From 9e4dddbde4228e83fc7c882a4ef410ddbe0a6e79 Mon Sep 17 00:00:00 2001 From: Jeremy Harris Date: Mon, 5 May 2014 16:53:48 +0100 Subject: Extractors for subject-alternate-name, ocsp-uri, crl-uri return list. Bug 1358 --- src/src/expand.c | 37 +++++---- src/src/functions.h | 22 +++--- src/src/tlscert-gnu.c | 193 +++++++++++++++++++++++++++++----------------- src/src/tlscert-openssl.c | 89 ++++++++++++++------- 4 files changed, 217 insertions(+), 124 deletions(-) (limited to 'src') diff --git a/src/src/expand.c b/src/src/expand.c index 8f1b3d875..05b714a7f 100644 --- a/src/src/expand.c +++ b/src/src/expand.c @@ -1185,26 +1185,28 @@ return string_nextinlist(&list, &sep, NULL, 0); /* Certificate fields, by name. Worry about by-OID later */ +/* Names are chosen to not have common prefixes */ #ifdef SUPPORT_TLS typedef struct { uschar * name; -uschar * (*getfn)(void * cert); +int namelen; +uschar * (*getfn)(void * cert, uschar * mod); } certfield; static certfield certfields[] = { /* linear search; no special order */ - { US"version", &tls_cert_version }, - { US"serial_number", &tls_cert_serial_number }, - { US"subject", &tls_cert_subject }, - { US"notbefore", &tls_cert_not_before }, - { US"notafter", &tls_cert_not_after }, - { US"issuer", &tls_cert_issuer }, - { US"signature", &tls_cert_signature }, - { US"signature_algorithm", &tls_cert_signature_algorithm }, - { US"subject_altname", &tls_cert_subject_altname }, - { US"ocsp_uri", &tls_cert_ocsp_uri }, - { US"crl_uri", &tls_cert_crl_uri }, + { US"version", 7, &tls_cert_version }, + { US"serial_number", 13, &tls_cert_serial_number }, + { US"subject", 7, &tls_cert_subject }, + { US"notbefore", 9, &tls_cert_not_before }, + { US"notafter", 8, &tls_cert_not_after }, + { US"issuer", 6, &tls_cert_issuer }, + { US"signature", 9, &tls_cert_signature }, + { US"sig_algorithm", 13, &tls_cert_signature_algorithm }, + { US"subj_altname", 12, &tls_cert_subject_altname }, + { US"ocsp_uri", 8, &tls_cert_ocsp_uri }, + { US"crl_uri", 7, &tls_cert_crl_uri }, }; static uschar * @@ -1236,8 +1238,12 @@ if (*field >= '0' && *field <= '9') for(cp = certfields; cp < certfields + nelements(certfields); cp++) - if (Ustrcmp(cp->name, field) == 0) - return (*cp->getfn)( *(void **)vp->value ); + if (Ustrncmp(cp->name, field, cp->namelen) == 0) + { + uschar * modifier = *(field += cp->namelen) == ',' + ? ++field : NULL; + return (*cp->getfn)( *(void **)vp->value, modifier ); + } expand_string_message = string_sprintf("bad field selector \"%s\" for certextract", field); @@ -7007,7 +7013,6 @@ return 0; #endif -/* - vi: aw ai sw=2 +/* vi: aw ai sw=2 */ /* End of expand.c */ diff --git a/src/src/functions.h b/src/src/functions.h index 8751a006e..566a32bd6 100644 --- a/src/src/functions.h +++ b/src/src/functions.h @@ -26,18 +26,18 @@ extern const char * extern const char * std_dh_prime_named(const uschar *); -extern uschar * tls_cert_crl_uri(void *); +extern uschar * tls_cert_crl_uri(void *, uschar * mod); extern uschar * tls_cert_ext_by_oid(void *, uschar *, int); -extern uschar * tls_cert_issuer(void *); -extern uschar * tls_cert_not_before(void *); -extern uschar * tls_cert_not_after(void *); -extern uschar * tls_cert_ocsp_uri(void *); -extern uschar * tls_cert_serial_number(void *); -extern uschar * tls_cert_signature(void *); -extern uschar * tls_cert_signature_algorithm(void *); -extern uschar * tls_cert_subject(void *); -extern uschar * tls_cert_subject_altname(void *); -extern uschar * tls_cert_version(void *); +extern uschar * tls_cert_issuer(void *, uschar * mod); +extern uschar * tls_cert_not_before(void *, uschar * mod); +extern uschar * tls_cert_not_after(void *, uschar * mod); +extern uschar * tls_cert_ocsp_uri(void *, uschar * mod); +extern uschar * tls_cert_serial_number(void *, uschar * mod); +extern uschar * tls_cert_signature(void *, uschar * mod); +extern uschar * tls_cert_signature_algorithm(void *, uschar * mod); +extern uschar * tls_cert_subject(void *, uschar * mod); +extern uschar * tls_cert_subject_altname(void *, uschar * mod); +extern uschar * tls_cert_version(void *, uschar * mod); extern int tls_client_start(int, host_item *, address_item *, uschar *, uschar *, uschar *, uschar *, uschar *, uschar *, diff --git a/src/src/tlscert-gnu.c b/src/src/tlscert-gnu.c index 649e93a35..61b526a69 100644 --- a/src/src/tlscert-gnu.c +++ b/src/src/tlscert-gnu.c @@ -86,7 +86,7 @@ return len > 0 ? cp : NULL; /**/ uschar * -tls_cert_issuer(void * cert) +tls_cert_issuer(void * cert, uschar * mod) { uschar txt[256]; size_t sz = sizeof(txt); @@ -95,21 +95,21 @@ return ( gnutls_x509_crt_get_issuer_dn(cert, CS txt, &sz) == 0 ) } uschar * -tls_cert_not_after(void * cert) +tls_cert_not_after(void * cert, uschar * mod) { return time_copy( gnutls_x509_crt_get_expiration_time((gnutls_x509_crt_t)cert)); } uschar * -tls_cert_not_before(void * cert) +tls_cert_not_before(void * cert, uschar * mod) { return time_copy( gnutls_x509_crt_get_activation_time((gnutls_x509_crt_t)cert)); } uschar * -tls_cert_serial_number(void * cert) +tls_cert_serial_number(void * cert, uschar * mod) { uschar bin[50], txt[150]; size_t sz = sizeof(bin); @@ -126,7 +126,7 @@ return string_copy(sp); } uschar * -tls_cert_signature(void * cert) +tls_cert_signature(void * cert, uschar * mod) { uschar * cp1; uschar * cp2; @@ -157,7 +157,7 @@ return cp2; } uschar * -tls_cert_signature_algorithm(void * cert) +tls_cert_signature_algorithm(void * cert, uschar * mod) { gnutls_sign_algorithm_t algo = gnutls_x509_crt_get_signature_algorithm((gnutls_x509_crt_t)cert); @@ -165,7 +165,7 @@ return algo < 0 ? NULL : string_copy(gnutls_sign_get_name(algo)); } uschar * -tls_cert_subject(void * cert) +tls_cert_subject(void * cert, uschar * mod) { static uschar txt[256]; size_t sz = sizeof(txt); @@ -174,7 +174,7 @@ return ( gnutls_x509_crt_get_dn(cert, CS txt, &sz) == 0 ) } uschar * -tls_cert_version(void * cert) +tls_cert_version(void * cert, uschar * mod) { return string_sprintf("%d", gnutls_x509_crt_get_version(cert)); } @@ -218,60 +218,106 @@ return cp2; } uschar * -tls_cert_subject_altname(void * cert) +tls_cert_subject_altname(void * cert, uschar * mod) { -uschar * cp = NULL; -size_t siz = 0; -unsigned int crit; +uschar * list = NULL; +int index; +size_t siz; int ret; +uschar sep = '\n'; +uschar * tag = US""; +uschar * ele; +int match = -1; -ret = gnutls_x509_crt_get_subject_alt_name ((gnutls_x509_crt_t)cert, - 0, cp, &siz, &crit); -switch(ret) +while (mod) { - case GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE: - return NULL; - case GNUTLS_E_SHORT_MEMORY_BUFFER: + if (*mod == '>' && *++mod) sep = *mod++; + else if (Ustrcmp(mod, "dns")==0) { match = GNUTLS_SAN_DNSNAME; mod += 3; } + else if (Ustrcmp(mod, "uri")==0) { match = GNUTLS_SAN_URI; mod += 3; } + else if (Ustrcmp(mod, "mail")==0) { match = GNUTLS_SAN_RFC822NAME; mod += 4; } + else continue; + + if (*mod++ != ',') break; - default: - expand_string_message = - string_sprintf("%s: gs0 fail: %d %s\n", __FUNCTION__, - ret, gnutls_strerror(ret)); - return NULL; } -cp = store_get(siz+1); -ret = gnutls_x509_crt_get_subject_alt_name ((gnutls_x509_crt_t)cert, - 0, cp, &siz, &crit); -if (ret < 0) +for(index = 0;; index++) { - expand_string_message = - string_sprintf("%s: gs1 fail: %d %s\n", __FUNCTION__, - ret, gnutls_strerror(ret)); - return NULL; + siz = 0; + switch(ret = gnutls_x509_crt_get_subject_alt_name( + (gnutls_x509_crt_t)cert, index, NULL, &siz, NULL)) + { + case GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE: + return list; /* no more elements; normal exit */ + + case GNUTLS_E_SHORT_MEMORY_BUFFER: + break; + + default: + expand_string_message = + string_sprintf("%s: gs0 fail: %d %s\n", __FUNCTION__, + ret, gnutls_strerror(ret)); + return NULL; + } + + ele = store_get(siz+1); + if ((ret = gnutls_x509_crt_get_subject_alt_name( + (gnutls_x509_crt_t)cert, index, ele, &siz, NULL)) < 0) + { + expand_string_message = + string_sprintf("%s: gs1 fail: %d %s\n", __FUNCTION__, + ret, gnutls_strerror(ret)); + return NULL; + } + ele[siz] = '\0'; + + if (match != -1 && match != ret) + continue; + switch (ret) + { + case GNUTLS_SAN_DNSNAME: tag = US"DNS"; break; + case GNUTLS_SAN_URI: tag = US"URI"; break; + case GNUTLS_SAN_RFC822NAME: tag = US"MAIL"; break; + default: continue; /* ignore unrecognised types */ + } + list = string_append_listele(list, sep, + match == -1 ? string_sprintf("%s=%s", tag, ele) : ele); } -cp[siz] = '\0'; -return cp; +/*NOTREACHED*/ } uschar * -tls_cert_ocsp_uri(void * cert) +tls_cert_ocsp_uri(void * cert, uschar * mod) { #if GNUTLS_VERSION_NUMBER >= 0x030000 gnutls_datum_t uri; -unsigned int crit; -int ret = gnutls_x509_crt_get_authority_info_access((gnutls_x509_crt_t)cert, - 0, GNUTLS_IA_OCSP_URI, &uri, &crit); +int ret; +uschar sep = '\n'; +int index; +uschar * list = NULL; + +if (mod) + if (*mod == '>' && *++mod) sep = *mod++; -if (ret >= 0) - return string_copyn(uri.data, uri.size); +for(index = 0;; index++) + { + ret = gnutls_x509_crt_get_authority_info_access((gnutls_x509_crt_t)cert, + index, GNUTLS_IA_OCSP_URI, &uri, NULL); -if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) - expand_string_message = - string_sprintf("%s: gai fail: %d %s\n", __FUNCTION__, - ret, gnutls_strerror(ret)); + if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) + return list; + if (ret < 0) + { + expand_string_message = + string_sprintf("%s: gai fail: %d %s\n", __FUNCTION__, + ret, gnutls_strerror(ret)); + return NULL; + } -return NULL; + list = string_append_listele(list, sep, + string_copyn(uri.data, uri.size)); + } +/*NOTREACHED*/ #else @@ -284,39 +330,48 @@ return NULL; } uschar * -tls_cert_crl_uri(void * cert) +tls_cert_crl_uri(void * cert, uschar * mod) { int ret; -uschar * cp = NULL; -size_t siz = 0; +size_t siz; +uschar sep = '\n'; +int index; +uschar * list = NULL; +uschar * ele; + +if (mod) + if (*mod == '>' && *++mod) sep = *mod++; -ret = gnutls_x509_crt_get_crl_dist_points ((gnutls_x509_crt_t)cert, - 0, cp, &siz, NULL, NULL); -switch(ret) +for(index = 0;; index++) { - case GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE: - return NULL; - case GNUTLS_E_SHORT_MEMORY_BUFFER: - break; - default: + siz = 0; + switch(ret = gnutls_x509_crt_get_crl_dist_points( + (gnutls_x509_crt_t)cert, index, NULL, &siz, NULL, NULL)) + { + case GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE: + return list; + case GNUTLS_E_SHORT_MEMORY_BUFFER: + break; + default: + expand_string_message = + string_sprintf("%s: gc0 fail: %d %s\n", __FUNCTION__, + ret, gnutls_strerror(ret)); + return NULL; + } + + ele = store_get(siz+1); + if ((ret = gnutls_x509_crt_get_crl_dist_points( + (gnutls_x509_crt_t)cert, index, ele, &siz, NULL, NULL)) < 0) + { expand_string_message = - string_sprintf("%s: gc0 fail: %d %s\n", __FUNCTION__, + string_sprintf("%s: gc1 fail: %d %s\n", __FUNCTION__, ret, gnutls_strerror(ret)); return NULL; + } + ele[siz] = '\0'; + list = string_append_listele(list, sep, ele); } - -cp = store_get(siz+1); -ret = gnutls_x509_crt_get_crl_dist_points ((gnutls_x509_crt_t)cert, - 0, cp, &siz, NULL, NULL); -if (ret < 0) - { - expand_string_message = - string_sprintf("%s: gs1 fail: %d %s\n", __FUNCTION__, - ret, gnutls_strerror(ret)); - return NULL; - } -cp[siz] = '\0'; -return cp; +/*NOTREACHED*/ } diff --git a/src/src/tlscert-openssl.c b/src/src/tlscert-openssl.c index 20ecbbc6c..53945a1e0 100644 --- a/src/src/tlscert-openssl.c +++ b/src/src/tlscert-openssl.c @@ -109,25 +109,25 @@ return bio_string_copy(bp, len_good); /**/ uschar * -tls_cert_issuer(void * cert) +tls_cert_issuer(void * cert, uschar * mod) { return x509_name_copy(X509_get_issuer_name((X509 *)cert)); } uschar * -tls_cert_not_before(void * cert) +tls_cert_not_before(void * cert, uschar * mod) { return asn1_time_copy(X509_get_notBefore((X509 *)cert)); } uschar * -tls_cert_not_after(void * cert) +tls_cert_not_after(void * cert, uschar * mod) { return asn1_time_copy(X509_get_notAfter((X509 *)cert)); } uschar * -tls_cert_serial_number(void * cert) +tls_cert_serial_number(void * cert, uschar * mod) { uschar txt[256]; BIO * bp = BIO_new(BIO_s_mem()); @@ -142,7 +142,7 @@ return string_copynlc(txt, len); /* lowercase */ } uschar * -tls_cert_signature(void * cert) +tls_cert_signature(void * cert, uschar * mod) { BIO * bp = BIO_new(BIO_s_mem()); uschar * cp = NULL; @@ -162,19 +162,19 @@ return cp; } uschar * -tls_cert_signature_algorithm(void * cert) +tls_cert_signature_algorithm(void * cert, uschar * mod) { return string_copy(OBJ_nid2ln(X509_get_signature_type((X509 *)cert))); } uschar * -tls_cert_subject(void * cert) +tls_cert_subject(void * cert, uschar * mod) { return x509_name_copy(X509_get_subject_name((X509 *)cert)); } uschar * -tls_cert_version(void * cert) +tls_cert_version(void * cert, uschar * mod) { return string_sprintf("%d", X509_get_version((X509 *)cert)); } @@ -211,58 +211,86 @@ return cp3; } uschar * -tls_cert_subject_altname(void * cert) +tls_cert_subject_altname(void * cert, uschar * mod) { -uschar * cp; +uschar * list = NULL; STACK_OF(GENERAL_NAME) * san = (STACK_OF(GENERAL_NAME) *) X509_get_ext_d2i((X509 *)cert, NID_subject_alt_name, NULL, NULL); +uschar sep = '\n'; +uschar * tag = US""; +uschar * ele; +int match = -1; if (!san) return NULL; +while (mod) + { + if (*mod == '>' && *++mod) sep = *mod++; + else if (Ustrcmp(mod, "dns")==0) { match = GEN_DNS; mod += 3; } + else if (Ustrcmp(mod, "uri")==0) { match = GEN_URI; mod += 3; } + else if (Ustrcmp(mod, "mail")==0) { match = GEN_EMAIL; mod += 4; } + else continue; + + if (*mod++ != ',') + break; + } + while (sk_GENERAL_NAME_num(san) > 0) { GENERAL_NAME * namePart = sk_GENERAL_NAME_pop(san); + if (match != -1 && match != namePart->type) + continue; switch (namePart->type) { + case GEN_DNS: + tag = US"DNS"; + ele = ASN1_STRING_data(namePart->d.dNSName); + break; case GEN_URI: - cp = string_sprintf("URI=%s", - ASN1_STRING_data(namePart->d.uniformResourceIdentifier)); - return cp; + tag = US"URI"; + ele = ASN1_STRING_data(namePart->d.uniformResourceIdentifier); + break; case GEN_EMAIL: - cp = string_sprintf("email=%s", - ASN1_STRING_data(namePart->d.rfc822Name)); - return cp; + tag = US"MAIL"; + ele = ASN1_STRING_data(namePart->d.rfc822Name); + break; default: - cp = string_sprintf("Unrecognisable"); - return cp; + continue; /* ignore unrecognised types */ } + list = string_append_listele(list, sep, + match == -1 ? string_sprintf("%s=%s", tag, ele) : ele); } -/* sk_GENERAL_NAME_pop_free(gen_names, GENERAL_NAME_free); ??? */ -return cp; +sk_GENERAL_NAME_free(san); +return list; } uschar * -tls_cert_ocsp_uri(void * cert) +tls_cert_ocsp_uri(void * cert, uschar * mod) { STACK_OF(ACCESS_DESCRIPTION) * ads = (STACK_OF(ACCESS_DESCRIPTION) *) X509_get_ext_d2i((X509 *)cert, NID_info_access, NULL, NULL); int adsnum = sk_ACCESS_DESCRIPTION_num(ads); int i; +uschar sep = '\n'; +uschar * list = NULL; + +if (mod) + if (*mod == '>' && *++mod) sep = *mod++; for (i = 0; i < adsnum; i++) { ACCESS_DESCRIPTION * ad = sk_ACCESS_DESCRIPTION_value(ads, i); if (ad && OBJ_obj2nid(ad->method) == NID_ad_OCSP) - return string_copy( ASN1_STRING_data(ad->location->d.ia5) ); + list = string_append_listele(list, sep, + ASN1_STRING_data(ad->location->d.ia5)); } - -return NULL; +return list; } uschar * -tls_cert_crl_uri(void * cert) +tls_cert_crl_uri(void * cert, uschar * mod) { STACK_OF(DIST_POINT) * dps = (STACK_OF(DIST_POINT) *) X509_get_ext_d2i((X509 *)cert, NID_crl_distribution_points, @@ -270,6 +298,11 @@ STACK_OF(DIST_POINT) * dps = (STACK_OF(DIST_POINT) *) DIST_POINT * dp; int dpsnum = sk_DIST_POINT_num(dps); int i; +uschar sep = '\n'; +uschar * list = NULL; + +if (mod) + if (*mod == '>' && *++mod) sep = *mod++; if (dps) for (i = 0; i < dpsnum; i++) if ((dp = sk_DIST_POINT_value(dps, i))) @@ -283,10 +316,10 @@ if (dps) for (i = 0; i < dpsnum; i++) if ( (np = sk_GENERAL_NAME_value(names, j)) && np->type == GEN_URI ) - return string_copy(ASN1_STRING_data( - np->d.uniformResourceIdentifier)); + list = string_append_listele(list, sep, + ASN1_STRING_data(np->d.uniformResourceIdentifier)); } -return NULL; +return list; } /* vi: aw ai sw=2 -- cgit v1.2.3