src/security/PeerConnector.cc

   1 /*
   2  * Copyright (C) 1996-2016 The Squid Software Foundation and contributors
   3  *
   4  * Squid software is distributed under GPLv2+ license and includes
   5  * contributions from numerous individuals and organizations.
   6  * Please see the COPYING and CONTRIBUTORS files for details.
   7  */
   8
   9 /* DEBUG: section 83    TLS Server/Peer negotiation */
  10
  11 #include "squid.h"
  12 #include "acl/FilledChecklist.h"
  13 #include "comm/Loops.h"
  14 #include "Downloader.h"
  15 #include "errorpage.h"
  16 #include "fde.h"
  17 #include "http/Stream.h"
  18 #include "HttpRequest.h"
  19 #include "security/NegotiationHistory.h"
  20 #include "security/PeerConnector.h"
  21 #include "SquidConfig.h"
  22 #if USE_OPENSSL
  23 #include "ssl/bio.h"
  24 #include "ssl/cert_validate_message.h"
  25 #include "ssl/Config.h"
  26 #include "ssl/helper.h"
  27 #endif
  28
  29 CBDATA_NAMESPACED_CLASS_INIT(Security, PeerConnector);
  30
  31 Security::PeerConnector::PeerConnector(const Comm::ConnectionPointer &aServerConn, AsyncCall::Pointer &aCallback, const AccessLogEntryPointer &alp, const time_t timeout) :
  32     AsyncJob("Security::PeerConnector"),
  33     serverConn(aServerConn),
  34     al(alp),
  35     callback(aCallback),
  36     negotiationTimeout(timeout),
  37     startTime(squid_curtime),
  38     useCertValidator_(true),
  39     certsDownloads(0)
  40 {
  41     debugs(83, 5, "Security::PeerConnector constructed, this=" << (void*)this);
  42     // if this throws, the caller's cb dialer is not our CbDialer
  43     Must(dynamic_cast<CbDialer*>(callback->getDialer()));
  44 }
  45
  46 Security::PeerConnector::~PeerConnector()
  47 {
  48     debugs(83, 5, "Security::PeerConnector destructed, this=" << (void*)this);
  49 }
  50
  51 bool Security::PeerConnector::doneAll() const
  52 {
  53     return (!callback || callback->canceled()) && AsyncJob::doneAll();
  54 }
  55
  56 /// Preps connection and SSL state. Calls negotiate().
  57 void
  58 Security::PeerConnector::start()
  59 {
  60     AsyncJob::start();
  61
  62     Security::SessionPointer tmp;
  63     if (prepareSocket() && initializeTls(tmp))
  64         negotiateSsl();
  65     else
  66         mustStop("Security::PeerConnector TLS socket initialize failed");
  67 }
  68
  69 void
  70 Security::PeerConnector::commCloseHandler(const CommCloseCbParams &params)
  71 {
  72     debugs(83, 5, "FD " << params.fd << ", Security::PeerConnector=" << params.data);
  73     connectionClosed("Security::PeerConnector::commCloseHandler");
  74 }
  75
  76 void
  77 Security::PeerConnector::connectionClosed(const char *reason)
  78 {
  79     mustStop(reason);
  80     callback = NULL;
  81 }
  82
  83 bool
  84 Security::PeerConnector::prepareSocket()
  85 {
  86     const int fd = serverConnection()->fd;
  87     if (!Comm::IsConnOpen(serverConn) || fd_table[serverConn->fd].closing()) {
  88         connectionClosed("Security::PeerConnector::prepareSocket");
  89         return false;
  90     }
  91
  92     // watch for external connection closures
  93     typedef CommCbMemFunT<Security::PeerConnector, CommCloseCbParams> Dialer;
  94     closeHandler = JobCallback(9, 5, Dialer, this, Security::PeerConnector::commCloseHandler);
  95     comm_add_close_handler(fd, closeHandler);
  96     return true;
  97 }
  98
  99 bool
 100 Security::PeerConnector::initializeTls(Security::SessionPointer &serverSession)
 101 {
 102 #if USE_OPENSSL
 103     Security::ContextPtr sslContext(getSslContext());
 104     assert(sslContext);
 105
 106     if (!Ssl::CreateClient(sslContext, serverConnection(), "server https start")) {
 107         ErrorState *anErr = new ErrorState(ERR_SOCKET_FAILURE, Http::scInternalServerError, request.getRaw());
 108         anErr->xerrno = errno;
 109         debugs(83, DBG_IMPORTANT, "Error allocating SSL handle: " << ERR_error_string(ERR_get_error(), NULL));
 110         noteNegotiationDone(anErr);
 111         bail(anErr);
 112         return false;
 113     }
 114
 115     // A TLS/SSL session has now been created for the connection and stored in fd_table
 116     serverSession = fd_table[serverConnection()->fd].ssl;
 117
 118     // If CertValidation Helper used do not lookup checklist for errors,
 119     // but keep a list of errors to send it to CertValidator
 120     if (!Ssl::TheConfig.ssl_crt_validator) {
 121         // Create the ACL check list now, while we have access to more info.
 122         // The list is used in ssl_verify_cb() and is freed in ssl_free().
 123         if (acl_access *acl = ::Config.ssl_client.cert_error) {
 124             ACLFilledChecklist *check = new ACLFilledChecklist(acl, request.getRaw(), dash_str);
 125             check->al = al;
 126             // check->fd(fd); XXX: need client FD here
 127             SSL_set_ex_data(serverSession.get(), ssl_ex_index_cert_error_check, check);
 128         }
 129     }
 130
 131     return true;
 132 #else
 133     return false;
 134 #endif
 135 }
 136
 137 void
 138 Security::PeerConnector::setReadTimeout()
 139 {
 140     int timeToRead;
 141     if (negotiationTimeout) {
 142         const int timeUsed = squid_curtime - startTime;
 143         const int timeLeft = max(0, static_cast<int>(negotiationTimeout - timeUsed));
 144         timeToRead = min(static_cast<int>(::Config.Timeout.read), timeLeft);
 145     } else
 146         timeToRead = ::Config.Timeout.read;
 147     AsyncCall::Pointer nil;
 148     commSetConnTimeout(serverConnection(), timeToRead, nil);
 149 }
 150
 151 void
 152 Security::PeerConnector::recordNegotiationDetails()
 153 {
 154 #if USE_OPENSSL
 155     const int fd = serverConnection()->fd;
 156     Security::SessionPtr ssl = fd_table[fd].ssl.get();
 157
 158     // retrieve TLS server negotiated information if any
 159     serverConnection()->tlsNegotiations()->retrieveNegotiatedInfo(ssl);
 160     // retrieve TLS parsed extra info
 161     BIO *b = SSL_get_rbio(ssl);
 162     Ssl::ServerBio *bio = static_cast<Ssl::ServerBio *>(b->ptr);
 163     if (const Security::TlsDetails::Pointer &details = bio->receivedHelloDetails())
 164         serverConnection()->tlsNegotiations()->retrieveParsedInfo(details);
 165 #endif
 166 }
 167
 168 void
 169 Security::PeerConnector::negotiateSsl()
 170 {
 171     if (!Comm::IsConnOpen(serverConnection()) || fd_table[serverConnection()->fd].closing())
 172         return;
 173
 174 #if USE_OPENSSL
 175     const int fd = serverConnection()->fd;
 176     Security::SessionPtr ssl = fd_table[fd].ssl.get();
 177     const int result = SSL_connect(ssl);
 178 #else
 179     const int result = -1;
 180 #endif
 181     if (result <= 0) {
 182         handleNegotiateError(result);
 183         return; // we might be gone by now
 184     }
 185
 186     recordNegotiationDetails();
 187
 188     if (!sslFinalized())
 189         return;
 190
 191     callBack();
 192 }
 193
 194 bool
 195 Security::PeerConnector::sslFinalized()
 196 {
 197 #if USE_OPENSSL
 198     if (Ssl::TheConfig.ssl_crt_validator && useCertValidator_) {
 199         const int fd = serverConnection()->fd;
 200         Security::SessionPtr ssl = fd_table[fd].ssl.get();
 201
 202         Ssl::CertValidationRequest validationRequest;
 203         // WARNING: Currently we do not use any locking for any of the
 204         // members of the Ssl::CertValidationRequest class. In this code the
 205         // Ssl::CertValidationRequest object used only to pass data to
 206         // Ssl::CertValidationHelper::submit method.
