verify.c

Go to the documentation of this file.

/*
 *   This program is free software; you can redistribute it and/or modify
 *   it under the terms of the GNU General Public License as published by
 *   the Free Software Foundation; either version 2 of the License, or
 *   (at your option) any later version.
 *
 *   This program is distributed in the hope that it will be useful,
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *   GNU General Public License for more details.
 *
 *   You should have received a copy of the GNU General Public License
 *   along with this program; if not, write to the Free Software
 *   Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
 */
 
/**
 * $Id: fdbb16fa726f5935721182da1236b9ad411d1144 $
 *
 * @file tls/verify.c
 * @brief Expose certificate OIDs as attributes, and call validation virtual
 *      server to check cert is valid.
 *
 * @copyright 2003 Alan DeKok (aland@freeradius.org)
 * @copyright 2006-2016 The FreeRADIUS server project
 */
#ifdef WITH_TLS
#define LOG_PREFIX "tls"
 
#define _TLS_PRIVATE 1
 
#include <freeradius-devel/server/exec.h>
#include <freeradius-devel/server/pair.h>
#include <freeradius-devel/tls/log.h>
#include <freeradius-devel/unlang/function.h>
#include <freeradius-devel/unlang/subrequest.h>
#include <freeradius-devel/util/debug.h>
#include <freeradius-devel/util/strerror.h>
#include <freeradius-devel/util/syserror.h>
 
#include <freeradius-devel/protocol/tls/freeradius.h>
 
#include <openssl/x509v3.h>
 
#include "attrs.h"
#include "base.h"
 
/** Check to see if a verification operation should apply to a certificate
 *
 * @param[in] depth     starting at 0.
 *                      Certificate 0 is the leaf cert (i.e. the client or server cert);
 * @param[in] untrusted The number of untrusted certificates.
 * @param[in] mode      to check
 * @return
 *      - true if a given validation check should apply.
 **     - false if a validation check should not apply.
 */
static inline CC_HINT(always_inline)
bool verify_applies(fr_tls_verify_mode_t mode, int depth, int untrusted)
{
        if (mode == FR_TLS_VERIFY_MODE_ALL) return true;
        if (mode == FR_TLS_VERIFY_MODE_DISABLED) return false;
 
        if ((mode & FR_TLS_VERIFY_MODE_LEAF) && (depth == 0)) return true;
        if ((mode & FR_TLS_VERIFY_MODE_ISSUER) && (depth == 1)) return true;
        if ((mode & FR_TLS_VERIFY_MODE_UNTRUSTED) && (depth < untrusted)) return true;
 
        return false;
}
 
DIAG_OFF_OPTIONAL(used-but-marked-unused)       /* fix spurious warnings for sk macros */
 
/** Print verbose humanly readable messages about why certificate validation failed
 *
 */
static void tls_verify_error_detail(request_t *request, SSL_CTX *ctx, int err)
{
        X509_STORE      *store = SSL_CTX_get_ex_data(ctx, FR_TLS_EX_CTX_INDEX_VERIFY_STORE);
 
        switch (err) {
        /*
         *      We linked the provided cert to at least one
         *      other in a chain, but the chain doesn't terminate
         *      in a root CA.
         */
        case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
                FALL_THROUGH;
 
        /*
         *      We failed to link the provided cert to any
         *      other local certificates in the chain.
         */
        case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
                RDEBUG2("(TLS) Static certificates in verification store are");
                if (RDEBUG_ENABLED2) {
                        RINDENT();
                        fr_tls_x509_objects_log(request, L_DBG, X509_STORE_get0_objects(store));
                        REXDENT();
                }
                break;
 
        default:
                break;
        }
}
 
/** Validates a certificate using custom logic
 *
 * Before trusting a certificate, we make sure that the certificate is
 * 'valid'. There are several checks we perform to verify its validity.
 *
 *   1. Verify the certificate's signature, and verifying that the certificate has
 *      been issued by a trusted Certificate Authority (this is done for us by OpenSSL).
 *
 *   2. Verify that the certificate is valid for the present date (i.e. it is being
 *      presented within its validity dates).
 *
 *   3. Verify that the certificate has not been revoked by its issuing Certificate
 *      Authority, by checking with respect to a Certificate Revocation List (CRL).
 *
 * @note This callback will be called multiple times based on the depth of the root
 *      certificate chain.
 *
 * @note OpenSSL runs the handshake (including this callback) on a fibre with a
 *      limited stack (32 KB on OpenSSL releases without ASYNC_set_mem_functions()).
 *      Because of that limited stack, we need to perform all certificate decoding
 *      outside of the fibre on the main stack, i.e. after OpenSSL has yielded and
 *      the handshake has paused.  See fr_tls_verify_cert_pending_push().
 *
 * @param ok            preverify ok.  1 if true, 0 if false.
 * @param x509_ctx      containing certs to verify.
 * @return
 *      - 0 if not valid.
 *      - 1 if valid.
 */
int fr_tls_verify_cert_cb(int ok, X509_STORE_CTX *x509_ctx)
{
        X509                    *cert;
 
        SSL_CTX                 *ssl_ctx;
        SSL                     *ssl;
        fr_tls_session_t        *tls_session;
        int                     err, depth;
        fr_tls_conf_t           *conf;
        int                     my_ok = ok;
        int                     untrusted;
 
        request_t               *request;
        fr_pair_t               *depth_pair;
 
        cert = X509_STORE_CTX_get_current_cert(x509_ctx);
        err = X509_STORE_CTX_get_error(x509_ctx);
        depth = X509_STORE_CTX_get_error_depth(x509_ctx);
        untrusted = X509_STORE_CTX_get_num_untrusted(x509_ctx);
 
        /*
         *      Retrieve the pointer to the SSL of the connection currently treated
         *      and the application specific data stored into the SSL object.
         */
        ssl = X509_STORE_CTX_get_ex_data(x509_ctx, SSL_get_ex_data_X509_STORE_CTX_idx());
        ssl_ctx = SSL_get_SSL_CTX(ssl);
        conf = fr_tls_session_conf(ssl);
        tls_session = talloc_get_type_abort(SSL_get_ex_data(ssl, FR_TLS_EX_INDEX_TLS_SESSION), fr_tls_session_t);
        request = fr_tls_session_request(tls_session->ssl);
 
        /*
         *      If this error appears it suggests
         *      that OpenSSL is trying to perform post-handshake
         *      certificate validation which we don't support.
         */
        if (!tls_session->can_pause) {
                fr_assert_msg("Unexpected call to %s. "
                              "tls_session_async_handshake_cont must be in call stack", __FUNCTION__);
                return 0;
        }
 
        /*
         *      Bail out as quickly as possible, producing
         *      as few errors as possible.
         */
        if (unlang_request_is_cancelled(request)) {
                X509_STORE_CTX_set_error(x509_ctx, 0);
                return 1;
        }
 
        /*
         *      Find or add the chain depth attribute and record the greatest depth we see + 1,
         *      as depth is zero based.
         */
        if (unlikely(fr_pair_find_or_append_by_da(request->session_state_ctx, &depth_pair, &request->session_state_pairs,
                                         attr_tls_certificate_chain_depth) < 0)) {
                REDEBUG("(TLS) Failed to add certificate chain depth pair");
                return 0;
        }
        if (depth_pair->vp_uint32 < ((uint32_t)depth) + 1) depth_pair->vp_uint32 = (uint32_t)depth + 1;
 
        if (RDEBUG_ENABLED3) {
                char            subject[2048];
                STACK_OF(X509)  *our_chain;
                int             i;
 
                our_chain = X509_STORE_CTX_get0_chain(x509_ctx);
                RDEBUG3("(TLS) Certificate chain - %i cert(s) untrusted", untrusted);
                for (i = sk_X509_num(our_chain); i > 0 ; i--) {
                        X509 *this_cert = sk_X509_value(our_chain, i - 1);
 
                        X509_NAME_oneline(X509_get_subject_name(this_cert), subject, sizeof(subject));
                        subject[sizeof(subject) - 1] = '\0';
 
                        RDEBUG3("(TLS) %s [%i] %s", this_cert == cert ? ">" : " ", i - 1, subject);
                }
        }
 
        /*
         *      See if the user has disabled verification for
         *      this certificate.  If they have, force verification
         *      to succeed.
         */
        if (!my_ok) {
                char const *p = X509_verify_cert_error_string(err);
                if (!verify_applies(conf->verify.mode, depth, untrusted)) {
                        RDEBUG2("(TLS) Ignoring verification error - %s (%i)", p, err);
                        tls_verify_error_detail(request, ssl_ctx, err);
 
                        my_ok = 1;
                        X509_STORE_CTX_set_error(x509_ctx, 0);
                } else {
                        REDEBUG("(TLS) Verification error - %s (%i)", p, err);
                        fr_tls_session_error_add(request, FR_ERROR_VALUE_CERTIFICATE_VERIFY_FAILED);
                        tls_verify_error_detail(request, ssl_ctx, err);
                        goto done;
                }
        }
 
done:
        /*
         *      The chain is complete once OpenSSL reaches depth 0.  Pause the handshake
         *      here so that fr_tls_verify_cert_pending_push() can decode the chain and run
         *      the `verify certificate` section on the main stack.  Execution continues
         *      after the ASYNC_pause_job() call below once the section has run.
         */
        if (my_ok && (depth == 0)) {
                bool want_pairs = conf->verify.attribute_mode != FR_TLS_VERIFY_MODE_DISABLED;
                bool want_verify = conf->verify_certificate && tls_session->verify_peer_cert;
 
                if (want_pairs || want_verify) {
                        fr_tls_verify_cert_request(tls_session, x509_ctx);
 
                        /*
                         *      Be aware that if the request is cancelled
                         *      whatever was meant to be done during the
                         *      time we yielded may not have been completed.
                         */
                        ASYNC_pause_job();
 
                        /*
                         *      Just try and bail out as quickly as possible.
                         */
                        if (unlang_request_is_cancelled(request)) {
                                X509_STORE_CTX_set_error(x509_ctx, 0);
                                fr_tls_verify_cert_reset(tls_session);
                                return 1;
                        }
 
                        /*
                         *      If we couldn't decode the chain, or the
                         *      `verify certificate` section rejected it,
                         *      then validation overall fails.
                         */
                        if (!fr_tls_verify_cert_result(tls_session)) {
                                REDEBUG("(TLS) Certificate validation failed");
                                my_ok = 0;
                                X509_STORE_CTX_set_error(x509_ctx, X509_V_ERR_APPLICATION_VERIFICATION);
                        }
                }
        }
 
        tls_session->peer_cert_ok = (my_ok > 0);
        RDEBUG2("(TLS) [verify] = %s", my_ok ? "ok" : "invalid");
 
        return my_ok;
}
DIAG_ON_OPTIONAL(used-but-marked-unused)
 
/** Revalidates the client's certificate chain
 *
 * Wraps the fr_tls_verify_cert_cb callback, allowing us to use the same
 * validation logic whenever we need to.
 *
 * @note Only use so far is forcing the chain to be re-validated on session
 *      resumption.
 *
 * @return
 *      - 1 if the chain could be validated.
 *      - 0 if the chain failed validation.
 */
int fr_tls_verify_cert_chain(request_t *request, SSL *ssl)
{
        int             err;
        int             verify;
        int             ret = 1;
 
        SSL_CTX         *ssl_ctx;
        STACK_OF(X509)  *chain;
        X509            *cert;
        X509_STORE      *store;
        X509_STORE_CTX  *store_ctx;
 
        /*
         *      If there's no client certificate, we just return OK.
         */
        cert = SSL_get0_peer_certificate(ssl);                  /* Does not increase ref count */
        if (!cert) return 1;
 
        ssl_ctx = SSL_get_SSL_CTX(ssl);
        store_ctx = X509_STORE_CTX_new();
        if (unlikely(store_ctx == NULL)) {
                REDEBUG("(TLS) Failed allocating X509_STORE_CTX");
                return 0;
        }
 
        chain = SSL_get_peer_cert_chain(ssl);                   /* Does not increase ref count */
        store = SSL_CTX_get_ex_data(ssl_ctx, FR_TLS_EX_CTX_INDEX_VERIFY_STORE); /* Gets the verification store */
 
        /*
         *      This sets up a store_ctx for doing peer certificate verification.
         *
         *      store_ctx       - Is the ctx to initialise
         *      store           - Is an X509_STORE of implicitly
         *                        trusted certificates.  Here we're using
         *                        the verify store that was created when we
         *                        allocated the SSL_CTX.
         *      cert            - Is the certificate to validate.
         *      chain           - Is any other certificates the peer provided
         *                        us in order to build a chain from a trusted
         *                        root or intermediary to its leaf (cert).
         *
         *      Note: SSL_CTX_get_cert_store() returns the ctx->cert_store, which
         *      is not the same as the verification cert store.
         */
        if (unlikely(X509_STORE_CTX_init(store_ctx, store, cert, chain) != 1)) {
                REDEBUG("(TLS) Failed initialising X509_STORE_CTX");
                X509_STORE_CTX_free(store_ctx);
                return 0;
        }
 
