#include <errno.h>
#include <inttypes.h>
#include <string.h>
+#include <sys/types.h>
+#include <sys/socket.h>
#include <netinet/tcp.h>
#include <openssl/err.h>
#include <openssl/ssl.h>
if (!verify_peer_cert || (bootstrap_ca_cert && type == CLIENT)) {
SSL_set_verify(ssl, SSL_VERIFY_NONE, NULL);
}
+ if (type == CLIENT) {
+ /* Grab SSL session information from the cache. */
+ SSL_SESSION *session = shash_find_data(&client_sessions, name);
+ if (session && SSL_set_session(ssl, session) != 1) {
+ interpret_queued_ssl_error("SSL_set_session");
+ }
+ }
/* Create and return the ssl_stream. */
sslv = xmalloc(sizeof *sslv);
if (!cert) {
out_of_memory();
}
+ SSL_CTX_set_cert_store(ctx, X509_STORE_new());
if (SSL_CTX_load_verify_locations(ctx, ca_cert.file_name, NULL) != 1) {
VLOG_ERR("SSL_CTX_load_verify_locations: %s",
ERR_error_string(ERR_get_error(), NULL));
MSG_PEEK);
}
- /* Grab SSL session information from the cache. */
- if (sslv->type == CLIENT) {
- SSL_SESSION *session = shash_find_data(&client_sessions,
- stream_get_name(stream));
- if (session) {
- SSL_set_session(sslv->ssl, session);
- }
- }
-
retval = (sslv->type == CLIENT
? SSL_connect(sslv->ssl) : SSL_accept(sslv->ssl));
if (retval != 1) {
/* Set up CAs for OpenSSL to trust in verifying the peer's
* certificate. */
+ SSL_CTX_set_cert_store(ctx, X509_STORE_new());
if (SSL_CTX_load_verify_locations(ctx, file_name, NULL) != 1) {
VLOG_ERR("SSL_CTX_load_verify_locations: %s",
ERR_error_string(ERR_get_error(), NULL));