1 Index: net/third_party/nss/ssl/ssl.h 2 =================================================================== 3 --- net/third_party/nss/ssl/ssl.h (revision 225295) 4 +++ net/third_party/nss/ssl/ssl.h (working copy) 5 @@ -434,6 +434,15 @@ 6 */ 7 SSL_IMPORT CERTCertificate *SSL_PeerCertificate(PRFileDesc *fd); 8 9 +/* 10 +** Return the certificates presented by the SSL peer. If the SSL peer 11 +** did not present certificates, return NULL with the 12 +** SSL_ERROR_NO_CERTIFICATE error. On failure, return NULL with an error 13 +** code other than SSL_ERROR_NO_CERTIFICATE. 14 +** "fd" the socket "file" descriptor 15 +*/ 16 +SSL_IMPORT CERTCertList *SSL_PeerCertificateChain(PRFileDesc *fd); 17 + 18 /* SSL_PeerStapledOCSPResponses returns the OCSP responses that were provided 19 * by the TLS server. The return value is a pointer to an internal SECItemArray 20 * that contains the returned OCSP responses; it is only valid until the 21 @@ -463,18 +472,6 @@ 22 SSLKEAType kea); 23 24 /* 25 -** Return references to the certificates presented by the SSL peer. 26 -** |maxNumCerts| must contain the size of the |certs| array. On successful 27 -** return, |*numCerts| contains the number of certificates available and 28 -** |certs| will contain references to as many certificates as would fit. 29 -** Therefore if |*numCerts| contains a value less than or equal to 30 -** |maxNumCerts|, then all certificates were returned. 31 -*/ 32 -SSL_IMPORT SECStatus SSL_PeerCertificateChain( 33 - PRFileDesc *fd, CERTCertificate **certs, 34 - unsigned int *numCerts, unsigned int maxNumCerts); 35 - 36 -/* 37 ** Authenticate certificate hook. Called when a certificate comes in 38 ** (because of SSL_REQUIRE_CERTIFICATE in SSL_Enable) to authenticate the 39 ** certificate. 40 Index: net/third_party/nss/ssl/sslauth.c 41 =================================================================== 42 --- net/third_party/nss/ssl/sslauth.c (revision 225295) 43 +++ net/third_party/nss/ssl/sslauth.c (working copy) 44 @@ -28,38 +28,43 @@ 45 } 46 47 /* NEED LOCKS IN HERE. */ 48 -SECStatus 49 -SSL_PeerCertificateChain(PRFileDesc *fd, CERTCertificate **certs, 50 - unsigned int *numCerts, unsigned int maxNumCerts) 51 +CERTCertList * 52 +SSL_PeerCertificateChain(PRFileDesc *fd) 53 { 54 sslSocket *ss; 55 - ssl3CertNode* cur; 56 + CERTCertList *chain = NULL; 57 + CERTCertificate *cert; 58 + ssl3CertNode *cur; 59 60 ss = ssl_FindSocket(fd); 61 if (!ss) { 62 SSL_DBG(("%d: SSL[%d]: bad socket in PeerCertificateChain", 63 SSL_GETPID(), fd)); 64 - return SECFailure; 65 + return NULL; 66 } 67 - if (!ss->opt.useSecurity) 68 - return SECFailure; 69 - 70 - if (ss->sec.peerCert == NULL) { 71 - *numCerts = 0; 72 - return SECSuccess; 73 + if (!ss->opt.useSecurity || !ss->sec.peerCert) { 74 + PORT_SetError(SSL_ERROR_NO_CERTIFICATE); 75 + return NULL; 76 } 77 - 78 - *numCerts = 1; /* for the leaf certificate */ 79 - if (maxNumCerts > 0) 80 - certs[0] = CERT_DupCertificate(ss->sec.peerCert); 81 - 82 + chain = CERT_NewCertList(); 83 + if (!chain) { 84 + return NULL; 85 + } 86 + cert = CERT_DupCertificate(ss->sec.peerCert); 87 + if (CERT_AddCertToListTail(chain, cert) != SECSuccess) { 88 + goto loser; 89 + } 90 for (cur = ss->ssl3.peerCertChain; cur; cur = cur->next) { 91 - if (*numCerts < maxNumCerts) 92 - certs[*numCerts] = CERT_DupCertificate(cur->cert); 93 - (*numCerts)++; 94 + cert = CERT_DupCertificate(cur->cert); 95 + if (CERT_AddCertToListTail(chain, cert) != SECSuccess) { 96 + goto loser; 97 + } 98 } 99 + return chain; 100 101 - return SECSuccess; 102 +loser: 103 + CERT_DestroyCertList(chain); 104 + return NULL; 105 } 106 107 /* NEED LOCKS IN HERE. */ 108
