Share

Standards Based Linux Instrumentation

Tracker: Bugs

5 Indication sending via https does not include client cert - ID: 1866424
Last Update: Comment added ( sf-robot )

When sending an indication using HTTPS, a client side certificate is *not*
presented to the indication listener as part of the SSL hand shake. An
indication listener can not authenticate the source of the indication
without this information and this can lead to an 'indication masquerade'.
Using a client side certificate as part of the SSL handshake allows the
indication listener to inspect the client side certificate and using a CA
chain verify that the indication is 'trusted'.

The attached patch solves this problem taking advantage of lib curl's
curl_easy APIs.

Patch details:
* registers server's cert to be used when sending indications.
* uses getControlChars() to read the sslCertificateFilePath and
sslKeyFilePath.
* sets curl options with curl_easy_setopt()

The patch has been tested on a HTTPS based indication listener.


Peter Mellquist ( peter_nature ) - 2008-01-08 00:07

5

Closed

Fixed

Chris Buccella

sfcb

Security

Public


Comments ( 2 )

Date: 2008-03-12 02:20
Sender: sf-robotSourceForge.net Site Admin


This Tracker item was closed automatically by the system. It was
previously set to a Pending status, and the original submitter
did not respond within 60 days (the time period specified by
the administrator of this Tracker).


Date: 2008-01-11 17:03
Sender: buccellaProject Admin


Committed to CVS HEAD and 1_2_BRANCH, 1/10/2008.


Attached File ( 1 )

Filename Description Download
patch.txt indication sending with client side cert patch Download

Changes ( 6 )

Field Old Value Date By
status_id Pending 2008-03-12 02:20 sf-robot
close_date 2008-01-11 17:03 2008-03-12 02:20 sf-robot
status_id Open 2008-01-11 17:03 buccella
resolution_id None 2008-01-11 17:03 buccella
close_date - 2008-01-11 17:03 buccella
File Added 261268: patch.txt 2008-01-08 00:07 peter_nature