openssl: set quiet shutdown flag to ensure that shutdown always succeeds

[project/ustream-ssl.git] / ustream-openssl.c

diff --git a/ustream-openssl.c b/ustream-openssl.c
index a45e2f49714fb67fa787e481d90ef3e945178533..06053e6fb661556a66da8f4cf7f70349ace2eb5b 100644 (file)
--- a/ustream-openssl.c
+++ b/ustream-openssl.c
@@ -16,6 +16,7 @@
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
+#include <string.h>
 #include <ctype.h>
 #include <openssl/x509v3.h>
 #include "ustream-ssl.h"
@@ -51,6 +52,7 @@ __ustream_ssl_context_new(bool server)
                return NULL;
 
        SSL_CTX_set_verify(c, SSL_VERIFY_NONE, NULL);
+       SSL_CTX_set_quiet_shutdown(c, 1);
 
        return (void *) c;
 }
@@ -99,12 +101,20 @@ __hidden void __ustream_ssl_context_free(struct ustream_ssl_ctx *ctx)
        SSL_CTX_free((void *) ctx);
 }
 
+void __ustream_ssl_session_free(void *ssl)
+{
+       SSL_shutdown(ssl);
+       SSL_free(ssl);
+}
+
 static void ustream_ssl_error(struct ustream_ssl *us, int ret)
 {
        us->error = ret;
        uloop_timeout_set(&us->error_timer, 0);
 }
 
+#ifndef CYASSL_OPENSSL_H_
+
 static bool host_pattern_match(const unsigned char *pattern, const char *cn)
 {
        char c;
@@ -157,6 +167,7 @@ static bool ustream_ssl_verify_cn_alt(struct ustream_ssl *us, X509 *cert)
 {
        GENERAL_NAMES *alt_names;
        int i, n_alt;
+       bool ret = false;
 
        alt_names = X509_get_ext_d2i (cert, NID_subject_alt_name, NULL, NULL);
        if (!alt_names)
@@ -172,11 +183,14 @@ static bool ustream_ssl_verify_cn_alt(struct ustream_ssl *us, X509 *cert)
                if (name->type != GEN_DNS)
                        continue;
 
-               if (host_pattern_match_asn1(name->d.dNSName, us->peer_cn))
-                       return true;
+               if (host_pattern_match_asn1(name->d.dNSName, us->peer_cn)) {
+                       ret = true;
+                       break;
+               }
        }
 
-       return false;
+       sk_GENERAL_NAME_free(alt_names);
+       return ret;
 }
 
 static bool ustream_ssl_verify_cn(struct ustream_ssl *us, X509 *cert)
@@ -217,10 +231,6 @@ static void ustream_ssl_verify_cert(struct ustream_ssl *us)
        X509 *cert;
        int res;
 
-       cert = SSL_get_peer_certificate(ssl);
-       if (!cert)
-               return;
-
        res = SSL_get_verify_result(ssl);
        if (res != X509_V_OK) {
                if (us->notify_verify_error)
@@ -228,10 +238,17 @@ static void ustream_ssl_verify_cert(struct ustream_ssl *us)
                return;
        }
 
+       cert = SSL_get_peer_certificate(ssl);
+       if (!cert)
+               return;
+
        us->valid_cert = true;
        us->valid_cn = ustream_ssl_verify_cn(us, cert);
+       X509_free(cert);
 }
 
+#endif
+
 __hidden enum ssl_conn_status __ustream_ssl_connect(struct ustream_ssl *us)
 {
        void *ssl = us->ssl;
@@ -243,7 +260,9 @@ __hidden enum ssl_conn_status __ustream_ssl_connect(struct ustream_ssl *us)
                r = SSL_connect(ssl);
 
        if (r == 1) {
+#ifndef CYASSL_OPENSSL_H_
                ustream_ssl_verify_cert(us);
+#endif
                return U_SSL_OK;
        }