Commit b50052db authored by Todd Short's avatar Todd Short Committed by Rich Salz
Browse files

Add SSL_CTX_set1_cert_store() 



For convenience, combine getting a new ref for the new SSL_CTX
with assigning the store and freeing the old one.

Reviewed-by: default avatarMatt Caswell <matt@openssl.org>
Reviewed-by: default avatarRich Salz <rsalz@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/1755)
parent ba740700

doc/man3/SSL_CTX_set_cert_store.pod

+17 −1
Original line number Diff line number Diff line
@@ -2,13 +2,14 @@ 


=head1 NAME



SSL_CTX_set_cert_store, SSL_CTX_get_cert_store - manipulate X509 certificate verification storage

SSL_CTX_set_cert_store, SSL_CTX_set1_cert_store, SSL_CTX_get_cert_store - manipulate X509 certificate verification storage



=head1 SYNOPSIS



 #include <openssl/ssl.h>



 void SSL_CTX_set_cert_store(SSL_CTX *ctx, X509_STORE *store);

 void SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store);

 X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *ctx);



=head1 DESCRIPTION
@@ -17,6 +18,10 @@ SSL_CTX_set_cert_store() sets/replaces the certificate verification storage 
of B<ctx> to/with B<store>. If another X509_STORE object is currently

set in B<ctx>, it will be X509_STORE_free()ed.



SSL_CTX_set1_cert_store() sets/replaces the certificate verification storage

of B<ctx> to/with B<store>. The B<store>'s reference count is incremented.

If another X509_STORE object is currently set in B<ctx>, it will be X509_STORE_free()ed.



SSL_CTX_get_cert_store() returns a pointer to the current certificate

verification storage.
@@ -42,6 +47,15 @@ L<SSL_CTX_set_verify(3)> family of functions. 
This document must therefore be updated when documentation about the

X509_STORE object and its handling becomes available.



SSL_CTX_set_cert_store() does not increment the B<store>'s reference

count, so it should not be used to assign an X509_STORE that is owned

by another SSL_CTX.



To share X509_STOREs between two SSL_CTXs, use SSL_CTX_get_cert_store()

to get the X509_STORE from the first SSL_CTX, and then use

SSL_CTX_set1_cert_store() to assign to the second SSL_CTX and

increment the reference count of the X509_STORE.



=head1 RESTRICTIONS



The X509_STORE structure used by an SSL_CTX is used for verifying peer
@@ -53,6 +67,8 @@ functions such as SSL_CTX_set1_verify_cert_store() instead. 


SSL_CTX_set_cert_store() does not return diagnostic output.



SSL_CTX_set1_cert_store() does not return diagnostic output.



SSL_CTX_get_cert_store() returns the current setting.



=head1 SEE ALSO

doc/man7/ssl.pod

+2 −0
Original line number Diff line number Diff line
@@ -320,6 +320,8 @@ protocol context defined in the B<SSL_CTX> structure. 


=item void B<SSL_CTX_set_cert_store>(SSL_CTX *ctx, X509_STORE *cs);



=item void B<SSL_CTX_set1_cert_store>(SSL_CTX *ctx, X509_STORE *cs);



=item void B<SSL_CTX_set_cert_verify_cb>(SSL_CTX *ctx, int (*cb)(), char *arg)



=item int B<SSL_CTX_set_cipher_list>(SSL_CTX *ctx, char *str);

include/openssl/ssl.h

+1 −0
Original line number Diff line number Diff line
@@ -1308,6 +1308,7 @@ __owur long SSL_CTX_set_timeout(SSL_CTX *ctx, long t); 
__owur long SSL_CTX_get_timeout(const SSL_CTX *ctx);

__owur X509_STORE *SSL_CTX_get_cert_store(const SSL_CTX *);

void SSL_CTX_set_cert_store(SSL_CTX *, X509_STORE *);

void SSL_CTX_set1_cert_store(SSL_CTX *, X509_STORE *);

__owur int SSL_want(const SSL *s);

__owur int SSL_clear(SSL *s);

ssl/ssl_lib.c

+7 −0
Original line number Diff line number Diff line
@@ -3553,6 +3553,13 @@ void SSL_CTX_set_cert_store(SSL_CTX *ctx, X509_STORE *store) 
    ctx->cert_store = store;

}



void SSL_CTX_set1_cert_store(SSL_CTX *ctx, X509_STORE *store)

{

    if (store != NULL)

        X509_STORE_up_ref(store);

    SSL_CTX_set_cert_store(ctx, store);

}



int SSL_want(const SSL *s)

{

    return (s->rwstate);

util/libssl.num

+1 −0
Original line number Diff line number Diff line
@@ -403,3 +403,4 @@ SSL_dane_clear_flags 403 1_1_0 EXIST::FUNCTION: 
SSL_SESSION_get0_cipher                 404	1_1_0	EXIST::FUNCTION:

SSL_SESSION_get0_id_context             405	1_1_0	EXIST::FUNCTION:

SSL_SESSION_set1_id                     406	1_1_0	EXIST::FUNCTION:

SSL_CTX_set1_cert_store                 407	1_1_1	EXIST::FUNCTION: