diff options
| author | Jose <jose@zeroc.com> | 2017-02-22 19:06:16 +0100 |
|---|---|---|
| committer | Jose <jose@zeroc.com> | 2017-02-22 19:06:16 +0100 |
| commit | 88eceb7c051cdb53eb4009774d1fb6bebb95d4d5 (patch) | |
| tree | da7e01e0533558bced252578ee88fb8d259eb1c8 /cpp | |
| parent | Fix hostname verification to ignore errors when IceSSL.VerifyPeer is 0 (diff) | |
| download | ice-88eceb7c051cdb53eb4009774d1fb6bebb95d4d5.tar.bz2 ice-88eceb7c051cdb53eb4009774d1fb6bebb95d4d5.tar.xz ice-88eceb7c051cdb53eb4009774d1fb6bebb95d4d5.zip | |
Disable SSL host name verification with empty host
Diffstat (limited to 'cpp')
| -rw-r--r-- | cpp/src/IceSSL/UWPTransceiverI.cpp | 22 |
1 files changed, 20 insertions, 2 deletions
diff --git a/cpp/src/IceSSL/UWPTransceiverI.cpp b/cpp/src/IceSSL/UWPTransceiverI.cpp index ca4bdc46afc..1f6eb168cd0 100644 --- a/cpp/src/IceSSL/UWPTransceiverI.cpp +++ b/cpp/src/IceSSL/UWPTransceiverI.cpp @@ -255,7 +255,10 @@ IceSSL::TransceiverI::startWrite(IceInternal::Buffer& buf) // stream->Control->IgnorableServerCertificateErrors->Append(ChainValidationResult::Expired); stream->Control->IgnorableServerCertificateErrors->Append(ChainValidationResult::IncompleteChain); - if(!_engine->getCheckCertName()) + // + // Check if we need to enable host name verification + // + if(!_engine->getCheckCertName() || _host.empty()) { stream->Control->IgnorableServerCertificateErrors->Append(ChainValidationResult::InvalidName); } @@ -293,7 +296,22 @@ IceSSL::TransceiverI::finishWrite(IceInternal::Buffer& buf) { if(CERT_E_CN_NO_MATCH == asyncInfo->error) { - throw SecurityException(__FILE__, __LINE__, "Hostname mismatch"); + ostringstream ostr; + ostr << "IceSSL: certificate validation failure: " + << (IceInternal::isIpAddress(_host) ? "IP address mismatch" : "Hostname mismatch"); + string msg = ostr.str(); + if(_engine->securityTraceLevel() >= 1) + { + Trace out(_logger, _securityTraceCategory); + out << msg; + } + + if(_engine->getVerifyPeer() > 0) + { + SecurityException ex(__FILE__, __LINE__); + ex.reason = msg; + throw ex; + } } IceInternal::checkErrorCode(__FILE__, __LINE__, asyncInfo->error); } |