TLSClient: add hostname verifcation

The CN or subjectAltNames of the TLS certification is now matched with
the hostname connected to.

taskd.trust is now a tristate value (allow all, ignore hostname,
strict) to optionally disable the new hostname verification.
This commit is contained in:
Alexander Sulfrian 2014-03-18 19:21:49 +01:00 committed by Paul Beckingham
parent fdcc04d13e
commit 7fb1487993
5 changed files with 73 additions and 17 deletions

View file

@ -232,8 +232,12 @@ int CmdDiagnostics::execute (std::string& output)
? " (readable)" : " (not readable)")
<< "\n";
if (context.config.get ("taskd.trust") != "")
out << " Trust: override\n";
if (context.config.get ("taskd.trust") == "allow all")
out << " Trust: allow all\n";
else if (context.config.get ("taskd.trust") == "ignore hostname")
out << " Trust: ignore hostanme\n";
else
out << " Trust: strict\n";
out << " Cert: "
<< context.config.get ("taskd.certificate")