[Libdexter-commits] SF.net SVN: libdexter: [373] libdexter/trunk
Brought to you by:
pkovacs
Menu
▾
▴
[Libdexter-commits] SF.net SVN: libdexter: [373] libdexter/trunk
|
From: <pk...@us...> - 2007-06-11 06:21:17
|
Revision: 373
http://svn.sourceforge.net/libdexter/?rev=373&view=rev
Author: pkovacs
Date: 2007-06-10 23:21:15 -0700 (Sun, 10 Jun 2007)
Log Message:
-----------
Committing intermediate work on TLS.
Modified Paths:
--------------
libdexter/trunk/ChangeLog
libdexter/trunk/TODO
libdexter/trunk/dexter/dexter-channel-internal.h
libdexter/trunk/dexter/dexter-channel.c
libdexter/trunk/dexter/dexter-channel.h
libdexter/trunk/dexter/dexter-network.c
libdexter/trunk/dexter/dexter-network.h
libdexter/trunk/dexter/dexter-server.c
libdexter/trunk/dexter/dexter-server.h
libdexter/trunk/dexter/dexter-servercomm.c
libdexter/trunk/dexter/dexter-servercomm.h
libdexter/trunk/dexter/dexter-tls-gnutls.c
libdexter/trunk/dexter/dexter-tls.h
libdexter/trunk/docs/reference/dexter/config-example.sgml
libdexter/trunk/docs/reference/dexter/config-structure.sgml
libdexter/trunk/docs/reference/dexter/tmpl/dexter-channel.sgml
libdexter/trunk/docs/reference/dexter/tmpl/dexter-server.sgml
Modified: libdexter/trunk/ChangeLog
===================================================================
--- libdexter/trunk/ChangeLog 2007-06-11 02:30:30 UTC (rev 372)
+++ libdexter/trunk/ChangeLog 2007-06-11 06:21:15 UTC (rev 373)
@@ -1,3 +1,6 @@
+2007-06-11 pkovacs
+ * Committing intermediate work on TLS.
+
2007-06-09 pkovacs
* Committing intermediate work on TLS.
Modified: libdexter/trunk/TODO
===================================================================
--- libdexter/trunk/TODO 2007-06-11 02:30:30 UTC (rev 372)
+++ libdexter/trunk/TODO 2007-06-11 06:21:15 UTC (rev 373)
@@ -1,9 +1,6 @@
TLS work in progress
refs: RFC 2246 (TLS protcol), RFC 2487 (STARTTLS extention to SMTP)
-- create new config items: ChannelTLSVerifyServerHostname/ServerTLSVerifyClientHostname
- to optionally verify hostname on first cert in the chain. Useful for situations
- where the peer does not have a reliable DNS entry.
- servercomm changes to *require* tls when that is indicated.
- dexter_tls_recv: 'A TLS packet with unexpected length was received'
when breaking off client or server. There should not be any error.
Modified: libdexter/trunk/dexter/dexter-channel-internal.h
===================================================================
--- libdexter/trunk/dexter/dexter-channel-internal.h 2007-06-11 02:30:30 UTC (rev 372)
+++ libdexter/trunk/dexter/dexter-channel-internal.h 2007-06-11 06:21:15 UTC (rev 373)
@@ -29,15 +29,16 @@
G_BEGIN_DECLS
-#define DEFAULT_CHANNEL_HOST "127.0.0.1"
-#define DEFAULT_CHANNEL_SERVICE "3663"
-#define DEFAULT_CHANNEL_SOCKET_OPTIONS NULL
-#define DEFAULT_CHANNEL_RECV_BUFFER_SIZE 2048
+#define DEFAULT_CHANNEL_HOST "127.0.0.1"
+#define DEFAULT_CHANNEL_SERVICE "3663"
+#define DEFAULT_CHANNEL_SOCKET_OPTIONS NULL
+#define DEFAULT_CHANNEL_RECV_BUFFER_SIZE 2048
#ifdef HAVE_TLS
-#define DEFAULT_CHANNEL_TLS_CERT_FILE "/etc/ssl/libdexter/channel-cert.pem"
-#define DEFAULT_CHANNEL_TLS_KEY_FILE "/etc/ssl/libdexter/channel-key.pem"
-#define DEFAULT_CHANNEL_TLS_TRUST_FILE "/etc/ssl/libdexter/channel-trust.pem"
-#define DEFAULT_CHANNEL_TLS_CRL_FILE "/etc/ssl/libdexter/channel-crl.pem"
+#define DEFAULT_CHANNEL_TLS_CERT_FILE "/etc/ssl/libdexter/channel-cert.pem"
+#define DEFAULT_CHANNEL_TLS_KEY_FILE "/etc/ssl/libdexter/channel-key.pem"
+#define DEFAULT_CHANNEL_TLS_TRUST_FILE "/etc/ssl/libdexter/channel-trust.pem"
+#define DEFAULT_CHANNEL_TLS_CRL_FILE "/etc/ssl/libdexter/channel-crl.pem"
