From 5c57c60beb42ecb1bfa39a2802c0ee4c8623f136 Mon Sep 17 00:00:00 2001 From: David Benjamin Date: Sat, 21 Jun 2014 12:52:18 -0400 Subject: [PATCH] Deprecate SSL_get_client_certificate_types. OpenSSL added SSL_get0_certificate_types and fixed the truncation (and subsequent parse error) by adding an alternate copy of the data. http://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=9f27b1eec3175305e62eed87faa80e231f319ca0 Make SSL_get_client_certificate_types call SSL_get0_certificate_types to query the new list. Remove when Chromium is switched over. Also remove a now unnecessary cast because SSL_get_client_certificate_types fixed the type of tmp.ctypes. Further fix it to use a size_t and match the cert_st copy OpenSSL added. BUG=388000 Change-Id: Ic6653e10e5a3c3ac6b3fe2a2322f388d6ffb0a06 --- ssl/s3_lib.c | 4 ++-- ssl/ssl.h | 1 + ssl/ssl3.h | 2 +- ssl/ssl_cert.c | 13 +++---------- 4 files changed, 7 insertions(+), 13 deletions(-) diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c index 92b36802a..1d934c278 100644 --- a/ssl/s3_lib.c +++ b/ssl/s3_lib.c @@ -3195,8 +3195,8 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg) return (int)s->cert->ctype_num; } if (pctype) - *pctype = (unsigned char *)s->s3->tmp.ctype; - return s->s3->tmp.ctype_num; + *pctype = s->s3->tmp.ctype; + return (int)s->s3->tmp.ctype_num; } case SSL_CTRL_SET_CLIENT_CERT_TYPES: diff --git a/ssl/ssl.h b/ssl/ssl.h index fdb280838..701c28389 100644 --- a/ssl/ssl.h +++ b/ssl/ssl.h @@ -2416,6 +2416,7 @@ STACK_OF(X509_NAME) *SSL_CTX_get_client_CA_list(const SSL_CTX *s); int SSL_add_client_CA(SSL *ssl,X509 *x); int SSL_CTX_add_client_CA(SSL_CTX *ctx,X509 *x); +/* Deprecated. Use SSL_get0_certificate_types instead. */ void SSL_get_client_certificate_types(const SSL *s, const unsigned char **ctype, size_t *ctype_num); diff --git a/ssl/ssl3.h b/ssl/ssl3.h index 1d3be7b66..af1ecf2bf 100644 --- a/ssl/ssl3.h +++ b/ssl/ssl3.h @@ -524,7 +524,7 @@ typedef struct ssl3_state_st /* used for certificate requests */ int cert_req; - int ctype_num; + size_t ctype_num; unsigned char ctype[SSL3_CT_NUMBER]; STACK_OF(X509_NAME) *ca_names; diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c index 095235ea5..1bad680e1 100644 --- a/ssl/ssl_cert.c +++ b/ssl/ssl_cert.c @@ -1020,16 +1020,9 @@ int SSL_CTX_add_client_CA(SSL_CTX *ctx,X509 *x) void SSL_get_client_certificate_types(const SSL *s, const unsigned char **ctype, size_t *ctype_num) { - if (s->s3 == NULL) - { - *ctype = NULL; - *ctype_num = 0; - return; - } - - /* This always returns nothing for the server. */ - *ctype = s->s3->tmp.ctype; - *ctype_num = s->s3->tmp.ctype_num; + /* TODO(fork): Remove this function once Chromium is updated + * to use the new one. */ + *ctype_num = SSL_get0_certificate_types((SSL*)s, ctype); } static int xname_cmp(const X509_NAME **a, const X509_NAME **b)