commit 3a1dd46e4e902ce669616a9bb5f54a9e7c801df6
author David Benjamin <davidben@google.com> Tue Jul 11 16:13:10 2017 -0400
committer David Benjamin <davidben@google.com> Mon Jul 17 20:55:23 2017 +0000
tree 832ab83303faf744df8acdae397107fbcf9b9206
parent 7e9e06a7393298c65a2a33e0cb3d13e957c06e4a

Add async certificate verification callback.

This also serves as a certificate verification callback for
CRYPTO_BUFFER-based consumers. Remove the silly
SSL_CTX_i_promise_to_verify_certs_after_the_handshake placeholder.

Bug: 54, chromium:347402
Change-Id: I4c6b445cb9cd7204218acb2e5d1625e6f37aff6f
Reviewed-on: https://boringssl-review.googlesource.com/17964
Reviewed-by: David Benjamin <davidben@google.com>

ssl/handshake_client.cc

diff --git a/ssl/handshake_client.cc b/ssl/handshake_client.cc
index 9efbf0a..10c10a2 100644
--- a/ssl/handshake_client.cc
+++ b/ssl/handshake_client.cc
@@ -173,7 +173,6 @@
 static int ssl3_get_server_hello(SSL_HANDSHAKE *hs);
 static int ssl3_get_server_certificate(SSL_HANDSHAKE *hs);
 static int ssl3_get_cert_status(SSL_HANDSHAKE *hs);
-static int ssl3_verify_server_cert(SSL_HANDSHAKE *hs);
 static int ssl3_get_server_key_exchange(SSL_HANDSHAKE *hs);
 static int ssl3_get_certificate_request(SSL_HANDSHAKE *hs);
 static int ssl3_get_server_hello_done(SSL_HANDSHAKE *hs);
@@ -292,9 +291,16 @@
 
       case SSL3_ST_VERIFY_SERVER_CERT:
         if (ssl_cipher_uses_certificate_auth(hs->new_cipher)) {
-          ret = ssl3_verify_server_cert(hs);
-          if (ret <= 0) {
-            goto end;
+          switch (ssl_verify_peer_cert(hs)) {
+            case ssl_verify_ok:
+              break;
+            case ssl_verify_invalid:
+              ret = -1;
+              goto end;
+            case ssl_verify_retry:
+              ssl->rwstate = SSL_CERTIFICATE_VERIFY;
+              ret = -1;
+              goto end;
           }
         }
         hs->state = SSL3_ST_CR_KEY_EXCH_A;
@@ -1185,15 +1191,6 @@
   return 1;
 }
 
-static int ssl3_verify_server_cert(SSL_HANDSHAKE *hs) {
-  SSL *const ssl = hs->ssl;
-  if (!ssl->ctx->x509_method->session_verify_cert_chain(hs->new_session, ssl)) {
-    return -1;
-  }
-
-  return 1;
-}
-
 static int ssl3_get_server_key_exchange(SSL_HANDSHAKE *hs) {
   SSL *const ssl = hs->ssl;
   EC_KEY *ecdh = NULL;