Implement shim for SSL_CTX_set1_cert_store() (affects Debian 9)

This commit implements a shim for SSL_CTX_set1_cert_store() for
OpenSSL/LibreSSL versions where it is not available.

diff --git a/configure.ac b/configure.ac
index 8ea89295d5b3ba5cf5f467f318a3ebcef5967fe5..14f176bf3a43dff09882eb08e67d6f30ef326721 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -650,6 +650,7 @@ AC_CHECK_FUNCS([SSL_CTX_set_keylog_callback])
 AC_CHECK_FUNCS([SSL_CTX_set_min_proto_version])
 AC_CHECK_FUNCS([SSL_CTX_up_ref])
 AC_CHECK_FUNCS([SSL_read_ex SSL_peek_ex SSL_write_ex])
+AC_CHECK_FUNCS([SSL_CTX_set1_cert_store X509_STORE_up_ref])
 
 #
 # Check for algorithm support in OpenSSL

diff --git a/lib/isc/openssl_shim.c b/lib/isc/openssl_shim.c
index 759ceb408b5e72637da5d6e7c695536258e70244..1dcc921f01e5a5fb32b5c12a8c2c99e59971e492 100644 (file)
--- a/lib/isc/openssl_shim.c
+++ b/lib/isc/openssl_shim.c
@@ -169,3 +169,23 @@ OPENSSL_cleanup(void) {
        return;
 }
 #endif
+
+#if !HAVE_X509_STORE_UP_REF
+
+int
+X509_STORE_up_ref(X509_STORE *store) {
+       return (CRYPTO_add(&store->references, 1, CRYPTO_LOCK_X509_STORE));
+}
+
+#endif /* !HAVE_OPENSSL_CLEANUP */
+
+#if !HAVE_SSL_CTX_SET1_CERT_STORE
+
+void
+SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store) {
+       (void)X509_STORE_up_ref(store);
+
+       SSL_CTX_set_cert_store(ctx, store);
+}
+
+#endif /* !HAVE_SSL_CTX_SET1_CERT_STORE */

diff --git a/lib/isc/openssl_shim.h b/lib/isc/openssl_shim.h
index b4877f85090443ad34ab06df435b3625f90ba0ab..0755fbb49dd204fb9ceaa31a3fd57e8741a25f2a 100644 (file)
--- a/lib/isc/openssl_shim.h
+++ b/lib/isc/openssl_shim.h
@@ -120,3 +120,13 @@ OPENSSL_cleanup(void);
 #if !HAVE_TLS_CLIENT_METHOD
 #define TLS_client_method SSLv23_client_method
 #endif
+
+#if !HAVE_X509_STORE_UP_REF
+int
+X509_STORE_up_ref(X509_STORE *v);
+#endif /* !HAVE_OPENSSL_CLEANUP */
+
+#if !HAVE_SSL_CTX_SET1_CERT_STORE
+void
+SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store);
+#endif /* !HAVE_SSL_CTX_SET1_CERT_STORE */

diff --git a/lib/isc/tls.c b/lib/isc/tls.c
index 543fda7b2d9b3a350ecbf7799fca8b27b1b8efcd..19bed66efba440b5cbb46c1b6f1d81e8d4b31565 100644 (file)
--- a/lib/isc/tls.c
+++ b/lib/isc/tls.c
@@ -980,19 +980,7 @@ isc_tlsctx_enable_peer_verification(isc_tlsctx_t *tlsctx, const bool is_server,
        }
 
        /* "Attach" the cert store to the context */
-#if defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER >= 0x3050000fL)
-       (void)X509_STORE_up_ref(store);
-       SSL_CTX_set_cert_store(tlsctx, store);
-#elif defined(CRYPTO_LOCK_X509_STORE)
-       /*
-        * That is the case for OpenSSL < 1.1.X and LibreSSL < 3.5.0.
-        * No SSL_CTX_set1_cert_store(), no X509_STORE_up_ref(). Sigh...
-        */
-       (void)CRYPTO_add(&store->references, 1, CRYPTO_LOCK_X509_STORE);
-       SSL_CTX_set_cert_store(tlsctx, store);
-#else
        SSL_CTX_set1_cert_store(tlsctx, store);
-#endif
 
        /* enable verification */
        if (is_server) {