commit 3a1dd46e4e902ce669616a9bb5f54a9e7c801df6
author David Benjamin <davidben@google.com> Tue Jul 11 16:13:10 2017 -0400
committer David Benjamin <davidben@google.com> Mon Jul 17 20:55:23 2017 +0000
tree 832ab83303faf744df8acdae397107fbcf9b9206
parent 7e9e06a7393298c65a2a33e0cb3d13e957c06e4a

Add async certificate verification callback.

This also serves as a certificate verification callback for
CRYPTO_BUFFER-based consumers. Remove the silly
SSL_CTX_i_promise_to_verify_certs_after_the_handshake placeholder.

Bug: 54, chromium:347402
Change-Id: I4c6b445cb9cd7204218acb2e5d1625e6f37aff6f
Reviewed-on: https://boringssl-review.googlesource.com/17964
Reviewed-by: David Benjamin <davidben@google.com>

ssl/handshake_server.cc

diff --git a/ssl/handshake_server.cc b/ssl/handshake_server.cc
index ee5358c..00ac549 100644
--- a/ssl/handshake_server.cc
+++ b/ssl/handshake_server.cc
@@ -282,6 +282,23 @@
             goto end;
           }
         }
+        hs->state = SSL3_ST_VERIFY_CLIENT_CERT;
+        break;
+
+      case SSL3_ST_VERIFY_CLIENT_CERT:
+        if (sk_CRYPTO_BUFFER_num(hs->new_session->certs) > 0) {
+          switch (ssl_verify_peer_cert(hs)) {
+            case ssl_verify_ok:
+              break;
+            case ssl_verify_invalid:
+              ret = -1;
+              goto end;
+            case ssl_verify_retry:
+              ssl->rwstate = SSL_CERTIFICATE_VERIFY;
+              ret = -1;
+              goto end;
+          }
+        }
         hs->state = SSL3_ST_SR_KEY_EXCH_A;
         break;
 
@@ -1264,10 +1281,6 @@
     hs->new_session->peer_sha256_valid = 1;
   }
 
-  if (!ssl->ctx->x509_method->session_verify_cert_chain(hs->new_session, ssl)) {
-    return -1;
-  }
-
   return 1;
 }