basebuilder_pel7ppc64lebuilder0
4 years ago
18 changed files with 1045 additions and 539 deletions
Binary file not shown.
@ -0,0 +1,227 @@ |
|||||||
|
ITS#7595 Add Elliptic Curve support for OpenSSL |
||||||
|
|
||||||
|
Cherry-picked upstream e631ce808ed56119e61321463d06db7999ba5a08 |
||||||
|
Author: Howard Chu <hyc@openldap.org> |
||||||
|
Date: Sat Sep 7 09:47:19 2013 -0700 |
||||||
|
|
||||||
|
diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 |
||||||
|
index 9c72e8296..2311c3096 100644 |
||||||
|
--- a/doc/man/man5/slapd-config.5 |
||||||
|
+++ b/doc/man/man5/slapd-config.5 |
||||||
|
@@ -922,6 +922,13 @@ are not used. |
||||||
|
When using Mozilla NSS these parameters are always generated randomly |
||||||
|
so this directive is ignored. |
||||||
|
.TP |
||||||
|
+.B olcTLSECName: <name> |
||||||
|
+Specify the name of a curve to use for Elliptic curve Diffie-Hellman |
||||||
|
+ephemeral key exchange. This is required to enable ECDHE algorithms in |
||||||
|
+OpenSSL. This option is not used with GnuTLS; the curves may be |
||||||
|
+chosen in the GnuTLS ciphersuite specification. This option is also |
||||||
|
+ignored for Mozilla NSS. |
||||||
|
+.TP |
||||||
|
.B olcTLSProtocolMin: <major>[.<minor>] |
||||||
|
Specifies minimum SSL/TLS protocol version that will be negotiated. |
||||||
|
If the server doesn't support at least that version, |
||||||
|
diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 |
||||||
|
index f504adcf9..ef03e0ad8 100644 |
||||||
|
--- a/doc/man/man5/slapd.conf.5 |
||||||
|
+++ b/doc/man/man5/slapd.conf.5 |
||||||
|
@@ -1153,6 +1153,13 @@ are not used. |
||||||
|
When using Mozilla NSS these parameters are always generated randomly |
||||||
|
so this directive is ignored. |
||||||
|
.TP |
||||||
|
+.B TLSECName <name> |
||||||
|
+Specify the name of a curve to use for Elliptic curve Diffie-Hellman |
||||||
|
+ephemeral key exchange. This is required to enable ECDHE algorithms in |
||||||
|
+OpenSSL. This option is not used with GnuTLS; the curves may be |
||||||
|
+chosen in the GnuTLS ciphersuite specification. This option is also |
||||||
|
+ignored for Mozilla NSS. |
||||||
|
+.TP |
||||||
|
.B TLSProtocolMin <major>[.<minor>] |
||||||
|
Specifies minimum SSL/TLS protocol version that will be negotiated. |
||||||
|
If the server doesn't support at least that version, |
||||||
|
diff --git a/include/ldap.h b/include/ldap.h |
||||||
|
index c245651c2..0964a193e 100644 |
||||||
|
--- a/include/ldap.h |
||||||
|
+++ b/include/ldap.h |
||||||
|
@@ -158,6 +158,7 @@ LDAP_BEGIN_DECL |
||||||
|
#define LDAP_OPT_X_TLS_NEWCTX 0x600f |
||||||
|
#define LDAP_OPT_X_TLS_CRLFILE 0x6010 /* GNUtls only */ |
||||||
|
#define LDAP_OPT_X_TLS_PACKAGE 0x6011 |
||||||
|
+#define LDAP_OPT_X_TLS_ECNAME 0x6012 |
||||||
|
|
||||||
