generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add new ctrl to retrieve client certificate types, print out

Browse Source 
details in s_client.

Also add ctrl to set client certificate types. If not used sensible values
will be included based on supported signature algorithms: for example if
we don't include any DSA signing algorithms the DSA certificate type is
omitted.

Fix restriction in old code where certificate types would be truncated
if it exceeded TLS_CT_NUMBER.
(backport from HEAD)
This commit is contained in:
Dr. Stephen Henson
2012-12-26 14:51:37 +00:00
parent 8546add692
commit a897502cd9
10 changed files with 238 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
ssl/s3_clnt.c
View File

@@ -1937,11 +1937,22 @@ int ssl3_get_certificate_request(SSL *s)
/* get the certificate types */
ctype_num= *(p++);
if (s->cert->ctypes)
{
OPENSSL_free(s->cert->ctypes);
s->cert->ctypes = NULL;
}
if (ctype_num > SSL3_CT_NUMBER)
{
/* If we exceed static buffer copy all to cert structure */
s->cert->ctypes = OPENSSL_malloc(ctype_num);
memcpy(s->cert->ctypes, p, ctype_num);
s->cert->ctype_num = (size_t)ctype_num;
ctype_num=SSL3_CT_NUMBER;
}
for (i=0; i<ctype_num; i++)
s->s3->tmp.ctype[i]= p[i];
p+=ctype_num;
p+=p[-1];
if (TLS1_get_version(s) >= TLS1_2_VERSION)
{
n2s(p, llen);

122
ssl/s3_lib.c
View File

@@ -3089,6 +3089,8 @@ static char * MS_CALLBACK srp_password_from_info_cb(SSL *s, void *arg)
}
#endif
static int ssl3_set_req_cert_type(CERT *c, const unsigned char *p, size_t len);
long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
{
int ret=0;
@@ -3426,6 +3428,27 @@ long ssl3_ctrl(SSL *s, int cmd, long larg, void *parg)
case SSL_CTRL_SET_CLIENT_SIGALGS_LIST:
return tls1_set_sigalgs_list(s->cert, parg, 1);
case SSL_CTRL_GET_CLIENT_CERT_TYPES:
{
const unsigned char **pctype = parg;
if (s->server || !s->s3->tmp.cert_req)
return 0;
if (s->cert->ctypes)
{
if (pctype)
*pctype = s->cert->ctypes;
return (int)s->cert->ctype_num;
}
if (pctype)
*pctype = (unsigned char *)s->s3->tmp.ctype;
return s->s3->tmp.ctype_num;
}
case SSL_CTRL_SET_CLIENT_CERT_TYPES:
if (!s->server)
return 0;
return ssl3_set_req_cert_type(s->cert, parg, larg);
default:
break;
}
@@ -3715,6 +3738,9 @@ long ssl3_ctx_ctrl(SSL_CTX *ctx, int cmd, long larg, void *parg)
case SSL_CTRL_SET_CLIENT_SIGALGS_LIST:
return tls1_set_sigalgs_list(ctx->cert, parg, 1);
case SSL_CTRL_SET_CLIENT_CERT_TYPES:
return ssl3_set_req_cert_type(ctx->cert, parg, larg);
case SSL_CTRL_SET_TLSEXT_AUTHZ_SERVER_AUDIT_PROOF_CB_ARG:
ctx->tlsext_authz_server_audit_proof_cb_arg = parg;
break;
@@ -4004,8 +4030,61 @@ SSL_CIPHER *ssl3_choose_cipher(SSL *s, STACK_OF(SSL_CIPHER) *clnt,
int ssl3_get_req_cert_type(SSL *s, unsigned char *p)
{
int ret=0;
const unsigned char *sig;
size_t siglen;
int have_rsa_sign = 0, have_dsa_sign = 0, have_ecdsa_sign = 0;
int nostrict = 1;
unsigned long alg_k;
/* If we have custom certificate types set, use them */
if (s->cert->ctypes)
{
memcpy(p, s->cert->ctypes, s->cert->ctype_num);
return (int)s->cert->ctype_num;
}
/* Else see if we have any signature algorithms configured */
if (s->cert->client_sigalgs)
{
sig = s->cert->client_sigalgs;
siglen = s->cert->client_sigalgslen;
}
else
{
sig = s->cert->conf_sigalgs;
siglen = s->cert->conf_sigalgslen;
}
/* If we have sigalgs work out if we can sign with RSA, DSA, ECDSA */
if (sig)
{
size_t i;
if (s->cert->cert_flags & SSL_CERT_FLAG_TLS_STRICT)
nostrict = 0;
for (i = 0; i < siglen; i+=2, sig+=2)
{
switch(sig[1])
{
case TLSEXT_signature_rsa:
have_rsa_sign = 1;
break;
case TLSEXT_signature_dsa:
have_dsa_sign = 1;
break;
case TLSEXT_signature_ecdsa:
have_ecdsa_sign = 1;
break;
}
}
}
/* Otherwise allow anything */
else
{
have_rsa_sign = 1;
have_dsa_sign = 1;
have_ecdsa_sign = 1;
}
alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
#ifndef OPENSSL_NO_GOST
@@ -4024,10 +4103,15 @@ int ssl3_get_req_cert_type(SSL *s, unsigned char *p)
if (alg_k & (SSL_kDHr|SSL_kEDH))
{
# ifndef OPENSSL_NO_RSA
p[ret++]=SSL3_CT_RSA_FIXED_DH;
/* Since this refers to a certificate signed with an RSA
* algorithm, only check for rsa signing in strict mode.
*/
if (nostrict || have_rsa_sign)
p[ret++]=SSL3_CT_RSA_FIXED_DH;
# endif
# ifndef OPENSSL_NO_DSA
p[ret++]=SSL3_CT_DSS_FIXED_DH;
if (nostrict || have_dsa_sign)
p[ret++]=SSL3_CT_DSS_FIXED_DH;
# endif
}
if ((s->version == SSL3_VERSION) &&
@@ -4042,16 +4126,20 @@ int ssl3_get_req_cert_type(SSL *s, unsigned char *p)
}
#endif /* !OPENSSL_NO_DH */
#ifndef OPENSSL_NO_RSA
p[ret++]=SSL3_CT_RSA_SIGN;
if (have_rsa_sign)
p[ret++]=SSL3_CT_RSA_SIGN;
#endif
#ifndef OPENSSL_NO_DSA
p[ret++]=SSL3_CT_DSS_SIGN;
if (have_dsa_sign)
p[ret++]=SSL3_CT_DSS_SIGN;
#endif
#ifndef OPENSSL_NO_ECDH
if ((alg_k & (SSL_kECDHr|SSL_kECDHe)) && (s->version >= TLS1_VERSION))
{
p[ret++]=TLS_CT_RSA_FIXED_ECDH;
p[ret++]=TLS_CT_ECDSA_FIXED_ECDH;
if (nostrict || have_rsa_sign)
p[ret++]=TLS_CT_RSA_FIXED_ECDH;
if (nostrict || have_ecdsa_sign)
p[ret++]=TLS_CT_ECDSA_FIXED_ECDH;
}
#endif
@@ -4061,12 +4149,32 @@ int ssl3_get_req_cert_type(SSL *s, unsigned char *p)
*/
if (s->version >= TLS1_VERSION)
{
p[ret++]=TLS_CT_ECDSA_SIGN;
if (have_ecdsa_sign)
p[ret++]=TLS_CT_ECDSA_SIGN;
}
#endif
return(ret);
}
static int ssl3_set_req_cert_type(CERT *c, const unsigned char *p, size_t len)
{
if (c->ctypes)
{
OPENSSL_free(c->ctypes);
c->ctypes = NULL;
}
if (!p || !len)
return 1;
if (len > 0xff)
return 0;
c->ctypes = OPENSSL_malloc(len);
if (!c->ctypes)
return 0;
memcpy(c->ctypes, p, len);
c->ctype_num = len;
return 1;
}
int ssl3_shutdown(SSL *s)
{
int ret;

