Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

V3.2.x Add handling for Subject Alternative Name (SAN) URIs #5450

Open
wants to merge 3 commits into
base: v3.2.x
Choose a base branch
from
Open

V3.2.x Add handling for Subject Alternative Name (SAN) URIs #5450

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
03d1cc0
Add SAN URI handling
ablanken Oct 18, 2024
a2d63a8
Add Subject-Alt-Name-Uri dictionary attributes
ablanken Oct 18, 2024
f691c11
Merge branch 'FreeRADIUS:v3.2.x' into v3.2.x
ablanken Oct 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions share/dictionary.freeradius.internal
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -578,6 +578,8 @@ ATTRIBUTE TLS-Client-Cert-X509v3-Basic-Constraints 1930 string
ATTRIBUTE TLS-Client-Cert-Subject-Alt-Name-Dns 1931 string
ATTRIBUTE TLS-Client-Cert-Subject-Alt-Name-Upn 1932 string
ATTRIBUTE TLS-PSK-Identity 1933 string
ATTRIBUTE TLS-Cert-Subject-Alt-Name-Uri 1934 string
ATTRIBUTE TLS-Client-Cert-Subject-Alt-Name-Uri 1935 string
ATTRIBUTE TLS-Client-Cert-X509v3-Extended-Key-Usage-OID 1936 string
ATTRIBUTE TLS-Client-Cert-Valid-Since 1937 string
ATTRIBUTE TLS-Cache-Method 1938 integer
Expand Down
20 changes: 14 additions & 6 deletions src/main/tls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2928,7 +2928,7 @@ static ocsp_status_t ocsp_check(REQUEST *request, X509_STORE *store, X509 *issue
/*
* For creating certificate attributes.
*/
static char const *cert_attr_names[9][2] = {
static char const *cert_attr_names[10][2] = {
{ "TLS-Client-Cert-Serial", "TLS-Cert-Serial" },
{ "TLS-Client-Cert-Expiration", "TLS-Cert-Expiration" },
{ "TLS-Client-Cert-Subject", "TLS-Cert-Subject" },
Expand All @@ -2937,6 +2937,7 @@ static char const *cert_attr_names[9][2] = {
{ "TLS-Client-Cert-Subject-Alt-Name-Email", "TLS-Cert-Subject-Alt-Name-Email" },
{ "TLS-Client-Cert-Subject-Alt-Name-Dns", "TLS-Cert-Subject-Alt-Name-Dns" },
{ "TLS-Client-Cert-Subject-Alt-Name-Upn", "TLS-Cert-Subject-Alt-Name-Upn" },
{ "TLS-Client-Cert-Subject-Alt-Name-Uri", "TLS-Cert-Subject-Alt-Name-Uri" },
{ "TLS-Client-Cert-Valid-Since", "TLS-Cert-Valid-Since" }
};

Expand All @@ -2945,10 +2946,11 @@ static char const *cert_attr_names[9][2] = {
#define FR_TLS_SUBJECT (2)
#define FR_TLS_ISSUER (3)
#define FR_TLS_CN (4)
#define FR_TLS_SAN_EMAIL (5)
#define FR_TLS_SAN_DNS (6)
#define FR_TLS_SAN_UPN (7)
#define FR_TLS_VALID_SINCE (8)
#define FR_TLS_SAN_EMAIL (5)
#define FR_TLS_SAN_DNS (6)
#define FR_TLS_SAN_UPN (7)
#define FR_TLS_SAN_URI (8)
#define FR_TLS_VALID_SINCE (9)

/*
* Before trusting a certificate, you must make sure that the
Expand Down Expand Up @@ -3186,6 +3188,13 @@ int cbtls_verify(int ok, X509_STORE_CTX *ctx)
}
break;
#endif /* GEN_OTHERNAME */
#ifdef GEN_URI
case GEN_URI:
vp = fr_pair_make(talloc_ctx, certs, cert_attr_names[FR_TLS_SAN_URI][lookup],
(char const *) ASN1_STRING_get0_data(name->d.uniformResourceIdentifier), T_OP_SET);
rdebug_pair(L_DBG_LVL_2, request, vp, NULL);
break;
#endif /* GEN_URI */
default:
/* XXX TODO handle other SAN types */
break;
Expand Down Expand Up @@ -5444,4 +5453,3 @@ fr_tls_status_t tls_ack_handler(tls_session_t *ssn, REQUEST *request)
}
}
#endif /* WITH_TLS */

Loading