A callback to configure the `SSL` object before the connection is established.
| 1034 | // A callback to configure the `SSL` object before the connection is |
| 1035 | // established. |
| 1036 | Try<Nothing> configure_socket( |
| 1037 | SSL* ssl, |
| 1038 | openssl::Mode mode, |
| 1039 | const Address& peer_address, |
| 1040 | const Option<std::string>& peer_hostname) |
| 1041 | { |
| 1042 | if (mode == Mode::CLIENT && ssl_flags->verify_server_cert) { |
| 1043 | SSL_set_verify( |
| 1044 | ssl, |
| 1045 | SSL_VERIFY_PEER, |
| 1046 | &verify_callback); |
| 1047 | } |
| 1048 | |
| 1049 | if (mode == Mode::SERVER && ssl_flags->require_client_cert) { |
| 1050 | SSL_set_verify( |
| 1051 | ssl, |
| 1052 | SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, |
| 1053 | &verify_callback); |
| 1054 | } |
| 1055 | |
| 1056 | if (ssl_flags->hostname_validation_scheme == "openssl") { |
| 1057 | #if OPENSSL_VERSION_NUMBER < MIN_VERSION_X509_VERIFY_PARAM |
| 1058 | // We should have already checked this during startup. |
| 1059 | EXIT(EXIT_FAILURE) << |
| 1060 | "The linked OpenSSL library does not support `X509_VERIFY_PARAM` for" |
| 1061 | " hostname validation. OpenSSL >= 1.0.2 is required."; |
| 1062 | #else |
| 1063 | if (mode == openssl::Mode::SERVER) { |
| 1064 | // We don't do client hostname validation, because the application layer |
| 1065 | // should set the policy on which certificate fields are considered a |
| 1066 | // valid proof of identity. |
| 1067 | // |
| 1068 | // TODO(bevers): Provide hooks to the application code to make these |
| 1069 | // policy decisions, for example via a Mesos module. |
| 1070 | return Nothing(); |
| 1071 | } |
| 1072 | |
| 1073 | if (mode == openssl::Mode::CLIENT && !ssl_flags->verify_server_cert) { |
| 1074 | return Nothing(); |
| 1075 | } |
| 1076 | |
| 1077 | // Decide whether we want to verify the peer's IP or DNS name. |
| 1078 | X509_VERIFY_PARAM *param = SSL_get0_param(ssl); |
| 1079 | if (peer_hostname.isSome()) { |
| 1080 | if (!X509_VERIFY_PARAM_set1_host(param, peer_hostname->c_str(), 0)) { |
| 1081 | return Error("Could not enable x509 hostname check."); |
| 1082 | } |
| 1083 | } else { |
| 1084 | if (!ssl_flags->verify_ipadd) { |
| 1085 | return Error("No DNS name given and IP address verification is " |
| 1086 | " disabled. I cannot work like this :("); |
| 1087 | } |
| 1088 | |
| 1089 | if (peer_address.family() != Address::Family::INET4 && |
| 1090 | peer_address.family() != Address::Family::INET6) { |
| 1091 | return Error("Can only use IPv4 or IPv6 addresses for IP address" |
| 1092 | " validation."); |
| 1093 | } |
no test coverage detected