Skip to content

Commit cdc2230

Browse files
urosg80UrosG
andauthored
server_certificate_verifier extended to reuse built-in verifier (#2064)
* server_certificate_verifier extended to reuse built-in verifier * code cleanup and SSLVerifierResponse enum clarification as per @falbrechtskirchinger comment * cleanup * clang-format * change local var verification_status_ declaration to auto * change local var verification_status_ to verification_status * clang-format * clang-format --------- Co-authored-by: UrosG <[email protected]>
1 parent 574f5ce commit cdc2230

File tree

1 file changed

+27
-10
lines changed

1 file changed

+27
-10
lines changed

httplib.h

Lines changed: 27 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -435,6 +435,15 @@ struct scope_exit {
435435

436436
} // namespace detail
437437

438+
enum SSLVerifierResponse {
439+
// no decision has been made, use the built-in certificate verifier
440+
NoDecisionMade,
441+
// connection certificate is verified and accepted
442+
CertificateAccepted,
443+
// connection certificate was processed but is rejected
444+
CertificateRejected
445+
};
446+
438447
enum StatusCode {
439448
// Information responses
440449
Continue_100 = 100,
@@ -1483,7 +1492,8 @@ class ClientImpl {
14831492
#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
14841493
void enable_server_certificate_verification(bool enabled);
14851494
void enable_server_hostname_verification(bool enabled);
1486-
void set_server_certificate_verifier(std::function<bool(SSL *ssl)> verifier);
1495+
void set_server_certificate_verifier(
1496+
std::function<SSLVerifierResponse(SSL *ssl)> verifier);
14871497
#endif
14881498

14891499
void set_logger(Logger logger);
@@ -1600,7 +1610,7 @@ class ClientImpl {
16001610
#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
16011611
bool server_certificate_verification_ = true;
16021612
bool server_hostname_verification_ = true;
1603-
std::function<bool(SSL *ssl)> server_certificate_verifier_;
1613+
std::function<SSLVerifierResponse(SSL *ssl)> server_certificate_verifier_;
16041614
#endif
16051615

16061616
Logger logger_;
@@ -1913,7 +1923,8 @@ class Client {
19131923
#ifdef CPPHTTPLIB_OPENSSL_SUPPORT
19141924
void enable_server_certificate_verification(bool enabled);
19151925
void enable_server_hostname_verification(bool enabled);
1916-
void set_server_certificate_verifier(std::function<bool(SSL *ssl)> verifier);
1926+
void set_server_certificate_verifier(
1927+
std::function<SSLVerifierResponse(SSL *ssl)> verifier);
19171928
#endif
19181929

19191930
void set_logger(Logger logger);
@@ -9008,7 +9019,7 @@ inline void ClientImpl::enable_server_hostname_verification(bool enabled) {
90089019
}
90099020

90109021
inline void ClientImpl::set_server_certificate_verifier(
9011-
std::function<bool(SSL *ssl)> verifier) {
9022+
std::function<SSLVerifierResponse(SSL *ssl)> verifier) {
90129023
server_certificate_verifier_ = verifier;
90139024
}
90149025
#endif
@@ -9617,12 +9628,18 @@ inline bool SSLClient::initialize_ssl(Socket &socket, Error &error) {
96179628
}
96189629

96199630
if (server_certificate_verification_) {
9631+
auto verification_status = SSLVerifierResponse::NoDecisionMade;
9632+
96209633
if (server_certificate_verifier_) {
9621-
if (!server_certificate_verifier_(ssl2)) {
9622-
error = Error::SSLServerVerification;
9623-
return false;
9624-
}
9625-
} else {
9634+
verification_status = server_certificate_verifier_(ssl2);
9635+
}
9636+
9637+
if (verification_status == SSLVerifierResponse::CertificateRejected) {
9638+
error = Error::SSLServerVerification;
9639+
return false;
9640+
}
9641+
9642+
if (verification_status == SSLVerifierResponse::NoDecisionMade) {
96269643
verify_result_ = SSL_get_verify_result(ssl2);
96279644

96289645
if (verify_result_ != X509_V_OK) {
@@ -10383,7 +10400,7 @@ inline void Client::enable_server_hostname_verification(bool enabled) {
1038310400
}
1038410401

1038510402
inline void Client::set_server_certificate_verifier(
10386-
std::function<bool(SSL *ssl)> verifier) {
10403+
std::function<SSLVerifierResponse(SSL *ssl)> verifier) {
1038710404
cli_->set_server_certificate_verifier(verifier);
1038810405
}
1038910406
#endif

0 commit comments

Comments
 (0)