src/ssl_sock.c
int ssl_sock_verifycbk(int ok, X509_STORE_CTX *x_store)
{
	SSL *ssl;
	struct connection *conn;
	int err, depth;

	ssl = X509_STORE_CTX_get_ex_data(x_store, SSL_get_ex_data_X509_STORE_CTX_idx());
	conn = (struct connection *)SSL_get_app_data(ssl);

	conn->xprt_st |= SSL_SOCK_ST_FL_VERIFY_DONE;

	if (ok) /* no errors */
		return ok;

	depth = X509_STORE_CTX_get_error_depth(x_store);
	err = X509_STORE_CTX_get_error(x_store);

	/* check if CA error needs to be ignored */
	if (depth > 0) {
		if (!SSL_SOCK_ST_TO_CA_ERROR(conn->xprt_st)) {
			conn->xprt_st |= SSL_SOCK_CA_ERROR_TO_ST(err);
			conn->xprt_st |= SSL_SOCK_CAEDEPTH_TO_ST(depth);
		}

		if (objt_listener(conn->target)->bind_conf->ca_ignerr & (1ULL << err)) {
			ERR_clear_error();
			return 1;
		}

		conn->err_code = CO_ER_SSL_CA_FAIL;
		return 0;
	}

	if (!SSL_SOCK_ST_TO_CRTERROR(conn->xprt_st))
		conn->xprt_st |= SSL_SOCK_CRTERROR_TO_ST(err);

	/* check if certificate error needs to be ignored */
	if (objt_listener(conn->target)->bind_conf->crt_ignerr & (1ULL << err)) {
		ERR_clear_error();
		return 1;
	}

	conn->err_code = CO_ER_SSL_CRT_FAIL;
	return 0;
}
/* Callback is called for each certificate of the chain during a verify
   ok is set to 1 if preverify detect no error on current certificate.
   Returns 0 to break the handshake, 1 otherwise. */
Callback is called for each certificate of the chain during a verify
ok is set to 1 if preverify detect no error on current certificate.
Returns 0 to break the handshake, 1 otherwise.
Callback is called for each certificate of the chain during a verify ok is set to 1 if preverify detect no error on current certificate . Returns 0 to break the handshake 1 otherwise .
int ssl_sock_verifycbk(int ok, X509_STORE_CTX *x_store)
{
	SSL *ssl;
	struct connection *conn;
	int err, depth;
	ssl = X509_STORE_CTX_get_ex_data(x_store, SSL_get_ex_data_X509_STORE_CTX_idx());
	conn = (struct connection *)SSL_get_app_data(ssl);
	conn->xprt_st |= SSL_SOCK_ST_FL_VERIFY_DONE;
	if (ok) 
		return ok;
	depth = X509_STORE_CTX_get_error_depth(x_store);
	err = X509_STORE_CTX_get_error(x_store);
	if (depth > 0) {
		if (!SSL_SOCK_ST_TO_CA_ERROR(conn->xprt_st)) {
			conn->xprt_st |= SSL_SOCK_CA_ERROR_TO_ST(err);
			conn->xprt_st |= SSL_SOCK_CAEDEPTH_TO_ST(depth);
		}
		if (objt_listener(conn->target)->bind_conf->ca_ignerr & (1ULL << err)) {
			ERR_clear_error();
			return 1;
		}
		conn->err_code = CO_ER_SSL_CA_FAIL;
		return 0;
	}
	if (!SSL_SOCK_ST_TO_CRTERROR(conn->xprt_st))
		conn->xprt_st |= SSL_SOCK_CRTERROR_TO_ST(err);
	if (objt_listener(conn->target)->bind_conf->crt_ignerr & (1ULL << err)) {
		ERR_clear_error();
		return 1;
	}
	conn->err_code = CO_ER_SSL_CRT_FAIL;
	return 0;
}
int ssl_sock_verifycbk ( int ok , X509_STORE_CTX * x_store ) { SSL * ssl ; struct connection * conn ; int err , depth ; ssl = X509_STORE_CTX_get_ex_data ( x_store , SSL_get_ex_data_X509_STORE_CTX_idx ( ) ) ; conn = ( struct connection * ) SSL_get_app_data ( ssl ) ; conn -> xprt_st |= SSL_SOCK_ST_FL_VERIFY_DONE ; if ( ok ) return ok ; depth = X509_STORE_CTX_get_error_depth ( x_store ) ; err = X509_STORE_CTX_get_error ( x_store ) ; if ( depth > 0 ) { if ( ! SSL_SOCK_ST_TO_CA_ERROR ( conn -> xprt_st ) ) { conn -> xprt_st |= SSL_SOCK_CA_ERROR_TO_ST ( err ) ; conn -> xprt_st |= SSL_SOCK_CAEDEPTH_TO_ST ( depth ) ; } if ( objt_listener ( conn -> target ) -> bind_conf -> ca_ignerr & ( 1ULL << err ) ) { ERR_clear_error ( ) ; return 1 ; } conn -> err_code = CO_ER_SSL_CA_FAIL ; return 0 ; } if ( ! SSL_SOCK_ST_TO_CRTERROR ( conn -> xprt_st ) ) conn -> xprt_st |= SSL_SOCK_CRTERROR_TO_ST ( err ) ; if ( objt_listener ( conn -> target ) -> bind_conf -> crt_ignerr & ( 1ULL << err ) ) { ERR_clear_error ( ) ; return 1 ; } conn -> err_code = CO_ER_SSL_CRT_FAIL ; return 0 ; }
Callback is called for each certificate of the chain during a verify
ok is set to 1 if preverify detect no error on current certificate.
Callback is called for each certificate of the chain during a verify ok is set to 1 if preverify detect no error on current certificate .
/* no errors */ /* check if CA error needs to be ignored */ /* check if certificate error needs to be ignored */