Refactored (and disabled for PolarSSL) support for writing external cert files in...

Signed-off-by: Adriaan de Jong <dejong@fox-it.com>
Acked-by: James Yonan <james@openvpn.net>
Signed-off-by: David Sommerseth <davids@redhat.com>

diff --git a/options.c b/options.c
index 8ee24a002e4118e38afd26db3acec8a42695f076..f780681d1a971ad79556a113500b18dcf20d23fb 100644 (file)
--- a/options.c
+++ b/options.c
@@ -6248,6 +6248,7 @@ add_option (struct options *options,
        }
 #endif
     }
+#ifdef USE_POLARSSL
   else if (streq (p[0], "pkcs12") && p[1])
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
@@ -6259,6 +6260,7 @@ add_option (struct options *options,
        }
 #endif
     }
+#endif /* USE_POLARSSL */
   else if (streq (p[0], "askpass"))
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
@@ -6320,11 +6322,13 @@ add_option (struct options *options,
       warn_multiple_script (options->tls_verify, "tls-verify");
       options->tls_verify = string_substitute (p[1], ',', ' ', &options->gc);
     }
+#ifndef USE_POLARSSL
   else if (streq (p[0], "tls-export-cert") && p[1])
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
       options->tls_export_cert = p[1];
     }
+#endif
   else if (streq (p[0], "tls-remote") && p[1])
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);

diff --git a/ssl_verify.c b/ssl_verify.c
index 0c1296af2ef270813a5fae9640a6604a50fe9ef7..82331471b08c89d790feeca613c6d33be6c8766c 100644 (file)
--- a/ssl_verify.c
+++ b/ssl_verify.c
@@ -464,6 +464,34 @@ verify_cert_call_plugin(const struct plugin_list *plugins, struct env_set *es,
   return 0;
 }
 
+static const char *
+verify_cert_export_cert(x509_cert_t *peercert, const char *tmp_dir, struct gc_arena *gc)
+{
+  FILE *peercert_file;
+  const char *peercert_filename="";
+
+  if(!tmp_dir)
+      return NULL;
+
+  /* create tmp file to store peer cert */
+  peercert_filename = create_temp_file (tmp_dir, "pcf", gc);
+
+  /* write peer-cert in tmp-file */
+  peercert_file = fopen(peercert_filename, "w+");
+  if(!peercert_file)
+    {
+      msg (M_ERR, "Failed to open temporary file : %s", peercert_filename);
+      return NULL;
+    }
+
+  if (x509_write_pem(peercert_file, peercert))
+      msg (M_ERR, "Error writing PEM file containing certificate");
+
+  fclose(peercert_file);
+  return peercert_filename;
+}
+
+
 /*
  * run --tls-verify script
  */
@@ -481,7 +509,7 @@ verify_cert_call_command(const char *verify_command, struct env_set *es,
   if (verify_export_cert)
     {
       gc = gc_new();
-      if ((tmp_file=x509_write_cert(cert, verify_export_cert,&gc)))
+      if ((tmp_file=verify_cert_export_cert(cert, verify_export_cert, &gc)))
        {
          setenv_str(es, "peer_cert", tmp_file);
        }

diff --git a/ssl_verify_backend.h b/ssl_verify_backend.h
index d52627026342691fe0ade0a8b2e5e9a16ca0d95e..f7e086112560a94f480bf581dded5055a2142e35 100644 (file)
--- a/ssl_verify_backend.h
+++ b/ssl_verify_backend.h
@@ -98,7 +98,6 @@ void x509_free_subject (char *subject);
  *
  * @return             a string containing the SHA1 hash of the certificate
  */
-
 unsigned char *x509_get_sha1_hash (x509_cert_t *cert);
 
 /*
@@ -247,8 +246,7 @@ bool x509_verify_cert_eku (x509_cert_t *x509, const char * const expected_oid);
  * @param tmp_dir      Temporary directory to store the directory
  * @param gc           gc_arena to store temporary objects in
  */
-const char *x509_write_cert(x509_cert_t *cert, const char *tmp_dir,
-    struct gc_arena *gc);
+bool x509_write_pem(FILE *peercert_file, x509_cert_t *peercert);
 
 /*
  * Check the certificate against a CRL file.

diff --git a/ssl_verify_openssl.c b/ssl_verify_openssl.c
index 8bcdc100e850e26018badca1215b22902ec01b35..a8e2e49b5f184fd4db01d0c2f058c301d92ae7b6 100644 (file)
--- a/ssl_verify_openssl.c
+++ b/ssl_verify_openssl.c
@@ -515,34 +515,15 @@ x509_verify_cert_eku (X509 *x509, const char * const expected_oid)
   return fFound;
 }
 
-const char *
-x509_write_cert(X509 *peercert, const char *tmp_dir, struct gc_arena *gc)
+bool
+x509_write_pem(FILE *peercert_file, X509 *peercert)
 {
-  FILE *peercert_file;
-  const char *peercert_filename="";
-
-  if(!tmp_dir)
-      return NULL;
-
-  /* create tmp file to store peer cert */
-  peercert_filename = create_temp_file (tmp_dir, "pcf", gc);
-
-  /* write peer-cert in tmp-file */
-  peercert_file = fopen(peercert_filename, "w+");
-  if(!peercert_file)
-    {
-      msg (M_ERR, "Failed to open temporary file : %s", peercert_filename);
-      return NULL;
-    }
-  if(PEM_write_X509(peercert_file,peercert)<0)
+  if (PEM_write_X509(peercert_file, peercert) < 0)
     {
       msg (M_ERR, "Failed to write peer certificate in PEM format");
-      fclose(peercert_file);
-      return NULL;
+      return true;
     }
-
-  fclose(peercert_file);
-  return peercert_filename;
+  return false;
 }
 
 #endif /* OPENSSL_VERSION_NUMBER */

diff --git a/ssl_verify_polarssl.c b/ssl_verify_polarssl.c
index 91a699a01304c84a7df87f4529a3566a44d677ad..03a28fec256316eefcff1669ff71036c82629be9 100644 (file)
--- a/ssl_verify_polarssl.c
+++ b/ssl_verify_polarssl.c
@@ -372,35 +372,11 @@ x509_verify_cert_eku (x509_cert *cert, const char * const expected_oid)
     return fFound;
 }
 
-const char *
-x509_write_cert(x509_cert *peercert, const char *tmp_dir, struct gc_arena *gc)
+bool
+x509_write_pem(FILE *peercert_file, x509_cert *peercert)
 {
-  FILE *peercert_file;
-  const char *peercert_filename="";
-
-  if(!tmp_dir)
-      return NULL;
-
-  /* create tmp file to store peer cert */
-  peercert_filename = create_temp_file (tmp_dir, "pcf", gc);
-
-  /* write peer-cert in tmp-file */
-  peercert_file = fopen(peercert_filename, "w+");
-  if(!peercert_file)
-    {
-      msg (M_ERR, "Failed to open temporary file : %s", peercert_filename);
-      return NULL;
-    }
-
-//  if(PEM_write_X509(peercert_file,peercert)<0)
-//    {
-      msg (M_ERR, "PolarSSL does not support writing peer certificate in PEM format");
-      fclose(peercert_file);
-      return NULL;
-//    }
-
-  fclose(peercert_file);
-  return peercert_filename;
+    msg (M_WARN, "PolarSSL does not support writing peer certificate in PEM format");
+    return true;
 }
 
 /*