set_tls_verify_peer: use peer_info callback for relay cert verification

logsrvd/logsrvd.c

@@ -1460,10 +1460,15 @@ set_tls_verify_peer(void)
 	}
     }
     if (relay_ctx != NULL && logsrvd_conf_relay_tls_check_peer()) {
-	/* Verify relay cert during the handshake. */
+	/*
+	 * Verify relay cert during the handshake.  The relay connection
+	 * stores a struct peer_info in the SSL object (see tls_ctx_client_setup())
+	 * so we must use tls_verify_peer(), not the connection_closure-based
+	 * verify_peer_identity() used for accepted client connections.
+	 */
 	SSL_CTX_set_verify(relay_ctx,
 	    SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
-	    verify_peer_identity);
+	    tls_verify_peer);
     }
 
     debug_return;

logsrvd/tls_client.c

@@ -52,15 +52,15 @@
  * contains the server name or IP address.
  * Returns 0 if the cert is invalid, else 1.
  */
-static int
-verify_peer_identity(int preverify_ok, X509_STORE_CTX *ctx)
+int
+tls_verify_peer(int preverify_ok, X509_STORE_CTX *ctx)
 {
     HostnameValidationResult result;
     struct peer_info *peer_info;
     SSL *ssl;
     X509 *current_cert;
     X509 *peer_cert;
-    debug_decl(verify_peer_identity, SUDO_DEBUG_UTIL);
+    debug_decl(tls_verify_peer, SUDO_DEBUG_UTIL);
 
     current_cert = X509_STORE_CTX_get_current_cert(ctx);
 
@@ -252,7 +252,7 @@ tls_client_setup(int sock, const char *ca_bundle_file, const char *cert_file,
 	/* Verify server cert during the handshake. */
 	SSL_CTX_set_verify(ssl_ctx,
 	    SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
-	    verify_peer_identity);
+	    tls_verify_peer);
     }
 
     debug_return_bool(tls_ctx_client_setup(ssl_ctx, sock, closure));

logsrvd/tls_common.h

@@ -42,6 +42,7 @@ struct tls_client_closure {
 };
 
 /* tls_client.c */
+int tls_verify_peer(int preverify_ok, X509_STORE_CTX *ctx);
 void tls_connect_cb(int sock, int what, void *v);
 bool tls_client_setup(int sock, const char *ca_bundle_file, const char *cert_file, const char *key_file, const char *dhparam_file, const char *ciphers_v12, const char *ciphers_v13, bool verify_server, bool check_peer, struct tls_client_closure *closure);
 bool tls_ctx_client_setup(SSL_CTX *ssl_ctx, int sock, struct tls_client_closure *closure);