tyler.durden
/
icinga2
mirror of https://github.com/Icinga/icinga2.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix unauthenticated TLS connections 

refs #7244
This commit is contained in:
Gunnar Beutner 2014-10-16 09:58:01 +02:00
parent 311cce5d41
commit fd6fe82606
2 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/base/tlsstream.cpp
View File

@ -36,7 +36,7 @@ bool I2_EXPORT TlsStream::m_SSLIndexInitialized = false;
* @param sslContext The SSL context for the client. * @param sslContext The SSL context for the client.
*/ */
TlsStream::TlsStream(const Socket::Ptr& socket, ConnectionRole role, const shared_ptr<SSL_CTX>& sslContext) TlsStream::TlsStream(const Socket::Ptr& socket, ConnectionRole role, const shared_ptr<SSL_CTX>& sslContext)
: m_Eof(false), m_Socket(socket), m_Role(role), m_VerifyOK(false) : m_Eof(false), m_Socket(socket), m_Role(role), m_VerifyOK(true)
{ {
std::ostringstream msgbuf; std::ostringstream msgbuf;
char errbuf[120]; char errbuf[120];
@ -75,7 +75,8 @@ int TlsStream::ValidateCertificate(int preverify_ok, X509_STORE_CTX *ctx)
{ {
SSL *ssl = static_cast<SSL *>(X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx())); SSL *ssl = static_cast<SSL *>(X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()));
TlsStream *stream = static_cast<TlsStream *>(SSL_get_ex_data(ssl, m_SSLIndex)); TlsStream *stream = static_cast<TlsStream *>(SSL_get_ex_data(ssl, m_SSLIndex));
stream->m_VerifyOK = preverify_ok; if (!preverify_ok)
stream->m_VerifyOK = false;
return 1; return 1;
} }

5
lib/cli/pkisigncsrcommand.cpp
View File

@ -119,16 +119,21 @@ int PKISignCSRCommand::Run(const boost::program_options::variables_map& vm, cons
X509 *cert = CreateCert(pubkey, X509_REQ_get_subject_name(req), X509_get_subject_name(cacert), privkey, false); X509 *cert = CreateCert(pubkey, X509_REQ_get_subject_name(req), X509_get_subject_name(cacert), privkey, false);
EVP_PKEY_free(pubkey);
X509_free(cacert); X509_free(cacert);
BIO *certbio = BIO_new_fp(stdout, BIO_NOCLOSE); BIO *certbio = BIO_new_fp(stdout, BIO_NOCLOSE);
if (!PEM_write_bio_X509(certbio, cert)) { if (!PEM_write_bio_X509(certbio, cert)) {
BIO_free(certbio);
msgbuf << "Could not write X509 certificate: " << ERR_peek_error() << ", \"" << ERR_error_string(ERR_peek_error(), errbuf) << "\""; msgbuf << "Could not write X509 certificate: " << ERR_peek_error() << ", \"" << ERR_error_string(ERR_peek_error(), errbuf) << "\"";
Log(LogCritical, "SSL", msgbuf.str()); Log(LogCritical, "SSL", msgbuf.str());
return 1; return 1;
} }
X509_free(cert);
BIO_free(certbio); BIO_free(certbio);
return 0; return 0;