 207         validationRequest.ssl = ssl;
 208         validationRequest.domainName = request->url.host();
 209         if (Ssl::CertErrors *errs = static_cast<Ssl::CertErrors *>(SSL_get_ex_data(ssl, ssl_ex_index_ssl_errors)))
 210             // validationRequest disappears on return so no need to cbdataReference
 211             validationRequest.errors = errs;
 212         else
 213             validationRequest.errors = NULL;
 214         try {
 215             debugs(83, 5, "Sending SSL certificate for validation to ssl_crtvd.");
 216             AsyncCall::Pointer call = asyncCall(83,5, "Security::PeerConnector::sslCrtvdHandleReply", Ssl::CertValidationHelper::CbDialer(this, &Security::PeerConnector::sslCrtvdHandleReply, nullptr));
 217             Ssl::CertValidationHelper::GetInstance()->sslSubmit(validationRequest, call);
 218             return false;
 219         } catch (const std::exception &e) {
 220             debugs(83, DBG_IMPORTANT, "ERROR: Failed to compose ssl_crtvd " <<
 221                    "request for " << validationRequest.domainName <<
 222                    " certificate: " << e.what() << "; will now block to " <<
 223                    "validate that certificate.");
 224             // fall through to do blocking in-process generation.
 225             ErrorState *anErr = new ErrorState(ERR_GATEWAY_FAILURE, Http::scInternalServerError, request.getRaw());
 226
 227             noteNegotiationDone(anErr);
 228             bail(anErr);
 229             serverConn->close();
 230             return true;
 231         }
 232     }
 233 #endif
 234
 235     noteNegotiationDone(NULL);
 236     return true;
 237 }
 238
 239 #if USE_OPENSSL
 240 void
 241 Security::PeerConnector::sslCrtvdHandleReply(Ssl::CertValidationResponse::Pointer validationResponse)
 242 {
 243     Must(validationResponse != NULL);
 244
 245     Ssl::ErrorDetail *errDetails = NULL;
 246     bool validatorFailed = false;
 247     if (!Comm::IsConnOpen(serverConnection())) {
 248         return;
 249     }
 250
 251     debugs(83,5, request->url.host() << " cert validation result: " << validationResponse->resultCode);
 252
 253     if (validationResponse->resultCode == ::Helper::Error) {
 254         if (Ssl::CertErrors *errs = sslCrtvdCheckForErrors(*validationResponse, errDetails)) {
 255             Security::SessionPtr ssl = fd_table[serverConnection()->fd].ssl.get();
 256             Ssl::CertErrors *oldErrs = static_cast<Ssl::CertErrors*>(SSL_get_ex_data(ssl, ssl_ex_index_ssl_errors));
 257             SSL_set_ex_data(ssl, ssl_ex_index_ssl_errors,  (void *)errs);
 258             delete oldErrs;
 259         }
 260     } else if (validationResponse->resultCode != ::Helper::Okay)
 261         validatorFailed = true;
 262
 263     if (!errDetails && !validatorFailed) {
 264         noteNegotiationDone(NULL);
 265         callBack();
 266         return;
 267     }
 268
 269     ErrorState *anErr = NULL;
 270     if (validatorFailed) {
 271         anErr = new ErrorState(ERR_GATEWAY_FAILURE, Http::scInternalServerError, request.getRaw());
 272     }  else {
 273         anErr =  new ErrorState(ERR_SECURE_CONNECT_FAIL, Http::scServiceUnavailable, request.getRaw());
 274         anErr->detail = errDetails;
 275         /*anErr->xerrno= Should preserved*/
 276     }
 277
 278     noteNegotiationDone(anErr);
 279     bail(anErr);
 280     serverConn->close();
 281     return;
 282 }
 283 #endif
 284
 285 #if USE_OPENSSL
 286 /// Checks errors in the cert. validator response against sslproxy_cert_error.
