On 2014-06-25 at 16:28, Viktor Dukhovni <[email protected]> wrote:
> On Wed, Jun 25, 2014 at 03:23:27PM +0200, Jens Maus wrote:
>
>> Ok, but then please allow the question how I should deal with
>>
>> SSL_CTX_set_cert_verify_callback(sslCtx, func, conn);
>
> Set this callback once, with a "conn" value of 0. Use
>
> ssl_idx = SSL_get_ex_data_X509_STORE_CTX_idx();
> conn = X509_STORE_CTX_get_ex_data(store_ctx, ssl_idx);
>
> to retrieve the connection handle.
Ok, thank you for that hint. But I still have problems understanding it
completely or I haven’t made myself clear enough.
How exactly can I set the ‘conn’ pointer so that within my verify callback I
can use your suggested solution?
My current pseudo-code looks like:
— cut here —
verify_callback(..)
{
[..]
conn = X509_STORE_CTX_get_app_data(x509_ctx);
/* storing verify failures as flags in sslCertFailures */
setFlag(conn->sslCertFailures, ..)
[..]
}
InitSSL()
{
ssLCtx = SSL_CTX_new(SSLv23_client_method()); // global variable
[..]
SSL_CTX_set_verify(sslCtx, ..);
SSL_CTX_set_cert_verify_callback(sslCtx, verify_callback, conn);
}
/* then within an own thread when creating a new connection */
NewSSLConnection()
{
conn = CreateNewConnection(); // local variable
conn->ssl = SSL_new(sslCtx);
SSL_set_fd(conn->ssl, (int)conn->socket);
SSL_connect(conn->ssl);
[..]
/* evaluate conn->sslCertFailues set by verify_callback() */
}
— cut here —
Hope that makes it clear now. The problem is that ‘conn’ is created as soon as
a new connection is created and thus does not exist at the time I have to call
SSL_CTX_set_cert_verify_callback() when I use only one SSL_CTX throughout my
whole application. So I need to have some possibility that after
“CreateNewConnection” I can tell either SSL_CTX or SSL to use ‘conn’ so that as
soon as the verify_callback is executed I can get the correct app_data via
X509_STORE_CTX_get_app_data().
Hope that makes it more clear.
Thanks in advance.
best regards,
jens
--
Jens Maus, Dresden/Germany
http://jens-maus.de/
(Please note a real name change effective since 5.9.2013.
Former name: Jens Langner)
*** Content is authentic only with digital signature ***
smime.p7s
Description: S/MIME cryptographic signature