+#define DEFAULT_CHANNEL_TLS_VERIFY_HOSTNAME TRUE
#endif
#define DEXTER_TYPE_CHANNEL (dexter_channel_get_type ())
Modified: libdexter/trunk/dexter/dexter-channel.c
===================================================================
--- libdexter/trunk/dexter/dexter-channel.c 2007-06-11 02:30:30 UTC (rev 372)
+++ libdexter/trunk/dexter/dexter-channel.c 2007-06-11 06:21:15 UTC (rev 373)
@@ -106,10 +106,12 @@
*dexter_channel_tls_parameters_new (const gchar *cert_file,
const gchar *key_file,
const gchar *trust_file,
- const gchar *crl_file);
+ const gchar *crl_file,
+ gboolean verify_hostname);
static DexterChannelTLSParameters
*dexter_channel_tls_parameters_dup (const DexterChannelTLSParameters *source);
static void dexter_channel_tls_parameters_free (DexterChannelTLSParameters *tls_parameters);
+static void dexter_channel_tls_parameters_check (DexterChannelTLSParameters *tls_parameters);
#endif /* HAVE_TLS */
/* GDestroyNotify to destroy channel hash entries */
@@ -244,7 +246,7 @@
channel->object_hash = dexter_hash_table_new_full (g_int_hash, g_int_equal,
NULL, (GDestroyNotify) _destroy_object_hash_entry);
#ifdef HAVE_TLS
- channel->tls_parameters = dexter_channel_tls_parameters_new (NULL, NULL, NULL, NULL);
+ channel->tls_parameters = dexter_channel_tls_parameters_new (NULL, NULL, NULL, NULL, TRUE);
/* fetch TLS parameters from config file */
if (!dexter_config_get_string (__ICONFIG,
@@ -252,37 +254,32 @@
&channel->tls_parameters->cert_file, NULL))
{
channel->tls_parameters->cert_file = g_strdup (DEFAULT_CHANNEL_TLS_CERT_FILE);
-#ifdef G_ENABLE_DEBUG
- g_message ("%s: using default %s for TLS cert file", G_STRFUNC, channel->tls_parameters->cert_file);
-#endif
}
if (!dexter_config_get_string (__ICONFIG,
"Main", "ChannelTLSKeyFile",
&channel->tls_parameters->key_file, NULL))
{
channel->tls_parameters->key_file = g_strdup (DEFAULT_CHANNEL_TLS_KEY_FILE);
-#ifdef G_ENABLE_DEBUG
- g_message ("%s: using default %s for TLS key file", G_STRFUNC, channel->tls_parameters->key_file);
-#endif
}
if (!dexter_config_get_string (__ICONFIG,
"Main", "ChannelTLSTrustFile",
&channel->tls_parameters->trust_file, NULL))
{
channel->tls_parameters->trust_file = g_strdup (DEFAULT_CHANNEL_TLS_TRUST_FILE);
-#ifdef G_ENABLE_DEBUG
- g_message ("%s: using default %s for TLS trust file", G_STRFUNC, channel->tls_parameters->trust_file);
-#endif
}
if (!dexter_config_get_string (__ICONFIG,
"Main", "ChannelTLSCrlFile",
&channel->tls_parameters->crl_file, NULL))
{
channel->tls_parameters->crl_file = g_strdup (DEFAULT_CHANNEL_TLS_CRL_FILE);
-#ifdef G_ENABLE_DEBUG
- g_message ("%s: using default %s for TLS crl file", G_STRFUNC, channel->tls_parameters->crl_file);
-#endif
}
+ if (!dexter_config_get_boolean (__ICONFIG,
+ "Main", "ChannelTLSVerifyHostname",
+ &channel->tls_parameters->verify_hostname, NULL))
+ {
+ channel->tls_parameters->verify_hostname = DEFAULT_CHANNEL_TLS_VERIFY_HOSTNAME;
+ }
+ dexter_channel_tls_parameters_check (channel->tls_parameters);
#endif /* HAVE_TLS */
}
@@ -713,7 +710,8 @@
dexter_channel_tls_parameters_new (const gchar *cert_file,
const gchar *key_file,
const gchar *trust_file,
- const gchar *crl_file)
+ const gchar *crl_file,
+ gboolean verify_hostname)
{
DexterChannelTLSParameters *tls_parameters = g_slice_new0 (DexterChannelTLSParameters);
@@ -721,6 +719,7 @@
tls_parameters->key_file = g_strdup (key_file);
tls_parameters->trust_file = g_strdup (trust_file);
tls_parameters->crl_file = g_strdup (crl_file);
+ tls_parameters->verify_hostname = verify_hostname;
return tls_parameters;
}
@@ -735,7 +734,8 @@
return dexter_channel_tls_parameters_new (source->cert_file,
