tyler.durden/icinga2
1
0
Fork 0
mirror of https://github.com/Icinga/icinga2.git synced 2025-07-29 16:44:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Check the certificate name when reconnecting to an instance

Browse Source 
refs #10963
This commit is contained in:
Gunnar Beutner 2016-01-19 16:24:12 +01:00
parent b1aa6cc98a
commit e4b7111577
3 changed files with 17 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
lib/base/tlsstream.cpp
View File

@ -85,7 +85,7 @@ TlsStream::TlsStream(const Socket::Ptr& socket, const String& hostname, Connecti
TlsStream::~TlsStream(void) TlsStream::~TlsStream(void)
{ {
Close(); CloseInternal(true);
} }
int TlsStream::ValidateCertificate(int preverify_ok, X509_STORE_CTX *ctx) int TlsStream::ValidateCertificate(int preverify_ok, X509_STORE_CTX *ctx)
@ -310,17 +310,21 @@ void TlsStream::Shutdown(void)
*/ */
void TlsStream::Close(void) void TlsStream::Close(void)
{ {
if (!m_Eof) { CloseInternal(false);
}
void TlsStream::CloseInternal(bool inDestructor)
{
if (!m_Eof && !inDestructor) {
m_Eof = true; m_Eof = true;
SignalDataAvailable(); SignalDataAvailable();
} }
Stream::Close();
SocketEvents::Unregister(); SocketEvents::Unregister();
boost::mutex::scoped_lock lock(m_Mutex); Stream::Close();
boost::mutex::scoped_lock lock(m_Mutex);
if (!m_SSL) if (!m_SSL)
return; return;

2
lib/base/tlsstream.hpp
View File

@ -99,6 +99,8 @@ private:
static int ValidateCertificate(int preverify_ok, X509_STORE_CTX *ctx); static int ValidateCertificate(int preverify_ok, X509_STORE_CTX *ctx);
static void NullCertificateDeleter(X509 *certificate); static void NullCertificateDeleter(X509 *certificate);
void CloseInternal(bool inDestructor);
}; };
} }

6
lib/remote/apilistener.cpp
View File

@ -321,6 +321,12 @@ void ApiListener::NewClientHandlerInternal(const Socket::Ptr& client, const Stri
return; return;
} }
if (!hostname.IsEmpty() && identity != hostname) {
Log(LogInformation, "ApiListener")
<< "Unexpected certificate common name while connecting to endpoint '" << hostname << "': got '" << identity << "'";
return;
}
verify_ok = tlsStream->IsVerifyOK(); verify_ok = tlsStream->IsVerifyOK();
Log(LogInformation, "ApiListener") Log(LogInformation, "ApiListener")