Enable server to server TLS #211
Conversation
…EY if the connection is already encrypted
… validation logic" This reverts commit 1ab1c16.
|
This pull request introduces 1 alert when merging 5c4cc45 into 7fc039d - view on LGTM.com new alerts:
|
|
This pull request introduces 2 alerts when merging 52b4dcc into 7fc039d - view on LGTM.com new alerts:
|
|
This pull request introduces 1 alert when merging ed6587c into 7fc039d - view on LGTM.com new alerts:
|
… self signed certs
|
This pull request introduces 1 alert when merging 1b19af1 into 7fc039d - view on LGTM.com new alerts:
|
|
This pull request introduces 2 alerts when merging 024722d into 7fc039d - view on LGTM.com new alerts:
|
|
This pull request introduces 2 alerts when merging 37aa0fa into 7fc039d - view on LGTM.com new alerts:
|
|
This pull request introduces 1 alert when merging 730a4ca into 7fc039d - view on LGTM.com new alerts:
|
src/m_server.c
Outdated
| #ifdef USE_SSL | ||
| IsSSL(cptr) ? " encrypted" : "", | ||
| #else | ||
| RC4EncLink(cptr) ? " encrypted" : "", | ||
| #endif |
There was a problem hiding this comment.
This looks like it won't show anything for RC4 encrypted links anymore when USE_SSL is defined.
src/s_bsd.c
Outdated
| sendto_one(cptr, "CAPAB SSJOIN NOQUIT BURST UNCONNECT DKEY" | ||
| sendto_one(cptr, "CAPAB SSJOIN NOQUIT BURTS UNCONNECT DKEY" |
There was a problem hiding this comment.
"BURTS" looks like a typo.
src/s_bsd.c
Outdated
|
|
||
| int ret=0; | ||
|
|
||
| mydata_index = SSL_get_ex_new_index(0, "mydata index", NULL, NULL, NULL); |
There was a problem hiding this comment.
mydata_index should be initialized once in ssl_init instead of being recreated every connect attempt. This may show up as a problem when multiple connects are attempted simultaneously.
src/ssl.c
Outdated
| { /* only compare CN against server cert, not rest of chain */ | ||
| /* | ||
| * for testing, must delete | ||
| */ | ||
|
|
||
| X509_NAME *subj = X509_get_subject_name(cert); | ||
| X509_NAME_ENTRY *e = X509_NAME_get_entry(subj, 5); | ||
| ASN1_STRING *d = X509_NAME_ENTRY_get_data(e); | ||
| char *cn = ASN1_STRING_data(d); |
There was a problem hiding this comment.
This looks like it could crash if the certificate isn't exactly as the code expects. Using X509_NAME_get_index_by_NID(subj, NID_commonName, -1) and using the result after checking for an error might help here.
No description provided.