 287 /// The first honored error, if any, is returned via errDetails parameter.
 288 /// The method returns all seen errors except SSL_ERROR_NONE as Ssl::CertErrors.
 289 Ssl::CertErrors *
 290 Security::PeerConnector::sslCrtvdCheckForErrors(Ssl::CertValidationResponse const &resp, Ssl::ErrorDetail *& errDetails)
 291 {
 292     Ssl::CertErrors *errs = NULL;
 293
 294     ACLFilledChecklist *check = NULL;
 295     if (acl_access *acl = ::Config.ssl_client.cert_error) {
 296         check = new ACLFilledChecklist(acl, request.getRaw(), dash_str);
 297         check->al = al;
 298     }
 299
 300     Security::SessionPtr ssl = fd_table[serverConnection()->fd].ssl.get();
 301     typedef Ssl::CertValidationResponse::RecvdErrors::const_iterator SVCRECI;
 302     for (SVCRECI i = resp.errors.begin(); i != resp.errors.end(); ++i) {
 303         debugs(83, 7, "Error item: " << i->error_no << " " << i->error_reason);
 304
 305         assert(i->error_no != SSL_ERROR_NONE);
 306
 307         if (!errDetails) {
 308             bool allowed = false;
 309             if (check) {
 310                 check->sslErrors = new Ssl::CertErrors(Ssl::CertError(i->error_no, i->cert.get(), i->error_depth));
 311                 if (check->fastCheck() == ACCESS_ALLOWED)
 312                     allowed = true;
 313             }
 314             // else the Config.ssl_client.cert_error access list is not defined
 315             // and the first error will cause the error page
 316
 317             if (allowed) {
 318                 debugs(83, 3, "bypassing SSL error " << i->error_no << " in " << "buffer");
 319             } else {
 320                 debugs(83, 5, "confirming SSL error " << i->error_no);
 321                 X509 *brokenCert = i->cert.get();
 322                 Security::CertPointer peerCert(SSL_get_peer_certificate(ssl));
 323                 const char *aReason = i->error_reason.empty() ? NULL : i->error_reason.c_str();
 324                 errDetails = new Ssl::ErrorDetail(i->error_no, peerCert.get(), brokenCert, aReason);
 325             }
 326             if (check) {
 327                 delete check->sslErrors;
 328                 check->sslErrors = NULL;
 329             }
 330         }
 331
 332         if (!errs)
 333             errs = new Ssl::CertErrors(Ssl::CertError(i->error_no, i->cert.get(), i->error_depth));
 334         else
 335             errs->push_back_unique(Ssl::CertError(i->error_no, i->cert.get(), i->error_depth));
 336     }
 337     if (check)
 338         delete check;
 339
 340     return errs;
 341 }
 342 #endif
 343
 344 /// A wrapper for Comm::SetSelect() notifications.
 345 void
 346 Security::PeerConnector::NegotiateSsl(int, void *data)
 347 {
 348     PeerConnector *pc = static_cast<PeerConnector*>(data);
 349     // Use job calls to add done() checks and other job logic/protections.
 350     CallJobHere(83, 7, pc, Security::PeerConnector, negotiateSsl);
 351 }
 352
 353 void
 354 Security::PeerConnector::handleNegotiateError(const int ret)
 355 {
 356 #if USE_OPENSSL
 357     const int fd = serverConnection()->fd;
 358     unsigned long ssl_lib_error = SSL_ERROR_NONE;
 359     Security::SessionPtr ssl = fd_table[fd].ssl.get();
 360     const int ssl_error = SSL_get_error(ssl, ret);
 361
 362     switch (ssl_error) {
 363     case SSL_ERROR_WANT_READ:
 364         noteWantRead();
 365         return;
 366
 367     case SSL_ERROR_WANT_WRITE:
 368         noteWantWrite();
 369         return;
 370
 371     case SSL_ERROR_SSL:
 372     case SSL_ERROR_SYSCALL:
 373         ssl_lib_error = ERR_get_error();
 374         // proceed to the general error handling code
 375         break;
 376     default:
 377         // no special error handling for all other errors
 378         break;
 379     }
 380
 381     // Log connection details, if any
 382     recordNegotiationDetails();
 383     noteSslNegotiationError(ret, ssl_error, ssl_lib_error);
 384 #endif
 385 }
 386
 387 void
 388 Security::PeerConnector::noteWantRead()
 389 {
 390     const int fd = serverConnection()->fd;
 391 #if USE_OPENSSL
 392     Security::SessionPtr ssl = fd_table[fd].ssl.get();
 393     BIO *b = SSL_get_rbio(ssl);
 394     Ssl::ServerBio *srvBio = static_cast<Ssl::ServerBio *>(b->ptr);
 395     if (srvBio->holdRead()) {
 396         if (srvBio->gotHello()) {
 397             if (checkForMissingCertificates())
 398                 return; // Wait to download certificates before proceed.
