Function pn_ssl_init

c/src/ssl/schannel.cpp:683–729

static pn_ssl_domain_t *default_server_domain = 0;

int pn_ssl_init(pn_ssl_t *ssl0, pn_ssl_domain_t *domain, const char *session_id)
{
  pn_transport_t *transport = get_transport_internal(ssl0);
  pni_ssl_t *ssl = transport->ssl;
  if (!ssl) return -1;
  if (ssl->state != CREATED) return -1;

  if (!domain) {
    if (transport->server) {
        if (!default_server_domain) {
            default_server_domain = pn_ssl_domain(PN_SSL_MODE_SERVER);
        }
        domain = default_server_domain;
    }
    else {
      if (!default_client_domain) {
        default_client_domain = pn_ssl_domain(PN_SSL_MODE_CLIENT);
        pn_ssl_domain_set_peer_authentication(default_client_domain, PN_SSL_VERIFY_PEER_NAME, NULL);
      }
      domain = default_client_domain;
    }
  }

  csguard g(&domain->cslock);
  csguard g2(&domain->cred->cslock);
  if (session_id && domain->mode == PN_SSL_MODE_CLIENT)
    ssl->session_id = pn_strdup(session_id);

  // If SSL doesn't specifically allow skipping encryption, require SSL
  // TODO: This is a probably a stop-gap until allow_unsecured is removed
  if (!domain->allow_unsecured) transport->encryption_required = true;

  ssl->cred = domain->cred;
  pn_incref(domain->cred);

  SECURITY_STATUS status = SEC_E_OK;
  ssl->cred_handle = win_credential_cred_handle(ssl->cred, ssl->session_id, &status);
  if (status != SEC_E_OK) {
    ssl_log_error_status(status, "Credentials handle failure");
    return -1;
  }

  ssl->state = (domain->mode == PN_SSL_MODE_CLIENT) ? CLIENT_HELLO : NEGOTIATING;
  ssl->verify_mode = domain->verify_mode;
  ssl->mode = domain->mode;
  return 0;
}


int pn_ssl_domain_allow_unsecured_client(pn_ssl_domain_t *domain)