Git-Mirrors/monero
1
0
Fork 0
mirror of https://github.com/monero-project/monero.git synced 2025-05-06 10:15:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

Change SSL certificate file list to OpenSSL builtin load_verify_location

Browse source 
Specifying SSL certificates for peer verification does an exact match,
making it a not-so-obvious alias for the fingerprints option. This
changes the checks to OpenSSL which loads concatenated certificate(s)
from a single file and does a certificate-authority (chain of trust)
check instead. There is no drop in security - a compromised exact match
fingerprint has the same worse case failure. There is increased security
in allowing separate long-term CA key and short-term SSL server keys.

This also removes loading of the system-default CA files if a custom
CA file or certificate fingerprint is specified.
This commit is contained in:
Lee Clagett 2019-03-11 22:01:03 -04:00
parent 5dbcceb664
commit a3b0284837
13 changed files with 92 additions and 134 deletions
Download patch file Download diff file Expand all files Collapse all files

4
contrib/epee/include/net/http_server_impl_base.h
View file

@ -61,7 +61,7 @@ namespace epee
boost::optional<net_utils::http::login> user = boost::none,
epee::net_utils::ssl_support_t ssl_support = epee::net_utils::ssl_support_t::e_ssl_support_autodetect,
const std::pair<std::string, std::string> &private_key_and_certificate_path = {},
std::list<std::string> allowed_certificates = {},
const std::string &ca_path = {},
std::vector<std::vector<uint8_t>> allowed_fingerprints = {},
bool allow_any_cert = false)
{
@ -80,7 +80,7 @@ namespace epee
m_net_server.get_config_object().m_user = std::move(user);
MGINFO("Binding on " << bind_ip << ":" << bind_port);
bool res = m_net_server.init_server(bind_port, bind_ip, ssl_support, private_key_and_certificate_path, std::move(allowed_certificates), std::move(allowed_fingerprints), allow_any_cert);
bool res = m_net_server.init_server(bind_port, bind_ip, ssl_support, private_key_and_certificate_path, ca_path, std::move(allowed_fingerprints), allow_any_cert);
if(!res)
{
LOG_ERROR("Failed to bind server");