]>
git.proxmox.com Git - pve-manager.git/blob - PVE/CertCache.pm
1 package PVE
::CertCache
;
11 # X509 Certificate cache helper
13 my $cert_cache_nodes = {};
14 my $cert_cache_timestamp = time();
15 my $cert_cache_fingerprints = {};
17 sub update_cert_cache
{
18 my ($update_node, $clear) = @_;
20 syslog
('info', "Clearing outdated entries from certificate cache")
23 $cert_cache_timestamp = time() if !defined($update_node);
25 my $node_list = defined($update_node) ?
26 [ $update_node ] : [ keys %$cert_cache_nodes ];
28 foreach my $node (@$node_list) {
30 if (my $old_fp = $cert_cache_nodes->{$node}) {
31 # distrust old fingerprint
32 delete $cert_cache_fingerprints->{$old_fp};
33 # ensure reload on next proxied request
34 delete $cert_cache_nodes->{$node};
38 my $fp = eval { PVE
::Cluster
::get_node_fingerprint
($node) };
41 &$clear_old() if $clear;
45 my $old_fp = $cert_cache_nodes->{$node};
46 $cert_cache_fingerprints->{$fp} = 1;
47 $cert_cache_nodes->{$node} = $fp;
49 if (defined($old_fp) && $fp ne $old_fp) {
50 delete $cert_cache_fingerprints->{$old_fp};
55 # load and cache cert fingerprint once
56 sub initialize_cert_cache
{
59 update_cert_cache
($node)
60 if defined($node) && !defined($cert_cache_nodes->{$node});
63 sub check_cert_fingerprint
{
66 # clear cache every 30 minutes at least
67 update_cert_cache
(undef, 1) if time() - $cert_cache_timestamp >= 60*30;
69 # get fingerprint of server certificate
70 my $fp = Net
::SSLeay
::X509_get_fingerprint
($cert, 'sha256');
71 return 0 if !defined($fp) || $fp eq ''; # error
74 for my $expected (keys %$cert_cache_fingerprints) {
75 return 1 if $fp eq $expected;
80 return 1 if &$check();
82 # clear cache and retry at most once every minute
83 if (time() - $cert_cache_timestamp >= 60) {
84 syslog
('info', "Could not verify remote node certificate '$fp' with list of pinned certificates, refreshing cache");