Gitweb:
http://git.exim.org/exim.git/commitdiff/8d69247061599b35b60308ca4b75ba529b8dcba2
Commit: 8d69247061599b35b60308ca4b75ba529b8dcba2
Parent: 4650b314ad07f4813d2cb826546d9048a4555c83
Author: Jeremy Harris <jgh146exb@???>
AuthorDate: Sun Oct 26 21:06:46 2014 +0000
Committer: Jeremy Harris <jgh146exb@???>
CommitDate: Wed Nov 5 18:22:20 2014 +0000
Do not permit multi-component wildcards on certificate names (OpenSSL)
---
doc/doc-txt/ChangeLog | 5 +++++
doc/doc-txt/experimental-spec.txt | 16 ++++++++++++++--
src/src/tls-openssl.c | 6 +++++-
3 files changed, 24 insertions(+), 3 deletions(-)
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index ed45747..b389a7d 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -59,6 +59,11 @@ JH/08 Rename the TPDA expermimental facility to Event Actions. The #ifdef
raised for inbound connections, if the main configuration event_action
option is defined.
+JH/09 When compiled with OpenSSL and EXPERIMENTAL_CERTNAMES, the checks on
+ server certificate names available under the smtp transport option
+ "tls_verify_cert_hostname" now do not permit multi-component wildcard
+ matches.
+
Exim version 4.84
-----------------
diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt
index faa64df..8192f3d 100644
--- a/doc/doc-txt/experimental-spec.txt
+++ b/doc/doc-txt/experimental-spec.txt
@@ -1144,6 +1144,8 @@ the next hop does not support DSN.
Adding it to a redirect router makes no difference.
+
+
Certificate name checking
--------------------------------------------------------------
The X509 certificates used for TLS are supposed be verified
@@ -1151,7 +1153,7 @@ that they are owned by the expected host. The coding of TLS
support to date has not made these checks.
If built with EXPERIMENTAL_CERTNAMES defined, code is
-included to do so, and a new smtp transport option
+included to do so for server certificates, and a new smtp transport option
"tls_verify_cert_hostname" supported which takes a list of
names for which the checks must be made. The host must
also be in "tls_verify_hosts".
@@ -1161,6 +1163,16 @@ are supported, as are wildcard certificates (limited to
a single wildcard being the initial component of a 3-or-more
component FQDN).
+The equivalent check on the server for client certificates is not
+implemented. At least one major email provider is using a client
+certificate which fails this check. They do not retry either without
+hte client certificate or in clear.
+
+It is possible to duplicate the effect of this checking by
+creative use of Events.
+
+
+
DANE
------------------------------------------------------------
@@ -1304,7 +1316,7 @@ in the delivery log line will show as "CV=dane".
There is a new variable $tls_out_dane which will have "yes" if
verification succeeded using DANE and "no" otherwise (only useful
-in combination with EXPERIMENTAL_TPDA), and a new variable
+in combination with EXPERIMENTAL_EVENT), and a new variable
$tls_out_tlsa_usage (detailed above).
diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index 25d5232..afc898c 100644
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -366,6 +366,9 @@ else
# ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
# define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
# endif
+# ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
+# define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
+# endif
{
int sep = 0;
uschar * list = verify_cert_hostnames;
@@ -373,7 +376,8 @@ else
int rc;
while ((name = string_nextinlist(&list, &sep, NULL, 0)))
if ((rc = X509_check_host(cert, name, 0,
- X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS)))
+ X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
+ | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS)))
{
if (rc < 0)
{
