op public repos

Blame

Date:: Wed Aug 23 17:38:49 2023 UTC
Message:: bundle libtls gmid (like all other daemons that want to do privsep crypto) has a very close relationship with libtls and need to stay in sync with it. OpenBSD' libtls was recently changed to use OpenSSL' EC_KEY_METHOD instead of the older ECDSA_METHOD, on the gmid side we have to do the same otherwise failures happens at runtime. In a similar manner, privsep crypto is silently broken in the current libretls (next version should fix it.) The proper solution would be to complete the signer APIs so that applications don't need to dive into the library' internals, but that's a mid-term goal, for the immediate bundling the 'little' libtls is the lesser evil. The configure script has gained a new (undocumented for the time being) flag `--with-libtls=bundled|system' to control which libtls to use. It defaults to `bundled' except for OpenBSD where it uses the `system' one. Note that OpenBSD versions before 7.3 (inclusive) ought to use --with-libtls=bundled too since they still do ECDSA_METHOD.
Actions:: History | Blob | Raw File

  1 f9ab77a8 2023-08-23 op /* $OpenBSD: tls_peer.c,v 1.8 2017/04/10 17:11:13 jsing Exp $ */
  2 f9ab77a8 2023-08-23 op /*
  3 f9ab77a8 2023-08-23 op  * Copyright (c) 2015 Joel Sing <jsing@openbsd.org>
  4 f9ab77a8 2023-08-23 op  * Copyright (c) 2015 Bob Beck <beck@openbsd.org>
  5 f9ab77a8 2023-08-23 op  *
  6 f9ab77a8 2023-08-23 op  * Permission to use, copy, modify, and distribute this software for any
  7 f9ab77a8 2023-08-23 op  * purpose with or without fee is hereby granted, provided that the above
  8 f9ab77a8 2023-08-23 op  * copyright notice and this permission notice appear in all copies.
  9 f9ab77a8 2023-08-23 op  *
 10 f9ab77a8 2023-08-23 op  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 11 f9ab77a8 2023-08-23 op  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 12 f9ab77a8 2023-08-23 op  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 13 f9ab77a8 2023-08-23 op  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 14 f9ab77a8 2023-08-23 op  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 15 f9ab77a8 2023-08-23 op  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 16 f9ab77a8 2023-08-23 op  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 17 f9ab77a8 2023-08-23 op  */
 18 f9ab77a8 2023-08-23 op 
 19 f9ab77a8 2023-08-23 op #include "config.h"
 20 f9ab77a8 2023-08-23 op 
 21 f9ab77a8 2023-08-23 op #include <stdio.h>
 22 f9ab77a8 2023-08-23 op 
 23 f9ab77a8 2023-08-23 op #include <openssl/x509.h>
 24 f9ab77a8 2023-08-23 op 
 25 f9ab77a8 2023-08-23 op #include <tls.h>
 26 f9ab77a8 2023-08-23 op #include "tls_internal.h"
 27 f9ab77a8 2023-08-23 op 
 28 f9ab77a8 2023-08-23 op const char *
 29 f9ab77a8 2023-08-23 op tls_peer_cert_hash(struct tls *ctx)
 30 f9ab77a8 2023-08-23 op {
 31 f9ab77a8 2023-08-23 op 	if (ctx->conninfo == NULL)
 32 f9ab77a8 2023-08-23 op 		return (NULL);
 33 f9ab77a8 2023-08-23 op 	return (ctx->conninfo->hash);
