| 1844 | } |
| 1845 | |
| 1846 | static apr_status_t ssl_init_proxy_certs(server_rec *s, |
| 1847 | apr_pool_t *p, |
| 1848 | apr_pool_t *ptemp, |
| 1849 | modssl_ctx_t *mctx) |
| 1850 | { |
| 1851 | int n, ncerts = 0; |
| 1852 | STACK_OF(X509_INFO) *sk; |
| 1853 | modssl_pk_proxy_t *pkp = mctx->pkp; |
| 1854 | STACK_OF(X509) *chain; |
| 1855 | X509_STORE_CTX *sctx; |
| 1856 | X509_STORE *store = SSL_CTX_get_cert_store(mctx->ssl_ctx); |
| 1857 | int addl_chain = 0; /* non-zero if additional chain certs were |
| 1858 | * added to store */ |
| 1859 | |
| 1860 | ap_assert(store != NULL); /* safe to assume always non-NULL? */ |
| 1861 | |
| 1862 | #if OPENSSL_VERSION_NUMBER >= 0x1010100fL && !defined(LIBRESSL_VERSION_NUMBER) |
| 1863 | /* For OpenSSL >=1.1.1, turn on client cert support which is |
| 1864 | * otherwise turned off by default (by design). |
| 1865 | * https://github.com/openssl/openssl/issues/6933 */ |
| 1866 | SSL_CTX_set_post_handshake_auth(mctx->ssl_ctx, 1); |
| 1867 | #endif |
| 1868 | |
| 1869 | SSL_CTX_set_client_cert_cb(mctx->ssl_ctx, |
| 1870 | ssl_callback_proxy_cert); |
| 1871 | |
| 1872 | if (!(pkp->cert_file || pkp->cert_path)) { |
| 1873 | return APR_SUCCESS; |
| 1874 | } |
| 1875 | |
| 1876 | sk = sk_X509_INFO_new_null(); |
| 1877 | |
| 1878 | if (pkp->cert_file) { |
| 1879 | load_x509_info(ptemp, sk, pkp->cert_file); |
| 1880 | } |
| 1881 | |
| 1882 | if (pkp->cert_path) { |
| 1883 | ssl_init_ca_cert_path(s, ptemp, pkp->cert_path, NULL, sk); |
| 1884 | } |
| 1885 | |
| 1886 | /* Check that all client certs have got certificates and private |
| 1887 | * keys. Note the number of certs in the stack may decrease |
| 1888 | * during the loop. */ |
| 1889 | for (n = 0; n < sk_X509_INFO_num(sk); n++) { |
| 1890 | X509_INFO *inf = sk_X509_INFO_value(sk, n); |
| 1891 | int has_privkey = inf->x_pkey && inf->x_pkey->dec_pkey; |
| 1892 | |
| 1893 | /* For a lone certificate in the file, trust it as a |
| 1894 | * CA/intermediate certificate. */ |
| 1895 | if (inf->x509 && !has_privkey && !inf->enc_data) { |
| 1896 | ssl_log_xerror(SSLLOG_MARK, APLOG_DEBUG, 0, ptemp, s, inf->x509, |
| 1897 | APLOGNO(10261) "Trusting non-leaf certificate"); |
| 1898 | X509_STORE_add_cert(store, inf->x509); /* increments inf->x509 */ |
| 1899 | /* Delete from the stack and iterate again. */ |
| 1900 | X509_INFO_free(inf); |
| 1901 | sk_X509_INFO_delete(sk, n); |
| 1902 | n--; |
| 1903 | addl_chain = 1; |
no test coverage detected