Changeset 5a8a32b in mod_gnutls


Ignore:
Timestamp:
Feb 5, 2015, 8:48:45 AM (5 years ago)
Author:
Thomas Klute <thomas2.klute@…>
Branches:
debian/master, debian/stretch-backports, jessie-backports, master, upstream
Children:
8731286
Parents:
c4ba972
Message:

TLS Client auth: Check server verify mode if unset for dir

The authentication hook (mgs_hook_authz) failed to consider the server's
client verify mode, even if the verify mode was unset in the directory
configuration. As a result, invalid certificates were ignored and
clients could connect and receive data as long as they presented any
certificate whatsoever. Logs showed that authorization was granted
despite the certificate being invalid (timestamps removed for
readability):

[:debug] [pid 10806:tid 140242057148160] gnutls_hooks.c(1198): [client ::1:40992] GnuTLS: Verifying list of 1 certificate(s) via method 'cartel'
[:info] [pid 10806:tid 140242057148160] [client ::1:40992] GnuTLS: Could not find Signer for Peer Certificate
[:info] [pid 10806:tid 140242057148160] [client ::1:40992] GnuTLS: Peer Certificate is invalid.
[authz_core:debug] [pid 10806:tid 140242057148160] mod_authz_core.c(835): [client ::1:40992] AH01628: authorization result: granted (no directives)

This commit adds a check for undefined verify mode in the directory
configuration and applies the server wide configuration in that case.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • src/gnutls_hooks.c

    rc4ba972 r5a8a32b  
    899899        }
    900900        rv = mgs_cert_verify(r, ctxt);
    901         if (rv != DECLINED &&
    902                 (rv != HTTP_FORBIDDEN ||
    903                 dc->client_verify_mode == GNUTLS_CERT_REQUIRE)) {
     901        if (rv != DECLINED
     902            && (rv != HTTP_FORBIDDEN
     903                || dc->client_verify_mode == GNUTLS_CERT_REQUIRE
     904                || (dc->client_verify_mode == -1
     905                    && ctxt->sc->client_verify_mode == GNUTLS_CERT_REQUIRE)))
     906        {
    904907            return rv;
    905908        }
Note: See TracChangeset for help on using the changeset viewer.