upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-29 02:49:35 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

dnstap io, check peer verification in unbound-dnstap-socket tap_handshake.

Browse source
This commit is contained in:
W.C.A. Wijngaards 2020-02-12 16:49:18 +01:00
parent 5714260953
commit 76772fe786
1 changed files with 51 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

51
dnstap/unbound-dnstap-socket.c
View file

@ -865,6 +865,52 @@ static int reply_with_finish(int fd)
return 1;
}
/** check SSL peer certificate, return 0 on fail */
static int tap_check_peer(struct tap_data* data)
{
if((SSL_get_verify_mode(data->ssl)&SSL_VERIFY_PEER)) {
/* verification */
if(SSL_get_verify_result(data->ssl) == X509_V_OK) {
X509* x = SSL_get_peer_certificate(data->ssl);
if(!x) {
if(verbosity) log_info("SSL connection %s"
" failed no certificate", data->id);
return 0;
}
if(verbosity)
log_cert(VERB_ALGO, "peer certificate", x);
#ifdef HAVE_SSL_GET0_PEERNAME
if(SSL_get0_peername(data->ssl)) {
if(verbosity) log_info("SSL connection %s "
"to %s authenticated", data->id,
SSL_get0_peername(data->ssl));
} else {
#endif
if(verbosity) log_info("SSL connection %s "
"authenticated", data->id);
#ifdef HAVE_SSL_GET0_PEERNAME
}
#endif
X509_free(x);
} else {
X509* x = SSL_get_peer_certificate(data->ssl);
if(x) {
if(verbosity)
log_cert(VERB_ALGO, "peer certificate", x);
X509_free(x);
}
if(verbosity) log_info("SSL connection %s failed: "
"failed to authenticate", data->id);
return 0;
}
} else {
/* unauthenticated, the verify peer flag was not set
* in ssl when the ssl object was created from ssl_ctx */
if(verbosity) log_info("SSL connection %s", data->id);
}
return 1;
}
/** perform SSL handshake, return 0 to wait for events, 1 if done */
static int tap_handshake(struct tap_data* data)
{
@ -921,6 +967,11 @@ static int tap_handshake(struct tap_data* data)
}
/* check peer verification */
data->ssl_handshake_done = 1;
if(!tap_check_peer(data)) {
/* closed */
tap_data_free(data);
return 0;
}
return 1;
}