| 9358 | } |
| 9359 | |
| 9360 | inline bool SSLClient::initialize_ssl(Socket &socket, Error &error) { |
| 9361 | auto ssl = detail::ssl_new( |
| 9362 | socket.sock, ctx_, ctx_mutex_, |
| 9363 | [&](SSL *ssl2) { |
| 9364 | if (server_certificate_verification_) { |
| 9365 | if (!load_certs()) { |
| 9366 | error = Error::SSLLoadingCerts; |
| 9367 | return false; |
| 9368 | } |
| 9369 | SSL_set_verify(ssl2, SSL_VERIFY_NONE, nullptr); |
| 9370 | } |
| 9371 | |
| 9372 | if (!detail::ssl_connect_or_accept_nonblocking( |
| 9373 | socket.sock, ssl2, SSL_connect, connection_timeout_sec_, |
| 9374 | connection_timeout_usec_)) { |
| 9375 | error = Error::SSLConnection; |
| 9376 | return false; |
| 9377 | } |
| 9378 | |
| 9379 | if (server_certificate_verification_) { |
| 9380 | if (server_certificate_verifier_) { |
| 9381 | if (!server_certificate_verifier_(ssl2)) { |
| 9382 | error = Error::SSLServerVerification; |
| 9383 | return false; |
| 9384 | } |
| 9385 | } else { |
| 9386 | verify_result_ = SSL_get_verify_result(ssl2); |
| 9387 | |
| 9388 | if (verify_result_ != X509_V_OK) { |
| 9389 | error = Error::SSLServerVerification; |
| 9390 | return false; |
| 9391 | } |
| 9392 | |
| 9393 | auto server_cert = SSL_get1_peer_certificate(ssl2); |
| 9394 | auto se = detail::scope_exit([&] { X509_free(server_cert); }); |
| 9395 | |
| 9396 | if (server_cert == nullptr) { |
| 9397 | error = Error::SSLServerVerification; |
| 9398 | return false; |
| 9399 | } |
| 9400 | |
| 9401 | if (server_hostname_verification_) { |
| 9402 | if (!verify_host(server_cert)) { |
| 9403 | error = Error::SSLServerHostnameVerification; |
| 9404 | return false; |
| 9405 | } |
| 9406 | } |
| 9407 | } |
| 9408 | } |
| 9409 | |
| 9410 | return true; |
| 9411 | }, |
| 9412 | [&](SSL *ssl2) { |
| 9413 | #if defined(OPENSSL_IS_BORINGSSL) |
| 9414 | SSL_set_tlsext_host_name(ssl2, host_.c_str()); |
| 9415 | #else |
| 9416 | // NOTE: Direct call instead of using the OpenSSL macro to suppress |
| 9417 | // -Wold-style-cast warning |
no test coverage detected