 399
 400             srvBio->holdRead(false);
 401             // schedule a negotiateSSl to allow openSSL parse received data
 402             Security::PeerConnector::NegotiateSsl(fd, this);
 403             return;
 404         } else if (srvBio->gotHelloFailed()) {
 405             srvBio->holdRead(false);
 406             debugs(83, DBG_IMPORTANT, "Error parsing SSL Server Hello Message on FD " << fd);
 407             // schedule a negotiateSSl to allow openSSL parse received data
 408             Security::PeerConnector::NegotiateSsl(fd, this);
 409             return;
 410         }
 411     }
 412 #endif
 413     setReadTimeout();
 414     Comm::SetSelect(fd, COMM_SELECT_READ, &NegotiateSsl, this, 0);
 415 }
 416
 417 void
 418 Security::PeerConnector::noteWantWrite()
 419 {
 420     const int fd = serverConnection()->fd;
 421     Comm::SetSelect(fd, COMM_SELECT_WRITE, &NegotiateSsl, this, 0);
 422     return;
 423 }
 424
 425 void
 426 Security::PeerConnector::noteSslNegotiationError(const int ret, const int ssl_error, const int ssl_lib_error)
 427 {
 428 #if USE_OPENSSL // not used unless OpenSSL enabled.
 429 #if defined(EPROTO)
 430     int sysErrNo = EPROTO;
 431 #else
 432     int sysErrNo = EACCES;
 433 #endif
 434
 435     // store/report errno when ssl_error is SSL_ERROR_SYSCALL, ssl_lib_error is 0, and ret is -1
 436     if (ssl_error == SSL_ERROR_SYSCALL && ret == -1 && ssl_lib_error == 0)
 437         sysErrNo = errno;
 438
 439     const int fd = serverConnection()->fd;
 440     debugs(83, DBG_IMPORTANT, "Error negotiating SSL on FD " << fd <<
 441            ": " << ERR_error_string(ssl_lib_error, NULL) << " (" <<
 442            ssl_error << "/" << ret << "/" << errno << ")");
 443
 444     ErrorState *anErr = NULL;
 445     if (request != NULL)
 446         anErr = ErrorState::NewForwarding(ERR_SECURE_CONNECT_FAIL, request.getRaw());
 447     else
 448         anErr = new ErrorState(ERR_SECURE_CONNECT_FAIL, Http::scServiceUnavailable, NULL);
 449     anErr->xerrno = sysErrNo;
 450
 451     Security::SessionPtr ssl = fd_table[fd].ssl.get();
 452     Ssl::ErrorDetail *errFromFailure = (Ssl::ErrorDetail *)SSL_get_ex_data(ssl, ssl_ex_index_ssl_error_detail);
 453     if (errFromFailure != NULL) {
 454         // The errFromFailure is attached to the ssl object
 455         // and will be released when ssl object destroyed.
