From 2b9ce8cc8b56b0c736bec58d7063e904dee18cc2 Mon Sep 17 00:00:00 2001 From: roman Date: Tue, 14 May 2024 09:09:30 +0200 Subject: [PATCH] session wrapper UPDATE store client cert in sess --- src/session.c | 1 - src/session_mbedtls.c | 25 +++++++++++++++++++++++++ src/session_openssl.c | 5 +++++ 3 files changed, 30 insertions(+), 1 deletion(-) diff --git a/src/session.c b/src/session.c index 83f3a8aa..8304a4d3 100644 --- a/src/session.c +++ b/src/session.c @@ -809,7 +809,6 @@ nc_session_free_transport(struct nc_session *session, int *multisession) session->ti.tls.config = NULL; if (session->side == NC_SERVER) { - // TODO nc_tls_cert_destroy_wrap(session->opts.server.client_cert); } diff --git a/src/session_mbedtls.c b/src/session_mbedtls.c index 17b03a86..1a53620b 100644 --- a/src/session_mbedtls.c +++ b/src/session_mbedtls.c @@ -427,6 +427,24 @@ nc_server_tls_set_tls_versions_wrap(void *tls_cfg, unsigned int tls_versions) return 0; } +static mbedtls_x509_crt * +nc_tls_cert_dup(const mbedtls_x509_crt *cert) +{ + mbedtls_x509_crt *new_cert; + + new_cert = nc_tls_cert_new_wrap(); + if (!new_cert) { + return NULL; + } + + if (mbedtls_x509_crt_parse_der(new_cert, cert->raw.p, cert->raw.len)) { + free(new_cert); + return NULL; + } + + return new_cert; +} + static int nc_server_tls_verify_cb(void *cb_data, mbedtls_x509_crt *cert, int depth, uint32_t *flags) { @@ -468,6 +486,13 @@ nc_server_tls_verify_cb(void *cb_data, mbedtls_x509_crt *cert, int depth, uint32 return MBEDTLS_ERR_X509_ALLOC_FAILED; } else if (!ret) { /* success */ + if ((depth == 0) && (!data->session->opts.server.client_cert)) { + /* copy the client cert */ + data->session->opts.server.client_cert = nc_tls_cert_dup(cert); + if (!data->session->opts.server.client_cert) { + return MBEDTLS_ERR_X509_ALLOC_FAILED; + } + } return 0; } else { if (depth > 0) { diff --git a/src/session_openssl.c b/src/session_openssl.c index 3891dc7b..83a5b933 100644 --- a/src/session_openssl.c +++ b/src/session_openssl.c @@ -387,6 +387,11 @@ nc_server_tls_verify_cb(int preverify_ok, X509_STORE_CTX *x509_ctx) return 0; } else if (!ret) { /* success */ + if ((depth == 0) && (!data->session->opts.server.client_cert)) { + /* copy the client cert */ + data->session->opts.server.client_cert = X509_dup(cert); + NC_CHECK_ERRMEM_RET(!data->session->opts.server.client_cert, 0); + } return 1; } else { if (depth > 0) {