Dr. David von Oheimb 0c3eb2793b TLS client: allow cert verify callback return -1 for SSL_ERROR_WANT_RETRY_VERIFY
The client-side cert verification callback function may not only return
as usual for success or 0 for failure, but also -1,
typically on failure verifying the server certificate.
This makes the handshake suspend and return control to the calling application
with SSL_ERROR_WANT_RETRY_VERIFY.
The app can for instance fetch further certificates or cert status information
needed for the verification.
Calling SSL_connect() again resumes the connection attempt
by retrying the server certificate verification step.
This process may even be repeated if need be.

The core implementation of the feature is in ssl/statem/statem_clnt.c,
splitting tls_process_server_certificate() into a preparation step
that just copies the certificates received from the server to s->session->peer_chain
(rather than having them in a local variable at first) and returns to the state machine,
and a post-processing step in tls_post_process_server_certificate() that can be repeated:
Try verifying the current contents of s->session->peer_chain basically as before,
but give the verification callback function the chance to pause connecting and
make the TLS state machine later call tls_post_process_server_certificate() again.
Otherwise processing continues as usual.

The documentation of the new feature is added to SSL_CTX_set_cert_verify_callback.pod
and SSL_want.pod.

This adds two tests:
* A generic test in test/helpers/handshake.c
  on the usability of the new server cert verification retry feature.
  It is triggered via test/ssl-tests/03-custom_verify.cnf.in (while the bulky auto-
  generated changes to test/ssl-tests/03-custom_verify.cnf can be basically ignored).
* A test in test/sslapitest.c that demonstrates the effectiveness of the approach
  for augmenting the cert chain provided by the server in between SSL_connect() calls.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/13906)
2021-01-26 17:09:13 +01:00
..
2019-07-02 14:22:29 +02:00
2020-06-04 14:33:57 +01:00
2020-07-05 01:49:20 +02:00
2020-07-05 01:49:20 +02:00
2020-07-16 14:47:04 +02:00
2020-07-16 14:47:04 +02:00
2020-08-06 13:22:30 +01:00
2020-07-16 14:47:04 +02:00
2019-10-11 15:30:57 +02:00
2020-04-23 13:55:52 +01:00
2020-08-06 13:22:30 +01:00
2019-10-11 15:30:57 +02:00
2020-08-06 13:22:30 +01:00
2019-10-31 14:26:34 +01:00
2020-08-06 13:22:30 +01:00
2020-08-06 13:22:30 +01:00
2020-06-25 14:13:12 +01:00
2020-08-06 13:22:30 +01:00
2020-08-06 13:22:30 +01:00
2020-08-06 13:22:30 +01:00
2020-10-15 14:10:06 +01:00
2019-08-19 07:19:56 +02:00
2020-10-15 14:10:06 +01:00
2019-07-01 10:09:22 +02:00
2020-10-15 14:10:06 +01:00
2020-07-05 01:49:20 +02:00
2020-05-15 14:09:49 +01:00
2020-04-23 13:55:52 +01:00
2020-08-06 13:22:30 +01:00
2020-04-23 13:55:52 +01:00
2020-07-05 01:49:20 +02:00
2020-04-23 13:55:52 +01:00
2020-07-16 14:47:04 +02:00
2020-06-04 14:33:57 +01:00
2020-06-04 14:33:57 +01:00
2020-07-05 01:49:20 +02:00
2020-08-06 13:22:30 +01:00
2020-08-06 13:22:30 +01:00
2020-04-23 13:55:52 +01:00
2019-11-15 17:20:33 +01:00
2020-10-15 14:10:06 +01:00
2020-08-06 13:22:30 +01:00
2020-08-06 13:22:30 +01:00
2020-08-06 13:22:30 +01:00
2019-11-15 17:20:33 +01:00
2020-08-06 13:22:30 +01:00
2020-07-24 18:14:03 +03:00
2020-08-06 13:22:30 +01:00
2020-06-25 14:13:12 +01:00
2020-06-25 14:13:12 +01:00
2019-07-02 14:22:29 +02:00
2020-08-06 13:22:30 +01:00
2020-06-25 14:13:12 +01:00
2020-07-16 14:47:04 +02:00
2020-08-06 13:22:30 +01:00
2020-07-05 01:49:20 +02:00
2020-08-06 13:22:30 +01:00
2020-08-06 13:22:30 +01:00
2020-08-06 13:22:30 +01:00
2020-06-25 14:13:12 +01:00
2020-07-16 14:47:04 +02:00
2020-08-06 13:22:30 +01:00
2020-06-25 14:13:12 +01:00
2020-04-23 13:55:52 +01:00
2020-04-23 13:55:52 +01:00
2020-08-06 13:22:30 +01:00
2020-07-16 14:47:04 +02:00
2019-12-11 19:04:01 +01:00
2020-07-16 14:47:04 +02:00
2020-08-06 13:22:30 +01:00
2020-07-16 14:47:04 +02:00
2020-07-16 14:47:04 +02:00
2020-07-16 14:47:04 +02:00
2020-10-15 14:10:06 +01:00
2019-10-09 17:44:04 +02:00
2020-08-06 13:22:30 +01:00
2020-10-15 14:10:06 +01:00
2020-07-16 14:47:04 +02:00
2020-10-15 14:10:06 +01:00
2020-08-07 14:16:47 +10:00
2020-08-06 13:22:30 +01:00
2020-08-06 13:22:30 +01:00
2020-04-23 13:55:52 +01:00
2020-04-23 13:55:52 +01:00
2020-08-06 13:22:30 +01:00
2020-04-23 13:55:52 +01:00
2020-04-23 13:55:52 +01:00
2020-04-23 13:55:52 +01:00
2020-04-23 13:55:52 +01:00
2020-04-23 13:55:52 +01:00
2020-04-23 13:55:52 +01:00
2019-10-31 14:26:34 +01:00
2020-08-06 13:22:30 +01:00
2020-05-15 14:09:49 +01:00
2020-08-06 13:22:30 +01:00
2021-01-07 13:38:50 +00:00
2020-08-06 13:22:30 +01:00
2020-08-06 13:22:30 +01:00
2020-06-30 14:14:05 +01:00
2020-07-16 14:47:04 +02:00
2020-08-06 13:22:30 +01:00
2020-08-06 13:22:30 +01:00
2020-08-06 13:22:30 +01:00
2020-08-06 13:22:30 +01:00
2020-08-06 13:22:30 +01:00
2020-07-16 14:47:04 +02:00
2020-10-15 14:10:06 +01:00
2020-04-23 13:55:52 +01:00
2020-04-23 13:55:52 +01:00
2020-08-26 14:04:17 +03:00
2020-07-16 14:47:04 +02:00
2020-04-23 13:55:52 +01:00
2020-04-23 13:55:52 +01:00
2020-04-28 09:06:04 +10:00
2020-10-15 14:10:06 +01:00
2020-08-06 13:22:30 +01:00
2020-10-01 09:25:20 +01:00