wbrawner/openssl
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add SSL_CTX_set1_cert_store()

Browse source 
For convenience, combine getting a new ref for the new SSL_CTX
with assigning the store and freeing the old one.

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Rich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1755)
This commit is contained in:
Todd Short 2015-03-31 16:20:03 -04:00 committed by Rich Salz
parent ba7407002d
commit b50052dbe8
5 changed files with 28 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
doc/man3/SSL_CTX_set_cert_store.pod
View file

@ -2,13 +2,14 @@
=head1 NAME
SSL_CTX_set_cert_store, SSL_CTX_get_cert_store - manipulate X509 certificate verification storage
SSL_CTX_set_cert_store, SSL_CTX_set1_cert_store, SSL_CTX_get_cert_store - manipulate X509 certificate verification storage
=head1 SYNOPSIS
#include <openssl/ssl.h>
void SSL_CTX_set_cert_store(SSL_CTX *ctx, X509_STORE *store);
void SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store);
X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *ctx);
=head1 DESCRIPTION
@ -17,6 +18,10 @@ SSL_CTX_set_cert_store() sets/replaces the certificate verification storage
of B<ctx> to/with B<store>. If another X509_STORE object is currently
set in B<ctx>, it will be X509_STORE_free()ed.
SSL_CTX_set1_cert_store() sets/replaces the certificate verification storage
of B<ctx> to/with B<store>. The B<store>'s reference count is incremented.
If another X509_STORE object is currently set in B<ctx>, it will be X509_STORE_free()ed.
SSL_CTX_get_cert_store() returns a pointer to the current certificate
verification storage.
@ -42,6 +47,15 @@ L<SSL_CTX_set_verify(3)> family of functions.
This document must therefore be updated when documentation about the
X509_STORE object and its handling becomes available.
SSL_CTX_set_cert_store() does not increment the B<store>'s reference
count, so it should not be used to assign an X509_STORE that is owned
by another SSL_CTX.
To share X509_STOREs between two SSL_CTXs, use SSL_CTX_get_cert_store()
to get the X509_STORE from the first SSL_CTX, and then use
SSL_CTX_set1_cert_store() to assign to the second SSL_CTX and
increment the reference count of the X509_STORE.
=head1 RESTRICTIONS
The X509_STORE structure used by an SSL_CTX is used for verifying peer
@ -53,6 +67,8 @@ functions such as SSL_CTX_set1_verify_cert_store() instead.
SSL_CTX_set_cert_store() does not return diagnostic output.
SSL_CTX_set1_cert_store() does not return diagnostic output.
SSL_CTX_get_cert_store() returns the current setting.
=head1 SEE ALSO

2
doc/man7/ssl.pod
View file

@ -320,6 +320,8 @@ protocol context defined in the B<SSL_CTX> structure.
=item void B<SSL_CTX_set_cert_store>(SSL_CTX *ctx, X509_STORE *cs);
=item void B<SSL_CTX_set1_cert_store>(SSL_CTX *ctx, X509_STORE *cs);
=item void B<SSL_CTX_set_cert_verify_cb>(SSL_CTX *ctx, int (*cb)(), char *arg)
=item int B<SSL_CTX_set_cipher_list>(SSL_CTX *ctx, char *str);

1
include/openssl/ssl.h
View file

@ -1308,6 +1308,7 @@ __owur long SSL_CTX_set_timeout(SSL_CTX *ctx, long t);
__owur long SSL_CTX_get_timeout(const SSL_CTX *ctx);
__owur X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *);
void SSL_CTX_set_cert_store(SSL_CTX *, X509_STORE *);
void SSL_CTX_set1_cert_store(SSL_CTX *, X509_STORE *);
__owur int SSL_want(const SSL *s);
__owur int SSL_clear(SSL *s);

7
ssl/ssl_lib.c
View file

@ -3553,6 +3553,13 @@ void SSL_CTX_set_cert_store(SSL_CTX *ctx, X509_STORE *store)
ctx->cert_store = store;
}
void SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store)
{
if (store != NULL)
X509_STORE_up_ref(store);
SSL_CTX_set_cert_store(ctx, store);
}
int SSL_want(const SSL *s)
{
return (s->rwstate);

1
util/libssl.num
View file

@ -403,3 +403,4 @@ SSL_dane_clear_flags 403 1_1_0 EXIST::FUNCTION:
SSL_SESSION_get0_cipher 404 1_1_0 EXIST::FUNCTION:
SSL_SESSION_get0_id_context 405 1_1_0 EXIST::FUNCTION:
SSL_SESSION_set1_id 406 1_1_0 EXIST::FUNCTION:
SSL_CTX_set1_cert_store 407 1_1_1 EXIST::FUNCTION: