OpenSSL: Write PKCS#12 extra cert errors into debug log

Commit de2a7b796d82d92120aa9532450863f503e1885a ('OpenSSL: Use
connection certificate chain with PKCS#12 extra certs') added a new
mechanism for doing this with OpenSSL 1.0.2 and newer. However, it did
not poinr out anything in debug log if SSL_add1_chain_cert() failed. Add
such a debug print and also silence static analyzer warning on res being
stored without being read (since the error case is ignored at least for
now).

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c
index 88bf410..8b7b47b 100644 (file)
--- a/src/crypto/tls_openssl.c
+++ b/src/crypto/tls_openssl.c
@@ -2237,10 +2237,15 @@ static int tls_parse_pkcs12(struct tls_data *data, SSL *ssl, PKCS12 *p12,
                        wpa_printf(MSG_DEBUG, "TLS: additional certificate"
                                   " from PKCS12: subject='%s'", buf);
                        if (SSL_add1_chain_cert(ssl, cert) != 1) {
+                               tls_show_errors(MSG_DEBUG, __func__,
+                                               "Failed to add additional certificate");
                                res = -1;
                                break;
                        }
                }
+               if (!res) {
+                       /* Try to continue anyway */
+               }
                sk_X509_free(certs);
 #ifndef OPENSSL_IS_BORINGSSL
                res = SSL_build_cert_chain(ssl,