| 8537 | } |
| 8538 | |
| 8539 | inline bool SSLClient::initialize_ssl(Socket &socket, Error &error) { |
| 8540 | auto ssl = detail::ssl_new( |
| 8541 | socket.sock, ctx_, ctx_mutex_, |
| 8542 | [&](SSL *ssl2) { |
| 8543 | if (server_certificate_verification_) { |
| 8544 | if (!load_certs()) { |
| 8545 | error = Error::SSLLoadingCerts; |
| 8546 | return false; |
| 8547 | } |
| 8548 | SSL_set_verify(ssl2, SSL_VERIFY_NONE, nullptr); |
| 8549 | } |
| 8550 | |
| 8551 | if (!detail::ssl_connect_or_accept_nonblocking( |
| 8552 | socket.sock, ssl2, SSL_connect, connection_timeout_sec_, |
| 8553 | connection_timeout_usec_)) { |
| 8554 | error = Error::SSLConnection; |
| 8555 | return false; |
| 8556 | } |
| 8557 | |
| 8558 | if (server_certificate_verification_) { |
| 8559 | verify_result_ = SSL_get_verify_result(ssl2); |
| 8560 | |
| 8561 | if (verify_result_ != X509_V_OK) { |
| 8562 | error = Error::SSLServerVerification; |
| 8563 | return false; |
| 8564 | } |
| 8565 | |
| 8566 | auto server_cert = SSL_get1_peer_certificate(ssl2); |
| 8567 | |
| 8568 | if (server_cert == nullptr) { |
| 8569 | error = Error::SSLServerVerification; |
| 8570 | return false; |
| 8571 | } |
| 8572 | |
| 8573 | if (!verify_host(server_cert)) { |
| 8574 | X509_free(server_cert); |
| 8575 | error = Error::SSLServerVerification; |
| 8576 | return false; |
| 8577 | } |
| 8578 | X509_free(server_cert); |
| 8579 | } |
| 8580 | |
| 8581 | return true; |
| 8582 | }, |
| 8583 | [&](SSL *ssl2) { |
| 8584 | // NOTE: With -Wold-style-cast, this can produce a warning, since |
| 8585 | // SSL_set_tlsext_host_name is a macro (in OpenSSL), which contains |
| 8586 | // an old style cast. Short of doing compiler specific pragma's |
| 8587 | // here, we can't get rid of this warning. :'( |
| 8588 | SSL_set_tlsext_host_name(ssl2, host_.c_str()); |
| 8589 | return true; |
| 8590 | }); |
| 8591 | |
| 8592 | if (ssl) { |
| 8593 | socket.ssl = ssl; |
| 8594 | return true; |
| 8595 | } |
| 8596 |
no test coverage detected