| 1049 | } |
| 1050 | |
| 1051 | static apr_status_t ssl_init_ctx_verify(server_rec *s, |
| 1052 | apr_pool_t *p, |
| 1053 | apr_pool_t *ptemp, |
| 1054 | modssl_ctx_t *mctx) |
| 1055 | { |
| 1056 | SSL_CTX *ctx = mctx->ssl_ctx; |
| 1057 | |
| 1058 | int verify = SSL_VERIFY_NONE; |
| 1059 | STACK_OF(X509_NAME) *ca_list; |
| 1060 | |
| 1061 | if (mctx->auth.verify_mode == SSL_CVERIFY_UNSET) { |
| 1062 | mctx->auth.verify_mode = SSL_CVERIFY_NONE; |
| 1063 | } |
| 1064 | |
| 1065 | if (mctx->auth.verify_depth == UNSET) { |
| 1066 | mctx->auth.verify_depth = 1; |
| 1067 | } |
| 1068 | |
| 1069 | /* |
| 1070 | * Configure callbacks for SSL context |
| 1071 | */ |
| 1072 | if (mctx->auth.verify_mode == SSL_CVERIFY_REQUIRE) { |
| 1073 | verify |= SSL_VERIFY_PEER_STRICT; |
| 1074 | } |
| 1075 | |
| 1076 | if ((mctx->auth.verify_mode == SSL_CVERIFY_OPTIONAL) || |
| 1077 | (mctx->auth.verify_mode == SSL_CVERIFY_OPTIONAL_NO_CA)) |
| 1078 | { |
| 1079 | verify |= SSL_VERIFY_PEER; |
| 1080 | } |
| 1081 | |
| 1082 | SSL_CTX_set_verify(ctx, verify, ssl_callback_SSLVerify); |
| 1083 | |
| 1084 | /* |
| 1085 | * Configure Client Authentication details |
| 1086 | */ |
| 1087 | if (mctx->auth.ca_cert_file || mctx->auth.ca_cert_path) { |
| 1088 | ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s, |
| 1089 | "Configuring client authentication"); |
| 1090 | |
| 1091 | if (!modssl_CTX_load_verify_locations(ctx, mctx->auth.ca_cert_file, |
| 1092 | mctx->auth.ca_cert_path)) { |
| 1093 | ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(01895) |
| 1094 | "Unable to configure verify locations " |
| 1095 | "for client authentication"); |
| 1096 | ssl_log_ssl_error(SSLLOG_MARK, APLOG_EMERG, s); |
| 1097 | return ssl_die(s); |
| 1098 | } |
| 1099 | |
| 1100 | if (mctx->pks && (mctx->pks->ca_name_file || mctx->pks->ca_name_path)) { |
| 1101 | ca_list = ssl_init_FindCAList(s, ptemp, |
| 1102 | mctx->pks->ca_name_file, |
| 1103 | mctx->pks->ca_name_path); |
| 1104 | } else |
| 1105 | ca_list = ssl_init_FindCAList(s, ptemp, |
| 1106 | mctx->auth.ca_cert_file, |
| 1107 | mctx->auth.ca_cert_path); |
| 1108 | if (sk_X509_NAME_num(ca_list) <= 0) { |
no test coverage detected