198 lines
6.4 KiB
Diff
198 lines
6.4 KiB
Diff
From 19e631e977c4f57905b2380cf79ccaf8e6d99e9d Mon Sep 17 00:00:00 2001
|
|
From: Howard Chu <hyc@openldap.org>
|
|
Date: Mon, 27 Apr 2020 03:41:12 +0100
|
|
Subject: [PATCH 1/4] ITS#9176 Add TLS SNI support to libldap
|
|
|
|
Implemented for OpenSSL, GnuTLS just stubbed
|
|
---
|
|
libraries/libldap/ldap-tls.h | 2 +-
|
|
libraries/libldap/tls2.c | 2 +-
|
|
libraries/libldap/tls_g.c | 2 +-
|
|
libraries/libldap/tls_o.c | 8 ++++++--
|
|
4 files changed, 9 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/libraries/libldap/ldap-tls.h b/libraries/libldap/ldap-tls.h
|
|
index c8a27112f1..c149b1867c 100644
|
|
--- a/libraries/libldap/ldap-tls.h
|
|
+++ b/libraries/libldap/ldap-tls.h
|
|
@@ -34,7 +34,7 @@ typedef void (TI_ctx_free)(tls_ctx *ctx);
|
|
typedef int (TI_ctx_init)(struct ldapoptions *lo, struct ldaptls *lt, int is_server);
|
|
|
|
typedef tls_session *(TI_session_new)(tls_ctx *ctx, int is_server);
|
|
-typedef int (TI_session_connect)(LDAP *ld, tls_session *s);
|
|
+typedef int (TI_session_connect)(LDAP *ld, tls_session *s, const char *name_in);
|
|
typedef int (TI_session_accept)(tls_session *s);
|
|
typedef int (TI_session_upflags)(Sockbuf *sb, tls_session *s, int rc);
|
|
typedef char *(TI_session_errmsg)(tls_session *s, int rc, char *buf, size_t len );
|
|
diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c
|
|
index 82ca5272cc..cbeea8c6c4 100644
|
|
--- a/libraries/libldap/tls2.c
|
|
+++ b/libraries/libldap/tls2.c
|
|
@@ -368,7 +368,7 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host )
|
|
lo->ldo_tls_connect_cb( ld, ssl, ctx, lo->ldo_tls_connect_arg );
|
|
}
|
|
|
|
- err = tls_imp->ti_session_connect( ld, ssl );
|
|
+ err = tls_imp->ti_session_connect( ld, ssl, host );
|
|
|
|
#ifdef HAVE_WINSOCK
|
|
errno = WSAGetLastError();
|
|
diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c
|
|
index 3b72cd2a1f..5468ed3f05 100644
|
|
--- a/libraries/libldap/tls_g.c
|
|
+++ b/libraries/libldap/tls_g.c
|
|
@@ -336,7 +336,7 @@ tlsg_session_accept( tls_session *session )
|
|
}
|
|
|
|
static int
|
|
-tlsg_session_connect( LDAP *ld, tls_session *session )
|
|
+tlsg_session_connect( LDAP *ld, tls_session *session, const char *name_in )
|
|
{
|
|
return tlsg_session_accept( session);
|
|
}
|
|
diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c
|
|
index 498f805fa1..455b23c0e9 100644
|
|
--- a/libraries/libldap/tls_o.c
|
|
+++ b/libraries/libldap/tls_o.c
|
|
@@ -548,12 +548,16 @@ tlso_session_new( tls_ctx *ctx, int is_server )
|
|
}
|
|
|
|
static int
|
|
-tlso_session_connect( LDAP *ld, tls_session *sess )
|
|
+tlso_session_connect( LDAP *ld, tls_session *sess, const char *name_in )
|
|
{
|
|
tlso_session *s = (tlso_session *)sess;
|
|
+ int rc;
|
|
|
|
+#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
|
|
+ SSL_set_tlsext_host_name( s, name_in );
|
|
+#endif
|
|
/* Caller expects 0 = success, OpenSSL returns 1 = success */
|
|
- int rc = SSL_connect( s ) - 1;
|
|
+ rc = SSL_connect( s ) - 1;
|
|
#ifdef LDAP_USE_NON_BLOCKING_TLS
|
|
if ( rc < 0 ) {
|
|
int sockerr = sock_errno();
|
|
|
|
From 421c2021c7209bd7cd947ccb8b989bddab7b63cb Mon Sep 17 00:00:00 2001
|
|
From: Howard Chu <hyc@openldap.org>
|
|
Date: Mon, 27 Apr 2020 18:25:10 +0100
|
|
Subject: [PATCH 2/4] ITS#9176 check for numeric addrs before passing SNI
|
|
|
|
---
|
|
libraries/libldap/tls2.c | 22 +++++++++++++++++++++-
|
|
libraries/libldap/tls_o.c | 4 +++-
|
|
2 files changed, 24 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c
|
|
