| 43 | } // end anonymous namespace |
| 44 | |
| 45 | int |
| 46 | verify_callback(int signature_ok, X509_STORE_CTX *ctx) |
| 47 | { |
| 48 | X509 *cert; |
| 49 | int depth; |
| 50 | int err; |
| 51 | SSL *ssl; |
| 52 | |
| 53 | Dbg(dbg_ctl_ssl_verify, "Entered cert verify callback"); |
| 54 | |
| 55 | /* |
| 56 | * Retrieve the pointer to the SSL of the connection currently treated |
| 57 | * and the application specific data stored into the SSL object. |
| 58 | */ |
| 59 | ssl = static_cast<SSL *>(X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx())); |
| 60 | SSLNetVConnection *netvc = SSLNetVCAccess(ssl); |
| 61 | |
| 62 | // No enforcing, go away |
| 63 | if (netvc == nullptr) { |
| 64 | // No netvc, very bad. Go away. Things are not good. |
| 65 | Dbg(dbg_ctl_ssl_verify, "WARNING, NetVC is NULL in cert verify callback"); |
| 66 | return false; |
| 67 | } else if (netvc->options.verifyServerPolicy == YamlSNIConfig::Policy::DISABLED) { |
| 68 | return true; // Tell them that all is well |
| 69 | } |
| 70 | |
| 71 | depth = X509_STORE_CTX_get_error_depth(ctx); |
| 72 | cert = X509_STORE_CTX_get_current_cert(ctx); |
| 73 | err = X509_STORE_CTX_get_error(ctx); |
| 74 | |
| 75 | bool enforce_mode = (netvc->options.verifyServerPolicy == YamlSNIConfig::Policy::ENFORCED); |
| 76 | bool check_sig = |
| 77 | static_cast<uint8_t>(netvc->options.verifyServerProperties) & static_cast<uint8_t>(YamlSNIConfig::Property::SIGNATURE_MASK); |
| 78 | |
| 79 | if (check_sig) { |
| 80 | if (!signature_ok) { |
| 81 | Dbg(dbg_ctl_ssl_verify, "verification error:num=%d:%s:depth=%d", err, X509_verify_cert_error_string(err), depth); |
| 82 | const char *sni_name; |
| 83 | char buff[INET6_ADDRSTRLEN]; |
| 84 | ats_ip_ntop(netvc->get_effective_remote_addr(), buff, INET6_ADDRSTRLEN); |
| 85 | if (netvc->options.sni_servername) { |
| 86 | sni_name = netvc->options.sni_servername.get(); |
| 87 | } else { |
| 88 | sni_name = buff; |
| 89 | } |
| 90 | Warning("Core server certificate verification failed for (%s). Action=%s Error=%s server=%s(%s) depth=%d", sni_name, |
| 91 | enforce_mode ? "Terminate" : "Continue", X509_verify_cert_error_string(err), netvc->options.ssl_servername.get(), |
| 92 | buff, depth); |
| 93 | // If not enforcing ignore the error, just log warning |
| 94 | return enforce_mode ? signature_ok : 1; |
| 95 | } |
| 96 | } |
| 97 | // Don't check names and other things unless this is the terminal cert |
| 98 | if (depth != 0) { |
| 99 | // Not server cert.... |
| 100 | return signature_ok; |
| 101 | } |
| 102 |
nothing calls this directly
no test coverage detected