Hi Timo,
Thanks, committed to CVS now although with some changes.
Nice!
- ssl_verify_client_cert now returns 0 in case of an invalid cert. was there a reason why it always returned 1?
Yes. ssl_verify_client_cert=yes doesn't require the certificate to be valid. Only ssl_require_valid_client_cert=yes in auth settings does that. This allows for some people to authenticate with certificates and others to authenticate the usual way. So I dropped this part of your patch.
OK, you also changed SSL_VERIFY_FAIL_IF_NO_PEER_CERT back to SSL_VERIFY_CLIENT_ONCE, same reason? Maybe the valid-client-cert-feature can have a conf.file switch, or a #define in the sourcecode, what's your opinion?
- if( (store=SSL_CTX_get_cert_store(ssl_ctx)) != NULL )
Can it ever return NULL? Looking at the manual page it didn't seem so, so I dropped the NULL-check from here.
No, SSL_CTX_new() returns NULL (1) if the "store" can't be malloc'ed, ssl-proxy-openssl.c checks this and fails with i_fatal(). So the NULL-check can be dropped. (1: openssl 0.9.7d source)
--
groeten,
HenkJan Wolthuis