[exim-cvs] Extractor for named RDN element types from a cert…

Startseite
Nachricht löschen
Nachricht beantworten
Autor: Exim Git Commits Mailing List
Datum:  
To: exim-cvs
Betreff: [exim-cvs] Extractor for named RDN element types from a certificate DN field.
Gitweb: http://git.exim.org/exim.git/commitdiff/812a604525eef4993d6ed165d455c8309ae72c36
Commit:     812a604525eef4993d6ed165d455c8309ae72c36
Parent:     8ded85897157e148f4c88692ac7b23ac7cb164cd
Author:     Jeremy Harris <jgh146exb@???>
AuthorDate: Tue May 13 22:02:51 2014 +0100
Committer:  Jeremy Harris <jgh146exb@???>
CommitDate: Tue May 13 22:22:00 2014 +0100


    Extractor for named RDN element types from a certificate DN field.
---
 doc/doc-docbook/spec.xfpt |    6 ++++
 src/src/functions.h       |    1 +
 src/src/tls.c             |   62 +++++++++++++++++++++++++++++++++++++++++++++
 src/src/tlscert-gnu.c     |   56 ++++++++++++++++++----------------------
 src/src/tlscert-openssl.c |    6 +++-
 test/confs/2002           |    1 +
 test/confs/2102           |    1 +
 test/log/2002             |    1 +
 test/log/2102             |    1 +
 9 files changed, 102 insertions(+), 33 deletions(-)


diff --git a/doc/doc-docbook/spec.xfpt b/doc/doc-docbook/spec.xfpt
index 17c69a7..e85ba66 100644
--- a/doc/doc-docbook/spec.xfpt
+++ b/doc/doc-docbook/spec.xfpt
@@ -8936,6 +8936,12 @@ output a Distinguished Name string which is
not quite
parseable by Exim as a comma-separated tagged list
(the exceptions being elements containin commas).
+RDN elements of a single type may be selected by
+a modifier of the type label; if so the expansion
+result is a list (newline-separated by default).
+The separator may be changed by another modifer of
+a right angle-bracket followed immediately by the new separator.
+Recognised RDN type labels include "CN", "O", "OU" and "DC".

 Field values are generally presented in human-readable form.
 .wen
diff --git a/src/src/functions.h b/src/src/functions.h
index 792f3df..741b632 100644
--- a/src/src/functions.h
+++ b/src/src/functions.h
@@ -62,6 +62,7 @@ extern void    tls_version_report(FILE *);
 #ifndef USE_GNUTLS
 extern BOOL    tls_openssl_options_parse(uschar *, long *);
 #endif
+extern uschar * tls_field_from_dn(uschar *, uschar *);
 #endif    /*SUPPORT_TLS*/



diff --git a/src/src/tls.c b/src/src/tls.c
index f0ac603..75c46e9 100644
--- a/src/src/tls.c
+++ b/src/src/tls.c
@@ -196,4 +196,66 @@ modify_variable(US"tls_sni",                  &dest_tsp->sni);
 #endif
 }


+/************************************************
+*    TLS certificate name operations         *
+************************************************/
+
+/* Convert an rfc4514 DN to an exim comma-sep list.
+Backslashed commas need to be replaced by doublecomma
+for Exim's list quoting.  We modify the given string
+inplace.
+*/
+
+static void
+dn_to_list(uschar * dn)
+{
+uschar * cp;
+for (cp = dn; *cp; cp++)
+  if (cp[0] == '\\' && cp[1] == ',')
+    *cp++ = ',';
+}
+
+
+/* Extract fields of a given type from an RFC4514-
+format Distinguished Name.  Return an Exim list.
+NOTE: We modify the supplied dn string during operation.
+
+Arguments:
+    dn    Distinguished Name string
+    mod    string containing optional list-sep and
+        field selector match, comma-separated
+Return:
+    allocated string with list of matching fields,
+    field type stripped
+*/
+
+uschar *
+tls_field_from_dn(uschar * dn, uschar * mod)
+{
+int insep = ',';
+uschar outsep = '\n';
+uschar * ele;
+uschar * match = NULL;
+int len;
+uschar * list = NULL;
+
+while (ele = string_nextinlist(&mod, &insep, NULL, 0))
+  if (ele[0] != '>')
+    match = ele;    /* field tag to match */
+  else if (ele[1])
+    outsep = ele[1];    /* nondefault separator */
+
+dn_to_list(dn);
+insep = ',';
+len = Ustrlen(match);
+while (ele = string_nextinlist(&dn, &insep, NULL, 0))
+  if (Ustrncmp(ele, match, len) == 0 && ele[len] == '=')
+    list = string_append_listele(list, outsep, ele+len+1);
+return list;
+}
+
+
+
+/* vi: aw ai sw=2
+*/
 /* End of tls.c */
diff --git a/src/src/tlscert-gnu.c b/src/src/tlscert-gnu.c
index 3d255ee..085e056 100644
--- a/src/src/tlscert-gnu.c
+++ b/src/src/tlscert-gnu.c
@@ -77,8 +77,8 @@ gnutls_global_deinit();
 static uschar *
 g_err(const char * tag, const char * from, int gnutls_err)
 {
-expand_string_message = string_sprintf(stderr,
-  "%s: %s fail: %s\n", from, tag, gnutls_strerror(gnutls_err));
+expand_string_message = string_sprintf("%s: %s fail: %s\n",
+  from, tag, gnutls_strerror(gnutls_err));
 return NULL;
 }


