Skip to content

GitLab

Commit 6b99b3dc authored by venaas's avatar venaas Committed by venaas
Browse files

added certificatenamecheck option to client/server for disabling default altsubjectname/cn check 

git-svn-id: https://svn.testnett.uninett.no/radsecproxy/trunk@245 e88ac4ed-0b26-0410-9574-a7f39faa03bf
parent b4644fb5
Hide whitespace changes
Inline Side-by-side
gconfig.c
View file @ 6b99b3dc
......@@ -153,6 +153,7 @@ void getgenericconfig(struct gconffile **cf, char *block, ...) {
char line[1024];
/* initialise lots of stuff to avoid stupid compiler warnings */
char *tokens[3], *s, *opt = NULL, *val = NULL, *word, *optval, **str = NULL, ***mstr = NULL;
uint8_t *bln;
int type = 0, tcount, conftype = 0, n;
void (*cbk)(struct gconffile **, char *, char *, char *) = NULL;
......@@ -230,6 +231,11 @@ void getgenericconfig(struct gconffile **cf, char *block, ...) {
if (!mstr)
debugx(1, DBG_ERR, "getgenericconfig: internal parameter error");
break;
case CONF_BLN:
bln = va_arg(ap, uint8_t *);
if (!bln)
debugx(1, DBG_ERR, "getgenericconfig: internal parameter error");
break;
case CONF_CBK:
cbk = va_arg(ap, void (*)(struct gconffile **, char *, char *, char *));
break;
......@@ -247,7 +253,7 @@ void getgenericconfig(struct gconffile **cf, char *block, ...) {
debugx(1, DBG_ERR, "configuration error, unknown option %s", opt);
}
if (((type == CONF_STR || type == CONF_MSTR) && conftype != CONF_STR) ||
if (((type == CONF_STR || type == CONF_MSTR || type == CONF_BLN) && conftype != CONF_STR) ||
(type == CONF_CBK && conftype != CONF_CBK)) {
if (block)
debugx(1, DBG_ERR, "configuration error in block %s, wrong syntax for option %s", block, opt);
......@@ -256,10 +262,6 @@ void getgenericconfig(struct gconffile **cf, char *block, ...) {
switch (type) {
case CONF_STR:
if (block)
debug(DBG_DBG, "getgenericconfig: block %s: %s = %s", block, opt, val);
else
debug(DBG_DBG, "getgenericconfig: %s = %s", opt, val);
if (*str)
debugx(1, DBG_ERR, "configuration error, option %s already set to %s", opt, *str);
*str = stringcopy(val, 0);
......@@ -267,10 +269,6 @@ void getgenericconfig(struct gconffile **cf, char *block, ...) {
debugx(1, DBG_ERR, "malloc failed");
break;
case CONF_MSTR:
if (block)
debug(DBG_DBG, "getgenericconfig: block %s: %s = %s", block, opt, val);
else
debug(DBG_DBG, "getgenericconfig: %s = %s", opt, val);
if (*mstr)
for (n = 0; (*mstr)[n]; n++);
else
......@@ -281,6 +279,16 @@ void getgenericconfig(struct gconffile **cf, char *block, ...) {
(*mstr)[n] = stringcopy(val, 0);
(*mstr)[n + 1] = NULL;
break;
case CONF_BLN:
if (!strcasecmp(val, "on"))
*bln = 1;
else if (!strcasecmp(val, "off"))
*bln = 0;
else if (block)
debugx(1, DBG_ERR, "configuration error in block %s, value for option %s must be on or off, not %s", block, opt, val);
else
debugx(1, DBG_ERR, "configuration error, value for option %s must be on or off, not %s", opt, val);
break;
case CONF_CBK:
optval = malloc(strlen(opt) + strlen(val) + 2);
if (!optval)
......@@ -288,9 +296,13 @@ void getgenericconfig(struct gconffile **cf, char *block, ...) {
sprintf(optval, "%s %s", opt, val);
cbk(cf, optval, opt, val);
free(optval);
break;
continue;
default:
debugx(1, DBG_ERR, "getgenericconfig: internal parameter error");
}
if (block)
debug(DBG_DBG, "getgenericconfig: block %s: %s = %s", block, opt, val);
else
debug(DBG_DBG, "getgenericconfig: %s = %s", opt, val);