source->key_file,
source->trust_file,
- source->crl_file);
+ source->crl_file,
+ source->verify_hostname);
}
@@ -751,6 +751,13 @@
g_free (tls_parameters->crl_file);
g_slice_free (DexterChannelTLSParameters, tls_parameters);
}
+
+
+static void
+dexter_channel_tls_parameters_check (DexterChannelTLSParameters *tls_parameters)
+{
+ /* no checks */
+}
#endif
@@ -941,9 +948,6 @@
"Main", "ChannelHost", &tmp_host, NULL))
{
tmp_host = g_strdup (DEFAULT_CHANNEL_HOST);
-#ifdef G_ENABLE_DEBUG
- g_message ("%s: using default %s for channel host", G_STRFUNC, tmp_host);
-#endif
}
}
@@ -954,9 +958,6 @@
&tmp_service, NULL))
{
tmp_service = g_strdup (DEFAULT_CHANNEL_SERVICE);
-#ifdef G_ENABLE_DEBUG
- g_message ("%s: using default %s for channel service", G_STRFUNC, tmp_service);
-#endif
}
}
@@ -967,9 +968,6 @@
&tmp_socket_options, NULL))
{
tmp_socket_options = g_strdup (DEFAULT_CHANNEL_SOCKET_OPTIONS);
-#ifdef G_ENABLE_DEBUG
- g_message ("%s: using default %s for channel socket options", G_STRFUNC, tmp_socket_options);
-#endif
}
}
@@ -1322,12 +1320,16 @@
dexter_network_session_peer_addrlen (channel->session),
tls_parameters);
+ /* check the parameters */
+ dexter_channel_tls_parameters_check (tls_parameters);
+
/* start TLS handshake, with adjusted parameters */
dexter_network_session_client_starttls (channel->session,
tls_parameters->cert_file,
tls_parameters->key_file,
tls_parameters->trust_file,
tls_parameters->crl_file,
+ tls_parameters->verify_hostname,
&local_error);
dexter_channel_tls_parameters_free (tls_parameters);
}
@@ -1339,6 +1341,7 @@
channel->tls_parameters->key_file,
channel->tls_parameters->trust_file,
channel->tls_parameters->crl_file,
+ channel->tls_parameters->verify_hostname,
&local_error);
}
if (local_error)
Modified: libdexter/trunk/dexter/dexter-channel.h
===================================================================
--- libdexter/trunk/dexter/dexter-channel.h 2007-06-11 02:30:30 UTC (rev 372)
+++ libdexter/trunk/dexter/dexter-channel.h 2007-06-11 06:21:15 UTC (rev 373)
@@ -137,6 +137,7 @@
* @key_file: full path to X.509 certificate private key file in PEM format.
* @trust_file: full path to X.509 trust file in PEM format.
* @crl_file: full path to X.509 certificate revocation list file in PEM format.
+ * @verify_hostname: verify that hostname of server matches its X.509 certificate.
*
* Parameters that the channel will use when starting TLS. The config file is used to specify
* default values.
@@ -152,10 +153,11 @@
struct _DexterChannelTLSParameters
{
/*< public >*/
- gchar *cert_file; /* ChannelTLSCertFile */
- gchar *key_file; /* ChannelTLSKeyFile */
- gchar *trust_file; /* ChannelTLSTrustFile */
- gchar *crl_file; /* ChannelTLSCrlFile */
+ gchar *cert_file; /* ChannelTLSCertFile */
+ gchar *key_file; /* ChannelTLSKeyFile */
+ gchar *trust_file; /* ChannelTLSTrustFile */
+ gchar *crl_file; /* ChannelTLSCrlFile */
+ gboolean verify_hostname; /* ChannelTLSVerifyHostname */
};
Modified: libdexter/trunk/dexter/dexter-network.c
===================================================================
--- libdexter/trunk/dexter/dexter-network.c 2007-06-11 02:30:30 UTC (rev 372)
+++ libdexter/trunk/dexter/dexter-network.c 2007-06-11 06:21:15 UTC (rev 373)
@@ -390,9 +390,31 @@
}
/* verify peer */
- dexter_tls_verify_peer (session->tls,
- "localhost",
- &local_error);
+ if (flags & DEXTER_TLS_VERIFY_HOSTNAME)
+ {
+ /* resolve peer's hostname */
+ char hbuf[NI_MAXHOST];
+ if (getnameinfo ((const struct sockaddr *)&session->addr,
+ session->addrlen, hbuf, sizeof(hbuf), NULL, 0, NI_NAMEREQD))
+ {
+ g_set_error (error,
+ DEXTER_NETWORK_ERROR,
+ DEXTER_NETWORK_ERROR_FAILED,
+ "%s: could not resolve peer hostname", G_STRFUNC);
+ return FALSE;
+ }
+ /* verify peer with hostname check */
+ dexter_tls_verify_peer (session->tls,
+ hbuf,
+ &local_error);
+ }
+ else
+ {
+ /* verify peer without hostname check */
+ dexter_tls_verify_peer (session->tls,
+ NULL,
+ &local_error);
+ }
if (local_error)
{
g_set_error (error,
@@ -701,6 +723,7 @@
const gchar *key_file,
const gchar *trust_file,
const gchar *crl_file,
+ gboolean verify_hostname,
GError **error)
{
#ifndef HAVE_TLS
@@ -716,7 +739,7 @@
key_file,
trust_file,
crl_file,
- 0,
+ verify_hostname ? DEXTER_TLS_VERIFY_HOSTNAME : 0,
error);
#endif
}
@@ -728,6 +751,7 @@
const gchar *trust_file,
const gchar *crl_file,
guint client_cert_flag,
+ gboolean verify_hostname,
GError **error)
{
#ifndef HAVE_TLS
@@ -743,7 +767,8 @@
key_file,
trust_file,
crl_file,
- 1<<client_cert_flag,
+ (1<<client_cert_flag) |
+ (verify_hostname ? DEXTER_TLS_VERIFY_HOSTNAME : 0),
error);
#endif
}
Modified: libdexter/trunk/dexter/dexter-network.h
===================================================================
--- libdexter/trunk/dexter/dexter-network.h 2007-06-11 02:30:30 UTC (rev 372)
+++ libdexter/trunk/dexter/dexter-network.h 2007-06-11 06:21:15 UTC (rev 373)
@@ -78,6 +78,7 @@
const gchar *key_file,
const gchar *trust_file,
const gchar *crl_file,
+ gboolean verify_hostname,
GError **error) G_GNUC_INTERNAL;
gboolean dexter_network_session_server_starttls
@@ -87,6 +88,7 @@
const gchar *trust_file,
const gchar *crl_file,
guint client_cert_flag,
+ gboolean verify_hostname,
GError **error) G_GNUC_INTERNAL;
gboolean dexter_network_session_tls_running (dexter_network_session_t *session) G_GNUC_INTERNAL;
Modified: libdexter/trunk/dexter/dexter-server.c
===================================================================
--- libdexter/trunk/dexter/dexter-server.c 2007-06-11 02:30:30 UTC (rev 372)
+++ libdexter/trunk/dexter/dexter-server.c 2007-06-11 06:21:15 UTC (rev 373)
@@ -796,9 +796,8 @@
* <informalexample><programlisting>
* DexterServer *server1 = dexter_server_new ("192.168.0.3", "3663", NULL);
* DexterServer *server2 = dexter_server_new ("0:ffff::192.168.0.3", "3663", NULL);
- * DexterServer *server3 = dexter_server_new ("0::0", "3663", NULL);
+ * DexterServer *server3 = dexter_server_new ("0::0", "3663", "IPTOS_LOWDELAY SO_RCVBUF=2048 SO_SNDBUF=2048");
* DexterServer *server4 = dexter_server_new ("0.0.0.0", "3663", NULL);
- * DexterServer *server5 = dexter_server_new ("privatehost.lan.net", "mysql", NULL);
* DexterServer *server6 = dexter_server_new (NULL, NULL, NULL);
* </programlisting></informalexample>
*
@@ -823,9 +822,6 @@
if (!dexter_config_get_string (__ICONFIG, "Main", "ServerHost", &tmp_host, NULL))
{
tmp_host = g_strdup (DEFAULT_SERVER_HOST);
-#ifdef G_ENABLE_DEBUG
- g_message ("%s: using default %s for server host", G_STRFUNC, tmp_host);
-#endif
}
}
@@ -835,9 +831,6 @@
&tmp_service, NULL))
{
tmp_service = g_strdup (DEFAULT_SERVER_SERVICE);
-#ifdef G_ENABLE_DEBUG
- g_message ("%s: using default %s for server service", G_STRFUNC, tmp_service);
-#endif
}
}
@@ -848,9 +841,6 @@
&tmp_socket_options, NULL))
{
tmp_socket_options = g_strdup (DEFAULT_SERVER_SOCKET_OPTIONS);
-#ifdef G_ENABLE_DEBUG
- g_message ("%s: using default %s for server socket options", G_STRFUNC, tmp_socket_options);
-#endif
}
}
@@ -900,33 +890,22 @@
g_return_val_if_fail (DEXTER_IS_SERVER (server), FALSE);
g_return_val_if_fail (error == NULL || *error == NULL, FALSE);
- g_return_val_if_fail (tls_settings == NULL
-#ifdef HAVE_TLS
- || tls_settings->support_flag == DEXTER_SERVER_TLS_SUPPORT_NONE
