Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Config parameter "tls_disable_client_certs" is wrongly evaluated. #4049

Merged
merged 10 commits into from
Feb 28, 2018
Merged

Config parameter "tls_disable_client_certs" is wrongly evaluated. #4049

Changes from 9 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
0b4a74d
Update Makefile
bharath-b23 Sep 22, 2017
4325f41
Update build.sh
bharath-b23 Sep 22, 2017
8d8b74f
Reverted back strip vault binary changes
bharath-b23 Sep 23, 2017
a3d3005
Update build.sh - Add comment for the changes made
bharath-b23 Sep 25, 2017
619483a
Merge branch 'master' into master
bharath-b23 Oct 3, 2017
c5891ac
Merge branch 'master' into master
bharath-b23 Oct 23, 2017
82f1694
Remove VAULT_STRIP_BINARIES check
bharath-b23 Nov 8, 2017
e76f498
Update listener.go
bharath-b23 Feb 28, 2018
c62eaae
Merge pull request #1 from hashicorp/master
bharath-b23 Feb 28, 2018
38c7163
Set TLS Client Auth to NoClientCert, only when tls_disable_client_cer…
bharath-b23 Feb 28, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion command/server/listener.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,7 +177,12 @@ PASSPHRASECORRECT:
if disableClientCerts && requireVerifyCerts {
return nil, nil, nil, fmt.Errorf("'tls_disable_client_certs' and 'tls_require_and_verify_client_cert' are mutually exclusive")
}
tlsConf.ClientAuth = tls.NoClientCert
if disableClientCerts {
tlsConf.ClientAuth = tls.NoClientCert
}
if !disableClientCerts {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This if section shouldn't be here. Only the first is needed.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If "tls_disable_client_certs" is set to false, then if client provides a certificate shouldn't it be validated.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry I overlooked the default value set.

tlsConf.ClientAuth = tls.VerifyClientCertIfGiven
}
}

ln = tls.NewListener(ln, tlsConf)
Expand Down