|
#define LDAP_OPT_X_TLS_NEVER 0 |
||||||
|
#define LDAP_OPT_X_TLS_HARD 1 |
||||||
|
diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h |
||||||
|
index 66e04ae80..db7193f4f 100644 |
||||||
|
--- a/libraries/libldap/ldap-int.h |
||||||
|
+++ b/libraries/libldap/ldap-int.h |
||||||
|
@@ -165,6 +165,7 @@ struct ldaptls { |
||||||
|
char *lt_ciphersuite; |
||||||
|
char *lt_crlfile; |
||||||
|
char *lt_randfile; /* OpenSSL only */ |
||||||
|
+ char *lt_ecname; /* OpenSSL only */ |
||||||
|
int lt_protocol_min; |
||||||
|
}; |
||||||
|
#endif |
||||||
|
@@ -250,6 +251,7 @@ struct ldapoptions { |
||||||
|
#define ldo_tls_certfile ldo_tls_info.lt_certfile |
||||||
|
#define ldo_tls_keyfile ldo_tls_info.lt_keyfile |
||||||
|
#define ldo_tls_dhfile ldo_tls_info.lt_dhfile |
||||||
|
+#define ldo_tls_ecname ldo_tls_info.lt_ecname |
||||||
|
#define ldo_tls_cacertfile ldo_tls_info.lt_cacertfile |
||||||
|
#define ldo_tls_cacertdir ldo_tls_info.lt_cacertdir |
||||||
|
#define ldo_tls_ciphersuite ldo_tls_info.lt_ciphersuite |
||||||
|
diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c |
||||||
|
index d25c190ea..0451b01af 100644 |
||||||
|
--- a/libraries/libldap/tls2.c |
||||||
|
+++ b/libraries/libldap/tls2.c |
||||||
|
@@ -118,6 +118,10 @@ ldap_int_tls_destroy( struct ldapoptions *lo ) |
||||||
|
LDAP_FREE( lo->ldo_tls_dhfile ); |
||||||
|
lo->ldo_tls_dhfile = NULL; |
||||||
|
} |
||||||
|
+ if ( lo->ldo_tls_ecname ) { |
||||||
|
+ LDAP_FREE( lo->ldo_tls_ecname ); |
||||||
|
+ lo->ldo_tls_ecname = NULL; |
||||||
|
+ } |
||||||
|
if ( lo->ldo_tls_cacertfile ) { |
||||||
|
LDAP_FREE( lo->ldo_tls_cacertfile ); |
||||||
|
lo->ldo_tls_cacertfile = NULL; |
||||||
|
@@ -232,6 +236,10 @@ ldap_int_tls_init_ctx( struct ldapoptions *lo, int is_server ) |
||||||
|
lts.lt_dhfile = LDAP_STRDUP( lts.lt_dhfile ); |
||||||
|
__atoe( lts.lt_dhfile ); |
||||||
|
} |
||||||
|
+ if ( lts.lt_ecname ) { |
||||||
|
+ lts.lt_ecname = LDAP_STRDUP( lts.lt_ecname ); |
||||||
|
+ __atoe( lts.lt_ecname ); |
||||||
|
+ } |
||||||
|
#endif |
||||||
|
lo->ldo_tls_ctx = ti->ti_ctx_new( lo ); |
||||||
|
if ( lo->ldo_tls_ctx == NULL ) { |
||||||
|
@@ -257,6 +265,7 @@ error_exit: |
||||||
|
LDAP_FREE( lts.lt_crlfile ); |
||||||
|
LDAP_FREE( lts.lt_cacertdir ); |
||||||
|
LDAP_FREE( lts.lt_dhfile ); |
||||||
|
+ LDAP_FREE( lts.lt_ecname ); |
||||||
|
#endif |
||||||
|
return rc; |
||||||
|
} |
||||||
|
@@ -646,6 +655,10 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg ) |
||||||
|
*(char **)arg = lo->ldo_tls_dhfile ? |
||||||
|
LDAP_STRDUP( lo->ldo_tls_dhfile ) : NULL; |
||||||
|
break; |
||||||
|
+ case LDAP_OPT_X_TLS_ECNAME: |
||||||
|
+ *(char **)arg = lo->ldo_tls_ecname ? |
||||||
|
+ LDAP_STRDUP( lo->ldo_tls_ecname ) : NULL; |
||||||
|
+ break; |
||||||
|
