gergely/taskwarrior-2.x
1
0
Fork 0
Code Issues Actions Packages Projects Releases 1 Wiki Activity

TLSClient: add hostname verifcation

Browse Source 
The CN or subjectAltNames of the TLS certification is now matched with
the hostname connected to.

taskd.trust is now a tristate value (allow all, ignore hostname,
strict) to optionally disable the new hostname verification.
This commit is contained in:
Alexander Sulfrian
2014-03-18 19:21:49 +01:00
committed by Paul Beckingham
parent fdcc04d13e
commit 7fb1487993
5 changed files with 73 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/commands/CmdSync.cpp
View File

@@ -29,7 +29,6 @@
#include <inttypes.h>
#include <signal.h>
#include <Context.h>
#include <TLSClient.h>
#include <Color.h>
#include <text.h>
#include <util.h>
@@ -87,14 +86,18 @@ int CmdSync::execute (std::string& output)
if (credentials.size () != 3)
throw std::string (STRING_CMD_SYNC_BAD_CRED);
bool trust = context.config.getBoolean ("taskd.trust");
enum TLSClient::trust_level trust = TLSClient::strict;
if (context.config.get ("taskd.trust") == "allow all")
trust = TLSClient::allow_all;
else if (context.config.get ("taskd.trust") == "ignore hostname")
trust = TLSClient::ignore_hostname;
// CA must exist, if provided.
File ca (context.config.get ("taskd.ca"));
if (ca._data != "" && ! ca.exists ())
throw std::string (STRING_CMD_SYNC_BAD_CA);
if (trust && ca._data != "")
if (trust == TLSClient::allow_all && ca._data != "")
throw std::string (STRING_CMD_SYNC_TRUST_CA);
File certificate (context.config.get ("taskd.certificate"));
@@ -319,7 +322,7 @@ bool CmdSync::send (
const std::string& ca,
const std::string& certificate,
const std::string& key,
bool trust,
const enum TLSClient::trust_level trust,
const Msg& request,
Msg& response)
{