Callback function for verifying client certificate
| 269 | |
| 270 | // Callback function for verifying client certificate |
| 271 | static int |
| 272 | ssl_verify_client_callback(int preverify_ok, X509_STORE_CTX *ctx) |
| 273 | { |
| 274 | Dbg(dbg_ctl_ssl_verify, "Callback: verify client cert"); |
| 275 | auto *ssl = static_cast<SSL *>(X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx())); |
| 276 | SSLNetVConnection *netvc = SSLNetVCAccess(ssl); |
| 277 | TLSBasicSupport *tbs = TLSBasicSupport::getInstance(ssl); |
| 278 | |
| 279 | if (tbs == nullptr) { |
| 280 | Dbg(dbg_ctl_ssl_verify, "call back on stale netvc"); |
| 281 | return false; |
| 282 | } |
| 283 | |
| 284 | if (tbs->verify_certificate(ctx) == 1) { // hook moved the handshake state to terminal |
| 285 | Warning("TS_EVENT_SSL_VERIFY_CLIENT plugin failed the client certificate check for %s.", netvc->options.sni_servername.get()); |
| 286 | return false; |
| 287 | } |
| 288 | |
| 289 | return preverify_ok; |
| 290 | } |
| 291 | |
| 292 | #if HAVE_SSL_CTX_SET_CLIENT_HELLO_CB |
| 293 | // Pausable callback |
nothing calls this directly
no test coverage detected