diff options
Diffstat (limited to 'modules/spanningtree/server.cpp')
| -rw-r--r-- | modules/spanningtree/server.cpp | 15 |
1 files changed, 11 insertions, 4 deletions
diff --git a/modules/spanningtree/server.cpp b/modules/spanningtree/server.cpp index 7c6c08544..6199673ae 100644 --- a/modules/spanningtree/server.cpp +++ b/modules/spanningtree/server.cpp @@ -141,19 +141,26 @@ std::shared_ptr<Link> TreeSocket::AuthRemote(const CommandBase::Params& params) if (!ComparePass(*x, password)) { - ServerInstance->SNO.WriteToSnoMask('l', "Invalid password on link: {}", x->Name); + ServerInstance->SNO.WriteToSnoMask('l', "Invalid credentials on link: {}", x->Name); continue; } - if (!CheckDuplicate(sname, sid)) + auto* hook = TLS::GetHook(this); + if (hook && !hook->GetCertificate()->IsUsable(!x->AllowSelfSigned)) + { + this->SendError("Peer provided an unusable (probably self-signed) TLS certificate"); return nullptr; + } - if (TLS::GetHook(this) && !IsLocalRange(capab->remotesa)) + if (!hook && !IsLocalRange(capab->remotesa)) { - this->SendError("Non-local server connections MUST be linked with SSL!"); + this->SendError("Non-local server connections MUST be linked with TLS"); return nullptr; } + if (!CheckDuplicate(sname, sid)) + return nullptr; + ServerInstance->SNO.WriteToSnoMask('l', "Verified server connection " + linkID + " ("+description+")"); return x; } |