diff options
| author | Mark Spruiell <mes@zeroc.com> | 2006-04-14 13:54:10 +0000 |
|---|---|---|
| committer | Mark Spruiell <mes@zeroc.com> | 2006-04-14 13:54:10 +0000 |
| commit | 0fa7d87e63cbfb68fc206720134817449632cf66 (patch) | |
| tree | aaa5b6807fd995335ea277b27ee2703004ecd5b1 /cpp/src/IceSSL/Context.cpp | |
| parent | adding IceSSL test (diff) | |
| download | ice-0fa7d87e63cbfb68fc206720134817449632cf66.tar.bz2 ice-0fa7d87e63cbfb68fc206720134817449632cf66.tar.xz ice-0fa7d87e63cbfb68fc206720134817449632cf66.zip | |
minor change to verifier
Diffstat (limited to 'cpp/src/IceSSL/Context.cpp')
| -rw-r--r-- | cpp/src/IceSSL/Context.cpp | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/cpp/src/IceSSL/Context.cpp b/cpp/src/IceSSL/Context.cpp index 03668dce76b..2635a51a9ec 100644 --- a/cpp/src/IceSSL/Context.cpp +++ b/cpp/src/IceSSL/Context.cpp @@ -484,7 +484,7 @@ IceSSL::Context::ctx() const } void -IceSSL::Context::validatePeer(SSL* ssl, const string& address, bool incoming) +IceSSL::Context::verifyPeer(SSL* ssl, const string& address, bool incoming) { long result = SSL_get_verify_result(ssl); if(result != X509_V_OK) @@ -642,7 +642,19 @@ IceSSL::Context::validatePeer(SSL* ssl, const string& address, bool incoming) const_cast<string&>(info.address) = address; const_cast<vector<string>&>(info.dnsNames) = dnsNames; const_cast<vector<string>&>(info.ipAddresses) = ipAddresses; - verifier->verify(info); + if(!verifier->verify(info)) + { + string msg = string(incoming ? "incoming" : "outgoing") + + " connection rejected by certificate verifier"; + if(_instance->securityTraceLevel() >= 1) + { + _logger->trace(_instance->securityTraceCategory(), msg + "\n" + + IceInternal::fdToString(SSL_get_fd(ssl))); + } + SecurityException ex(__FILE__, __LINE__); + ex.reason = msg; + throw ex; + } } } catch(...) |