| 787 | |
| 788 | |
| 789 | Try<Nothing> verify( |
| 790 | const SSL* const ssl, |
| 791 | Mode mode, |
| 792 | const Option<string>& hostname, |
| 793 | const Option<net::IP>& ip) |
| 794 | { |
| 795 | // Return early if we don't need to verify. |
| 796 | if (mode == Mode::CLIENT && !ssl_flags->verify_cert) { |
| 797 | return Nothing(); |
| 798 | } |
| 799 | |
| 800 | if (mode == Mode::SERVER && !ssl_flags->require_cert) { |
| 801 | return Nothing(); |
| 802 | } |
| 803 | |
| 804 | // The X509 object must be freed if this call succeeds. |
| 805 | // TODO(jmlvanre): handle this better. How about RAII? |
| 806 | X509* cert = SSL_get_peer_certificate(ssl); |
| 807 | |
| 808 | // NOTE: Even without this check, the OpenSSL handshake will not complete |
| 809 | // when connecting to servers that do not present a certificate, unless an |
| 810 | // anonymous cipher is used. |
| 811 | if (cert == nullptr) { |
| 812 | return Error("Peer did not provide certificate"); |
| 813 | } |
| 814 | |
| 815 | if (SSL_get_verify_result(ssl) != X509_V_OK) { |
| 816 | X509_free(cert); |
| 817 | return Error("Could not verify peer certificate"); |
| 818 | } |
| 819 | |
| 820 | // When using the 'openssl' scheme, hostname validation was already |
| 821 | // performed during the TLS handshake so we don't have to do it again |
| 822 | // here. |
| 823 | // |
| 824 | // NOTE: When using the 'openssl' scheme, we technically dont need |
| 825 | // to call the `openssl::verify()` function *at all*. |
| 826 | if (ssl_flags->hostname_validation_scheme == "openssl") { |
| 827 | return Try<Nothing>(Nothing()); |
| 828 | } |
| 829 | |
| 830 | // NOTE: For backwards compatibility, we ignore the passed hostname here, |
| 831 | // i.e. the 'legacy' hostname validation scheme will always attempt to get |
| 832 | // the peer hostname using a reverse DNS lookup. |
| 833 | Option<std::string> peer_hostname = hostname; |
| 834 | if (ip.isSome()) { |
| 835 | VLOG(1) << "Doing rDNS lookup for 'libprocess' hostname validation"; |
| 836 | Stopwatch watch; |
| 837 | |
| 838 | watch.start(); |
| 839 | Try<string> lookup = net::getHostname(ip.get()); |
| 840 | watch.stop(); |
| 841 | |
| 842 | // Due to MESOS-9339, a slow reverse DNS lookup will cause |
| 843 | // serious issues as it blocks the event loop thread. |
| 844 | if (watch.elapsed() > SLOW_DNS_WARN_THRESHOLD) { |
| 845 | LOG(WARNING) << "Reverse DNS lookup for '" << ip.get() << "'" |
| 846 | << " took " << watch.elapsed().ms() << "ms" |
no test coverage detected