTRA_CHAIN_CERTS,0,px509) +#define SSL_CTX_add_extra_chain_cert(ctx, x509) \ + SSL_CTX_ctrl(ctx, SSL_CTRL_EXTRA_CHAIN_CERT, 0, (char *)x509) +#define SSL_CTX_get_extra_chain_certs(ctx, px509) \ + SSL_CTX_ctrl(ctx, SSL_CTRL_GET_EXTRA_CHAIN_CERTS, 0, px509) +#define SSL_CTX_get_extra_chain_certs_only(ctx, px509) \ + SSL_CTX_ctrl(ctx, SSL_CTRL_GET_EXTRA_CHAIN_CERTS, 1, px509) #define SSL_CTX_clear_extra_chain_certs(ctx) \ - SSL_CTX_ctrl(ctx,SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS,0,NULL) + SSL_CTX_ctrl(ctx, SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS, 0, NULL) #define SSL_get_server_tmp_key(s, pk) \ SSL_ctrl(s,SSL_CTRL_GET_SERVER_TMP_KEY,0,pk) |