}
}
gconfig.h
View file @ 6b99b3dc
#define CONF_STR 1
#define CONF_CBK 2
#define CONF_MSTR 3
#define CONF_BLN 4
struct gconffile {
char *path;
......
radsecproxy.c
View file @ 6b99b3dc
......@@ -766,7 +766,7 @@ int verifyconfcert(X509 *cert, struct clsrvconf *conf) {
uint8_t type = 0; /* 0 for DNS, AF_INET for IPv4, AF_INET6 for IPv6 */
struct in6_addr addr;
if (conf->prefixlen == 255) {
if (conf->certnamecheck && conf->prefixlen == 255) {
if (inet_pton(AF_INET, conf->host, &addr))
type = AF_INET;
else if (inet_pton(AF_INET6, conf->host, &addr))
......@@ -2960,6 +2960,7 @@ void confclient_cb(struct gconffile **cf, char *block, char *opt, char *val) {
if (!conf || !list_push(clconfs, conf))
debugx(1, DBG_ERR, "malloc failed");
memset(conf, 0, sizeof(struct clsrvconf));
conf->certnamecheck = 1;
getgenericconfig(cf, block,
"type", CONF_STR, &type,
......@@ -2967,6 +2968,7 @@ void confclient_cb(struct gconffile **cf, char *block, char *opt, char *val) {
"secret", CONF_STR, &conf->secret,
"tls", CONF_STR, &tls,
"matchcertificateattribute", CONF_STR, &matchcertattr,
"CertificateNameCheck", CONF_BLN, &conf->certnamecheck,
"rewrite", CONF_STR, &rewrite,
"rewriteattribute", CONF_STR, &rewriteattr,
NULL
......@@ -3014,7 +3016,7 @@ void confclient_cb(struct gconffile **cf, char *block, char *opt, char *val) {
}
void confserver_cb(struct gconffile **cf, char *block, char *opt, char *val) {
char *type = NULL, *tls = NULL, *matchcertattr = NULL, *statusserver = NULL, *rewrite = NULL;
char *type = NULL, *tls = NULL, *matchcertattr = NULL, *rewrite = NULL;
struct clsrvconf *conf;
debug(DBG_DBG, "confserver_cb called for %s", block);
......@@ -3023,6 +3025,7 @@ void confserver_cb(struct gconffile **cf, char *block, char *opt, char *val) {
if (!conf || !list_push(srvconfs, conf))
debugx(1, DBG_ERR, "malloc failed");
memset(conf, 0, sizeof(struct clsrvconf));
conf->certnamecheck = 1;
getgenericconfig(cf, block,
"type", CONF_STR, &type,
......@@ -3030,9 +3033,10 @@ void confserver_cb(struct gconffile **cf, char *block, char *opt, char *val) {
"port", CONF_STR, &conf->port,
"secret", CONF_STR, &conf->secret,
"tls", CONF_STR, &tls,
"matchcertificateattribute", CONF_STR, &matchcertattr,
"MatchCertificateAttribute", CONF_STR, &matchcertattr,
"rewrite", CONF_STR, &rewrite,
"StatusServer", CONF_STR, &statusserver,
"StatusServer", CONF_BLN, &conf->statusserver,
"CertificateNameCheck", CONF_BLN, &conf->certnamecheck,
NULL
);
......@@ -3073,14 +3077,6 @@ void confserver_cb(struct gconffile **cf, char *block, char *opt, char *val) {
debugx(1, DBG_ERR, "error in block %s, secret must be specified for UDP", block);
conf->secret = stringcopy(DEFAULT_TLS_SECRET, 0);
}
if (statusserver) {
if (!strcasecmp(statusserver, "on"))
conf->statusserver = 1;
else if (strcasecmp(statusserver, "off"))
debugx(1, DBG_ERR, "error in block %s, StatusServer is %s, must be on or off", block, statusserver);
free(statusserver);
}
}
void confrealm_cb(struct gconffile **cf, char *block, char *opt, char *val) {
......
radsecproxy.h
View file @ 6b99b3dc
......@@ -84,6 +84,7 @@ struct clsrvconf {
regex_t *rewriteattrregex;
char *rewriteattrreplacement;
uint8_t statusserver;
uint8_t certnamecheck;
SSL_CTX *ssl_ctx;
struct rewrite *rewrite;
struct addrinfo *addrinfo;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment