diff options
| author |   reyk <reyk@openbsd.org> | 2015-01-22 09:16:24 +0000 |
|---|---|---|
| committer | reyk <reyk@openbsd.org> | 2015-01-22 09:16:24 +0000 |
| commit | 99cfb8c597f44ace647d8aa9d73b421b839f398e (patch) | |
| tree | e3e0162c7f8ee0502d68083bc695f47b08418b05 /lib/libtls/tls_client.c | |
| parent | Support CA verification in chroot'ed processes without direct file (diff) | |
| download | wireguard-openbsd-99cfb8c597f44ace647d8aa9d73b421b839f398e.tar.xz wireguard-openbsd-99cfb8c597f44ace647d8aa9d73b421b839f398e.zip | |
Allow to to load the CA chain directly from memory instead of
specifying a file. This enables CA verification in privsep'ed
processes that are running chroot'ed without direct access to the
certificate files.
With feedback, tests, and OK from bluhm@
Diffstat (limited to 'lib/libtls/tls_client.c')
| -rw-r--r-- | lib/libtls/tls_client.c | 17 |
1 files changed, 15 insertions, 2 deletions
diff --git a/lib/libtls/tls_client.c b/lib/libtls/tls_client.c index c6117c32929..4a9a4c976d8 100644 --- a/lib/libtls/tls_client.c +++ b/lib/libtls/tls_client.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls_client.c,v 1.8 2015/01/13 17:35:35 bluhm Exp $ */ +/* $OpenBSD: tls_client.c,v 1.9 2015/01/22 09:16:24 reyk Exp $ */ /* * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> * @@ -21,6 +21,7 @@ #include <arpa/inet.h> #include <netinet/in.h> +#include <limits.h> #include <netdb.h> #include <stdlib.h> #include <unistd.h> @@ -168,7 +169,19 @@ tls_connect_fds(struct tls *ctx, int fd_read, int fd_write, if (ctx->config->verify_cert) { SSL_CTX_set_verify(ctx->ssl_ctx, SSL_VERIFY_PEER, NULL); - if (SSL_CTX_load_verify_locations(ctx->ssl_ctx, + if (ctx->config->ca_mem != NULL) { + if (ctx->config->ca_len > INT_MAX) { + tls_set_error(ctx, "ca too long"); + goto err; + } + + if (SSL_CTX_load_verify_mem(ctx->ssl_ctx, + ctx->config->ca_mem, ctx->config->ca_len) != 1) { + tls_set_error(ctx, + "ssl verify memory setup failure"); + goto err; + } + } else if (SSL_CTX_load_verify_locations(ctx->ssl_ctx, ctx->config->ca_file, ctx->config->ca_path) != 1) { tls_set_error(ctx, "ssl verify setup failure"); goto err; |