summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--runtime/nsd_gtls.c9
-rw-r--r--runtime/nsd_ptcp.c41
-rw-r--r--tools/omfwd.c12
3 files changed, 56 insertions, 6 deletions
diff --git a/runtime/nsd_gtls.c b/runtime/nsd_gtls.c
index 131a3679..df458ea3 100644
--- a/runtime/nsd_gtls.c
+++ b/runtime/nsd_gtls.c
@@ -416,7 +416,6 @@ SetAuthMode(nsd_t *pNsd, uchar *mode)
nsd_gtls_t *pThis = (nsd_gtls_t*) pNsd;
ISOBJ_TYPE_assert((pThis), nsd_gtls);
-RUNLOG_VAR("%s", mode);
if(mode == NULL || !strcasecmp((char*)mode, "x509/name")) {
pThis->authMode = GTLS_AUTH_CERTNAME;
} else if(!strcasecmp((char*) mode, "x509/fingerprint")) {
@@ -424,7 +423,8 @@ RUNLOG_VAR("%s", mode);
} else if(!strcasecmp((char*) mode, "anon")) {
pThis->authMode = GTLS_AUTH_CERTANON;
} else {
- // TODO: logerror()?
+ errmsg.LogError(NO_ERRCODE, "authentication mode '%s' not supported by "
+ "gtls netstream driver", mode);
ABORT_FINALIZE(RS_RET_VALUE_NOT_SUPPORTED);
}
@@ -447,8 +447,11 @@ AddPermFingerprint(nsd_t *pNsd, uchar *pszFingerprint)
nsd_gtls_t *pThis = (nsd_gtls_t*) pNsd;
ISOBJ_TYPE_assert((pThis), nsd_gtls);
- if(pThis->authMode != GTLS_AUTH_CERTFINGERPRINT)
+ if(pThis->authMode != GTLS_AUTH_CERTFINGERPRINT) {
+ errmsg.LogError(NO_ERRCODE, "fingerprint authentication not supported by "
+ "gtls netstream driver in the configured authentication mode - ignored");
ABORT_FINALIZE(RS_RET_VALUE_NOT_IN_THIS_MODE);
+ }
// TODO: proper handling - but we need to redo this when we do the
// linked list. So for now, this is good enough (but MUST BE CHANGED!).
diff --git a/runtime/nsd_ptcp.c b/runtime/nsd_ptcp.c
index c5480a05..ae835aed 100644
--- a/runtime/nsd_ptcp.c
+++ b/runtime/nsd_ptcp.c
@@ -126,6 +126,45 @@ finalize_it:
}
+/* Set the authentication mode. For us, the following is supported:
+ * anon - no certificate checks whatsoever (discouraged, but supported)
+ * mode == NULL is valid and defaults to anon
+ * Actually, we do not even record the mode right now, because we can
+ * always work in anon mode, only. So there is no point in recording
+ * something if that's the only choice. What the function does is
+ * return an error if something is requested that we can not support.
+ * rgerhards, 2008-05-17
+ */
+static rsRetVal
+SetAuthMode(nsd_t __attribute__((unused)) *pNsd, uchar *mode)
+{
+ DEFiRet;
+ if(mode != NULL && strcasecmp((char*)mode, "anon")) {
+ errmsg.LogError(NO_ERRCODE, "authentication mode '%s' not supported by "
+ "ptcp netstream driver", mode);
+ ABORT_FINALIZE(RS_RET_VALUE_NOT_SUPPORTED);
+ }
+
+finalize_it:
+ RETiRet;
+}
+
+
+/* Add a permitted fingerprint. This is a dummy, always returning an
+ * error because we do not support fingerprint authentication.
+ * rgerhards, 2008-05-17
+ */
+static rsRetVal
+AddPermFingerprint(nsd_t __attribute__((unused)) *pNsd, uchar __attribute__((unused)) *pszFingerprint)
+{
+ errmsg.LogError(NO_ERRCODE, "fingerprint authentication not supported by "
+ "ptcp netstream driver - ignored");
+ return RS_RET_VALUE_NOT_IN_THIS_MODE;
+}
+
+
+
+
/* Provide access to the underlying OS socket. This is primarily
* useful for other drivers (like nsd_gtls) who utilize ourselfs
* for some of their functionality.
@@ -625,6 +664,8 @@ CODESTARTobjQueryInterface(nsd_ptcp)
pIf->GetSock = GetSock;
pIf->SetSock = SetSock;
pIf->SetMode = SetMode;
+ pIf->SetAuthMode = SetAuthMode;
+ pIf->AddPermFingerprint = AddPermFingerprint;
pIf->Rcv = Rcv;
pIf->Send = Send;
pIf->LstnInit = LstnInit;
diff --git a/tools/omfwd.c b/tools/omfwd.c
index e0b6db01..43f601e3 100644
--- a/tools/omfwd.c
+++ b/tools/omfwd.c
@@ -277,9 +277,15 @@ static rsRetVal TCPSendInit(void *pvData)
CHKiRet(netstrms.CreateStrm(pData->pNS, &pData->pNetstrm));
CHKiRet(netstrm.ConstructFinalize(pData->pNetstrm));
CHKiRet(netstrm.SetDrvrMode(pData->pNetstrm, pData->iStrmDrvrMode));
- CHKiRet(netstrm.SetDrvrAuthMode(pData->pNetstrm, pData->pszStrmDrvrAuthMode));
- CHKiRet(netstrm.AddDrvrPermittedFingerprint(pData->pNetstrm,
- pData->pszStrmDrvrFingerprint));
+ /* now set optional params, but only if they were actually configured */
+ if(pData->pszStrmDrvrAuthMode != NULL) {
+ CHKiRet(netstrm.SetDrvrAuthMode(pData->pNetstrm, pData->pszStrmDrvrAuthMode));
+ }
+ if(pData->pszStrmDrvrFingerprint != NULL) {
+ CHKiRet(netstrm.AddDrvrPermittedFingerprint(pData->pNetstrm,
+ pData->pszStrmDrvrFingerprint));
+ }
+ /* params set, now connect */
CHKiRet(netstrm.Connect(pData->pNetstrm, glbl.GetDefPFFamily(),
(uchar*)pData->port, (uchar*)pData->f_hname));
}