        X509_STORE_CTX_set_ex_data(store_ctx, SSL_get_ex_data_X509_STORE_CTX_idx(), ssl);
        X509_STORE_CTX_set_verify_cb(store_ctx, fr_tls_verify_cert_cb);
 
        verify = X509_verify_cert(store_ctx);
        if (verify != 1) {
                err = X509_STORE_CTX_get_error(store_ctx);
 
                if (err != X509_V_OK) {
                        REDEBUG("(TLS) Failed re-validating resumed session: %s", X509_verify_cert_error_string(err));
                        fr_tls_session_error_add(request, FR_ERROR_VALUE_CERTIFICATE_REVALIDATION_FAILED);
                        ret = 0;
                }
        }
 
        X509_STORE_CTX_free(store_ctx);
 
        return ret;
}
 
/** Process the result of `verify certificate { ... }`
 *
 */
static unlang_action_t tls_verify_peer_cert_result(request_t *request, void *uctx)
{
        fr_tls_session_t        *tls_session = talloc_get_type_abort(uctx, fr_tls_session_t);
        fr_pair_t               *vp, *next;
 
        fr_assert(tls_session->validate.state == FR_TLS_VALIDATION_REQUESTED);
 
        vp = fr_pair_find_by_da(&request->reply_pairs, NULL, attr_tls_packet_type);
        if (!vp || (vp->vp_uint32 != enum_tls_packet_type_success->vb_uint32)) {
                REDEBUG("(TLS) Failed (re-)validating certificates");
                fr_tls_session_error_add(request->parent, FR_ERROR_VALUE_VERIFY_CERTIFICATE_FAILED);
 
                /*
                 *      Hoist any instances of Module-Failure-Message from the subrequest
                 *      so they can be used for logging failures.
                 */
                vp = fr_pair_find_by_da(&request->request_pairs, NULL, attr_module_failure_message);
                while (vp && request->parent) {
                        next = fr_pair_find_by_da(&request->request_pairs, vp, attr_module_failure_message);
                        fr_pair_remove(&request->request_pairs, vp);
                        fr_pair_steal_append(request->parent->request_ctx, &request->parent->request_pairs, vp);
                        vp = next;
                }
 
                tls_session->validate.state = FR_TLS_VALIDATION_FAILED;
                return UNLANG_ACTION_CALCULATE_RESULT;
        }
 
        tls_session->validate.state = FR_TLS_VALIDATION_SUCCESS;
 
        RDEBUG2("(TLS) Certificates (re-)validated");
 
        return UNLANG_ACTION_CALCULATE_RESULT;
}
 
/** Push a `verify certificate { ... }` call into the current request, using a subrequest
 *
 * @param[in] request           The current request.
 * @param[in] tls_session       The current TLS session.
 * @return
 *      - UNLANG_ACTION_CALCULATE_RESULT on noop.
 *      - UNLANG_ACTION_PUSHED_CHILD on success.
 *      - UNLANG_ACTION_FAIL on failure.
 */
static unlang_action_t tls_verify_peer_cert_push(request_t *request, fr_tls_session_t *tls_session)
{
        fr_tls_conf_t           *conf = tls_session->conf;
        request_t               *child;
        fr_pair_t               *vp;
        unlang_action_t         ua;
 
        fr_assert(conf->virtual_server);
 
        MEM(child = tls_subrequest_alloc(request, enum_tls_packet_type_verify_certificate->vb_uint32,
                                         &tls_session->session_id));
        request = child;
 
        /*
         *      Add extra pairs to the subrequest
         */
        fr_tls_session_extra_pairs_copy_to_child(child, tls_session);
 
        /*
         *      Copy certificate pairs to the child session state
         */
        vp = NULL;
        while ((vp = fr_pair_find_by_da(&request->parent->session_state_pairs, vp, attr_tls_certificate))) {
                fr_pair_append(&request->session_state_pairs, fr_pair_copy(request->session_state_ctx, vp));
        }
        if (conf->verify.der_decode) {
                while ((vp = fr_pair_find_by_da(&request->parent->session_state_pairs, vp, attr_der_certificate))) {
                        fr_pair_append(&request->session_state_pairs, fr_pair_copy(request->session_state_ctx, vp));
                }
        }
 
        MEM(pair_append_request(&vp, attr_tls_session_resumed) >= 0);
        vp->vp_bool = tls_session->validate.resumed;
 
