[LON-CAPA-cvs] cvs: loncom / LondConnection.pm loncnew lonssl.pm

raeburn raeburn at source.lon-capa.org
Mon Dec 10 12:34:22 EST 2018


raeburn		Mon Dec 10 17:34:22 2018 EDT

  Modified files:              
    /loncom	loncnew LondConnection.pm lonssl.pm 
  Log:
  - Verification of CN when creating SSL tunnel on multi-domain servers.
    CN is default lonid, i.e., one listed last for the node's hostname in 
    hosts.tab and/or dns_hosts.tab. 
  
  
Index: loncom/loncnew
diff -u loncom/loncnew:1.106 loncom/loncnew:1.107
--- loncom/loncnew:1.106	Thu Dec  6 13:52:28 2018
+++ loncom/loncnew	Mon Dec 10 17:34:22 2018
@@ -2,7 +2,7 @@
 # The LearningOnline Network with CAPA
 # lonc maintains the connections to remote computers
 #
-# $Id: loncnew,v 1.106 2018/12/06 13:52:28 raeburn Exp $
+# $Id: loncnew,v 1.107 2018/12/10 17:34:22 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -94,8 +94,9 @@
 #
 #  The variables below are only used by the child processes.
 #
-my $RemoteHost;			# Name of host child is talking to.
-my $RemoteHostId;		# default lonid of host child is talking to.
+my $RemoteHost;			# Hostname of host child is talking to.
+my $RemoteHostId;		# lonid of host child is talking to.
+my $RemoteDefHostId;		# default lonhostID of host child is talking to.
 my @all_host_ids;
 my $UnixSocketDir= $perlvar{'lonSockDir'};
 my $IdleConnections = Stack->new(); # Set of idle connections
@@ -1248,7 +1249,8 @@
 
     my $Connection = LondConnection->new(&GetServerHost(),
 					 &GetServerPort(),
-					 &GetHostId());
+					 &GetHostId(),
+					 &GetDefHostId());
 
     if($Connection eq undef) {
 	Log("CRITICAL","Failed to make a connection with lond.");
@@ -1549,7 +1551,7 @@
 
 =pod
 
-=head2 GetServerId
+=head2 GetHostId
 
 Returns the hostid whose lond we talk with.
 
@@ -1561,6 +1563,18 @@
 
 =pod
 
+=head2 GetDefHostId
+
+Returns the default hostid for the node whose lond we talk with.
+
+=cut
+
+sub GetDefHostId {                      # Setup by the fork.
+    return $RemoteDefHostId;
+}
+
+=pod
+
 =head2 GetServerPort
 
 Returns the lond port number.
@@ -1822,7 +1836,7 @@
 #  Create a new child for host passed in:
 
 sub CreateChild {
-    my ($host, $hostid) = @_;
+    my ($host, $hostid, $defhostid) = @_;
 
     my $sigset = POSIX::SigSet->new(SIGINT);
     sigprocmask(SIG_BLOCK, $sigset);
@@ -1837,6 +1851,7 @@
 	undef(@all_host_ids);
     } else {			# child.
 	$RemoteHostId = $hostid;
+	$RemoteDefHostId = $defhostid;
 	ShowStatus("Connected to ".$RemoteHost);
 	$SIG{INT} = 'DEFAULT';
 	sigprocmask(SIG_UNBLOCK, $sigset);
@@ -1904,7 +1919,7 @@
     (my $hostname,my $lonid, at all_host_ids) = split(':',$data);
     $ChildHost{$hostname}++;
     if ($ChildHost{$hostname} == 1) {
-	&CreateChild($hostname,$lonid);
+	&CreateChild($hostname,$lonid,$all_host_ids[-1]);
     } else {
 	&Log('WARNING',"Request for a second child on $hostname");
     }
Index: loncom/LondConnection.pm
diff -u loncom/LondConnection.pm:1.58 loncom/LondConnection.pm:1.59
--- loncom/LondConnection.pm:1.58	Mon Dec  3 13:48:13 2018
+++ loncom/LondConnection.pm	Mon Dec 10 17:34:22 2018
@@ -1,7 +1,7 @@
 #   This module defines and implements a class that represents
 #   a connection to a lond daemon.
 #
-# $Id: LondConnection.pm,v 1.58 2018/12/03 13:48:13 raeburn Exp $
+# $Id: LondConnection.pm,v 1.59 2018/12/10 17:34:22 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -165,16 +165,24 @@
 
  port number the remote lond is listening on.
 
