From 99f09bc522a2981473b154fff112ef1c4041bb02 Mon Sep 17 00:00:00 2001 From: Emmanuel Hocdet Date: Wed, 1 Mar 2017 18:54:56 +0100 Subject: [PATCH] BUG/MEDIUM: ssl: fix verify/ca-file per certificate SSL verify and client_CA inherits from the initial ctx (default_ctx). When a certificate is found, the SSL connection environment must be replaced by the certificate configuration (via SSL_set_verify and SSL_set_client_CA_list). --- src/ssl_sock.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/src/ssl_sock.c b/src/ssl_sock.c index 0075db7..44198b7 100644 --- a/src/ssl_sock.c +++ b/src/ssl_sock.c @@ -1437,6 +1437,13 @@ ssl_sock_generate_certificate(const char *servername, struct bind_conf *bind_con } #endif /* !defined SSL_NO_GENERATE_CERTIFICATES */ +static void ssl_sock_switchctx_set(SSL *ssl, SSL_CTX *ctx) +{ + SSL_set_verify(ssl, SSL_CTX_get_verify_mode(ctx), ssl_sock_bind_verifycbk); + SSL_set_client_CA_list(ssl, SSL_dup_CA_list(SSL_CTX_get_client_CA_list(ctx))); + SSL_set_SSL_CTX(ssl, ctx); +} + #ifdef OPENSSL_IS_BORINGSSL static int ssl_sock_switchctx_err_cbk(SSL *ssl, int *al, void *priv) @@ -1615,7 +1622,7 @@ static int ssl_sock_switchctx_cbk(const struct ssl_early_callback_ctx *ctx) if (node) { /* switch ctx */ - SSL_set_SSL_CTX(ctx->ssl, container_of(node, struct sni_ctx, name)->ctx); + ssl_sock_switchctx_set(ctx->ssl, container_of(node, struct sni_ctx, name)->ctx); return 1; } if (!s->strict_sni) @@ -1706,7 +1713,7 @@ static int ssl_sock_switchctx_cbk(SSL *ssl, int *al, void *priv) } /* switch ctx */ - SSL_set_SSL_CTX(ssl, container_of(node, struct sni_ctx, name)->ctx); + ssl_sock_switchctx_set(ssl, container_of(node, struct sni_ctx, name)->ctx); return SSL_TLSEXT_ERR_OK; } #endif /* (!) OPENSSL_IS_BORINGSSL */ -- 2.1.4