Add SSL cert validation callback

src/conn.c

@@ -736,7 +736,7 @@ _makeTLSConn(natsConnection *nc)
                     s = nats_setError(NATS_SSL_ERROR, "unable to set expected hostname '%s'", nc->tlsName);
             }
             if (s == NATS_OK)
-                SSL_set_verify(ssl, SSL_VERIFY_PEER, _collectSSLErr);
+                SSL_set_verify(ssl, SSL_VERIFY_PEER, nc->opts->sslCtx->callback != NULL ? nc->opts->sslCtx->callback : _collectSSLErr);
         }
     }
 #if defined(NATS_USE_OPENSSL_1_1)

src/nats.h

@@ -2594,6 +2594,8 @@ natsOptions_SetExpectedHostname(natsOptions *opts, const char *hostname);
  * By default, the server certificate is verified. You can disable the verification
  * by passing <c>true</c> to this function.
  *
+ * \note Setting this to true will clear SSL verfication callback set via natsOptions_SetSSLVerificationCallback().
+ *
  * \warning This is fine for tests but use with caution since this is not secure.
  *
  * @param opts the pointer to the #natsOptions object.
@@ -2602,6 +2604,21 @@ natsOptions_SetExpectedHostname(natsOptions *opts, const char *hostname);
 NATS_EXTERN natsStatus
 natsOptions_SkipServerVerification(natsOptions *opts, bool skip);
 
+typedef struct x509_store_ctx_st X509_STORE_CTX;
+typedef int (*SSL_verify_cb)(int preverify_ok, X509_STORE_CTX *x509_ctx);
+
+/** \brief Sets the certificate validation callback.
+ *
+ * Sets a callback used to verify the SSL certificate.
+ *
+ * \note Setting a callback will enable SSL verification if disabled via natsOptions_SkipServerVerification().
+ *
+ * @param opts the pointer to the #natsOptions object.
+ * @param callback the custom SSL verification handler to invoke. see https://docs.openssl.org/master/man3/SSL_CTX_set_verify/
+ */
+NATS_EXTERN natsStatus
+natsOptions_SetSSLVerificationCallback(natsOptions *opts, SSL_verify_cb callback);
+
 /** \brief Sets the verbose mode.
  *
  * Sets the verbose mode. If `true`, sends are echoed by the server with

src/natsp.h

@@ -182,11 +182,12 @@ typedef struct __natsServerInfo
 
 typedef struct __natsSSLCtx
 {
-    natsMutex   *lock;
-    int         refs;
-    SSL_CTX     *ctx;
-    char        *expectedHostname;
-    bool        skipVerify;
+    natsMutex       *lock;
+    int             refs;
+    SSL_CTX         *ctx;
+    char            *expectedHostname;
+    bool            skipVerify;
+    SSL_verify_cb   callback;
 
 } natsSSLCtx;
 

src/opts.c

@@ -693,7 +693,35 @@ natsOptions_SkipServerVerification(natsOptions *opts, bool skip)
 
     s = _getSSLCtx(opts);
     if (s == NATS_OK)
+    {
         opts->sslCtx->skipVerify = skip;
+        if (skip)
+        {
+            opts->sslCtx->callback = NULL;
+        }
+    }
+
+    UNLOCK_OPTS(opts);
+
+    return s;
+}
+
+natsStatus
+natsOptions_SetSSLVerificationCallback(natsOptions *opts, SSL_verify_cb callback)
+{
+    natsStatus s = NATS_OK;
+
+    LOCK_AND_CHECK_OPTIONS(opts, 0);
+
+    s = _getSSLCtx(opts);
+    if (s == NATS_OK)
+    {
+        opts->sslCtx->callback = callback;
+        if (callback != NULL)
+        {
+            opts->sslCtx->skipVerify = false;
+        }
+    }
 
     UNLOCK_OPTS(opts);
 
@@ -758,6 +786,12 @@ natsOptions_SkipServerVerification(natsOptions *opts, bool skip)
     return nats_setError(NATS_ILLEGAL_STATE, "%s", NO_SSL_ERR);
 }
 
+natsStatus
+natsOptions_SetSSLVerificationCallback(natsOptions *opts, SSL_verify_cb callback)
+{
+    return nats_setError(NATS_ILLEGAL_STATE, "%s", NO_SSL_ERR);
+}
+
 #endif
 
 natsStatus

test/list_test.txt

@@ -260,6 +260,7 @@ _test(SSLMultithreads)
 _test(SSLReconnectWithAuthError)
 _test(SSLServerNameIndication)
 _test(SSLSkipServerVerification)
+_test(SSLVerificationCallback)
 _test(SSLSocketLeakWithEventLoop)
 _test(SSLVerify)
 _test(SSLVerifyHostname)

