| 97 | } |
| 98 | |
| 99 | int |
| 100 | CB_client_verify(TSCont cont, TSEvent event, void *edata) |
| 101 | { |
| 102 | TSVConn ssl_vc = reinterpret_cast<TSVConn>(edata); |
| 103 | |
| 104 | int count = reinterpret_cast<intptr_t>(TSContDataGet(cont)); |
| 105 | |
| 106 | // Is this a good name or not? |
| 107 | TSEvent reenable_event = TS_EVENT_CONTINUE; |
| 108 | X509_STORE_CTX *ctx = reinterpret_cast<X509_STORE_CTX *>(TSVConnSslVerifyCTXGet(ssl_vc)); |
| 109 | if (ctx) { |
| 110 | STACK_OF(X509) *chain = X509_STORE_CTX_get1_chain(ctx); |
| 111 | // X509 *cert = X509_STORE_CTX_get_current_cert(ctx); |
| 112 | bool retval = false; |
| 113 | // BoringSSL has sk_X509_num() return size_t. |
| 114 | for (int i = 0; i < static_cast<int>(sk_X509_num(chain)) && !retval; i++) { |
| 115 | auto cert = sk_X509_value(chain, i); |
| 116 | retval = check_names(cert); |
| 117 | } |
| 118 | if (!retval) { |
| 119 | reenable_event = TS_EVENT_ERROR; |
| 120 | } |
| 121 | sk_X509_pop_free(chain, X509_free); |
| 122 | } else { |
| 123 | reenable_event = TS_EVENT_ERROR; |
| 124 | } |
| 125 | |
| 126 | Dbg(dbg_ctl, "Client verify callback %d %p - event is %s %s", count, ssl_vc, event == TS_EVENT_SSL_VERIFY_CLIENT ? "good" : "bad", |
| 127 | reenable_event == TS_EVENT_ERROR ? "error HS" : "good HS"); |
| 128 | |
| 129 | // All done, reactivate things |
| 130 | TSVConnReenableEx(ssl_vc, reenable_event); |
| 131 | return TS_SUCCESS; |
| 132 | } |
| 133 | |
| 134 | void |
| 135 | parse_callbacks(int argc, const char *argv[], int &count) |
nothing calls this directly
no test coverage detected