- || tls_settings->support_flag == DEXTER_SERVER_TLS_SUPPORT_AVAILABLE
- || tls_settings->support_flag == DEXTER_SERVER_TLS_SUPPORT_REQUIRED
-#endif
- , FALSE);
#ifdef HAVE_TLS
dexter_server_tls_settings_free (server->tls_settings);
if (tls_settings)
{
server->tls_settings = dexter_server_tls_settings_dup (tls_settings);
-
}
else /* if (tls_settings) */
{
/* grab default support flag from config */
gint tmp_support_flag;
-
server->tls_settings = dexter_server_tls_settings_new (DEXTER_SERVER_TLS_SUPPORT_NONE, NULL);
if (!dexter_config_get_integer (__ICONFIG, "Main", "ServerTLSSupportFlag",
&tmp_support_flag, NULL))
{
server->tls_settings->support_flag = DEFAULT_SERVER_TLS_SUPPORT_FLAG;
- g_warning ("%s: using default %d for ServerTLSSupportFlag",
- G_STRFUNC, server->tls_settings->support_flag);
}
else
{
@@ -934,6 +913,17 @@
}
}
+ /* Verify DexterServerTLSSupportFlag sanity */
+ if ((server->tls_settings->support_flag != DEXTER_SERVER_TLS_SUPPORT_NONE) &&
+ (server->tls_settings->support_flag != DEXTER_SERVER_TLS_SUPPORT_AVAILABLE) &&
+ (server->tls_settings->support_flag != DEXTER_SERVER_TLS_SUPPORT_REQUIRED))
+ {
+ server->tls_settings->support_flag = DEFAULT_SERVER_TLS_SUPPORT_FLAG;
+ g_warning ("%s: invalid ServerTLSSupportFlag. Using default %d.",
+ G_STRFUNC, server->tls_settings->support_flag);
+ }
+
+ /* Possibly seed TLS parameters for first time */
if ((server->tls_settings->support_flag == DEXTER_SERVER_TLS_SUPPORT_AVAILABLE) ||
(server->tls_settings->support_flag == DEXTER_SERVER_TLS_SUPPORT_REQUIRED))
{
Modified: libdexter/trunk/dexter/dexter-server.h
===================================================================
--- libdexter/trunk/dexter/dexter-server.h 2007-06-11 02:30:30 UTC (rev 372)
+++ libdexter/trunk/dexter/dexter-server.h 2007-06-11 06:21:15 UTC (rev 373)
@@ -106,6 +106,7 @@
* @trust_file: full path to X.509 trust file in PEM format.
* @crl_file: full path to X.509 certificate revocation list file in PEM format.
* @client_cert_flag: server requirements for client certificates.
+ * @verify_hostname: verify that hostname of client matches its X.509 certificate.
*
* Parameters that the server will use when starting TLS. The config file is used to specify
* default values.
@@ -127,6 +128,7 @@
gchar *crl_file; /* ServerTLSCrlFile */
DexterServerTLSClientCertFlag
client_cert_flag; /* ServerTLSClientCertFlag */
+ gboolean verify_hostname; /* ServerTLSVerifyHostname */
};
Modified: libdexter/trunk/dexter/dexter-servercomm.c
===================================================================
--- libdexter/trunk/dexter/dexter-servercomm.c 2007-06-11 02:30:30 UTC (rev 372)
+++ libdexter/trunk/dexter/dexter-servercomm.c 2007-06-11 06:21:15 UTC (rev 373)
@@ -71,17 +71,19 @@
GError **error);
#ifdef HAVE_TLS
static DexterServerTLSParameters
- *dexter_servercomm_tls_parameters_new (const gchar *cert_file,
- const gchar *key_file,
- const gchar *trust_file,
- const gchar *crl_file,
- DexterServerTLSClientCertFlag client_cert_flag);
+ *dexter_servercomm_tls_parameters_new (const gchar *cert_file,
+ const gchar *key_file,
+ const gchar *trust_file,
+ const gchar *crl_file,
+ DexterServerTLSClientCertFlag client_cert_flag,
+ gboolean verify_hostname);
static DexterServerTLSParameters
- *dexter_servercomm_tls_parameters_dup (const DexterServerTLSParameters *source);
-static void dexter_servercomm_tls_parameters_free (DexterServerTLSParameters *tls_parameters);
-static void dexter_servercomm_starttls (DexterServerComm *servercomm,
- const DexterChannelMessage *msg,
- GError **error);
+ *dexter_servercomm_tls_parameters_dup (const DexterServerTLSParameters *source);
