gitea-mirror/monero
1
0
Fork 0
mirror of https://github.com/monero-project/monero.git synced 2026-01-18 23:55:47 -08:00
Code Issues Packages Projects Releases Wiki Activity

Enabling daemon-rpc SSL now requires non-system CA verification

Browse Source 
If `--daemon-ssl enabled` is set in the wallet, then a user certificate,
fingerprint, or onion/i2p address must be provided.
This commit is contained in:
Lee Clagett
2019-04-06 21:28:37 -04:00
parent d58f368289
commit 2e578b8214
4 changed files with 51 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
contrib/epee/src/net_ssl.cpp
View File

@@ -278,6 +278,25 @@ bool is_ssl(const unsigned char *data, size_t len)
return false;
}
bool ssl_options_t::has_strong_verification(boost::string_ref host) const noexcept
{
// onion and i2p addresses contain information about the server cert
// which both authenticates and encrypts
if (host.ends_with(".onion") || host.ends_with(".i2p"))
return true;
switch (verification)
{
default:
case ssl_verification_t::none:
case ssl_verification_t::system_ca:
return false;
case ssl_verification_t::user_certificates:
case ssl_verification_t::user_ca:
break;
}
return true;
}
bool ssl_options_t::has_fingerprint(boost::asio::ssl::verify_context &ctx) const
{
// can we check the certificate against a list of fingerprints?