test/test.c

@@ -21087,6 +21087,163 @@ void test_SSLSkipServerVerification(void)
 #endif
 }
 
+#if defined(NATS_HAS_TLS)
+static void
+_logCert(X509 *cert)
+{
+    char    buf[32];
+    char    *subjectName;
+    char    *issuerName;
+    const   ASN1_TIME* asn1NotBefore;
+    const   ASN1_TIME* asn1NotAfter;
+    struct  tm tmNotBefore;
+    struct  tm tmNotAfter;
+    char    *notBefore;
+    char    *notAfter;
+
+    if (cert == NULL)
+        return;
+
+    subjectName = X509_NAME_oneline(X509_get_subject_name(cert), NULL, 0);
+    issuerName = X509_NAME_oneline(X509_get_issuer_name(cert), NULL, 0);
+
+    asn1NotBefore = X509_get0_notBefore(cert);
+    ASN1_TIME_to_tm(asn1NotBefore, &tmNotBefore);
+    strftime(buf, sizeof(buf), "%F %T", &tmNotBefore);
+    notBefore = NATS_STRDUP(buf);
+
+    asn1NotAfter = X509_get0_notAfter(cert);
+    ASN1_TIME_to_tm(asn1NotAfter, &tmNotAfter);
+    strftime(buf, sizeof(buf), "%F %T", &tmNotAfter);
+    notAfter = NATS_STRDUP(buf);
+
+    testf("cert: subject: %s, issuer: %s, notBefore: %s, notAfter: %s\n", subjectName, issuerName, notBefore, notAfter);
+
+    OPENSSL_free(subjectName);
+    OPENSSL_free(issuerName);
+    NATS_FREE(notBefore);
+    NATS_FREE(notAfter);
+}
+
+static void
+_logChain(STACK_OF(X509) *chain)
+{
+    int     numElements;
+    int     level = 0;
+    X509    *cert;
+
+    if (chain == NULL)
+        return;
+
+    numElements = sk_X509_num(chain);
+    for (int i = 0; i < numElements; i++)
+    {
+        cert = sk_X509_value(chain, i);
+        testf("chain level: %d\n", ++level);
+        _logCert(cert);
+    }
+}
+
+static int
+_sslVerifyCallback(int preverify_ok, X509_STORE_CTX *ctx)
+{
+    X509                *cert               = X509_STORE_CTX_get_current_cert(ctx);
+    SSL                 *ssl                = X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx());
+    STACK_OF(X509)      *chain              = SSL_get_peer_cert_chain(ssl);
+    const ASN1_TIME     *asn1NotAfter;
+    struct              tm tmNotAfter;
+    char                *issuerName;
+    bool                result;
+    time_t              notAfter;
+    time_t              now;
+
+    testf("preverify_ok: %d\n", preverify_ok);
+
+    if (cert == NULL)
+    {
+        test("no cert\n");
+        return 0;
+    }
+    else
+    {
+        _logCert(cert);
+    }
+
+    if (chain == NULL)
+    {
+        test("no chain\n");
+    }
+    else
+    {
+        _logChain(chain);
+    }
+
+    asn1NotAfter = X509_get0_notAfter(cert);
+    ASN1_TIME_to_tm(asn1NotAfter, &tmNotAfter);
+    notAfter = mktime(&tmNotAfter);
+    time(&now);
+    issuerName = X509_NAME_oneline(X509_get_issuer_name(cert), NULL, 0);
+
+    if (notAfter > now)
+    {
+        if (strstr(issuerName, "Synadia"))
+        {
+            result = 1;
+        }
+        else
+        {
+            result = preverify_ok;
+        }
+    }
+    else
+    {
+        result = 0;
+    }
+
+    OPENSSL_free(issuerName);
+    testf("verfiy result: %d\n", result);
+    return result;
+}
+#endif // NATS_HAS_TLS
+
+void test_SSLVerificationCallback(void)
+{
+#if defined(NATS_HAS_TLS)
+    natsStatus          s;
+    natsConnection      *nc         = NULL;
+    natsOptions         *opts       = NULL;
+    natsPid             serverPid   = NATS_INVALID_PID;
+
+    opts = _createReconnectOptions();
+    if (opts == NULL)
+        FAIL("Unable to create reconnect options!");
+
+    serverPid = _startServer("nats://127.0.0.1:4443", "-config tls.conf", true);
+    CHECK_SERVER_STARTED(serverPid);
+
+    test("Check that connect fails due to server verification: ");
+    s = natsOptions_SetURL(opts, "nats://127.0.0.1:4443");
+    IFOK(s, natsOptions_SetSecure(opts, true));
+    IFOK(s, natsConnection_Connect(&nc, opts));
+    testCond(s == NATS_SSL_ERROR);
+    natsConnection_Destroy(nc);
+
+    test("Check that connect succeeds with validation callback:\n");
+    s = natsOptions_SetURL(opts, "nats://127.0.0.1:4443");
+    IFOK(s, natsOptions_SetSSLVerificationCallback(opts, _sslVerifyCallback));
+    IFOK(s, natsConnection_Connect(&nc, opts));
+    testCond(s == NATS_OK);
+    natsConnection_Destroy(nc);
+
+    natsOptions_Destroy(opts);
+
+    _stopServer(serverPid);
+#else
+    test("Skipped when built with no SSL support: ");
+    testCond(true);
+#endif
+}
+
 void test_SSLCiphers(void)
 {
 #if defined(NATS_HAS_TLS)