 456         // Copy errFromFailure to a new Ssl::ErrorDetail object
 457         anErr->detail = new Ssl::ErrorDetail(*errFromFailure);
 458     } else {
 459         // server_cert can be NULL here
 460         X509 *server_cert = SSL_get_peer_certificate(ssl);
 461         anErr->detail = new Ssl::ErrorDetail(SQUID_ERR_SSL_HANDSHAKE, server_cert, NULL);
 462         X509_free(server_cert);
 463     }
 464
 465     if (ssl_lib_error != SSL_ERROR_NONE)
 466         anErr->detail->setLibError(ssl_lib_error);
 467
 468     noteNegotiationDone(anErr);
 469     bail(anErr);
 470 #endif
 471 }
 472
 473 void
 474 Security::PeerConnector::bail(ErrorState *error)
 475 {
 476     Must(error); // or the recepient will not know there was a problem
 477     Must(callback != NULL);
 478     CbDialer *dialer = dynamic_cast<CbDialer*>(callback->getDialer());
 479     Must(dialer);
 480     dialer->answer().error = error;
 481
 482     callBack();
 483     // Our job is done. The callabck recepient will probably close the failed
 484     // peer connection and try another peer or go direct (if possible). We
 485     // can close the connection ourselves (our error notification would reach
 486     // the recepient before the fd-closure notification), but we would rather
 487     // minimize the number of fd-closure notifications and let the recepient
 488     // manage the TCP state of the connection.
 489 }
 490
 491 void
 492 Security::PeerConnector::callBack()
 493 {
 494     AsyncCall::Pointer cb = callback;
 495     // Do this now so that if we throw below, swanSong() assert that we _tried_
 496     // to call back holds.
 497     callback = NULL; // this should make done() true
 498
 499     // remove close handler
 500     comm_remove_close_handler(serverConnection()->fd, closeHandler);
 501
 502     CbDialer *dialer = dynamic_cast<CbDialer*>(cb->getDialer());
 503     Must(dialer);
 504     dialer->answer().conn = serverConnection();
 505     ScheduleCallHere(cb);
 506 }
 507
 508 void
 509 Security::PeerConnector::swanSong()
 510 {
 511     // XXX: unregister fd-closure monitoring and CommSetSelect interest, if any
 512     AsyncJob::swanSong();
 513     if (callback != NULL) { // paranoid: we have left the caller waiting
 514         debugs(83, DBG_IMPORTANT, "BUG: Unexpected state while connecting to a cache_peer or origin server");
 515         ErrorState *anErr = new ErrorState(ERR_GATEWAY_FAILURE, Http::scInternalServerError, request.getRaw());
 516         bail(anErr);
 517         assert(!callback);
 518         return;
 519     }
 520 }
 521
 522 const char *
 523 Security::PeerConnector::status() const
 524 {
 525     static MemBuf buf;
 526     buf.reset();
 527
 528     // TODO: redesign AsyncJob::status() API to avoid this
 529     // id and stop reason reporting duplication.
 530     buf.append(" [", 2);
 531     if (stopReason != NULL) {
 532         buf.append("Stopped, reason:", 16);
 533         buf.appendf("%s",stopReason);
 534     }
 535     if (serverConn != NULL)
 536         buf.appendf(" FD %d", serverConn->fd);
 537     buf.appendf(" %s%u]", id.Prefix, id.value);
 538     buf.terminate();
 539
 540     return buf.content();
 541 }
 542
 543 #if USE_OPENSSL
 544 /// CallDialer to allow use Downloader objects within PeerConnector class.