case LDAP_OPT_X_TLS_CRLFILE: /* GnuTLS only */ |
||||||
|
*(char **)arg = lo->ldo_tls_crlfile ? |
||||||
|
LDAP_STRDUP( lo->ldo_tls_crlfile ) : NULL; |
||||||
|
@@ -765,6 +778,10 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) |
||||||
|
if ( lo->ldo_tls_dhfile ) LDAP_FREE( lo->ldo_tls_dhfile ); |
||||||
|
lo->ldo_tls_dhfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; |
||||||
|
return 0; |
||||||
|
+ case LDAP_OPT_X_TLS_ECNAME: |
||||||
|
+ if ( lo->ldo_tls_ecname ) LDAP_FREE( lo->ldo_tls_ecname ); |
||||||
|
+ lo->ldo_tls_ecname = arg ? LDAP_STRDUP( (char *) arg ) : NULL; |
||||||
|
+ return 0; |
||||||
|
case LDAP_OPT_X_TLS_CRLFILE: /* GnuTLS only */ |
||||||
|
if ( lo->ldo_tls_crlfile ) LDAP_FREE( lo->ldo_tls_crlfile ); |
||||||
|
lo->ldo_tls_crlfile = arg ? LDAP_STRDUP( (char *) arg ) : NULL; |
||||||
|
diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c |
||||||
|
index f24060b7e..1370923af 100644 |
||||||
|
--- a/libraries/libldap/tls_o.c |
||||||
|
+++ b/libraries/libldap/tls_o.c |
||||||
|
@@ -373,10 +373,9 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) |
||||||
|
return -1; |
||||||
|
} |
||||||
|
|
||||||
|
- if ( lo->ldo_tls_dhfile ) { |
||||||
|
- DH *dh = NULL; |
||||||
|
+ if ( is_server && lo->ldo_tls_dhfile ) { |
||||||
|
+ DH *dh; |
||||||
|
BIO *bio; |
||||||
|
- SSL_CTX_set_options( ctx, SSL_OP_SINGLE_DH_USE ); |
||||||
|
|
||||||
|
if (( bio=BIO_new_file( lt->lt_dhfile,"r" )) == NULL ) { |
||||||
|
Debug( LDAP_DEBUG_ANY, |
||||||
|
@@ -395,7 +394,35 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) |
||||||
|
} |
||||||
|
BIO_free( bio ); |
||||||
|
SSL_CTX_set_tmp_dh( ctx, dh ); |
||||||
|
+ SSL_CTX_set_options( ctx, SSL_OP_SINGLE_DH_USE ); |
||||||
|
+ DH_free( dh ); |
||||||
|
+ } |
||||||
|
+ |
||||||
|
+#ifdef SSL_OP_SINGLE_ECDH_USE |
||||||
|
+ if ( is_server && lo->ldo_tls_ecname ) { |
||||||
|
+ EC_KEY *ecdh; |
||||||
|
+ |
||||||
|
+ int nid = OBJ_sn2nid( lt->lt_ecname ); |
||||||
|
+ if ( nid == NID_undef ) { |
||||||
|
+ Debug( LDAP_DEBUG_ANY, |
||||||
|
+ "TLS: could not use EC name `%s'.\n", |
||||||
|
+ lo->ldo_tls_ecname,0,0); |
||||||
|
+ tlso_report_error(); |
||||||
|
+ return -1; |
||||||
|
+ } |
||||||
|
+ ecdh = EC_KEY_new_by_curve_name( nid ); |
||||||
|
+ if ( ecdh == NULL ) { |
||||||
|
+ Debug( LDAP_DEBUG_ANY, |
||||||
|
+ "TLS: could not generate key for EC name `%s'.\n", |
||||||
|
+ lo->ldo_tls_ecname,0,0); |
||||||
|
+ tlso_report_error(); |
||||||
|
+ return -1; |
||||||
|
+ } |
||||||
|
+ SSL_CTX_set_tmp_ecdh( ctx, ecdh ); |
||||||
|
+ SSL_CTX_set_options( ctx, SSL_OP_SINGLE_ECDH_USE ); |
||||||
|
+ EC_KEY_free( ecdh ); |
||||||
|
} |
||||||
|
+#endif |
||||||
|
|
||||||
|
if ( tlso_opt_trace ) { |
||||||
|
SSL_CTX_set_info_callback( ctx, tlso_info_cb ); |
||||||
|
diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c |
||||||
|
index 250f14100..8b1e4e582 100644 |
||||||
|
--- a/servers/slapd/bconfig.c |
||||||
|
+++ b/servers/slapd/bconfig.c |
||||||
|
@@ -194,6 +194,7 @@ enum { |
||||||
|
CFG_ACL_ADD, |
||||||
|
CFG_SYNC_SUBENTRY, |
||||||
|
CFG_LTHREADS, |
||||||
|
+ CFG_TLS_ECNAME, |
||||||
|
|
||||||
|
CFG_LAST |
||||||
|
}; |
||||||
|
@@ -738,6 +739,14 @@ static ConfigTable config_back_cf_table[] = { |
||||||
|
#endif |
||||||
|
"( OLcfgGlAt:77 NAME 'olcTLSDHParamFile' " |
||||||
|
"SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, |
||||||
|
+ { "TLSECName", NULL, 2, 2, 0, |
||||||
|
+#ifdef HAVE_TLS |
||||||
|
+ CFG_TLS_ECNAME|ARG_STRING|ARG_MAGIC, &config_tls_option, |
||||||
|
+#else |
||||||
|
+ ARG_IGNORED, NULL, |
||||||
|
+#endif |
||||||
|
+ "( OLcfgGlAt:96 NAME 'olcTLSECName' " |
||||||
|
+ "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, |
||||||
|
{ "TLSProtocolMin", NULL, 2, 2, 0, |
||||||
|
#ifdef HAVE_TLS |
||||||
|
CFG_TLS_PROTOCOL_MIN|ARG_STRING|ARG_MAGIC, &config_tls_config, |
||||||
|
@@ -819,7 +828,7 @@ static ConfigOCs cf_ocs[] = { |
||||||
|
"olcThreads $ olcTimeLimit $ olcTLSCACertificateFile $ " |
||||||
|
"olcTLSCACertificatePath $ olcTLSCertificateFile $ " |
||||||
|
"olcTLSCertificateKeyFile $ olcTLSCipherSuite $ olcTLSCRLCheck $ " |
||||||
|
- "olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ " |
||||||
|
+ "olcTLSRandFile $ olcTLSVerifyClient $ olcTLSDHParamFile $ olcTLSECName $ " |
||||||
|
"olcTLSCRLFile $ olcTLSProtocolMin $ olcToolThreads $ olcWriteTimeout $ " |
||||||
|
"olcObjectIdentifier $ olcAttributeTypes $ olcObjectClasses $ " |
||||||
|
"olcDitContentRules $ olcLdapSyntaxes ) )", Cft_Global }, |
||||||
|
@@ -3824,6 +3833,7 @@ config_tls_option(ConfigArgs *c) { |
||||||
|
case CFG_TLS_CA_PATH: flag = LDAP_OPT_X_TLS_CACERTDIR; break; |
||||||
|
case CFG_TLS_CA_FILE: flag = LDAP_OPT_X_TLS_CACERTFILE; break; |
||||||
|
case CFG_TLS_DH_FILE: flag = LDAP_OPT_X_TLS_DHFILE; break; |
||||||
|
+ case CFG_TLS_ECNAME: flag = LDAP_OPT_X_TLS_ECNAME; break; |
||||||
|
#ifdef HAVE_GNUTLS |
||||||
|
case CFG_TLS_CRL_FILE: flag = LDAP_OPT_X_TLS_CRLFILE; break; |
||||||
|
#endif |
||||||
@ -0,0 +1,34 @@ |
|||||||
|
ITS#7595 don't try to use EC if OpenSSL lacks it |
||||||
|
|
||||||
|
Cherry-picked upstream 721e46fe6695077d63a3df6ea2e397920a72308d |
||||||
|
Author: Howard Chu <hyc@openldap.org> |
||||||
|
Date: Sun Sep 8 06:32:23 2013 -0700 |
||||||
|
|
||||||
|
diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c |
||||||
|
index 1a81bc625..71c2b055c 100644 |
||||||
|
--- a/libraries/libldap/tls_o.c |
||||||
|
+++ b/libraries/libldap/tls_o.c |
||||||
|
@@ -321,8 +321,12 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) |
||||||
|
DH_free( dh ); |
||||||
|
} |
||||||
