static int verify_callback(int preverify_ok, X509_STORE_CTX *ctx) {
int ret = preverify_ok;
/* determine the status for the current cert */
X509_STORE_CTX_get_current_cert(ctx);
int err = X509_STORE_CTX_get_error(ctx);
int depth = X509_STORE_CTX_get_error_depth(ctx);
/* conjure the stream & context to use */
SSL *ssl = (SSL*)X509_STORE_CTX_get_ex_data
(ctx, SSL_get_ex_data_X509_STORE_CTX_idx());
SSLSocket *stream =
(SSLSocket*)SSL_get_ex_data(ssl, SSLSocket::GetSSLExDataIndex());
/* if allow_self_signed is set, make sure that verification succeeds */
if (err == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT &&
stream->getContext()["allow_self_signed"].toBoolean()) {
ret = 1;
}
/* check the depth */
Variant vdepth = stream->getContext()["verify_depth"];
if (vdepth.toBoolean() && depth > vdepth.toInt64()) {
ret = 0;
X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_CHAIN_TOO_LONG);
}
return ret;
}
static int passwd_callback(char *buf, int num, int verify, void *data) {
/* TODO: could expand this to make a callback into PHP user-space */
SSLSocket *stream = (SSLSocket *)data;
String passphrase = stream->getContext()["passphrase"];
if (!passphrase.empty() && passphrase.size() < num - 1) {
memcpy(buf, passphrase.data(), passphrase.size() + 1);
return passphrase.size();
}
return 0;
}
