A callback to configure the `SSL` object before the connection is established.
| 996 | // A callback to configure the `SSL` object before the connection is |
| 997 | // established. |
| 998 | Try<Nothing> configure_socket( |
| 999 | SSL* ssl, |
| 1000 | openssl::Mode mode, |
| 1001 | const Address& peer_address, |
| 1002 | const Option<std::string>& peer_hostname) |
| 1003 | { |
| 1004 | if (mode == Mode::CLIENT && ssl_flags->verify_cert) { |
| 1005 | SSL_set_verify( |
| 1006 | ssl, |
| 1007 | SSL_VERIFY_PEER, |
| 1008 | &verify_callback); |
| 1009 | } |
| 1010 | |
| 1011 | if (mode == Mode::SERVER && ssl_flags->require_cert) { |
| 1012 | SSL_set_verify( |
| 1013 | ssl, |
| 1014 | SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, |
| 1015 | &verify_callback); |
| 1016 | } |
| 1017 | |
| 1018 | if (ssl_flags->hostname_validation_scheme == "openssl") { |
| 1019 | #if OPENSSL_VERSION_NUMBER < MIN_VERSION_X509_VERIFY_PARAM |
| 1020 | // We should have already checked this during startup. |
| 1021 | EXIT(EXIT_FAILURE) << |
| 1022 | "The linked OpenSSL library does not support `X509_VERIFY_PARAM` for" |
| 1023 | " hostname validation. OpenSSL >= 1.0.2 is required."; |
| 1024 | #else |
| 1025 | if (mode == openssl::Mode::SERVER) { |
| 1026 | // We don't do client hostname validation, because the application layer |
| 1027 | // should set the policy on which certificate fields are considered a |
| 1028 | // valid proof of identity. |
| 1029 | // |
| 1030 | // TODO(bevers): Provide hooks to the application code to make these |
| 1031 | // policy decisions, for example via a Mesos module. |
| 1032 | return Nothing(); |
| 1033 | } |
| 1034 | |
| 1035 | if (mode == openssl::Mode::CLIENT && !ssl_flags->verify_cert) { |
| 1036 | return Nothing(); |
| 1037 | } |
| 1038 | |
| 1039 | // Decide whether we want to verify the peer's IP or DNS name. |
| 1040 | X509_VERIFY_PARAM *param = SSL_get0_param(ssl); |
| 1041 | if (peer_hostname.isSome()) { |
| 1042 | if (!X509_VERIFY_PARAM_set1_host(param, peer_hostname->c_str(), 0)) { |
| 1043 | return Error("Could not enable x509 hostname check."); |
| 1044 | } |
| 1045 | } else { |
| 1046 | if (!ssl_flags->verify_ipadd) { |
| 1047 | return Error("No DNS name given and IP address verification is " |
| 1048 | " disabled. I cannot work like this :("); |
| 1049 | } |
| 1050 | |
| 1051 | if (peer_address.family() != Address::Family::INET4 && |
| 1052 | peer_address.family() != Address::Family::INET6) { |
| 1053 | return Error("Can only use IPv4 or IPv6 addresses for IP address" |
| 1054 | " validation."); |
| 1055 | } |
no test coverage detected