diff options
| author | Zbigniew Kurzynski <zbigniew.kurzynski@intel.com> | 2019-11-14 15:37:15 +0300 |
|---|---|---|
| committer | Zbigniew Kurzynski <zbigniew.kurzynski@intel.com> | 2019-12-16 11:07:09 +0300 |
| commit | 009c2a4d7ba310789487910cc06cb19c745c1c97 (patch) | |
| tree | 073259a9b54beaf1edc7596db9e3462507e6cb18 /include/sessions.hpp | |
| parent | 97d57aaa0b95a110c71016d190f95f853051126a (diff) | |
| download | bmcweb-009c2a4d7ba310789487910cc06cb19c745c1c97.tar.xz | |
Fixing mTLS switches
This commit is a fix for revert:
https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/27205
The mTLS will work only when:
* Compilation flag BMCWEB_ENABLE_MUTUAL_TLS_AUTHENTICATION is
enabled and,
* AccountService->Oem->OpenBMC->AuthMethods->TLS is set and,
* at least one certificate is uploaded to TrustStore.
To enforce a new mTLS settings after switching AuthMethods->TLS
all awaiting for acceptance connections are dropped.
In case of authorized mTLS requests a cookie with XSRF-TOKEN entry
and SESSION is added to response. It will force the X-XSRF-TOKEN
challenge in case of applications supporting cookies like web
browsers.
Also some minor log messages changes were made in this commit.
Tested:
validator_service run with status: 'Validation has succeeded'.
Tests were made with Chrome browser Version 78.0.3904.108.
The certificate popup appears only when mTLS is enabled in CMake,
the TLS option is set and at least one CA certificate is present.
In other cases mTLS is not active and there is no popup for certs.
Signed-off-by: Zbigniew Kurzynski <zbigniew.kurzynski@intel.com>
Change-Id: I778b848b767356b60386694f802a89b3c1f6cb14
Diffstat (limited to 'include/sessions.hpp')
| -rw-r--r-- | include/sessions.hpp | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/include/sessions.hpp b/include/sessions.hpp index 6e74f25919..f461521558 100644 --- a/include/sessions.hpp +++ b/include/sessions.hpp @@ -4,6 +4,7 @@ #include <boost/uuid/uuid.hpp> #include <boost/uuid/uuid_generators.hpp> #include <boost/uuid/uuid_io.hpp> +#include <csignal> #include <dbus_singleton.hpp> #include <nlohmann/json.hpp> #include <pam_authenticate.hpp> @@ -496,8 +497,14 @@ class SessionStore void updateAuthMethodsConfig(const AuthConfigMethods& config) { + bool isTLSchanged = (authMethodsConfig.tls != config.tls); authMethodsConfig = config; needWrite = true; + if (isTLSchanged) + { + // recreate socket connections with new settings + std::raise(SIGHUP); + } } AuthConfigMethods& getAuthMethodsConfig() |