gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

开启证书CRL检查，忽略找不到CRL的证书校验错误。

Browse Source
This commit is contained in:
zhengchao
2018-11-01 12:28:40 +08:00
parent 198818a2aa
commit b17b5fcd00
3 changed files with 32 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
platform/src/ssl_trusted_cert_storage.cpp
View File

@@ -50,6 +50,11 @@ static X509_STORE* _X509_store_create(const char* pem_bundle)
{
return NULL;
}
X509_VERIFY_PARAM *param=NULL;
param = X509_VERIFY_PARAM_new();
X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CRL_CHECK);
X509_STORE_set1_param(store, param);
X509_VERIFY_PARAM_free(param);
return store;
}
static MESA_htable_handle _create_mesa_htable(void)
@@ -101,7 +106,8 @@ static int _X509_add_cert_or_crl_add(X509_STORE* store, enum ssl_X509_obj_type
BIO *bio=NULL;
X509* x=NULL;
X509_CRL* x_crl=NULL;
int error;
bio=BIO_new_file(filename, "r");
if(bio==NULL)
{
@@ -110,26 +116,26 @@ static int _X509_add_cert_or_crl_add(X509_STORE* store, enum ssl_X509_obj_type
ret=0;
if(type==SSL_X509_OBJ_CERT)
{
x=PEM_read_bio_X509_AUX(bio, NULL, NULL, NULL);
if(x!=NULL)
while(NULL!=(x=PEM_read_bio_X509_AUX(bio, NULL, NULL, NULL)))
{
ret=X509_STORE_add_cert(store, x);
if(ret==0)
{
X509_free(x);
break;
}
}
}
else if(type==SSL_X509_OBJ_CRL)
{
x_crl=PEM_read_bio_X509_CRL(bio, NULL, NULL, NULL);
if(x_crl!=NULL)
while(NULL!=(x_crl=PEM_read_bio_X509_CRL(bio, NULL, NULL, NULL)))
{
ret=X509_STORE_add_crl(store, x_crl);
if(ret==0)
{
X509_CRL_free(x_crl);
}
break;
}
}
}
if(ret==0)
@@ -227,17 +233,19 @@ int ssl_trusted_cert_storage_verify_conn(struct ssl_trusted_cert_storage* storag
// The peer certificate chain is not necessarily available after reusing a session, in which case a NULL pointer is returned.
return 1;
}
pthread_rwlock_rdlock(&(storage->rwlock));
X509_STORE_CTX * ctx = X509_STORE_CTX_new();
X509 * cert = sk_X509_value(cert_chain, 0);
pthread_rwlock_rdlock(&(storage->rwlock));
ret = X509_STORE_CTX_init(ctx, storage->effective_store, cert, cert_chain);
assert(ret == 1);
//If a complete chain can be built and validated this function returns 1, otherwise it return zero or negtive code.
ret = X509_verify_cert(ctx);
if(ret!=1)
err_code=X509_STORE_CTX_get_error(ctx);
if(ret!=1 && err_code!=X509_V_ERR_UNABLE_TO_GET_CRL && err_code!=X509_V_ERR_DIFFERENT_CRL_SCOPE)
{
err_code=X509_STORE_CTX_get_error(ctx);
subj=ssl_x509_subject(cert);
issuer=ssl_x509_issuer(cert);
snprintf(reason, n_reason, "%s : subject - %s issuer - %s"
@@ -246,9 +254,14 @@ int ssl_trusted_cert_storage_verify_conn(struct ssl_trusted_cert_storage* storag
, issuer);
free(subj);
free(issuer);
ret=0;
}
else
{
ret=1;
}
X509_STORE_CTX_free(ctx);
pthread_rwlock_unlock(&(storage->rwlock));
return (ret == 1);
return ret;
}