 34 f9ab77a8 2023-08-23 op }
 35 f9ab77a8 2023-08-23 op const char *
 36 f9ab77a8 2023-08-23 op tls_peer_cert_issuer(struct tls *ctx)
 37 f9ab77a8 2023-08-23 op {
 38 f9ab77a8 2023-08-23 op 	if (ctx->conninfo == NULL)
 39 f9ab77a8 2023-08-23 op 		return (NULL);
 40 f9ab77a8 2023-08-23 op 	return (ctx->conninfo->issuer);
 41 f9ab77a8 2023-08-23 op }
 42 f9ab77a8 2023-08-23 op 
 43 f9ab77a8 2023-08-23 op const char *
 44 f9ab77a8 2023-08-23 op tls_peer_cert_subject(struct tls *ctx)
 45 f9ab77a8 2023-08-23 op {
 46 f9ab77a8 2023-08-23 op 	if (ctx->conninfo == NULL)
 47 f9ab77a8 2023-08-23 op 		return (NULL);
 48 f9ab77a8 2023-08-23 op 	return (ctx->conninfo->subject);
 49 f9ab77a8 2023-08-23 op }
 50 f9ab77a8 2023-08-23 op 
 51 f9ab77a8 2023-08-23 op int
 52 f9ab77a8 2023-08-23 op tls_peer_cert_provided(struct tls *ctx)
 53 f9ab77a8 2023-08-23 op {
 54 f9ab77a8 2023-08-23 op 	return (ctx->ssl_peer_cert != NULL);
 55 f9ab77a8 2023-08-23 op }
 56 f9ab77a8 2023-08-23 op 
 57 f9ab77a8 2023-08-23 op int
 58 f9ab77a8 2023-08-23 op tls_peer_cert_contains_name(struct tls *ctx, const char *name)
 59 f9ab77a8 2023-08-23 op {
 60 f9ab77a8 2023-08-23 op 	int match;
 61 f9ab77a8 2023-08-23 op 
 62 f9ab77a8 2023-08-23 op 	if (ctx->ssl_peer_cert == NULL)
 63 f9ab77a8 2023-08-23 op 		return (0);
 64 f9ab77a8 2023-08-23 op 
 65 f9ab77a8 2023-08-23 op 	if (tls_check_name(ctx, ctx->ssl_peer_cert, name, &match) == -1)
 66 f9ab77a8 2023-08-23 op 		return (0);
 67 f9ab77a8 2023-08-23 op 
 68 f9ab77a8 2023-08-23 op 	return (match);
 69 f9ab77a8 2023-08-23 op }
 70 f9ab77a8 2023-08-23 op 
 71 f9ab77a8 2023-08-23 op time_t
 72 f9ab77a8 2023-08-23 op tls_peer_cert_notbefore(struct tls *ctx)
 73 f9ab77a8 2023-08-23 op {
 74 f9ab77a8 2023-08-23 op 	if (ctx->ssl_peer_cert == NULL)
 75 f9ab77a8 2023-08-23 op 		return (-1);
 76 f9ab77a8 2023-08-23 op 	if (ctx->conninfo == NULL)
 77 f9ab77a8 2023-08-23 op 		return (-1);
 78 f9ab77a8 2023-08-23 op 	return (ctx->conninfo->notbefore);
 79 f9ab77a8 2023-08-23 op }
 80 f9ab77a8 2023-08-23 op 
 81 f9ab77a8 2023-08-23 op time_t
 82 f9ab77a8 2023-08-23 op tls_peer_cert_notafter(struct tls *ctx)
 83 f9ab77a8 2023-08-23 op {
 84 f9ab77a8 2023-08-23 op 	if (ctx->ssl_peer_cert == NULL)
 85 f9ab77a8 2023-08-23 op 		return (-1);
 86 f9ab77a8 2023-08-23 op 	if (ctx->conninfo == NULL)
 87 f9ab77a8 2023-08-23 op 		return (-1);
 88 f9ab77a8 2023-08-23 op 	return (ctx->conninfo->notafter);
 89 f9ab77a8 2023-08-23 op }
 90 f9ab77a8 2023-08-23 op 
 91 f9ab77a8 2023-08-23 op const uint8_t *
 92 f9ab77a8 2023-08-23 op tls_peer_cert_chain_pem(struct tls *ctx, size_t *size)
 93 f9ab77a8 2023-08-23 op {
 94 f9ab77a8 2023-08-23 op 	if (ctx->ssl_peer_cert == NULL)
 95 f9ab77a8 2023-08-23 op 		return (NULL);
 96 f9ab77a8 2023-08-23 op 	if (ctx->conninfo == NULL)
 97 f9ab77a8 2023-08-23 op 		return (NULL);
 98 f9ab77a8 2023-08-23 op 	*size = ctx->conninfo->peer_cert_len;
 99 f9ab77a8 2023-08-23 op 	return (ctx->conninfo->peer_cert);
100 f9ab77a8 2023-08-23 op }
101 f9ab77a8 2023-08-23 op