-/*
- * Copyright (C) 2006-2008 Stig Venaas <venaas@uninett.no>
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- */
+/* Copyright (c) 2006-2010, UNINETT AS
+ * Copyright (c) 2010-2012, NORDUnet A/S */
+/* See LICENSE for licensing information. */
#if defined(RADPROT_TLS) || defined(RADPROT_DTLS)
#include <signal.h>
#include <openssl/rand.h>
#include <openssl/err.h>
#include <openssl/md5.h>
-#include <openssl/hmac.h>
#include <openssl/x509v3.h>
#include "debug.h"
-#include "list.h"
#include "hash.h"
#include "util.h"
+#include "hostport.h"
#include "radsecproxy.h"
static struct hash *tlsconfs = NULL;
debug(DBG_WARN, "verify error: num=%d:%s:depth=%d:%s", err, X509_verify_cert_error_string(err), depth, buf ? buf : "");
free(buf);
buf = NULL;
-
+
switch (err) {
case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
if (err_cert) {
break;
}
}
-#ifdef DEBUG
+#ifdef DEBUG
printf("certificate verify returns %d\n", ok);
-#endif
+#endif
return ok;
}
X509_VERIFY_PARAM *pm;
ASN1_OBJECT *pobject;
int i;
-
+
pm = X509_VERIFY_PARAM_new();
if (!pm)
return NULL;
-
+
for (i = 0; poids[i]; i++) {
pobject = OBJ_txt2obj(poids[i], 0);
if (!pobject) {
static SSL_CTX *tlscreatectx(uint8_t type, struct tls *conf) {
SSL_CTX *ctx = NULL;
unsigned long error;
+ long sslversion = SSLeay();
switch (type) {
-#ifdef RADPROT_TLS
+#ifdef RADPROT_TLS
case RAD_TLS:
ctx = SSL_CTX_new(TLSv1_method());
-#ifdef DEBUG
+#ifdef DEBUG
SSL_CTX_set_info_callback(ctx, ssl_info_callback);
-#endif
+#endif
break;
-#endif
-#ifdef RADPROT_DTLS
+#endif
+#ifdef RADPROT_DTLS
case RAD_DTLS:
ctx = SSL_CTX_new(DTLSv1_method());
-#ifdef DEBUG
+#ifdef DEBUG
SSL_CTX_set_info_callback(ctx, ssl_info_callback);
-#endif
+#endif
SSL_CTX_set_read_ahead(ctx, 1);
break;
-#endif
+#endif
}
if (!ctx) {
debug(DBG_ERR, "tlscreatectx: Error initialising SSL/TLS in TLS context %s", conf->name);
return NULL;
}
-
+
+ if (sslversion < 0x00908100L ||
+ (sslversion >= 0x10000000L && sslversion < 0x10000020L)) {
+ debug(DBG_WARN, "%s: %s seems to be of a version with a "
+ "certain security critical bug (fixed in OpenSSL 0.9.8p and "
+ "1.0.0b). Disabling OpenSSL session caching for context %p.",
+ __func__, SSLeay_version(SSLEAY_VERSION), ctx);
+ SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF);
+ }
+
if (conf->certkeypwd) {
SSL_CTX_set_default_passwd_cb_userdata(ctx, conf->certkeypwd);
SSL_CTX_set_default_passwd_cb(ctx, pem_passwd_cb);
SSL_CTX *tlsgetctx(uint8_t type, struct tls *t) {
struct timeval now;
-
+
if (!t)
return NULL;
gettimeofday(&now, NULL);
-
+
switch (type) {
#ifdef RADPROT_TLS
case RAD_TLS:
X509 *verifytlscert(SSL *ssl) {
X509 *cert;
unsigned long error;
-
+
if (SSL_get_verify_result(ssl) != X509_V_OK) {
debug(DBG_ERR, "verifytlscert: basic validation failed");
while ((error = ERR_get_error()))
X509_EXTENSION *ex;
STACK_OF(GENERAL_NAME) *alt;
GENERAL_NAME *gn;
-
+
debug(DBG_DBG, "subjectaltnameaddr");
-
+
loc = X509_get_ext_by_NID(cert, NID_subject_alt_name, -1);
if (loc < 0)
return r;
-
+
ex = X509_get_ext(cert, loc);
alt = X509V3_EXT_d2i(ex);
if (!alt)
return r;
-
+
n = sk_GENERAL_NAME_num(alt);
for (i = 0; i < n; i++) {
gn = sk_GENERAL_NAME_value(alt, i);
X509_EXTENSION *ex;
STACK_OF(GENERAL_NAME) *alt;
GENERAL_NAME *gn;
-
+
debug(DBG_DBG, "subjectaltnameregexp");
-
+
loc = X509_get_ext_by_NID(cert, NID_subject_alt_name, -1);
if (loc < 0)
return r;
-
+
ex = X509_get_ext(cert, loc);
alt = X509V3_EXT_d2i(ex);
if (!alt)
return r;
-
+
n = sk_GENERAL_NAME_num(alt);
for (i = 0; i < n; i++) {
gn = sk_GENERAL_NAME_value(alt, i);
continue;
#ifdef DEBUG
printfchars(NULL, gn->type == GEN_DNS ? "dns" : "uri", NULL, v, l);
-#endif
+#endif