index cbeea8c6c4..85628bc3b3 100644
|
|
--- a/libraries/libldap/tls2.c
|
|
+++ b/libraries/libldap/tls2.c
|
|
@@ -334,6 +334,7 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host )
|
|
Sockbuf *sb = conn->lconn_sb;
|
|
int err;
|
|
tls_session *ssl = NULL;
|
|
+ char *sni = host;
|
|
|
|
if ( HAS_TLS( sb )) {
|
|
ber_sockbuf_ctrl( sb, LBER_SB_OPT_GET_SSL, (void *)&ssl );
|
|
@@ -368,7 +369,26 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host )
|
|
lo->ldo_tls_connect_cb( ld, ssl, ctx, lo->ldo_tls_connect_arg );
|
|
}
|
|
|
|
- err = tls_imp->ti_session_connect( ld, ssl, host );
|
|
+ /* pass hostname for SNI, but only if it's an actual name
|
|
+ * and not a numeric address
|
|
+ */
|
|
+ {
|
|
+ int numeric = 1;
|
|
+ char *c;
|
|
+ for ( c = sni; *c; c++ ) {
|
|
+ if ( *c == ':' ) /* IPv6 address */
|
|
+ break;
|
|
+ if ( *c == '.' )
|
|
+ continue;
|
|
+ if ( !isdigit( *c )) {
|
|
+ numeric = 0;
|
|
+ break;
|
|
+ }
|
|
+ }
|
|
+ if ( numeric )
|
|
+ sni = NULL;
|
|
+ }
|
|
+ err = tls_imp->ti_session_connect( ld, ssl, sni );
|
|
|
|
#ifdef HAVE_WINSOCK
|
|
errno = WSAGetLastError();
|
|
diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c
|
|
index 455b23c0e9..45948dbc64 100644
|
|
--- a/libraries/libldap/tls_o.c
|
|
+++ b/libraries/libldap/tls_o.c
|
|
@@ -554,7 +554,9 @@ tlso_session_connect( LDAP *ld, tls_session *sess, const char *name_in )
|
|
int rc;
|
|
|
|
#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
|
|
- SSL_set_tlsext_host_name( s, name_in );
|
|
+ if ( name_in ) {
|
|
+ SSL_set_tlsext_host_name( s, name_in );
|
|
+ }
|
|
#endif
|
|
/* Caller expects 0 = success, OpenSSL returns 1 = success */
|
|
rc = SSL_connect( s ) - 1;
|
|
|
|
From 05a65a46c684031a841bcc39cf01a82e8cc713a0 Mon Sep 17 00:00:00 2001
|
|
From: Howard Chu <hyc@openldap.org>
|
|
Date: Mon, 27 Apr 2020 18:54:02 +0100
|
|
Subject: [PATCH 3/4] ITS#9176 check for failure setting SNI
|
|
|
|
---
|
|
libraries/libldap/tls_o.c | 4 +++-
|
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c
|
|
index 45948dbc64..86e86db3b6 100644
|
|
--- a/libraries/libldap/tls_o.c
|
|
+++ b/libraries/libldap/tls_o.c
|
|
@@ -555,7 +555,9 @@ tlso_session_connect( LDAP *ld, tls_session *sess, const char *name_in )
|
|
|
|
#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
|
|
if ( name_in ) {
|
|
- SSL_set_tlsext_host_name( s, name_in );
|
|
+ rc = SSL_set_tlsext_host_name( s, name_in );
|
|
+ if ( !rc ) /* can fail to strdup the name */
|
|
+ return -1;
|
|
}
|
|
#endif
|
|
/* Caller expects 0 = success, OpenSSL returns 1 = success */
|
|
|
|
From d059488fa86b58744ad70819516d3bf4a37dbb8e Mon Sep 17 00:00:00 2001
|
|
From: Ryan Tandy <ryan@nardis.ca>
|
|
Date: Mon, 27 Apr 2020 11:01:01 -0700
|
|
Subject: [PATCH 4/4] ITS#9176 Implement SNI for GnuTLS
|
|
|
|
---
|
|
libraries/libldap/tls_g.c | 10 ++++++++++
|
|
1 file changed, 10 insertions(+)
|
|
|
|
diff --git a/libraries/libldap/tls_g.c b/libraries/libldap/tls_g.c
|
|
index 5468ed3f05..5fceb3e935 100644
|
|
--- a/libraries/libldap/tls_g.c
|
|
+++ b/libraries/libldap/tls_g.c
|
|
@@ -338,6 +338,16 @@ tlsg_session_accept( tls_session *session )
|
|
static int
|
|
tlsg_session_connect( LDAP *ld, tls_session *session, const char *name_in )
|
|
{
|
|
+ tlsg_session *s = (tlsg_session *)session;
|
|
+ int rc;
|
|
+
|
|
+ if ( name_in ) {
|
|
+ rc = gnutls_server_name_set( s->session, GNUTLS_NAME_DNS, name_in, strlen(name_in) );
|
|
+ if ( rc != GNUTLS_E_SUCCESS ) {
|
|
+ return rc;
|
|
+ }
|
|
+ }
|
|
+
|
|
return tlsg_session_accept( session);
|
|
}
|
|
|