Add new ctrl to retrieve client certificate types, print out

details in s_client.

Also add ctrl to set client certificate types. If not used sensible values
will be included based on supported signature algorithms: for example if
we don't include any DSA signing algorithms the DSA certificate type is
omitted.

Fix restriction in old code where certificate types would be truncated
if it exceeded TLS_CT_NUMBER.
(backport from HEAD)

1 files changed, 11 insertions, 0 deletions

diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c
index 1edbf18f3b..59a8544431 100644
--- a/ssl/ssl_cert.c
+++ b/ssl/ssl_cert.c
@@ -388,6 +388,15 @@ CERT *ssl_cert_dup(CERT *cert)
 		ret->client_sigalgs = NULL;
 	/* Shared sigalgs also NULL */
 	ret->shared_sigalgs = NULL;
+	/* Copy any custom client certificate types */
+	if (cert->ctypes)
+		{
+		ret->ctypes = OPENSSL_malloc(cert->ctype_num);
+		if (!ret->ctypes)
+			goto err;
+		memcpy(ret->ctypes, cert->ctypes, cert->ctype_num);
+		ret->ctype_num = cert->ctype_num;
+		}
 
 	ret->cert_flags = cert->cert_flags;
 
@@ -489,6 +498,8 @@ void ssl_cert_free(CERT *c)
 		OPENSSL_free(c->client_sigalgs);
 	if (c->shared_sigalgs)
 		OPENSSL_free(c->shared_sigalgs);
+	if (c->ctypes)
+		OPENSSL_free(c->ctypes);
 	OPENSSL_free(c);
 	}