| 834 | |
| 835 | |
| 836 | Try<Nothing> verify( |
| 837 | const SSL* const ssl, |
| 838 | Mode mode, |
| 839 | const Option<string>& hostname, |
| 840 | const Option<net::IP>& ip) |
| 841 | { |
| 842 | // Return early if we don't need to verify. |
| 843 | if (mode == Mode::CLIENT && !ssl_flags->verify_server_cert) { |
| 844 | return Nothing(); |
| 845 | } |
| 846 | |
| 847 | if (mode == Mode::SERVER && !ssl_flags->require_client_cert) { |
| 848 | return Nothing(); |
| 849 | } |
| 850 | |
| 851 | // The X509 object must be freed if this call succeeds. |
| 852 | std::unique_ptr<X509, decltype(&X509_free)> cert( |
| 853 | SSL_get_peer_certificate(ssl), |
| 854 | X509_free); |
| 855 | |
| 856 | // NOTE: Even without this check, the OpenSSL handshake will not complete |
| 857 | // when connecting to servers that do not present a certificate, unless an |
| 858 | // anonymous cipher is used. |
| 859 | if (cert == nullptr) { |
| 860 | return Error("Peer did not provide certificate"); |
| 861 | } |
| 862 | |
| 863 | if (SSL_get_verify_result(ssl) != X509_V_OK) { |
| 864 | return Error("Could not verify peer certificate"); |
| 865 | } |
| 866 | |
| 867 | // When using the 'openssl' scheme, hostname validation was already |
| 868 | // performed during the TLS handshake so we don't have to do it again |
| 869 | // here. |
| 870 | // |
| 871 | // NOTE: When using the 'openssl' scheme, we technically dont need |
| 872 | // to call the `openssl::verify()` function *at all*. |
| 873 | if (ssl_flags->hostname_validation_scheme == "openssl") { |
| 874 | return Try<Nothing>(Nothing()); |
| 875 | } |
| 876 | |
| 877 | // NOTE: For backwards compatibility, we ignore the passed hostname here, |
| 878 | // i.e. the 'legacy' hostname validation scheme will always attempt to get |
| 879 | // the peer hostname using a reverse DNS lookup. |
| 880 | Option<std::string> peer_hostname = hostname; |
| 881 | if (ip.isSome()) { |
| 882 | VLOG(1) << "Doing rDNS lookup for 'legacy' hostname validation"; |
| 883 | Stopwatch watch; |
| 884 | |
| 885 | watch.start(); |
| 886 | Try<string> lookup = net::getHostname(ip.get()); |
| 887 | watch.stop(); |
| 888 | |
| 889 | // Due to MESOS-9339, a slow reverse DNS lookup will cause |
| 890 | // serious issues as it blocks the event loop thread. |
| 891 | if (watch.elapsed() > SLOW_DNS_WARN_THRESHOLD) { |
| 892 | LOG(WARNING) << "Reverse DNS lookup for '" << ip.get() << "'" |
| 893 | << " took " << watch.elapsed().ms() << "ms" |
no test coverage detected