diff options
| author | Jose <pepone@users.noreply.github.com> | 2019-09-10 10:29:11 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-09-10 10:29:11 +0200 |
| commit | bad1d435dfba9b103bfe76555506757beda5c4df (patch) | |
| tree | f4a8dd87308ee80781f9b39ffabd95cee9e1ef69 /cpp/src/IceSSL/OpenSSLTransceiverI.cpp | |
| parent | Whitespace fixes (diff) | |
| download | ice-bad1d435dfba9b103bfe76555506757beda5c4df.tar.bz2 ice-bad1d435dfba9b103bfe76555506757beda5c4df.tar.xz ice-bad1d435dfba9b103bfe76555506757beda5c4df.zip | |
IceSSL cert name verification fixes - Close #512 (#515)
Diffstat (limited to 'cpp/src/IceSSL/OpenSSLTransceiverI.cpp')
| -rw-r--r-- | cpp/src/IceSSL/OpenSSLTransceiverI.cpp | 20 |
1 files changed, 19 insertions, 1 deletions
diff --git a/cpp/src/IceSSL/OpenSSLTransceiverI.cpp b/cpp/src/IceSSL/OpenSSLTransceiverI.cpp index def54dff731..1acd3b12800 100644 --- a/cpp/src/IceSSL/OpenSSLTransceiverI.cpp +++ b/cpp/src/IceSSL/OpenSSLTransceiverI.cpp @@ -171,7 +171,7 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal:: // Hostname verification was included in OpenSSL 1.0.2 // #if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x10002000L - if(_engine->getCheckCertName() && !_host.empty() && (sslVerifyMode & SSL_VERIFY_PEER)) + if(_engine->getCheckCertName() && !_host.empty()) { X509_VERIFY_PARAM* param = SSL_get0_param(_ssl); if(IceInternal::isIpAddress(_host)) @@ -339,6 +339,24 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal:: } _cipher = SSL_get_cipher_name(_ssl); // Nothing needs to be free'd. +#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER < 0x10002000L + try + { + // + // Peer hostname verification is new in OpenSSL 1.0.2 for older versions + // We use IceSSL built-in hostname verification. + // + _engine->verifyPeerCertName(address, info); + } + catch(const SecurityException&) + { + _verified = false; + if(_engine->getVerifyPeer() > 0) + { + throw; + } + } +#endif _engine->verifyPeer(_host, ICE_DYNAMIC_CAST(ConnectionInfo, getInfo()), toString()); if(_engine->securityTraceLevel() >= 1) |