Fixing a server certification verification bug saving a flag in the wrong location.

Author: stgates

Release/src/http/client/http_linux.cpp

@@ -282,6 +282,10 @@ namespace web { namespace http
                 boost::asio::deadline_timer m_timeout_timer;
                 std::shared_ptr<linux_connection> m_connection;
 
+#if defined(__APPLE__) || defined(ANDROID)
+                bool m_openssl_failed;
+#endif
+
                 virtual ~linux_client_request_context();
 
                 void handle_timeout_timer(const boost::system::error_code& ec)
@@ -449,9 +453,6 @@ namespace web { namespace http
 
             private:
                 tcp::resolver m_resolver;
-#if defined(__APPLE__) || defined(ANDROID)
-                bool m_openssl_failed;
-#endif
 
                 static bool _check_streambuf(std::shared_ptr<linux_client_request_context> ctx, concurrency::streams::streambuf<uint8_t> rdbuf, const utility::char_t* msg)
                 {
@@ -482,9 +483,9 @@ namespace web { namespace http
                     if (client_config().validate_certificates())
                     {
                         ctx->m_ssl_stream->set_verify_mode(boost::asio::ssl::context::verify_peer);
-                        ctx->m_ssl_stream->set_verify_callback(boost::bind(&linux_client::handle_cert_verification, shared_from_this(), _1, _2));
+                        ctx->m_ssl_stream->set_verify_callback(boost::bind(&linux_client::handle_cert_verification, shared_from_this(), _1, _2, ctx));
 #if defined(__APPLE__) || defined(ANDROID)
-                        m_openssl_failed = false;
+                        ctx->m_openssl_failed = false;
 #endif
                     }
                     else
@@ -544,8 +545,11 @@ namespace web { namespace http
                     }
                 }
 
-                bool handle_cert_verification(bool preverified, boost::asio::ssl::verify_context &ctx)
+                bool handle_cert_verification(bool preverified, boost::asio::ssl::verify_context &verifyCtx, std::shared_ptr<linux_client_request_context> requestCtx)
                 {
+                    // Unreferenced parameter on some platforms.
+                    requestCtx;
+
                     // OpenSSL calls the verification callback once per certificate in the chain,
                     // starting with the root CA certificate. The 'leaf', non-Certificate Authority (CA)
                     // certificate, i.e. actual server certificate is at the '0' position in the
@@ -555,15 +559,15 @@ namespace web { namespace http
 #if defined(__APPLE__) || defined(ANDROID)
                     if(!preverified)
                     {
-                        m_openssl_failed = true;
+                        requestCtx->m_openssl_failed = true;
                     }
-                    if(m_openssl_failed)
+                    if(requestCtx->m_openssl_failed)
                     {
                         // On OS X, iOS, and Android, OpenSSL doesn't have access to where the OS
                         // stores keychains. If OpenSSL fails we will doing verification at the
                         // end using the whole certificate chain so wait until the 'leaf' cert.
                         // For now return true so OpenSSL continues down the certificate chain.
-                        X509_STORE_CTX *storeContext = ctx.native_handle();
+                        X509_STORE_CTX *storeContext = verifyCtx.native_handle();
                         int currentDepth = X509_STORE_CTX_get_error_depth(storeContext);
                         if(currentDepth != 0)
                         {
@@ -607,7 +611,7 @@ namespace web { namespace http
 #endif
 
                     boost::asio::ssl::rfc2818_verification rfc2818(m_uri.host());
-                    return rfc2818(preverified, ctx);
+                    return rfc2818(preverified, verifyCtx);
                 }
 
                 void handle_handshake(const boost::system::error_code& ec, std::shared_ptr<linux_client_request_context> ctx)
@@ -1170,6 +1174,9 @@ namespace web { namespace http
                 , m_timedout(false)
                 , m_timeout_timer(crossplat::threadpool::shared_instance().service())
                 , m_connection(std::move(connection))
+#if defined(__APPLE__) || defined(ANDROID)
+                , m_openssl_failed(false)
+#endif
             {}
 
             std::shared_ptr<request_context> linux_client_request_context::create_request_context(