|
|
||||||
|
-#ifdef SSL_OP_SINGLE_ECDH_USE |
||||||
|
if ( is_server && lo->ldo_tls_ecname ) { |
||||||
|
+#ifdef OPENSSL_NO_EC |
||||||
|
+ Debug( LDAP_DEBUG_ANY, |
||||||
|
+ "TLS: Elliptic Curves not supported.\n", 0,0,0 ); |
||||||
|
+ return -1; |
||||||
|
+#else |
||||||
|
EC_KEY *ecdh; |
||||||
|
|
||||||
|
int nid = OBJ_sn2nid( lt->lt_ecname ); |
||||||
|
@@ -344,8 +348,8 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server ) |
||||||
|
SSL_CTX_set_tmp_ecdh( ctx, ecdh ); |
||||||
|
SSL_CTX_set_options( ctx, SSL_OP_SINGLE_ECDH_USE ); |
||||||
|
EC_KEY_free( ecdh ); |
||||||
|
- } |
||||||
|
#endif |
||||||
|
+ } |
||||||
|
|
||||||
|
if ( tlso_opt_trace ) { |
||||||
|
SSL_CTX_set_info_callback( ctx, tlso_info_cb ); |
||||||
@ -0,0 +1,48 @@ |
|||||||
|
Reference default system-wide CA certificates in manpages |
||||||
|
|
||||||
|
OpenSSL, unless explicitly configured, uses system-wide default set of CA |
||||||
|
certificates. |
||||||
|
|
||||||
|
Author: Matus Honek <mhonek@redhat.com> |
||||||
|
|
||||||
|
diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5 |
||||||
|
--- a/doc/man/man5/ldap.conf.5 |
||||||
|
+++ b/doc/man/man5/ldap.conf.5 |
||||||
|
@@ -307,6 +307,9 @@ are more options you can specify. These options are used when an |
||||||
|
.B ldaps:// URI |
||||||
|
is selected (by default or otherwise) or when the application |
||||||
|
negotiates TLS by issuing the LDAP StartTLS operation. |
||||||
|
+.LP |
||||||
|
+When using OpenSSL, if neither \fBTLS_CACERT\fP nor \fBTLS_CACERTDIR\fP |
||||||
|
+is set, the system-wide default set of CA certificates is used. |
||||||
|
.TP |
||||||
|
.B TLS_CACERT <filename> |
||||||
|
Specifies the file that contains certificates for all of the Certificate |
||||||
|
diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5 |
||||||
|
--- a/doc/man/man5/slapd-config.5 |
||||||
|
+++ b/doc/man/man5/slapd-config.5 |
||||||
|
@@ -801,6 +801,10 @@ If |
||||||
|
.B slapd |
||||||
|
is built with support for Transport Layer Security, there are more options |
||||||
|
you can specify. |
||||||
|
+.LP |
||||||
|
+When using OpenSSL, if neither \fBolcTLSCACertificateFile\fP nor |
||||||
|
+\fBolcTLSCACertificatePath\fP is set, the system-wide default set of CA |
||||||
|
+certificates is used. |
||||||
|
.TP |
||||||
|
.B olcTLSCipherSuite: <cipher-suite-spec> |
||||||
|
Permits configuring what ciphers will be accepted and the preference order. |
||||||
|
diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5 |
||||||
|
--- a/doc/man/man5/slapd.conf.5 |
||||||
|
+++ b/doc/man/man5/slapd.conf.5 |
||||||
|
@@ -1032,6 +1032,10 @@ If |
||||||
|
.B slapd |
||||||
|
is built with support for Transport Layer Security, there are more options |
||||||
|
you can specify. |
||||||
|
+.LP |
||||||
|
