nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-27 22:03:31 +01:00
Code Issues Packages Projects Releases Wiki Activity

Stop leaking X509 certs; those things are _nasty_ on the carpet

Browse Source 
svn:r833
This commit is contained in:
Nick Mathewson 2003-11-18 06:52:25 +00:00
parent 366ba4a7c7
commit dd16a9abcb
1 changed files with 15 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
src/common/tortls.c
View File

@ -140,7 +140,6 @@ tor_tls_create_certificate(crypto_pk_env_t *rsa,
X509 *x509 = NULL; X509 *x509 = NULL;
X509_NAME *name = NULL; X509_NAME *name = NULL;
int nid; int nid;
int err;
tor_tls_init(); tor_tls_init();
@ -179,13 +178,13 @@ tor_tls_create_certificate(crypto_pk_env_t *rsa,
if (!X509_sign(x509, pkey, EVP_sha1())) if (!X509_sign(x509, pkey, EVP_sha1()))
goto error; goto error;
err = 0;
goto done; goto done;
error: error:
err = 1; if (x509) {
X509_free(x509);
x509 = NULL;
}
done: done:
if (x509 && err)
X509_free(x509);
if (pkey) if (pkey)
EVP_PKEY_free(pkey); EVP_PKEY_free(pkey);
if (name) if (name)
@ -483,23 +482,29 @@ tor_tls_get_peer_cert_nickname(tor_tls *tls, char *buf, int buflen)
if (!(cert = SSL_get_peer_certificate(tls->ssl))) { if (!(cert = SSL_get_peer_certificate(tls->ssl))) {
log_fn(LOG_WARN, "Peer has no certificate"); log_fn(LOG_WARN, "Peer has no certificate");
return -1; goto error;
} }
if (!(name = X509_get_subject_name(cert))) { if (!(name = X509_get_subject_name(cert))) {
log_fn(LOG_WARN, "Peer certificate has no subject name"); log_fn(LOG_WARN, "Peer certificate has no subject name");
return -1; goto error;
} }
if ((nid = OBJ_txt2nid("commonName")) == NID_undef) if ((nid = OBJ_txt2nid("commonName")) == NID_undef)
return -1; goto error;
lenout = X509_NAME_get_text_by_NID(name, nid, buf, buflen); lenout = X509_NAME_get_text_by_NID(name, nid, buf, buflen);
if (lenout == -1) if (lenout == -1)
return -1; goto error;
if (strspn(buf, LEGAL_NICKNAME_CHARACTERS) != lenout) { if (strspn(buf, LEGAL_NICKNAME_CHARACTERS) != lenout) {
log_fn(LOG_WARN, "Peer certificate nickname has illegal characters."); log_fn(LOG_WARN, "Peer certificate nickname has illegal characters.");
return -1; goto error;
} }
return 0; return 0;
error:
if (cert)
X509_free(cert);
if (name)
X509_NAME_free(name);
return -1;
} }
/* If the provided tls connection is authenticated and has a /* If the provided tls connection is authenticated and has a