+static void dexter_servercomm_tls_parameters_free (DexterServerTLSParameters *tls_parameters);
+static void dexter_servercomm_tls_parameters_check (DexterServerTLSParameters *tls_parameters);
+static void dexter_servercomm_starttls (DexterServerComm *servercomm,
+ const DexterChannelMessage *msg,
+ GError **error);
#endif
/* function to destroy [timed]sampler when removed from sampler hash */
@@ -142,7 +144,7 @@
#ifdef HAVE_TLS
servercomm->tls_parameters =
- dexter_servercomm_tls_parameters_new (NULL, NULL, NULL, NULL, DEXTER_SERVER_TLS_CLIENT_CERT_NONE);
+ dexter_servercomm_tls_parameters_new (NULL, NULL, NULL, NULL, DEXTER_SERVER_TLS_CLIENT_CERT_NONE, FALSE);
/* fetch TLS parameters from config file */
if (!dexter_config_get_string (__ICONFIG,
@@ -150,56 +152,46 @@
&servercomm->tls_parameters->cert_file, NULL))
{
servercomm->tls_parameters->cert_file = g_strdup (DEFAULT_SERVERCOMM_TLS_CERT_FILE);
-#ifdef G_ENABLE_DEBUG
- g_message ("%s: using default %s for TLS cert file", G_STRFUNC, servercomm->tls_parameters->cert_file);
-#endif
}
if (!dexter_config_get_string (__ICONFIG,
"Main", "ServerTLSKeyFile",
&servercomm->tls_parameters->key_file, NULL))
{
servercomm->tls_parameters->key_file = g_strdup (DEFAULT_SERVERCOMM_TLS_KEY_FILE);
-#ifdef G_ENABLE_DEBUG
- g_message ("%s: using default %s for TLS key file", G_STRFUNC, servercomm->tls_parameters->key_file);
-#endif
}
if (!dexter_config_get_string (__ICONFIG,
"Main", "ServerTLSTrustFile",
&servercomm->tls_parameters->trust_file, NULL))
{
servercomm->tls_parameters->trust_file = g_strdup (DEFAULT_SERVERCOMM_TLS_TRUST_FILE);
-#ifdef G_ENABLE_DEBUG
- g_message ("%s: using default %s for TLS trust file", G_STRFUNC, servercomm->tls_parameters->trust_file);
-#endif
}
if (!dexter_config_get_string (__ICONFIG,
"Main", "ServerTLSCrlFile",
&servercomm->tls_parameters->crl_file, NULL))
{
servercomm->tls_parameters->crl_file = g_strdup (DEFAULT_SERVERCOMM_TLS_CRL_FILE);
-#ifdef G_ENABLE_DEBUG
- g_message ("%s: using default %s for TLS crl file", G_STRFUNC, servercomm->tls_parameters->crl_file);
-#endif
}
{
gint tmp_client_cert_flag;
-
if (!dexter_config_get_integer (__ICONFIG,
"Main", "ServerTLSClientCertFlag",
&tmp_client_cert_flag, NULL))
{
servercomm->tls_parameters->client_cert_flag = DEFAULT_SERVERCOMM_TLS_CLIENT_CERT_FLAG;
-#ifdef G_ENABLE_DEBUG
- g_message ("%s: using default %d for TLS client cert flag",
- G_STRFUNC, servercomm->tls_parameters->client_cert_flag);
-#endif
}
else
{
servercomm->tls_parameters->client_cert_flag = (DexterServerTLSClientCertFlag) tmp_client_cert_flag;
}
}
+ if (!dexter_config_get_boolean (__ICONFIG,
+ "Main", "ServerTLSVerifyHostname",
+ &servercomm->tls_parameters->verify_hostname, NULL))
+ {
+ servercomm->tls_parameters->verify_hostname = DEFAULT_SERVERCOMM_TLS_VERIFY_HOSTNAME;
+ }
+ dexter_servercomm_tls_parameters_check (servercomm->tls_parameters);
servercomm->tls_settings = NULL;
#endif /* HAVE_TLS */
}
@@ -278,7 +270,8 @@
const gchar *key_file,
const gchar *trust_file,
const gchar *crl_file,
- DexterServerTLSClientCertFlag client_cert_flag)
+ DexterServerTLSClientCertFlag client_cert_flag,
+ gboolean verify_hostname)
{
DexterServerTLSParameters *tls_parameters;
@@ -292,6 +285,7 @@
tls_parameters->trust_file = g_strdup (trust_file);
tls_parameters->crl_file = g_strdup (crl_file);
tls_parameters->client_cert_flag = client_cert_flag;
+ tls_parameters->verify_hostname = verify_hostname;
return tls_parameters;
}
@@ -307,7 +301,8 @@
source->key_file,
source->trust_file,
source->crl_file,
- source->client_cert_flag);
+ source->client_cert_flag,