 545 class PeerConnectorCertDownloaderDialer: public Downloader::CbDialer
 546 {
 547 public:
 548     typedef void (Security::PeerConnector::*Method)(SBuf &object, int status);
 549
 550     PeerConnectorCertDownloaderDialer(Method method, Security::PeerConnector *pc):
 551         method_(method),
 552         peerConnector_(pc) {}
 553
 554     /* CallDialer API */
 555     virtual bool canDial(AsyncCall &call) { return peerConnector_.valid(); }
 556     virtual void dial(AsyncCall &call) { ((&(*peerConnector_))->*method_)(object, status); }
 557     Method method_; ///< The Security::PeerConnector method to dial
 558     CbcPointer<Security::PeerConnector> peerConnector_; ///< The Security::PeerConnector object
 559 };
 560
 561 void
 562 Security::PeerConnector::startCertDownloading(SBuf &url)
 563 {
 564     AsyncCall::Pointer certCallback = asyncCall(81, 4,
 565                                             "Security::PeerConnector::certDownloadingDone",
 566                                             PeerConnectorCertDownloaderDialer(&Security::PeerConnector::certDownloadingDone, this));
 567
 568     const Downloader *csd = dynamic_cast<const Downloader*>(request->downloader.valid());
 569     Downloader *dl = new Downloader(url, certCallback, csd ? csd->nestedLevel() + 1 : 1);
 570     AsyncJob::Start(dl);
 571 }
 572
 573 void
 574 Security::PeerConnector::certDownloadingDone(SBuf &obj, int downloadStatus)
 575 {
 576     ++certsDownloads;
 577     debugs(81, 5, "Certificate downloading status: " << downloadStatus << " certificate size: " << obj.length());
 578
 579     // get ServerBio from SSL object
 580     const int fd = serverConnection()->fd;
 581     Security::SessionPtr ssl = fd_table[fd].ssl.get();
 582     BIO *b = SSL_get_rbio(ssl);
 583     Ssl::ServerBio *srvBio = static_cast<Ssl::ServerBio *>(b->ptr);
 584
 585     // Parse Certificate. Assume that it is in DER format.
 586     // According to RFC 4325:
 587     //  The server must provide a DER encoded certificate or a collection
 588     // collection of certificates in a "certs-only" CMS message.
 589     //  The applications MUST accept DER encoded certificates and SHOULD
 590     // be able to accept collection of certificates.
 591     // TODO: support collection of certificates
 592     const unsigned char *raw = (const unsigned char*)obj.rawContent();
 593     if (X509 *cert = d2i_X509(NULL, &raw, obj.length())) {
 594         char buffer[1024];
 595         debugs(81, 5, "Retrieved certificate: " << X509_NAME_oneline(X509_get_subject_name(cert), buffer, 1024));
 596         const Security::CertList &certsList = srvBio->serverCertificatesIfAny();
 597         if (const char *issuerUri = Ssl::uriOfIssuerIfMissing(cert,  certsList)) {
 598             urlsOfMissingCerts.push(SBuf(issuerUri));
 599         }
 600         Ssl::SSL_add_untrusted_cert(ssl, cert);
 601     }
 602
 603     // Check if there are URIs to download from and if yes start downloading
 604     // the first in queue.
 605     if (urlsOfMissingCerts.size() && certsDownloads <= MaxCertsDownloads) {
 606         startCertDownloading(urlsOfMissingCerts.front());
 607         urlsOfMissingCerts.pop();
 608         return;
 609     }
 610
 611     srvBio->holdRead(false);
 612     Security::PeerConnector::NegotiateSsl(serverConnection()->fd, this);
 613 }
 614
 615 bool
 616 Security::PeerConnector::checkForMissingCertificates()
 617 {
 618     // Check for nested SSL certificates downloads. For example when the
 619     // certificate located in an SSL site which requires to download a
 620     // a missing certificate (... from an SSL site which requires to ...).
 621
 622     const Downloader *csd = request->downloader.get();
 623     if (csd && csd->nestedLevel() >= MaxNestedDownloads)
 624         return false;
 625
 626     const int fd = serverConnection()->fd;
 627     Security::SessionPtr ssl = fd_table[fd].ssl.get();
 628     BIO *b = SSL_get_rbio(ssl);
 629     Ssl::ServerBio *srvBio = static_cast<Ssl::ServerBio *>(b->ptr);
 630     const Security::CertList &certs = srvBio->serverCertificatesIfAny();
 631
 632     if (certs.size()) {
 633         debugs(83, 5, "SSL server sent " << certs.size() << " certificates");
 634         Ssl::missingChainCertificatesUrls(urlsOfMissingCerts, certs);
 635         if (urlsOfMissingCerts.size()) {
 636             startCertDownloading(urlsOfMissingCerts.front());
 637             urlsOfMissingCerts.pop();
 638             return true;
 639         }
 640     }
 641
 642     return false;
 643 }
 644 #endif //USE_OPENSSL