Support for SSL_MODE_NO_AUTO_CHAIN

[Chenggang Tang (chentang)]

Hi all,

Currently freeradius seems not supporting SSL_MODE_NO_AUTO_CHAIN.
However, in some situations, that is needed.

Following is the patch we used to enable that support in our work.

Please consider to add this to code repository.

Thanks a lot!


--------------------------------------------------------------------------------
diff --git a/raddb/mods-available/eap b/raddb/mods-available/eap
index 10026ec..5c3d0bf 100644
--- a/raddb/mods-available/eap
+++ b/raddb/mods-available/eap
@@ -264,6 +264,8 @@ eap {
 		#
 	#	include_length = yes
 
+	#	enable_auto_chain = yes
+
 		#  Check the Certificate Revocation List
 		#
 		#  1) Copy CA certificates and CRLs to same directory.
diff --git a/src/include/tls-h b/src/include/tls-h
index a41c6f5..f4345fd 100644
--- a/src/include/tls-h
+++ b/src/include/tls-h
@@ -338,6 +338,7 @@ struct fr_tls_server_conf_t {
 	uint32_t	verify_depth;
 	bool		file_type;
 	bool		include_length;
+	bool		enable_auto_chain;
 	bool		disable_tlsv1;
 	bool		disable_tlsv1_1;
 	bool		disable_tlsv1_2;
diff --git a/src/main/tls.c b/src/main/tls.c
index 9df48b4..caa8713 100644
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -998,6 +998,7 @@ static CONF_PARSER tls_server_config[] = {
 	{ "random_file", FR_CONF_OFFSET(PW_TYPE_STRING, fr_tls_server_conf_t, random_file), NULL },
 	{ "fragment_size", FR_CONF_OFFSET(PW_TYPE_INTEGER, fr_tls_server_conf_t, fragment_size), "1024" },
 	{ "include_length", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, fr_tls_server_conf_t, include_length), "yes" },
+	{ "enable_auto_chain", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, fr_tls_server_conf_t, enable_auto_chain), "yes" },
 	{ "check_crl", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, fr_tls_server_conf_t, check_crl), "no" },
 #ifdef X509_V_FLAG_CRL_CHECK_ALL
 	{ "check_all_crl", FR_CONF_OFFSET(PW_TYPE_BOOLEAN, fr_tls_server_conf_t, check_all_crl), "no" },
@@ -2565,6 +2566,10 @@ post_ca:
 #endif
 #endif
 
+	if (!conf->enable_auto_chain) {
+		SSL_CTX_set_mode(ctx, SSL_MODE_NO_AUTO_CHAIN);
+	}
+
 	/* Set Info callback */
 	SSL_CTX_set_info_callback(ctx, cbtls_info);
 

--------------------------------------------------------------------------------

-- 
Best Regards,
Chenggang Tang | 汤承刚