+ source->verify_hostname);
}
@@ -325,6 +320,23 @@
}
+static void
+dexter_servercomm_tls_parameters_check (DexterServerTLSParameters *tls_parameters)
+{
+ g_return_if_fail (tls_parameters != NULL);
+
+ /* Verify sanity of client_cert_flag */
+ if ((tls_parameters->client_cert_flag != DEXTER_SERVER_TLS_CLIENT_CERT_NONE) &&
+ (tls_parameters->client_cert_flag != DEXTER_SERVER_TLS_CLIENT_CERT_REQUESTED) &&
+ (tls_parameters->client_cert_flag != DEXTER_SERVER_TLS_CLIENT_CERT_REQUIRED))
+ {
+ tls_parameters->client_cert_flag = DEFAULT_SERVERCOMM_TLS_CLIENT_CERT_FLAG;
+ g_warning ("%s: invalid ServerTLSClientCertFlag. Using default %d.",
+ G_STRFUNC, tls_parameters->client_cert_flag);
+ }
+}
+
+
static void
dexter_servercomm_starttls (DexterServerComm *servercomm,
const DexterChannelMessage *msg,
@@ -371,6 +383,9 @@
dexter_network_session_peer_addrlen (servercomm->session),
tls_parameters);
+ /* check parameters */
+ dexter_servercomm_tls_parameters_check (tls_parameters);
+
/* start TLS handshake, with adjusted parameters */
dexter_network_session_server_starttls (servercomm->session,
tls_parameters->cert_file,
@@ -378,6 +393,7 @@
tls_parameters->trust_file,
tls_parameters->crl_file,
tls_parameters->client_cert_flag,
+ tls_parameters->verify_hostname,
&local_error);
dexter_servercomm_tls_parameters_free (tls_parameters);
}
@@ -390,6 +406,7 @@
servercomm->tls_parameters->trust_file,
servercomm->tls_parameters->crl_file,
servercomm->tls_parameters->client_cert_flag,
+ servercomm->tls_parameters->verify_hostname,
&local_error);
}
Modified: libdexter/trunk/dexter/dexter-servercomm.h
===================================================================
--- libdexter/trunk/dexter/dexter-servercomm.h 2007-06-11 02:30:30 UTC (rev 372)
+++ libdexter/trunk/dexter/dexter-servercomm.h 2007-06-11 06:21:15 UTC (rev 373)
@@ -37,6 +37,7 @@
#define DEFAULT_SERVERCOMM_TLS_TRUST_FILE "/etc/ssl/libdexter/server-trust.pem"
#define DEFAULT_SERVERCOMM_TLS_CRL_FILE "/etc/ssl/libdexter/server-crl.pem"
#define DEFAULT_SERVERCOMM_TLS_CLIENT_CERT_FLAG 1
+#define DEFAULT_SERVERCOMM_TLS_VERIFY_HOSTNAME FALSE
#endif
Modified: libdexter/trunk/dexter/dexter-tls-gnutls.c
===================================================================
--- libdexter/trunk/dexter/dexter-tls-gnutls.c 2007-06-11 02:30:30 UTC (rev 372)
+++ libdexter/trunk/dexter/dexter-tls-gnutls.c 2007-06-11 06:21:15 UTC (rev 373)
@@ -381,7 +381,6 @@
#endif
g_return_val_if_fail (tls != NULL, FALSE);
- g_return_val_if_fail (canonical_hostname != NULL, FALSE);
g_return_val_if_fail (error == NULL || *error == NULL, FALSE);
/* Get peer's cert list */
@@ -489,8 +488,9 @@
}
- /* Check hostname on first cert
- if ((iter==0) && (gnutls_x509_crt_check_hostname (cert, canonical_hostname) != 0))
+ /* If canonical_hostname supplied, check hostname on first certificate. */
+ if (canonical_hostname && (iter==0) &&
+ (gnutls_x509_crt_check_hostname (cert, canonical_hostname) == 0))
{
g_set_error (error,
DEXTER_TLS_ERROR,
@@ -501,7 +501,6 @@
gnutls_x509_crt_deinit (cert);
return FALSE;
}
- */
/* Fetch cert activation time */
if ((activation_time = gnutls_x509_crt_get_activation_time (cert)) < 0)
Modified: libdexter/trunk/dexter/dexter-tls.h
===================================================================
--- libdexter/trunk/dexter/dexter-tls.h 2007-06-11 02:30:30 UTC (rev 372)
+++ libdexter/trunk/dexter/dexter-tls.h 2007-06-11 06:21:15 UTC (rev 373)
@@ -33,9 +33,10 @@
typedef enum
{
- DEXTER_TLS_CERT_NONE = 1<<0, /* for server use only: if not asking for client cert */
- DEXTER_TLS_CERT_REQUEST = 1<<1, /* for server use only: if requesting client cert */