if (exact) {
if (memcmp(v, exact, l))
continue;
return 0;
}
-int verifyconfcert(X509 *cert, struct clsrvconf *conf) {
+/* this is a bit sloppy, should not always accept match to any */
+int certnamecheck(X509 *cert, struct list *hostports) {
+ struct list_node *entry;
+ struct hostportres *hp;
int r;
uint8_t type = 0; /* 0 for DNS, AF_INET for IPv4, AF_INET6 for IPv6 */
struct in6_addr addr;
-
- if (conf->certnamecheck && conf->prefixlen == 255) {
- if (inet_pton(AF_INET, conf->host, &addr))
+
+ for (entry = list_first(hostports); entry; entry = list_next(entry)) {
+ hp = (struct hostportres *)entry->data;
+ if (hp->prefixlen != 255) {
+ /* we disable the check for prefixes */
+ return 1;
+ }
+ if (inet_pton(AF_INET, hp->host, &addr))
type = AF_INET;
- else if (inet_pton(AF_INET6, conf->host, &addr))
+ else if (inet_pton(AF_INET6, hp->host, &addr))
type = AF_INET6;
+ else
+ type = 0;
- r = type ? subjectaltnameaddr(cert, type, &addr) : subjectaltnameregexp(cert, GEN_DNS, conf->host, NULL);
+ r = type ? subjectaltnameaddr(cert, type, &addr) : subjectaltnameregexp(cert, GEN_DNS, hp->host, NULL);
if (r) {
- if (r < 0) {
- debug(DBG_WARN, "verifyconfcert: No subjectaltname matching %s %s", type ? "address" : "host", conf->host);
- return 0;
+ if (r > 0) {
+ debug(DBG_DBG, "certnamecheck: Found subjectaltname matching %s %s", type ? "address" : "host", hp->host);
+ return 1;
}
- debug(DBG_DBG, "verifyconfcert: Found subjectaltname matching %s %s", type ? "address" : "host", conf->host);
+ debug(DBG_WARN, "certnamecheck: No subjectaltname matching %s %s", type ? "address" : "host", hp->host);
} else {
- if (!cnregexp(cert, conf->host, NULL)) {
- debug(DBG_WARN, "verifyconfcert: cn not matching host %s", conf->host);
- return 0;
- }
- debug(DBG_DBG, "verifyconfcert: Found cn matching host %s", conf->host);
+ if (cnregexp(cert, hp->host, NULL)) {
+ debug(DBG_DBG, "certnamecheck: Found cn matching host %s", hp->host);
+ return 1;
+ }
+ debug(DBG_WARN, "certnamecheck: cn not matching host %s", hp->host);
+ }
+ }
+ return 0;
+}
+
+int verifyconfcert(X509 *cert, struct clsrvconf *conf) {
+ if (conf->certnamecheck) {
+ if (!certnamecheck(cert, conf->hostports)) {
+ debug(DBG_WARN, "verifyconfcert: certificate name check failed");
+ return 0;
}
+ debug(DBG_WARN, "verifyconfcert: certificate name check ok");
}
if (conf->certcnregex) {
if (cnregexp(cert, NULL, conf->certcnregex) < 1) {
int conftls_cb(struct gconffile **cf, void *arg, char *block, char *opt, char *val) {
struct tls *conf;
long int expiry = LONG_MIN;
-
+
debug(DBG_DBG, "conftls_cb called for %s", block);
-
+
conf = malloc(sizeof(struct tls));
if (!conf) {
debug(DBG_ERR, "conftls_cb: malloc failed");
return 0;
}
memset(conf, 0, sizeof(struct tls));
-
+
if (!getgenericconfig(cf, block,
"CACertificateFile", CONF_STR, &conf->cacertfile,
"CACertificatePath", CONF_STR, &conf->cacertpath,
"CRLCheck", CONF_BLN, &conf->crlcheck,
"PolicyOID", CONF_MSTR, &conf->policyoids,
NULL
- )) {
+ )) {
debug(DBG_ERR, "conftls_cb: configuration error in block %s", val);
goto errexit;
}
goto errexit;
}
conf->cacheexpiry = expiry;
- }
+ }
conf->name = stringcopy(val, 0);
if (!conf->name) {
debug(DBG_DBG, "conftls_cb: added TLS block %s", val);
return 1;
- errexit:
+errexit:
free(conf->cacertfile);
free(conf->cacertpath);
free(conf->certfile);
int addmatchcertattr(struct clsrvconf *conf) {
char *v;
regex_t **r;
-
+
if (!strncasecmp(conf->matchcertattr, "CN:/", 4)) {
r = &conf->certcnregex;
v = conf->matchcertattr + 4;
static void tlsdummy() {
}
#endif
+
+/* Local Variables: */
+/* c-file-style: "stroustrup" */
+/* End: */
projects / libradsec.git / blobdiff