tyler.durden/icinga2
1
0
Fork 0
mirror of https://github.com/Icinga/icinga2.git synced 2025-07-26 23:24:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix ticket hash calculation for indirectly connected clients

Browse Source 
refs #5450
This commit is contained in:
Michael Friedrich 2017-09-06 10:54:39 +02:00 committed by Gunnar Beutner
parent c02742925e
commit 88b4a54e6b
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
lib/remote/jsonrpcconnection-pki.cpp
View File

@ -118,11 +118,14 @@ Value RequestCertificateHandler(const MessageOrigin::Ptr& origin, const Dictiona
boost::shared_ptr<X509> newcert; boost::shared_ptr<X509> newcert;
boost::shared_ptr<EVP_PKEY> pubkey; boost::shared_ptr<EVP_PKEY> pubkey;
X509_NAME *subject; X509_NAME *subject;
String cn;
Dictionary::Ptr message; Dictionary::Ptr message;
if (!Utility::PathExists(GetIcingaCADir() + "/ca.key")) if (!Utility::PathExists(GetIcingaCADir() + "/ca.key"))
goto delayed_request; goto delayed_request;
cn = GetCertificateCN(cert);
if (!signedByCA) { if (!signedByCA) {
String salt = listener->GetTicketSalt(); String salt = listener->GetTicketSalt();
@ -131,9 +134,12 @@ Value RequestCertificateHandler(const MessageOrigin::Ptr& origin, const Dictiona
if (salt.IsEmpty() || ticket.IsEmpty()) if (salt.IsEmpty() || ticket.IsEmpty())
goto delayed_request; goto delayed_request;
String realTicket = PBKDF2_SHA1(origin->FromClient->GetIdentity(), salt, 50000); String realTicket = PBKDF2_SHA1(cn, salt, 50000);
if (ticket != realTicket) { if (ticket != realTicket) {
Log(LogWarning, "JsonRpcConnection")
<< "Ticket for identity '" << cn << "' is invalid.";
result->Set("status_code", 1); result->Set("status_code", 1);
result->Set("error", "Invalid ticket."); result->Set("error", "Invalid ticket.");
return result; return result;