+=item lonid
+
+ lonid of the remote lond is listening on.
+
+=item deflonid
+
+ default lonhostID of the remote lond is listening on.
+
 =cut
 
 sub new {
-    my ($class, $DnsName, $Port, $lonid) = @_;
+    my ($class, $DnsName, $Port, $lonid, $deflonid) = @_;
 
     if (!$ConfigRead) {
 	ReadConfig();
 	$ConfigRead = 1;
     }
-    &Debug(4,$class."::new( ".$DnsName.",".$Port.",".$lonid.")\n");
+    &Debug(4,$class."::new( ".$DnsName.",".$Port.",".$lonid.",".$deflonid.")\n");
 
     my ($conntype,$gotconninfo,$allowinsecure);
     if ((ref($secureconf{'connto'}) eq 'HASH') &&
@@ -203,6 +211,7 @@
     # Now create the object...
     my $self     = { Host               => $DnsName,
                      LoncapaHim         => $lonid,
+                     LoncapaDefid       => $deflonid,
                      Port               => $Port,
                      State              => "Initialized",
 		     AuthenticationMode => "",
@@ -1057,6 +1066,7 @@
     my $self   = shift;
     my $socket = $self->{Socket};
     my $peer = $self->{LoncapaHim};
+    my $peerdef = $self->{LoncapaDefid};
 
     #  Get our signed certificate, the certificate authority's 
     #  certificate and our private key file.  All of these
@@ -1066,9 +1076,9 @@
 	$SSLCertificate) = lonssl::CertificateFile();
     my $SSLKey             = lonssl::KeyFile();
     my $CRLFile;
-    unless ($crlchecked{$peer}) {
+    unless ($crlchecked{$peerdef}) {
         $CRLFile = lonssl::CRLFile();
-        $crlchecked{$peer} = 1;
+        $crlchecked{$peerdef} = 1;
     }
     #  Promote our connection to ssl and read the key from lond.
 
@@ -1077,6 +1087,7 @@
 						$SSLCertificate,
 						$SSLKey,
                                                 $peer,
+                                                $peerdef, 
                                                 $CRLFile);
     if(defined $SSLSocket) {
 	my $key  = <$SSLSocket>;
Index: loncom/lonssl.pm
diff -u loncom/lonssl.pm:1.20 loncom/lonssl.pm:1.21
--- loncom/lonssl.pm:1.20	Mon Dec  3 03:40:39 2018
+++ loncom/lonssl.pm	Mon Dec 10 17:34:22 2018
@@ -1,5 +1,5 @@
 #
-# $Id: lonssl.pm,v 1.20 2018/12/03 03:40:39 raeburn Exp $
+# $Id: lonssl.pm,v 1.21 2018/12/10 17:34:22 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -112,11 +112,12 @@
 #               Socket	IO::Socket::INET   Original ordinary socket.
 #               CACert	string	           Full path name to the certificate 
 #                                          authority certificate file.
-#                MyCert	string	           Full path name to the certificate 
+#               MyCert	string	           Full path name to the certificate 
 #                                          issued to this host.
-#                KeyFile string    	   Full pathname to the host's private 
+#               KeyFile string    	   Full pathname to the host's private 
 #                                          key file for the certificate.
-#               peer    string             lonHostID of remote LON-CAPA server
+#               peer    string             lonid of remote LON-CAPA server
+#               peerdef string             default lonHostID of remote server
 #               CRLFile                    Full path name to the certificate
 #                                          revocation list file for the cluster
 #                                          to which server belongs (optional)
@@ -134,6 +135,7 @@
 	$MyCert,
 	$KeyFile,
         $peer,
+        $peerdef,
         $CRLFile) = @_;
 
     Debug("Client promotion using key: $KeyFile, Cert: $MyCert, CA: $CACert, CRL: $CRLFile, Remote Host: $peer\n");
@@ -158,12 +160,17 @@
     # Set SSL_verify_mode to Net::SSLeay::VERIFY_PEER() instead of to
     # SSL_VERIFY_PEER for compatibility with IO::Socket::SSL rev. 1.01
     # used by CentOS/RHEL/Scientific Linux 5).
-    
+
+    my $verify_cn = $peerdef;
+    if ($verify_cn eq '') {
+        $verify_cn = $peer;
+    }
+
     my %sslargs = (SSL_use_cert      => 1,
                    SSL_key_file      => $KeyFile,
                    SSL_cert_file     => $MyCert,
                    SSL_ca_file       => $CACert,
-                   SSL_verifycn_name => $peer,
+                   SSL_verifycn_name => $verify_cn,
                    SSL_verify_mode   => Net::SSLeay::VERIFY_PEER());
     if (($CRLFile ne '') && (-e $CRLFile)) {
         $sslargs{SSL_check_crl} = 1;




More information about the LON-CAPA-cvs mailing list