        /*
         *      Allocate a child, and set it up to call
         *      the TLS virtual server.
         */
        ua = fr_tls_call_push(child, tls_verify_peer_cert_result, conf, tls_session, false);
        if (ua == UNLANG_ACTION_FAIL) {
                REDEBUG("(TLS) Failed calling TLS virtual server");
                talloc_free(child);
                return UNLANG_ACTION_FAIL;
        }
 
        return ua;
}
 
/** Clear any previous validation result
 *
 * Should be called by the validation requestor to get the result and reset
 * the validation state.
 *
 * @return
 *      - true if the certificate chain was validated.
 *      - false if the certificate chain failed validation.
 */
bool fr_tls_verify_cert_result(fr_tls_session_t *tls_session)
{
        bool result;
 
        fr_assert(tls_session->validate.state != FR_TLS_VALIDATION_INIT);
 
        result = tls_session->validate.state == FR_TLS_VALIDATION_SUCCESS;
 
        tls_session->validate.state = FR_TLS_VALIDATION_INIT;
        tls_session->validate.resumed = false;
 
        return result;
}
 
/** Reset the verification state
 *
 */
void fr_tls_verify_cert_reset(fr_tls_session_t *tls_session)
{
        tls_session->validate.state = FR_TLS_VALIDATION_INIT;
        tls_session->validate.resumed = false;
        tls_session->validate.x509_ctx = NULL;
}
 
/** Request validation of the chain OpenSSL is verifying
 *
 * Called by fr_tls_verify_cert_cb() before it pauses the handshake.
 *
 * @param[in] tls_session       The current TLS session.
 * @param[in] x509_ctx          holding the chain.  Only valid while the
 *                              handshake is paused inside the callback.
 */
void fr_tls_verify_cert_request(fr_tls_session_t *tls_session, X509_STORE_CTX *x509_ctx)
{
        fr_assert(tls_session->validate.state == FR_TLS_VALIDATION_INIT);
 
        tls_session->validate.state = FR_TLS_VALIDATION_REQUESTED;
        TLS_PENDING_SET(tls_session, FR_TLS_PENDING_VERIFY);
        tls_session->validate.resumed = false;
        tls_session->validate.x509_ctx = x509_ctx;
}
 
/** Request re-validation of the certificate pairs restored with a resumed session
 *
 * Called by the session cache code before it pauses the handshake.  A resumed
 * session has no chain to decode, the `TLS-Certificate` pairs came back with
 * the session.
 *
 * @param[in] tls_session       The current TLS session.
 */
void fr_tls_verify_resumed_request(fr_tls_session_t *tls_session)
{
        fr_assert(tls_session->validate.state == FR_TLS_VALIDATION_INIT);
 
        tls_session->validate.state = FR_TLS_VALIDATION_REQUESTED;
        TLS_PENDING_SET(tls_session, FR_TLS_PENDING_VERIFY);
        tls_session->validate.resumed = true;
        tls_session->validate.x509_ctx = NULL;
}
 
DIAG_OFF_OPTIONAL(used-but-marked-unused)       /* fix spurious warnings for sk macros */
/** Decode the chain OpenSSL is verifying into `session-state.TLS-Certificate` pairs
 *
 * Runs on the request's own stack while the handshake is paused in
 * fr_tls_verify_cert_cb().  The certificate at depth 0 is the peer's, and
 * `TLS-Certificate[n]` holds the certificate at depth n.
 *
 * @param[in] request           The current request.
 * @param[in] tls_session       The current TLS session.
 * @param[in] conf              The TLS configuration.
 * @return
 *      - 0 on success.
 *      - -1 if a certificate could not be decoded.  No `TLS-Certificate`
 *        pairs remain in the session-state list.
 */
static int tls_verify_chain_pairs_add(request_t *request, fr_tls_session_t *tls_session, fr_tls_conf_t const *conf)
{
        X509_STORE_CTX  *x509_ctx = tls_session->validate.x509_ctx;
        STACK_OF(X509)  *chain = X509_STORE_CTX_get0_chain(x509_ctx);
        int             untrusted = X509_STORE_CTX_get_num_untrusted(x509_ctx);
        int             num = sk_X509_num(chain);
        int             depth;
 
