xCAT/confluent
2
0
Fork 0
mirror of https://github.com/xcat2/confluent.git synced 2025-01-27 19:37:57 +00:00
Code Issues Projects Releases Wiki Activity

Reorder certificate check

Browse Source 
First order of business is to verify certificate before even thinking
about if the request is possible
This commit is contained in:
Jarrod Johnson 2018-07-20 13:34:14 -04:00
parent 3ff7e42074
commit e5c4219ee9
1 changed files with 9 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
confluent_server/confluent/collective/manager.py
View File

@ -350,6 +350,15 @@ def handle_connection(connection, cert, request, local=False):
populate_collinfo(collinfo)
tlvdata.send(connection, collinfo)
if 'connect' == operation:
drone = request['name']
droneinfo = cfm.get_collective_member(drone)
if not (droneinfo and util.cert_matches(droneinfo['fingerprint'],
cert)):
tlvdata.send(connection,
{'error': 'Invalid certificate, '
'redo invitation process'})
connection.close()
return
myself = connection.getsockname()[0]
if myself != get_leader(connection):
tlvdata.send(
@ -363,15 +372,6 @@ def handle_connection(connection, cert, request, local=False):
'backoff': True})
connection.close()
return
drone = request['name']
droneinfo = cfm.get_collective_member(drone)
if not (droneinfo and util.cert_matches(droneinfo['fingerprint'],
cert)):
tlvdata.send(connection,
{'error': 'Invalid certificate, '
'redo invitation process'})
connection.close()
return
if request['txcount'] > cfm._txcount:
retire_as_leader()
tlvdata.send(connection,