- DEXTER_TLS_CERT_REQUIRE = 1<<2 /* for server use only: if requiring client cert */
+ DEXTER_TLS_CERT_NONE = 1<<0, /* for server use only: if not asking for client cert */
+ DEXTER_TLS_CERT_REQUEST = 1<<1, /* for server use only: if requesting client cert */
+ DEXTER_TLS_CERT_REQUIRE = 1<<2, /* for server use only: if requiring client cert */
+ DEXTER_TLS_VERIFY_HOSTNAME = 1<<3 /* check if dns name matches certificate */
} DexterTLSFlags;
typedef enum
Modified: libdexter/trunk/docs/reference/dexter/config-example.sgml
===================================================================
--- libdexter/trunk/docs/reference/dexter/config-example.sgml 2007-06-11 02:30:30 UTC (rev 372)
+++ libdexter/trunk/docs/reference/dexter/config-example.sgml 2007-06-11 06:21:15 UTC (rev 373)
@@ -35,6 +35,7 @@
ServerTLSCrlFile=/etc/ssl/libdexter/server-crl.pem
ServerTLSClientCertFlag=1
ServerTLSSupportFlag=1
+ServerTLSVerifyHostname=false
ChannelHost=0.0.0.0
ChannelService=3663
@@ -45,6 +46,7 @@
ChannelTLSKeyFile=/etc/ssl/libdexter/channel-key.pem
ChannelTLSTrustFile=/etc/ssl/libdexter/channel-trust.pem
ChannelTLSCrlFile=/etc/ssl/libdexter/channel-crl.pem
+ChannelTLSVerifyHostname=true
[Plugins]
null=/usr/lib/libdexter/dxt-null
Modified: libdexter/trunk/docs/reference/dexter/config-structure.sgml
===================================================================
--- libdexter/trunk/docs/reference/dexter/config-structure.sgml 2007-06-11 02:30:30 UTC (rev 372)
+++ libdexter/trunk/docs/reference/dexter/config-structure.sgml 2007-06-11 06:21:15 UTC (rev 373)
@@ -191,6 +191,15 @@
</listitem>
</varlistentry>
<varlistentry>
+ <term><emphasis role="bold">ServerTLSVerifyHostname</emphasis></term>
+ <listitem>
+ <para>
+ <userinput>[true|1 or false|0, default: false]</userinput> Indicates whether or not the server
+ requires the client's DNS hostname to match its X.509 certificate.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
<term><emphasis role="bold">ChannelHost</emphasis></term>
<listitem>
<para>
@@ -276,6 +285,15 @@
</listitem>
</varlistentry>
<varlistentry>
+ <term><emphasis role="bold">ChannelTLSVerifyHostname</emphasis></term>
+ <listitem>
+ <para>
+ <userinput>[true|1 or false|0, default: true]</userinput> Indicates whether or not the client
+ requires the server's DNS hostname to match its X.509 certificate.
+ </para>
+ </listitem>
+ </varlistentry>
+ <varlistentry>
<term><emphasis role="bold">ThreadPoolNumThreads</emphasis></term>
<listitem>
<para>
Modified: libdexter/trunk/docs/reference/dexter/tmpl/dexter-channel.sgml
===================================================================
--- libdexter/trunk/docs/reference/dexter/tmpl/dexter-channel.sgml 2007-06-11 02:30:30 UTC (rev 372)
+++ libdexter/trunk/docs/reference/dexter/tmpl/dexter-channel.sgml 2007-06-11 06:21:15 UTC (rev 373)
@@ -90,6 +90,7 @@
@key_file:
@trust_file:
@crl_file:
+@verify_hostname:
<!-- ##### USER_FUNCTION DexterChannelTLSStartCallback ##### -->
<para>
Modified: libdexter/trunk/docs/reference/dexter/tmpl/dexter-server.sgml
===================================================================
--- libdexter/trunk/docs/reference/dexter/tmpl/dexter-server.sgml 2007-06-11 02:30:30 UTC (rev 372)
+++ libdexter/trunk/docs/reference/dexter/tmpl/dexter-server.sgml 2007-06-11 06:21:15 UTC (rev 373)
@@ -69,6 +69,7 @@
@trust_file:
@crl_file:
@client_cert_flag:
+@verify_hostname:
<!-- ##### USER_FUNCTION DexterServerTLSStartCallback ##### -->
<para>
This was sent by the SourceForge.net collaborative development platform, the world's largest Open Source development site.
|
