Guard against OpenSSL ENGINEs in httpapi_curl
This commit is contained in:
Родитель
100a051a09
Коммит
c502ae2394
|
@ -47,8 +47,10 @@ typedef struct HTTP_HANDLE_DATA_TAG
|
|||
const char* certificates; /*a list of CA certificates*/
|
||||
#if USE_OPENSSL
|
||||
OPTION_OPENSSL_KEY_TYPE x509privatekeytype;
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
char* engineId;
|
||||
ENGINE* engine;
|
||||
#endif // OPENSSL_NO_ENGINE
|
||||
#elif USE_MBEDTLS
|
||||
mbedtls_x509_crt cert;
|
||||
mbedtls_pk_context key;
|
||||
|
@ -220,6 +222,7 @@ void HTTPAPI_CloseConnection(HTTP_HANDLE handle)
|
|||
free(httpHandleData->hostURL);
|
||||
curl_easy_cleanup(httpHandleData->curl);
|
||||
#ifdef USE_OPENSSL
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
if (httpHandleData->engine != NULL)
|
||||
{
|
||||
ENGINE_free(httpHandleData->engine);
|
||||
|
@ -231,6 +234,7 @@ void HTTPAPI_CloseConnection(HTTP_HANDLE handle)
|
|||
free(httpHandleData->engineId);
|
||||
httpHandleData->engineId = NULL;
|
||||
}
|
||||
#endif // OPENSSL_NO_ENGINE
|
||||
#elif USE_MBEDTLS
|
||||
mbedtls_x509_crt_free(&httpHandleData->cert);
|
||||
mbedtls_pk_free(&httpHandleData->key);
|
||||
|
@ -315,6 +319,7 @@ static CURLcode ssl_ctx_callback(CURL *curl, void *ssl_ctx, void *userptr)
|
|||
HTTP_HANDLE_DATA *httpHandleData = (HTTP_HANDLE_DATA *)userptr;
|
||||
#ifdef USE_OPENSSL
|
||||
/*trying to set the x509 per device certificate*/
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
if (httpHandleData->x509privatekeytype == KEY_TYPE_ENGINE) {
|
||||
ENGINE_load_builtin_engines();
|
||||
httpHandleData->engine = ENGINE_by_id(httpHandleData->engineId);
|
||||
|
@ -324,14 +329,18 @@ static CURLcode ssl_ctx_callback(CURL *curl, void *ssl_ctx, void *userptr)
|
|||
LogError("unable to load engine by ID: %s", httpHandleData->engineId);
|
||||
result = CURLE_SSL_CERTPROBLEM;
|
||||
}
|
||||
else if (
|
||||
else
|
||||
#endif // OPENSSL_NO_ENGINE
|
||||
if (
|
||||
(httpHandleData->x509certificate != NULL) && (httpHandleData->x509privatekey != NULL) &&
|
||||
(x509_openssl_add_credentials(ssl_ctx, httpHandleData->x509certificate, httpHandleData->x509privatekey, httpHandleData->x509privatekeytype, httpHandleData->engine) != 0)
|
||||
)
|
||||
{
|
||||
LogError("unable to x509_openssl_add_credentials");
|
||||
result = CURLE_SSL_CERTPROBLEM;
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
ENGINE_free(httpHandleData->engine);
|
||||
#endif // OPENSSL_NO_ENGINE
|
||||
}
|
||||
/*trying to set CA certificates*/
|
||||
else if (
|
||||
|
@ -341,7 +350,9 @@ static CURLcode ssl_ctx_callback(CURL *curl, void *ssl_ctx, void *userptr)
|
|||
{
|
||||
LogError("failure in x509_openssl_add_certificates");
|
||||
result = CURLE_SSL_CERTPROBLEM;
|
||||
#ifndef OPENSSL_NO_ENGINE
|
||||
ENGINE_free(httpHandleData->engine);
|
||||
#endif // OPENSSL_NO_ENGINE
|
||||
}
|
||||
#elif USE_WOLFSSL
|
||||
if (
|
||||
|
|
Загрузка…
Ссылка в новой задаче