fix https client (#11608)
- do full chain check in env
Timotej S committed
Oct 4, 2021 at 08:52 UTC
9d483133cd08007011a74b8ac59148c1855b6bcd
1 file changed
+35
aclk/https_client.c
+35
@@ -421,6 +421,35 @@ err_exit:
421
return rc;
422
}
423
424
+static int cert_verify_callback(int preverify_ok, X509_STORE_CTX *ctx)
425
+{
426
+ X509 *err_cert;
427
+ int err, depth;
428
+ char *err_str;
429
+
430
+ if (!preverify_ok) {
431
+ err = X509_STORE_CTX_get_error(ctx);
432
+ depth = X509_STORE_CTX_get_error_depth(ctx);
433
+ err_cert = X509_STORE_CTX_get_current_cert(ctx);
434
+ err_str = X509_NAME_oneline(X509_get_subject_name(err_cert), NULL, 0);
435
+
436
+ error("Cert Chain verify error:num=%d:%s:depth=%d:%s", err,
437
+ X509_verify_cert_error_string(err), depth, err_str);
438
+
439
+ free(err_str);
440
+ }
441
+
442
+#ifdef ACLK_SSL_ALLOW_SELF_SIGNED
443
+ if (!preverify_ok && err == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT)
444
+ {
445
+ preverify_ok = 1;
446
+ error("Self Signed Certificate Accepted as the agent was built with ACLK_SSL_ALLOW_SELF_SIGNED");
447
+ }
448
+#endif
449
+
450
+ return preverify_ok;
451
+}
452
+
453
int https_request(https_req_t *request, https_req_response_t *response) {
454
int rc = 1, ret;
455
char connect_port_str[PORT_STR_MAX_BYTES];
@@ -480,6 +509,12 @@ int https_request(https_req_t *request, https_req_response_t *response) {
509
goto exit_sock;
510
}
511
512
+ if (!SSL_CTX_set_default_verify_paths(ctx->ssl_ctx)) {
513
+ error("Error setting default verify paths");
514
+ goto exit_CTX;
515
+ }
516
+ SSL_CTX_set_verify(ctx->ssl_ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, cert_verify_callback);
517
+
518
ctx->ssl = SSL_new(ctx->ssl_ctx);
519
if (ctx->ssl==NULL) {
520
error("Cannot allocate SSL");