interesting
/
getdns
mirror of https://github.com/getdnsapi/getdns.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

More review changes and made comments C style, req Willem.

This commit is contained in:
unknown 2016-02-01 10:56:45 -05:00
parent f5290b6a68
commit 170795ad06
1 changed files with 23 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
src/context.c
View File

@ -140,28 +140,28 @@ static void set_ub_edns_maximum_udp_payload_size(struct getdns_context*,
#ifdef USE_WINSOCK #ifdef USE_WINSOCK
// For windows, the CA trust store is not read by openssl. /* For windows, the CA trust store is not read by openssl.
// Add code to open the trust store using wincrypt API and add Add code to open the trust store using wincrypt API and add
// the root certs into openssl trust store the root certs into openssl trust store */
static int static int
add_WIN_cacerts_to_openssl_store(SSL_CTX* tls_ctx) add_WIN_cacerts_to_openssl_store(SSL_CTX* tls_ctx)
{ {
HCERTSTORE hSystemStore; HCERTSTORE hSystemStore;
PCCERT_CONTEXT pTargetCert = NULL; PCCERT_CONTEXT pTargetCert = NULL;
// load just once per context lifetime for this version of getdns /* load just once per context lifetime for this version of getdns
// TODO: dynamically update CA trust changes as they are available TODO: dynamically update CA trust changes as they are available */
if (!tls_ctx) if (!tls_ctx)
return 0; return 0;
// Call wincrypt's CertOpenStore to open the CA root store. /* Call wincrypt's CertOpenStore to open the CA root store. */
if ((hSystemStore = CertOpenStore( if ((hSystemStore = CertOpenStore(
CERT_STORE_PROV_SYSTEM, CERT_STORE_PROV_SYSTEM,
0, 0,
NULL, 0,
// NOTE: mingw does not have this const: replace with 1 << 16 from code /* NOTE: mingw does not have this const: replace with 1 << 16 from code
// CERT_SYSTEM_STORE_CURRENT_USER, CERT_SYSTEM_STORE_CURRENT_USER, */
1 << 16, 1 << 16,
L"root")) == 0) L"root")) == 0)
{ {
@ -172,23 +172,28 @@ add_WIN_cacerts_to_openssl_store(SSL_CTX* tls_ctx)
if (!store) if (!store)
return 0; return 0;
// iterate over the windows cert store and add to openssl store /* failure if the CA store is empty or the call fails */
while (pTargetCert = CertEnumCertificatesInStore( if ((pTargetCert = CertEnumCertificatesInStore(
hSystemStore, hSystemStore, pTargetCert)) == 0) {
pTargetCert)) DEBUG_STUB("*** %s(%s %d:%s)\n", __FUNCTION__,
"CA certificate store for Windows is empty.");
return 0;
}
/* iterate over the windows cert store and add to openssl store */
do
{ {
X509 *cert1 = d2i_X509(NULL, X509 *cert1 = d2i_X509(NULL,
(const unsigned char **)&pTargetCert->pbCertEncoded, (const unsigned char **)&pTargetCert->pbCertEncoded,
pTargetCert->cbCertEncoded); pTargetCert->cbCertEncoded);
if (!cert1) { if (!cert1) {
// do not return if a cert fails, continue and retrieve the rest /* return error if a cert fails */
DEBUG_STUB("*** %s(%s %d:%s)\n", __FUNCTION__, DEBUG_STUB("*** %s(%s %d:%s)\n", __FUNCTION__,
"unable to parse certificate in memory", "unable to parse certificate in memory",
ERR_get_error(), ERR_error_string(ERR_get_error(), NULL)); ERR_get_error(), ERR_error_string(ERR_get_error(), NULL));
return 0; return 0;
} }
else { else {
// do not return if a cert add to store fails, continue and retrieve the rest /* return error if a cert add to store fails */
if (X509_STORE_add_cert(store, cert1) == 0) { if (X509_STORE_add_cert(store, cert1) == 0) {
DEBUG_STUB("*** %s(%s %d:%s)\n", __FUNCTION__, DEBUG_STUB("*** %s(%s %d:%s)\n", __FUNCTION__,
"error adding certificate", ERR_get_error(), "error adding certificate", ERR_get_error(),
@ -197,9 +202,10 @@ add_WIN_cacerts_to_openssl_store(SSL_CTX* tls_ctx)
} }
X509_free(cert1); X509_free(cert1);
} }
} } while ((pTargetCert = CertEnumCertificatesInStore(
hSystemStore, pTargetCert)) != 0);
// Clean up memory and quit. /* Clean up memory and quit. */
if (pTargetCert) if (pTargetCert)
CertFreeCertificateContext(pTargetCert); CertFreeCertificateContext(pTargetCert);
if (hSystemStore) if (hSystemStore)
@ -209,7 +215,6 @@ add_WIN_cacerts_to_openssl_store(SSL_CTX* tls_ctx)
return 0; return 0;
} }
return 1; return 1;
} }
#endif #endif