* This OpenSSL callback function is called when OpenSSL * does client authentication and verifies the certificate chain. */
| 1566 | * does client authentication and verifies the certificate chain. |
| 1567 | */ |
| 1568 | int ssl_callback_SSLVerify(int ok, X509_STORE_CTX *ctx) |
| 1569 | { |
| 1570 | /* Get Apache context back through OpenSSL context */ |
| 1571 | SSL *ssl = X509_STORE_CTX_get_ex_data(ctx, |
| 1572 | SSL_get_ex_data_X509_STORE_CTX_idx()); |
| 1573 | conn_rec *conn = (conn_rec *)SSL_get_app_data(ssl); |
| 1574 | request_rec *r = (request_rec *)modssl_get_app_data2(ssl); |
| 1575 | server_rec *s = r ? r->server : mySrvFromConn(conn); |
| 1576 | |
| 1577 | SSLSrvConfigRec *sc = mySrvConfig(s); |
| 1578 | SSLConnRec *sslconn = myConnConfig(conn); |
| 1579 | SSLDirConfigRec *dc = r ? myDirConfig(r) : sslconn->dc; |
| 1580 | modssl_ctx_t *mctx = myConnCtxConfig(conn, sc); |
| 1581 | int crl_check_mode = mctx->crl_check_mask & ~SSL_CRLCHECK_FLAGS; |
| 1582 | |
| 1583 | /* Get verify ingredients */ |
| 1584 | int errnum = X509_STORE_CTX_get_error(ctx); |
| 1585 | int errdepth = X509_STORE_CTX_get_error_depth(ctx); |
| 1586 | int depth = UNSET; |
| 1587 | int verify = SSL_CVERIFY_UNSET; |
| 1588 | |
| 1589 | /* |
| 1590 | * Log verification information |
| 1591 | */ |
| 1592 | ssl_log_cxerror(SSLLOG_MARK, APLOG_DEBUG, 0, conn, |
| 1593 | X509_STORE_CTX_get_current_cert(ctx), APLOGNO(02275) |
| 1594 | "Certificate Verification, depth %d, " |
| 1595 | "CRL checking mode: %s (%x)", errdepth, |
| 1596 | crl_check_mode == SSL_CRLCHECK_CHAIN ? "chain" : |
| 1597 | crl_check_mode == SSL_CRLCHECK_LEAF ? "leaf" : "none", |
| 1598 | mctx->crl_check_mask); |
| 1599 | |
| 1600 | /* |
| 1601 | * Check for optionally acceptable non-verifiable issuer situation |
| 1602 | */ |
| 1603 | if (dc) { |
| 1604 | if (conn->outgoing) { |
| 1605 | verify = dc->proxy->auth.verify_mode; |
| 1606 | } |
| 1607 | else { |
| 1608 | verify = dc->nVerifyClient; |
| 1609 | } |
| 1610 | } |
| 1611 | if (!dc || (verify == SSL_CVERIFY_UNSET)) { |
| 1612 | verify = mctx->auth.verify_mode; |
| 1613 | } |
| 1614 | |
| 1615 | if (verify == SSL_CVERIFY_NONE) { |
| 1616 | /* |
| 1617 | * SSLProxyVerify is either not configured or set to "none". |
| 1618 | * (this callback doesn't happen in the server context if SSLVerify |
| 1619 | * is not configured or set to "none") |
| 1620 | */ |
| 1621 | return TRUE; |
| 1622 | } |
| 1623 | |
| 1624 | if (ssl_verify_error_is_optional(errnum) && |
| 1625 | (verify == SSL_CVERIFY_OPTIONAL_NO_CA)) |
nothing calls this directly
no test coverage detected