Fix a number of cases overwriting certificates, keys, etc. with SSL_CREDENTIAL
Field-by-field setters make the worst APIs. This fixes the following:
- Calling SSL_CTX_set_chain_and_key twice should override the old one
(Regression from SSL_CREDENTIAL.)
- Various APIs forgot to clear the old chain before appending new ones.
(Regression from SSL_CREDENTIAL.)
- Switching between a custom private key and a concrete one should not
leave the old one lying around. (I think this was always broken.)
Add tests for all of these cases.
Change-Id: Ief7b3aecf2ada3b123d79d4eddf464c65d5f7d0d
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/66907
Commit-Queue: David Benjamin <davidben@google.com>
Auto-Submit: David Benjamin <davidben@google.com>
Reviewed-by: Bob Beck <bbe@google.com>
Commit-Queue: Bob Beck <bbe@google.com>
diff --git a/ssl/internal.h b/ssl/internal.h
index 0e55739..0c2c2f8 100644
--- a/ssl/internal.h
+++ b/ssl/internal.h
@@ -1640,6 +1640,10 @@
bool SetLeafCert(bssl::UniquePtr<CRYPTO_BUFFER> leaf,
bool discard_key_on_mismatch);
+ // ClearIntermediateCerts clears intermediate certificates in the certificate
+ // chain, while preserving the leaf.
+ void ClearIntermediateCerts();
+
// AppendIntermediateCert appends |cert| to the certificate chain. If there is
// no leaf certificate configured, it leaves a placeholder null in |chain|. It
// returns one on success and zero on error.
