diff options
| author |  Sadie Powell | 2025-10-26 15:12:17 +0000 |
|---|---|---|
| committer | Sadie Powell | 2025-10-26 15:18:49 +0000 |
| commit | d424d2ef710b4f45c06bfad79089bd998d5a35f9 (patch) | |
| tree | 34197b740e7fa0912dc50e50efb15a80eb22c1f3 | |
| parent | Deprecate the contents of the SSLClientCert namespace. (diff) | |
Fix allowing expired client certificates in some cases.
This fixes a regression from v3.
| -rw-r--r-- | include/modules/ssl.h | 6 | ||||
| -rw-r--r-- | src/modules/m_sslinfo.cpp | 4 |
2 files changed, 5 insertions, 5 deletions
diff --git a/include/modules/ssl.h b/include/modules/ssl.h index 4526d7c9f..ff2646e8b 100644 --- a/include/modules/ssl.h +++ b/include/modules/ssl.h @@ -314,7 +314,7 @@ public: return nullptr; auto* cert = ssliohook->GetCertificate(); - if (!cert) + if (!cert || !cert->IsUsable()) return ""; return cert->GetFingerprint(); @@ -355,7 +355,7 @@ public: std::string GetFingerprint(User* user) { ssl_cert* cert = GetCertificate(user); - if (cert) + if (cert && cert->IsUsable()) return cert->GetFingerprint(); return ""; } @@ -368,7 +368,7 @@ public: std::vector<std::string> GetFingerprints(User* user) { ssl_cert* cert = GetCertificate(user); - if (cert) + if (cert && cert->IsUsable()) return cert->GetFingerprints(); return {}; } diff --git a/src/modules/m_sslinfo.cpp b/src/modules/m_sslinfo.cpp index 4a1f73f74..bebd08155 100644 --- a/src/modules/m_sslinfo.cpp +++ b/src/modules/m_sslinfo.cpp @@ -373,7 +373,7 @@ public: whois.SendLine(RPL_WHOISSECURE, "is using a secure connection"); ssl_cert* cert = cmd.sslapi.GetCertificate(whois.GetTarget()); - if (cert) + if (!cert || !cert->IsUsable()) { if (!cmd.operonlyfp || whois.IsSelfWhois() || whois.GetSource()->IsOper()) { @@ -415,7 +415,7 @@ public: } const std::string fingerprint = oper->GetConfig()->getString("fingerprint"); - if (!fingerprint.empty() && (!cert || !MatchFingerprint(cert, fingerprint))) + if (!fingerprint.empty() && (!cert || !cert->IsUsable() || !MatchFingerprint(cert, fingerprint))) { if (!automatic) { |