+When using OpenSSL, if neither \fBTLSCACertificateFile\fP nor |
||||||
|
+\fBTLSCACertificatePath\fP is set, the system-wide default set of CA |
||||||
|
+certificates is used. |
||||||
|
.TP |
||||||
|
.B TLSCipherSuite <cipher-suite-spec> |
||||||
|
Permits configuring what ciphers will be accepted and the preference order. |
||||||
@ -0,0 +1,224 @@ |
|||||||
|
From f2978fefa13eb92b73922e49d2f6c12b4f92ea85 Mon Sep 17 00:00:00 2001 |
||||||
|
From: Christian Heimes <christian@python.org> |
||||||
|
Date: Fri, 10 Jan 2020 18:35:02 +0100 |
||||||
|
Subject: [PATCH] Use OpenSSL API to verify host |
||||||
|
|
||||||
|
Replace custom hostname and IP address verification with OpenSSL 1.0.2 |
||||||
|
APIs. |
||||||
|
--- |
||||||
|
libraries/libldap/tls_o.c | 184 ++++++-------------------------------- |
||||||
|
1 file changed, 28 insertions(+), 156 deletions(-) |
||||||
|
|
||||||
|
diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c |
||||||
|
index e52c5507c..5adf7b74f 100644 |
||||||
|
--- a/libraries/libldap/tls_o.c |
||||||
|
+++ b/libraries/libldap/tls_o.c |
||||||
|
@@ -660,25 +660,15 @@ tlso_session_peer_dn( tls_session *sess, struct berval *der_dn ) |
||||||
|
return 0; |
||||||
|
} |
||||||
|
|
||||||
|
-/* what kind of hostname were we given? */ |
||||||
|
-#define IS_DNS 0 |
||||||
|
-#define IS_IP4 1 |
||||||
|
-#define IS_IP6 2 |
||||||
|
- |
||||||
|
static int |
||||||
|
tlso_session_chkhost( LDAP *ld, tls_session *sess, const char *name_in ) |
||||||
|
{ |
||||||
|
tlso_session *s = (tlso_session *)sess; |
||||||
|
- int i, ret = LDAP_LOCAL_ERROR; |
||||||
|
+ int ret = LDAP_LOCAL_ERROR; |
||||||
|
X509 *x; |
||||||
|
const char *name; |
||||||
|
- char *ptr; |
||||||
|
- int ntype = IS_DNS, nlen; |
||||||
|
-#ifdef LDAP_PF_INET6 |
||||||
|
- struct in6_addr addr; |
||||||
|
-#else |
||||||
|
- struct in_addr addr; |
||||||
|
-#endif |
||||||
|
+ int flags = X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS; |
||||||
|
+ ASN1_OCTET_STRING *ip; |
||||||
|
|
||||||
|
if( ldap_int_hostname && |
||||||
|
( !name_in || !strcasecmp( name_in, "localhost" ) ) ) |
||||||
|
@@ -687,7 +677,6 @@ tlso_session_chkhost( LDAP *ld, tls_session *sess, const char *name_in ) |
||||||
|
} else { |
||||||
|
name = name_in; |
||||||
|
} |
||||||
|
- nlen = strlen(name); |
||||||
|
|
||||||
|
x = tlso_get_cert(s); |
||||||
|
if (!x) { |
||||||
|
@@ -619,150 +619,32 @@ tlso_session_chkhost( LDAP *ld, tls_session *sess, const char *name_in ) |
||||||
|
return LDAP_SUCCESS; |
||||||
|
} |
||||||
|
|
||||||
|
-#ifdef LDAP_PF_INET6 |
||||||
|
- if (inet_pton(AF_INET6, name, &addr)) { |
||||||
|
- ntype = IS_IP6; |
||||||
|
- } else |
||||||
|
-#endif |
||||||
|
- if ((ptr = strrchr(name, '.')) && isdigit((unsigned char)ptr[1])) { |
||||||
|
