commit 5b90eb98f6746e8db7d2a6c3eae58aca38254494
author David Benjamin <davidben@google.com> Sat Nov 04 22:57:54 2017 -0400
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Mon Nov 06 17:44:20 2017 +0000
tree d68280d55959a6f0018d33376b1b10d99f01fa51
parent fdd5fed036996997dc11fef8fb1d4b10cd53b15f

Add a -require-any-client-cert flag to bssl server

Useful for testing client cert stuff.

Change-Id: Ieb3cb02a685b22c18cfc50b44170221017889a57
Reviewed-on: https://boringssl-review.googlesource.com/22644
Commit-Queue: Steven Valdez <svaldez@google.com>
Reviewed-by: Steven Valdez <svaldez@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>

tool/server.cc

diff --git a/tool/server.cc b/tool/server.cc
index b6ed284..0061cb3 100644
--- a/tool/server.cc
+++ b/tool/server.cc
@@ -80,6 +80,10 @@
         "Print debug information about the handshake",
     },
     {
+        "-require-any-client-cert", kBooleanArgument,
+        "The server will require a client certificate.",
+    },
+    {
         "", kOptionalArgument, "",
     },
 };
@@ -320,6 +324,14 @@
     SSL_CTX_set_info_callback(ctx.get(), InfoCallback);
   }
 
+  if (args_map.count("-require-any-client-cert") != 0) {
+    SSL_CTX_set_verify(
+        ctx.get(), SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, nullptr);
+    SSL_CTX_set_cert_verify_callback(
+        ctx.get(), [](X509_STORE_CTX *store, void *arg) -> int { return 1; },
+        nullptr);
+  }
+
   Listener listener;
   if (!listener.Init(args_map["-accept"])) {
     return false;