        /*
         *      Deepest first, so each DER decoded certificate is prepended ahead
         *      of its issuer and `DER-Certificate[0]` is the peer's.
         */
        for (depth = num - 1; depth >= 0; depth--) {
                X509            *cert = sk_X509_value(chain, depth);
                X509            *issuer;
                fr_pair_t       *container;
                unsigned int    i;
 
                if (!verify_applies(conf->verify.attribute_mode, depth, untrusted)) continue;
 
                /*
                 *      Already decoded, the pairs came back with a resumed session.
                 */
                container = fr_pair_find_by_da_idx(&request->session_state_pairs, attr_tls_certificate, depth);
                if (container && !fr_pair_list_empty(&container->vp_group)) continue;
 
                /*
                 *      Build out sufficient TLS-Certificate containers so the
                 *      TLS-Certificate indexes match the chain depth.
                 */
                for (i = fr_pair_count_by_da(&request->session_state_pairs, attr_tls_certificate);
                     i <= (unsigned int)depth;
                     i++) {
                        MEM(container = fr_pair_afrom_da(request->session_state_ctx, attr_tls_certificate));
                        fr_pair_append(&request->session_state_pairs, container);
                }
 
#ifdef STATIC_ANALYZER
                /*
                 *      Container can never be NULL, because if container
                 *      was previously NULL, i will be <= depth.
                 */
                if (!fr_cond_assert(container)) return -1;
#endif
 
                /*
                 *      The issuer is the next certificate up the chain.  The last
                 *      certificate is its own issuer when it is self-issued, which
                 *      is what OpenSSL reports as the current issuer when it calls
                 *      the verify callback for that certificate.
                 */
                if ((depth + 1) < num) {
                        issuer = sk_X509_value(chain, depth + 1);
                } else if (X509_check_issued(cert, cert) == X509_V_OK) {
                        issuer = cert;
                } else {
                        issuer = NULL;
                }
 
                /*
                 *      If we fail to populate the cert attributes,
                 *      trash all instances in the session-state list
                 *      and cause validation to fail.
                 */
                if (fr_tls_session_pairs_from_x509_cert(&container->vp_group, container,
                                                        request, cert, issuer, conf->verify.der_decode) < 0) {
                        fr_pair_delete_by_da(&request->session_state_pairs, attr_tls_certificate);
                        if (conf->verify.der_decode) {
                                fr_pair_delete_by_da(&request->session_state_pairs, attr_der_certificate);
                        }
                        fr_tls_session_error_add(request, FR_ERROR_VALUE_CERTIFICATE_ATTRIBUTES_FAILED);
                        return -1;
                }
 
                log_request_pair(L_DBG_LVL_2, request, NULL, container, "session-state.");
        }
 
        return 0;
}
DIAG_ON_OPTIONAL(used-but-marked-unused)
 
/** Decode the chain, then push a `verify certificate { ... }` section
 *
 * tls_session_async_handshake_cont() calls the function once the handshake
 * has paused, after the pushes for the session cache and `load psk` sections.
 *
 * @param[in] request           The current request.
 * @param[in] tls_session       The current TLS session.
 * @return
 *      - UNLANG_ACTION_CALCULATE_RESULT        - Nothing to push, resume the handshake.
 *      - UNLANG_ACTION_PUSHED_CHILD            - The section is running.
 *      - UNLANG_ACTION_FAIL                    - The section could not be pushed.
 */
unlang_action_t fr_tls_verify_cert_pending_push(request_t *request, fr_tls_session_t *tls_session)
{
        fr_tls_conf_t   *conf = tls_session->conf;
 
        if (tls_session->validate.state != FR_TLS_VALIDATION_REQUESTED) return UNLANG_ACTION_CALCULATE_RESULT;
 
        /*
         *      A resumed session has no chain, its pairs came back with the session.
         */
        if (!tls_session->validate.resumed) {
                RDEBUG2("(TLS) Decoding certificate chain");
                if (tls_verify_chain_pairs_add(request, tls_session, conf) < 0) {
                        tls_session->validate.state = FR_TLS_VALIDATION_FAILED;
                        return UNLANG_ACTION_CALCULATE_RESULT;
                }
        }
 
        /*
         *      Pairs were all that was wanted.
         */
        if (!conf->verify_certificate || !tls_session->verify_peer_cert) {
                tls_session->validate.state = FR_TLS_VALIDATION_SUCCESS;
                return UNLANG_ACTION_CALCULATE_RESULT;
        }
 
        RDEBUG2("(TLS) Requesting certificate validation");
 
        return tls_verify_peer_cert_push(request, tls_session);
}
#endif /* WITH_TLS */