10
ssl/ssl.h
View File

@@ -1655,6 +1655,8 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
#define SSL_CTRL_CLEAR_CERT_FLAGS 100
#define SSL_CTRL_SET_CLIENT_SIGALGS 101
#define SSL_CTRL_SET_CLIENT_SIGALGS_LIST 102
#define SSL_CTRL_GET_CLIENT_CERT_TYPES 103
#define SSL_CTRL_SET_CLIENT_CERT_TYPES 104
#define DTLSv1_get_timeout(ssl, arg) \
SSL_ctrl(ssl,DTLS_CTRL_GET_TIMEOUT,0, (void *)arg)
@@ -1749,6 +1751,14 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
#define SSL_set1_client_sigalgs_list(ctx, s) \
SSL_ctrl(ctx,SSL_CTRL_SET_CLIENT_SIGALGS_LIST,0,(char *)s)
#define SSL_get0_certificate_types(s, clist) \
SSL_ctrl(s, SSL_CTRL_GET_CLIENT_CERT_TYPES, 0, (char *)clist)
#define SSL_CTX_set1_client_certificate_types(ctx, clist, clistlen) \
SSL_CTX_ctrl(ctx,SSL_CTRL_SET_CLIENT_CERT_TYPES,clistlen,(char *)clist)
#define SSL_set1_client_certificate_types(s, clist, clistlen) \
SSL_ctrl(s,SSL_CTRL_SET_CLIENT_CERT_TYPES,clistlen,(char *)clist)
#ifndef OPENSSL_NO_BIO
BIO_METHOD *BIO_f_ssl(void);
BIO *BIO_new_ssl(SSL_CTX *ctx,int client);

11
ssl/ssl_cert.c
View File

@@ -388,6 +388,15 @@ CERT *ssl_cert_dup(CERT *cert)
ret->client_sigalgs = NULL;
/* Shared sigalgs also NULL */
ret->shared_sigalgs = NULL;
/* Copy any custom client certificate types */
if (cert->ctypes)
{
ret->ctypes = OPENSSL_malloc(cert->ctype_num);
if (!ret->ctypes)
goto err;
memcpy(ret->ctypes, cert->ctypes, cert->ctype_num);
ret->ctype_num = cert->ctype_num;
}
ret->cert_flags = cert->cert_flags;
@@ -489,6 +498,8 @@ void ssl_cert_free(CERT *c)
OPENSSL_free(c->client_sigalgs);
if (c->shared_sigalgs)
OPENSSL_free(c->shared_sigalgs);
if (c->ctypes)
OPENSSL_free(c->ctypes);
OPENSSL_free(c);
}

7
ssl/ssl_locl.h
View File

@@ -533,6 +533,13 @@ typedef struct cert_st
unsigned int cert_flags;
CERT_PKEY pkeys[SSL_PKEY_NUM];
/* Certificate types (received or sent) in certificate request
* message. On receive this is only set if number of certificate
* types exceeds SSL3_CT_NUMBER.
*/
unsigned char *ctypes;
size_t ctype_num;
/* signature algorithms peer reports: e.g. supported signature
* algorithms extension for server or as part of a certificate
* request for client.