session openssl UPDATE enable partial chains

With partial chains enabled the peer can be authenticated even if e.g.
there is a chain client <- intermediateCA <- rootCA and only rootCA is
configured on the server.

Fixes CESNET/netopeer2#1735

Author: Roytak

src/session_client_tls.c

@@ -293,7 +293,9 @@ nc_client_tls_session_new(int sock, const char *host, int timeout, struct nc_cli
     }
 
     /* set client's verify mode flags */
-    nc_client_tls_set_verify_wrap(tls_cfg);
+    if (nc_client_tls_set_verify_wrap(tls_cfg)) {
+        goto fail;
+    }
 
     /* init TLS context and store data which may be needed later in it */
     if (nc_tls_init_ctx_wrap(cli_cert, cli_pkey, cert_store, crl_store, tls_ctx)) {

src/session_mbedtls.c

@@ -674,10 +674,11 @@ nc_server_tls_set_verify_wrap(void *tls_cfg, struct nc_tls_verify_cb_data *cb_da
     mbedtls_ssl_conf_verify(tls_cfg, nc_server_tls_verify_cb, cb_data);
 }
 
-void
+int
 nc_client_tls_set_verify_wrap(void *tls_cfg)
 {
     mbedtls_ssl_conf_authmode(tls_cfg, MBEDTLS_SSL_VERIFY_REQUIRED);
+    return 0;
 }
 
 char *

src/session_openssl.c

@@ -407,10 +407,38 @@ nc_server_tls_set_verify_wrap(void *tls_cfg, struct nc_tls_verify_cb_data *cb_da
     SSL_CTX_set_verify(tls_cfg, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, nc_server_tls_verify_cb);
 }
 
-void
+int
 nc_client_tls_set_verify_wrap(void *tls_cfg)
 {
+    int ret = 0;
+    X509_VERIFY_PARAM *vpm = NULL;
+
+    /* set the verify flag */
     SSL_CTX_set_verify(tls_cfg, SSL_VERIFY_PEER, NULL);
+
+    vpm = X509_VERIFY_PARAM_new();
+    NC_CHECK_ERRMEM_RET(!vpm, 1);
+
+    /* set the partial chain flag to allow verification of a certificate chain
+     * to succeed even if the chain is not complete.
+     * See https://github.com/openssl/openssl/issues/7871
+     * This is not set for the server, because all the CA certs in the chain
+     * may be needed for CTN, so such partial chain cases are handled manually. */
+    if (!X509_VERIFY_PARAM_set_flags(vpm, X509_V_FLAG_PARTIAL_CHAIN)) {
+        ERR(NULL, "Setting X509_V_FLAG_PARTIAL_CHAIN flag failed (%s).", ERR_reason_error_string(ERR_get_error()));
+        ret = 1;
+        goto cleanup;
+    }
+
+    if (!SSL_CTX_set1_param(tls_cfg, vpm)) {
+        ERR(NULL, "Failed to set verify param (%s).", ERR_reason_error_string(ERR_get_error()));
+        ret = 1;
+        goto cleanup;
+    }
+
+cleanup:
+    X509_VERIFY_PARAM_free(vpm);
+    return ret;
 }
 
 char *

src/session_wrapper.h

@@ -219,8 +219,9 @@ void nc_server_tls_set_verify_wrap(void *tls_cfg, struct nc_tls_verify_cb_data *
  * @brief Set TLS client's verify flags.
  *
  * @param[in] tls_cfg TLS configuration.
+ * @return 0 on success, 1 on error.
  */
-void nc_client_tls_set_verify_wrap(void *tls_cfg);
+int nc_client_tls_set_verify_wrap(void *tls_cfg);
 
 /**
  * @brief Verify the certificate.