@@ -97,10 +97,19 @@ return len > 0 ? cp : NULL;
 uschar *
 tls_cert_issuer(void * cert, uschar * mod)
 {
-uschar txt[256];
-size_t sz = sizeof(txt);
-return ( gnutls_x509_crt_get_issuer_dn(cert, CS txt, &sz) == 0 )
-  ? string_copy(txt) : NULL;
+uschar * cp = NULL;
+int ret;
+size_t siz = 0;
+
+if ((ret = gnutls_x509_crt_get_issuer_dn(cert, cp, &siz))
+    != GNUTLS_E_SHORT_MEMORY_BUFFER)
+  return g_err("gi0", __FUNCTION__, ret);
+
+cp = store_get(siz);
+if ((ret = gnutls_x509_crt_get_issuer_dn(cert, cp, &siz)) < 0)
+  return g_err("gi1", __FUNCTION__, ret);
+
+return mod ? tls_field_from_dn(cp, mod) : cp;
 }


uschar *
@@ -143,20 +152,13 @@ uschar * cp3;
size_t len = 0;
int ret;

-if ((ret = gnutls_x509_crt_get_signature((gnutls_x509_crt_t)cert, cp1, &len)) !=
-    GNUTLS_E_SHORT_MEMORY_BUFFER)
-  {
-  fprintf(stderr, "%s: gs0 fail: %s\n", __FUNCTION__, gnutls_strerror(ret));
-  return NULL;
-  }
+if ((ret = gnutls_x509_crt_get_signature((gnutls_x509_crt_t)cert, cp1, &len))
+    != GNUTLS_E_SHORT_MEMORY_BUFFER)
+  return g_err("gs0", __FUNCTION__, ret);


cp1 = store_get(len*4+1);
-
if (gnutls_x509_crt_get_signature((gnutls_x509_crt_t)cert, cp1, &len) != 0)
- {
- fprintf(stderr, "%s: gs1 fail\n", __FUNCTION__);
- return NULL;
- }
+ return g_err("gs1", __FUNCTION__, ret);

for(cp3 = cp2 = cp1+len; cp1 < cp2; cp3 += 3, cp1++)
sprintf(cp3, "%.2x ", *cp1);
@@ -180,23 +182,15 @@ uschar * cp = NULL;
int ret;
size_t siz = 0;

-ret = gnutls_x509_crt_get_dn(cert, cp, &siz);
-if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER)
-  {
-  fprintf(stderr, "%s: gs0 fail: %s\n", __FUNCTION__, gnutls_strerror(ret));
-  return NULL;
-  }
+if ((ret = gnutls_x509_crt_get_dn(cert, cp, &siz))
+    != GNUTLS_E_SHORT_MEMORY_BUFFER)
+  return g_err("gs0", __FUNCTION__, ret);


cp = store_get(siz);
+if ((ret = gnutls_x509_crt_get_dn(cert, cp, &siz)) < 0)
+ return g_err("gs1", __FUNCTION__, ret);