- if (inet_aton(name, (struct in_addr *)&addr)) ntype = IS_IP4; |
||||||
|
- } |
||||||
|
- |
||||||
|
- i = X509_get_ext_by_NID(x, NID_subject_alt_name, -1); |
||||||
|
- if (i >= 0) { |
||||||
|
- X509_EXTENSION *ex; |
||||||
|
- STACK_OF(GENERAL_NAME) *alt; |
||||||
|
- |
||||||
|
- ex = X509_get_ext(x, i); |
||||||
|
- alt = X509V3_EXT_d2i(ex); |
||||||
|
- if (alt) { |
||||||
|
- int n, len2 = 0; |
||||||
|
- char *domain = NULL; |
||||||
|
- GENERAL_NAME *gn; |
||||||
|
- |
||||||
|
- if (ntype == IS_DNS) { |
||||||
|
- domain = strchr(name, '.'); |
||||||
|
- if (domain) { |
||||||
|
- len2 = nlen - (domain-name); |
||||||
|
- } |
||||||
|
- } |
||||||
|
- n = sk_GENERAL_NAME_num(alt); |
||||||
|
- for (i=0; i<n; i++) { |
||||||
|
- char *sn; |
||||||
|
- int sl; |
||||||
|
- gn = sk_GENERAL_NAME_value(alt, i); |
||||||
|
- if (gn->type == GEN_DNS) { |
||||||
|
- if (ntype != IS_DNS) continue; |
||||||
|
- |
||||||
|
- sn = (char *) ASN1_STRING_data(gn->d.ia5); |
||||||
|
- sl = ASN1_STRING_length(gn->d.ia5); |
||||||
|
- |
||||||
|
- /* ignore empty */ |
||||||
|
- if (sl == 0) continue; |
||||||
|
- |
||||||
|
- /* Is this an exact match? */ |
||||||
|
- if ((nlen == sl) && !strncasecmp(name, sn, nlen)) { |
||||||
|
- break; |
||||||
|
- } |
||||||
|
- |
||||||
|
- /* Is this a wildcard match? */ |
||||||
|
- if (domain && (sn[0] == '*') && (sn[1] == '.') && |
||||||
|
- (len2 == sl-1) && !strncasecmp(domain, &sn[1], len2)) |
||||||
|
- { |
||||||
|
- break; |
||||||
|
- } |
||||||
|
- |
||||||
|
- } else if (gn->type == GEN_IPADD) { |
||||||
|
- if (ntype == IS_DNS) continue; |
||||||
|
- |
||||||
|
- sn = (char *) ASN1_STRING_data(gn->d.ia5); |
||||||
|
- sl = ASN1_STRING_length(gn->d.ia5); |
||||||
|
- |
||||||
|
-#ifdef LDAP_PF_INET6 |
||||||
|
- if (ntype == IS_IP6 && sl != sizeof(struct in6_addr)) { |
||||||
|
- continue; |
||||||
|
- } else |
||||||
|
-#endif |
||||||
|
- if (ntype == IS_IP4 && sl != sizeof(struct in_addr)) { |
||||||
|
- continue; |
||||||
|
- } |
||||||
|
- if (!memcmp(sn, &addr, sl)) { |
||||||
|
- break; |
||||||
|
- } |
||||||
|
- } |
||||||
|
- } |
||||||
|
- |
||||||
|
- GENERAL_NAMES_free(alt); |
||||||
|
- if (i < n) { /* Found a match */ |
||||||
|
- ret = LDAP_SUCCESS; |
||||||
|
- } |
||||||
|
- } |
||||||
|
- } |
||||||
|
- |
||||||
|
- if (ret != LDAP_SUCCESS) { |
||||||
|
- X509_NAME *xn; |
||||||
|
- X509_NAME_ENTRY *ne; |
||||||
|
- ASN1_OBJECT *obj; |
||||||
|
- ASN1_STRING *cn = NULL; |
||||||
|
- int navas; |
||||||
|
- |
||||||
|
- /* find the last CN */ |
||||||
|
- obj = OBJ_nid2obj( NID_commonName ); |
||||||
|
- if ( !obj ) goto no_cn; /* should never happen */ |
||||||
|
- |
||||||
|
- xn = X509_get_subject_name(x); |
||||||
|
- navas = X509_NAME_entry_count( xn ); |
||||||
|
- for ( i=navas-1; i>=0; i-- ) { |
