Loading...
Searching...
No Matches
XrdTlsNotary Class Reference

`#include <XrdTlsNotary.hh>`

Collaboration diagram for XrdTlsNotary:

## Static Public Member Functions

static void | UseCN (bool yesno)
static const char * | Validate (const SSL *ssl, const char *hName, XrdNetAddrInfo *netInfo=0)

## Detailed Description

Definition at line 58 of file XrdTlsNotary.hh.

## Member Function Documentation

## UseCN()

void XrdTlsNotary::UseCN | ( | bool | yesno | ) |

inline static

Indicate whether or not common name may be used in validation.

Parameters

  yesno | - True if common name may be used, false otherwise. The common name is used only if the cert has no SAN extension or if we are allowed to use the DNS for validation. The default is true but is now deprecated!

Definition at line 91 of file XrdTlsNotary.hh.

{cnOK = yesno;}

## Validate()

const char * XrdTlsNotary::Validate | ( | const SSL * | ssl,
|  | const char * | hName,
|  | XrdNetAddrInfo * | netInfo = 0 )

static

Validate hostname using peer certificate (usually server's).

Parameters

  ssl | - pointer to peer's SSL object holding the cert.
  hName | - pointer to the hostname.
  netInfo | - Pointer to the XrdNetAddrInfo object for the peer host. This object will be used in a reverse lookup of the IP address to see if the names match as a final fallback. If nil, DNS fallback will not be tried.

Returns
  =0 - Hostname has been validated.
  !0 - Hostname not validated, return value is pointer to reason. The error message should be formed as follows: Unable to validate host <name>; <returned reason>

Definition at line 56 of file XrdTlsNotary.cc.

{
HostnameValidationResult rc;
bool dnsOK = (addrInfo != 0);
bool verChk= true;
// Obtain the certificate
//
X509 *theCert = SSL_get_peer_certificate(ssl);
if (!theCert) return "certificate not present.";
// Make sure the certificate was verified
//
if (verChk && (SSL_get_verify_result(ssl) != X509_V_OK))
{X509_free(theCert);
return "certificate has not been verified.";
}
// The first step is to check if the hostname can be verified using the SAN
// extension. Various version of openSSL have ways of doing this but we
// rely on the manual method which works for all versions. Eventually, we
// will migrate to the "standard" way of doing this.
//
rc = matches_subject_alternative_name(hName, theCert);
X509_free(theCert);
if (rc == MatchFound) return 0;
// If a SAN was present then we stop here unless we can use DNS.
//
if (rc != NoSANPresent && !dnsOK)
{if (rc == MatchNotFound) return "hostname not in SAN extension.";
return "malformed SAN extension.";
}
// If we are allowed to use the common name, try that now.
//
if (cnOK || dnsOK)
{rc = matches_common_name(hName, theCert);
if (rc == MatchFound) return 0;
if (!dnsOK)
{if (rc == Error) return "malformed certificate.";
return "malformed common name.";
}
}
// The last resort is to try using DNS if so allowed
//
if (dnsOK)
{const char *dnsErr = 0;
const char *dnsName = addrInfo->Name(0, &dnsErr);
if (dnsName)
{if (!strcmp(hName, dnsName)) return 0;
return "DNS registered name does not match.";
}
if (dnsErr) return dnsErr;
return "host not registered in DNS.";
}
// Neither DNS nor common name is allowed here. That means there was no SAN.
//
return "required SAN extension missing.";
}
HostnameValidationResult
HostnameValidationResult
Definition XrdTlsNotaryUtils.hh:37
MatchNotFound
@ MatchNotFound
Definition XrdTlsNotaryUtils.hh:39
Error
@ Error
Definition XrdTlsNotaryUtils.hh:42
NoSANPresent
@ NoSANPresent
Definition XrdTlsNotaryUtils.hh:40
MatchFound
@ MatchFound
Definition XrdTlsNotaryUtils.hh:38
matches_common_name
static HostnameValidationResult matches_common_name(const char *hostname, const X509 *server_cert)
Definition XrdTlsNotaryUtils.icc:57
matches_subject_alternative_name
static HostnameValidationResult matches_subject_alternative_name(const char *hostname, const X509 *server_cert)
Definition XrdTlsNotaryUtils.icc:109

References Error, matches_common_name(), matches_subject_alternative_name(), MatchFound, MatchNotFound, XrdNetAddrInfo::Name(), and NoSANPresent.

Referenced by XrdTlsSocket::Connect().

Here is the call graph for this function:
Here is the caller graph for this function:

The documentation for this class was generated from the following files:

- XrdTlsNotary.hh
- XrdTlsNotary.cc