make it possible for proxy to use CRL callback

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@94336 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/ssl/mod_ssl.h b/modules/ssl/mod_ssl.h
index 6146ad835176523cbbdb2d24210d590fc51ef869..1d2c623e8b22f28976ae111ba35019bd1f1005a7 100644 (file)
--- a/modules/ssl/mod_ssl.h
+++ b/modules/ssl/mod_ssl.h
@@ -628,7 +628,7 @@ int          ssl_hook_Handler(request_rec *);
 RSA         *ssl_callback_TmpRSA(SSL *, int, int);
 DH          *ssl_callback_TmpDH(SSL *, int, int);
 int          ssl_callback_SSLVerify(int, X509_STORE_CTX *);
-int          ssl_callback_SSLVerify_CRL(int, X509_STORE_CTX *, server_rec *);
+int          ssl_callback_SSLVerify_CRL(int, X509_STORE_CTX *, conn_rec *);
 int          ssl_callback_proxy_cert(SSL *ssl, X509 **x509, EVP_PKEY **pkey);
 int          ssl_callback_NewSessionCacheEntry(SSL *, SSL_SESSION *);
 SSL_SESSION *ssl_callback_GetSessionCacheEntry(SSL *, unsigned char *, int, int *);

diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
index f544b4ebd33a8bacc6ccef6cbb80354908fa9d53..f27a491e197bc7b8f310eee586014d58e1898aad 100644 (file)
--- a/modules/ssl/ssl_engine_kernel.c
+++ b/modules/ssl/ssl_engine_kernel.c
@@ -1320,7 +1320,7 @@ int ssl_callback_SSLVerify(int ok, X509_STORE_CTX *ctx)
      * Additionally perform CRL-based revocation checks
      */
     if (ok) {
-        if (!(ok = ssl_callback_SSLVerify_CRL(ok, ctx, s))) {
+        if (!(ok = ssl_callback_SSLVerify_CRL(ok, ctx, conn))) {
             errnum = X509_STORE_CTX_get_error(ctx);
         }
     }
@@ -1366,9 +1366,12 @@ int ssl_callback_SSLVerify(int ok, X509_STORE_CTX *ctx)
     return ok;
 }
 
-int ssl_callback_SSLVerify_CRL(int ok, X509_STORE_CTX *ctx, server_rec *s)
+int ssl_callback_SSLVerify_CRL(int ok, X509_STORE_CTX *ctx, conn_rec *c)
 {
+    server_rec *s       = c->base_server;
     SSLSrvConfigRec *sc = mySrvConfig(s);
+    SSLConnRec *sslconn = myConnConfig(c);
+    modssl_ctx_t *mctx  = myCtxConfig(sslconn);
     X509_OBJECT obj;
     X509_NAME *subject, *issuer;
     X509 *cert;
@@ -1379,7 +1382,7 @@ int ssl_callback_SSLVerify_CRL(int ok, X509_STORE_CTX *ctx, server_rec *s)
      * Unless a revocation store for CRLs was created we
      * cannot do any CRL-based verification, of course.
      */
-    if (!sc->server->crl) {
+    if (!mctx->crl) {
         return ok;
     }
 
@@ -1426,7 +1429,7 @@ int ssl_callback_SSLVerify_CRL(int ok, X509_STORE_CTX *ctx, server_rec *s)
      * the current certificate in order to verify it's integrity.
      */
     memset((char *)&obj, 0, sizeof(obj));
-    rc = SSL_X509_STORE_lookup(sc->server->crl,
+    rc = SSL_X509_STORE_lookup(mctx->crl,
                                X509_LU_CRL, subject, &obj);
     crl = obj.data.crl;
 
@@ -1503,7 +1506,7 @@ int ssl_callback_SSLVerify_CRL(int ok, X509_STORE_CTX *ctx, server_rec *s)
      * the current certificate in order to check for revocation.
      */
     memset((char *)&obj, 0, sizeof(obj));
-    rc = SSL_X509_STORE_lookup(sc->server->crl,
+    rc = SSL_X509_STORE_lookup(mctx->crl,
                                X509_LU_CRL, issuer, &obj);
 
     crl = obj.data.crl;