||||||
|
- ne = X509_NAME_get_entry( xn, i ); |
||||||
|
- if ( !OBJ_cmp( X509_NAME_ENTRY_get_object(ne), obj )) { |
||||||
|
- cn = X509_NAME_ENTRY_get_data( ne ); |
||||||
|
- break; |
||||||
|
- } |
||||||
|
+ /* attempt to encode name as IP address */ |
||||||
|
+ ip = a2i_IPADDRESS(name); |
||||||
|
+ if (ip == NULL) { |
||||||
|
+ ERR_clear_error(); |
||||||
|
+ /* it's a hostname */ |
||||||
|
+ if (X509_check_host(x, name, strlen(name), flags, NULL) == 1) { |
||||||
|
+ ret = LDAP_SUCCESS; |
||||||
|
} |
||||||
|
- |
||||||
|
- if( !cn ) |
||||||
|
- { |
||||||
|
-no_cn: |
||||||
|
- Debug( LDAP_DEBUG_ANY, |
||||||
|
- "TLS: unable to get common name from peer certificate.\n", |
||||||
|
- 0, 0, 0 ); |
||||||
|
- ret = LDAP_CONNECT_ERROR; |
||||||
|
- if ( ld->ld_error ) { |
||||||
|
- LDAP_FREE( ld->ld_error ); |
||||||
|
- } |
||||||
|
- ld->ld_error = LDAP_STRDUP( |
||||||
|
- _("TLS: unable to get CN from peer certificate")); |
||||||
|
- |
||||||
|
- } else if ( cn->length == nlen && |
||||||
|
- strncasecmp( name, (char *) cn->data, nlen ) == 0 ) { |
||||||
|
+ } else { |
||||||
|
+ /* It's an IPv4 or IPv6 address */ |
||||||
|
+ if (X509_check_ip(x, ASN1_STRING_data(ip), |
||||||
|
+ ASN1_STRING_length(ip), 0) == 1) { |
||||||
|
ret = LDAP_SUCCESS; |
||||||
|
- |
||||||
|
- } else if (( cn->data[0] == '*' ) && ( cn->data[1] == '.' )) { |
||||||
|
- char *domain = strchr(name, '.'); |
||||||
|
- if( domain ) { |
||||||
|
- int dlen; |
||||||
|
- |
||||||
|
- dlen = nlen - (domain-name); |
||||||
|
- |
||||||
|
- /* Is this a wildcard match? */ |
||||||
|
- if ((dlen == cn->length-1) && |
||||||
|
- !strncasecmp(domain, (char *) &cn->data[1], dlen)) { |
||||||
|
- ret = LDAP_SUCCESS; |
||||||
|
- } |
||||||
|
- } |
||||||
|
} |
||||||
|
+ ASN1_OCTET_STRING_free(ip); |
||||||
|
+ } |
||||||
|
|
||||||
|
- if( ret == LDAP_LOCAL_ERROR ) { |
||||||
|
- Debug( LDAP_DEBUG_ANY, "TLS: hostname (%s) does not match " |
||||||
|
- "common name in certificate (%.*s).\n", |
||||||
|
- name, cn->length, cn->data ); |
||||||
|
- ret = LDAP_CONNECT_ERROR; |
||||||
|
- if ( ld->ld_error ) { |
||||||
|
- LDAP_FREE( ld->ld_error ); |
||||||
|
- } |
||||||
|
- ld->ld_error = LDAP_STRDUP( |
||||||
|
- _("TLS: hostname does not match CN in peer certificate")); |
||||||
|
+ if( ret == LDAP_LOCAL_ERROR ) { |
||||||
|
+ Debug( LDAP_DEBUG_ANY, "TLS: hostname (%s) does not match " |
||||||
|
+ "peer certificate.\n", name, 0, 0); |
||||||
|
+ ret = LDAP_CONNECT_ERROR; |
||||||
|
+ if ( ld->ld_error ) { |
||||||
|
+ LDAP_FREE( ld->ld_error ); |
||||||
|
} |
||||||
|
+ ld->ld_error = LDAP_STRDUP( |
||||||
|
+ _("TLS: hostname does not match peer certificate")); |
||||||
|
} |
||||||
|
X509_free(x); |
||||||
|
return ret; |
||||||
Loading…
Reference in new issue