Code Review
/
vpp.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
review
|
tree
raw
|
inline
| side by side
tls: use default OpenSSL built-in DH parameters
[vpp.git]
/
src
/
plugins
/
tlsopenssl
/
tls_openssl.c
diff --git
a/src/plugins/tlsopenssl/tls_openssl.c
b/src/plugins/tlsopenssl/tls_openssl.c
index
496d777
..
3041047
100644
(file)
--- a/
src/plugins/tlsopenssl/tls_openssl.c
+++ b/
src/plugins/tlsopenssl/tls_openssl.c
@@
-341,9
+341,18
@@
openssl_ctx_handshake_rx (tls_ctx_t * ctx, session_t * tls_session)
{
/* Need to check transport status */
if (ctx->is_passive_close)
{
/* Need to check transport status */
if (ctx->is_passive_close)
- openssl_handle_handshake_failure (ctx);
- else
- tls_notify_app_accept (ctx);
+ {
+ openssl_handle_handshake_failure (ctx);
+ return -1;
+ }
+
+ /* Accept failed, cleanup */
+ if (tls_notify_app_accept (ctx))
+ {
+ ctx->c_s_index = SESSION_INVALID_INDEX;
+ tls_disconnect_transport (ctx);
+ return -1;
+ }
}
TLS_DBG (1, "Handshake for %u complete. TLS cipher is %s",
}
TLS_DBG (1, "Handshake for %u complete. TLS cipher is %s",
@@
-740,29
+749,59
@@
openssl_start_listen (tls_ctx_t * lctx)
return -1;
}
return -1;
}
+ /* use the default OpenSSL built-in DH parameters */
+ rv = SSL_CTX_set_dh_auto (ssl_ctx, 1);
+ if (rv != 1)
+ {
+ TLS_DBG (1, "Couldn't set temp DH parameters");
+ return -1;
+ }
+
/*
* Set the key and cert
*/
cert_bio = BIO_new (BIO_s_mem ());
/*
* Set the key and cert
*/
cert_bio = BIO_new (BIO_s_mem ());
+ if (!cert_bio)
+ {
+ clib_warning ("unable to allocate memory");
+ return -1;
+ }
BIO_write (cert_bio, ckpair->cert, vec_len (ckpair->cert));
srvcert = PEM_read_bio_X509 (cert_bio, NULL, NULL, NULL);
if (!srvcert)
{
clib_warning ("unable to parse certificate");
BIO_write (cert_bio, ckpair->cert, vec_len (ckpair->cert));
srvcert = PEM_read_bio_X509 (cert_bio, NULL, NULL, NULL);
if (!srvcert)
{
clib_warning ("unable to parse certificate");
-
return -1
;
+
goto err
;
}
}
- SSL_CTX_use_certificate (ssl_ctx, srvcert);
+ rv = SSL_CTX_use_certificate (ssl_ctx, srvcert);
+ if (rv != 1)
+ {
+ clib_warning ("unable to use SSL certificate");
+ goto err;
+ }
+
BIO_free (cert_bio);
cert_bio = BIO_new (BIO_s_mem ());
BIO_free (cert_bio);
cert_bio = BIO_new (BIO_s_mem ());
+ if (!cert_bio)
+ {
+ clib_warning ("unable to allocate memory");
+ return -1;
+ }
BIO_write (cert_bio, ckpair->key, vec_len (ckpair->key));
pkey = PEM_read_bio_PrivateKey (cert_bio, NULL, NULL, NULL);
if (!pkey)
{
clib_warning ("unable to parse pkey");
BIO_write (cert_bio, ckpair->key, vec_len (ckpair->key));
pkey = PEM_read_bio_PrivateKey (cert_bio, NULL, NULL, NULL);
if (!pkey)
{
clib_warning ("unable to parse pkey");
-
return -1
;
+
goto err
;
}
}
- SSL_CTX_use_PrivateKey (ssl_ctx, pkey);
+ rv = SSL_CTX_use_PrivateKey (ssl_ctx, pkey);
+ if (rv != 1)
+ {
+ clib_warning ("unable to use SSL PrivateKey");
+ goto err;
+ }
+
BIO_free (cert_bio);
olc_index = openssl_listen_ctx_alloc ();
BIO_free (cert_bio);
olc_index = openssl_listen_ctx_alloc ();
@@
-776,6
+815,10
@@
openssl_start_listen (tls_ctx_t * lctx)
return 0;
return 0;
+err:
+ if (cert_bio)
+ BIO_free (cert_bio);
+ return -1;
}
static int
}
static int