-ret = gnutls_x509_crt_get_dn(cert, cp, &siz);
-if (ret < 0)
- {
- fprintf(stderr, "%s: gs1 fail: %s\n", __FUNCTION__, gnutls_strerror(ret));
- return NULL;
- }
-
-return cp;
+return mod ? tls_field_from_dn(cp, mod) : cp;
}

uschar *
diff --git a/src/src/tlscert-openssl.c b/src/src/tlscert-openssl.c
index 9903f08..00a3cb5 100644
--- a/src/src/tlscert-openssl.c
+++ b/src/src/tlscert-openssl.c
@@ -111,7 +111,8 @@ return bio_string_copy(bp, len_good);
uschar *
tls_cert_issuer(void * cert, uschar * mod)
{
-return x509_name_copy(X509_get_issuer_name((X509 *)cert));
+uschar * cp = x509_name_copy(X509_get_issuer_name((X509 *)cert));
+return mod ? tls_field_from_dn(cp, mod) : cp;
}

uschar *
@@ -170,7 +171,8 @@ return string_copy(US OBJ_nid2ln(X509_get_signature_type((X509 *)cert)));
uschar *
tls_cert_subject(void * cert, uschar * mod)
{
-return x509_name_copy(X509_get_subject_name((X509 *)cert));
+uschar * cp = x509_name_copy(X509_get_subject_name((X509 *)cert));
+return mod ? tls_field_from_dn(cp, mod) : cp;
}

 uschar *
diff --git a/test/confs/2002 b/test/confs/2002
index 178265d..dc958ec 100644
--- a/test/confs/2002
+++ b/test/confs/2002
@@ -51,6 +51,7 @@ check_recipient:
       logwrite =  SR  <${certextract {serial_number}{$tls_in_peercert}}>
       logwrite =  SN  <${certextract {subject}    {$tls_in_peercert}}>
           logwrite =  IN  <${certextract {issuer}    {$tls_in_peercert}}>
+          logwrite =  IN/O <${certextract {issuer,O}    {$tls_in_peercert}}>
           logwrite =  NB  <${certextract {notbefore}    {$tls_in_peercert}}>
           logwrite =  NA  <${certextract {notafter}    {$tls_in_peercert}}>
           logwrite =  SA  <${certextract {sig_algorithm}{$tls_in_peercert}}>
diff --git a/test/confs/2102 b/test/confs/2102
index 3d5e51a..8879cd0 100644
--- a/test/confs/2102
+++ b/test/confs/2102
@@ -52,6 +52,7 @@ check_recipient:
       logwrite =  SR  <${certextract {serial_number}{$tls_in_peercert}}>
       logwrite =  SN  <${certextract {subject}    {$tls_in_peercert}}>
           logwrite =  IN  <${certextract {issuer}    {$tls_in_peercert}}>
+          logwrite =  IN/O <${certextract {issuer,O}    {$tls_in_peercert}}>
           logwrite =  NB  <${certextract {notbefore}    {$tls_in_peercert}}>
           logwrite =  NA  <${certextract {notafter}    {$tls_in_peercert}}>
           logwrite =  SA  <${certextract {sig_algorithm}{$tls_in_peercert}}>
diff --git a/test/log/2002 b/test/log/2002
index 6a5d0c8..1cfa6e8 100644
--- a/test/log/2002
+++ b/test/log/2002
@@ -12,6 +12,7 @@
 1999-03-02 09:44:33 SR  <c9>
 1999-03-02 09:44:33 SN  <CN=server2.example.com>
 1999-03-02 09:44:33 IN  <O=example.com,CN=clica Signing Cert>
+1999-03-02 09:44:33 IN/O <example.com>
 1999-03-02 09:44:33 NB  <Nov  1 12:34:06 2012 GMT>
 1999-03-02 09:44:33 NA  <Jan  1 12:34:06 2038 GMT>
 1999-03-02 09:44:33 SA  <RSA-SHA>
diff --git a/test/log/2102 b/test/log/2102
index 5724040..79c51d0 100644
--- a/test/log/2102
+++ b/test/log/2102
@@ -13,6 +13,7 @@
 1999-03-02 09:44:33 SR  <c9>
 1999-03-02 09:44:33 SN  <CN=server2.example.com>
 1999-03-02 09:44:33 IN  <CN=clica Signing Cert,O=example.com>
+1999-03-02 09:44:33 IN/O <example.com>
 1999-03-02 09:44:33 NB  <Nov  1 12:34:06 2012 GMT>
 1999-03-02 09:44:33 NA  <Jan  1 12:34:06 2038 GMT>
 1999-03-02 09:44:33 SA  <undefined>