qpid-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From kgiu...@apache.org
Subject svn commit: r1422045 - in /qpid/proton/trunk: proton-c/include/proton/ssl.h proton-c/src/ssl/openssl.c tests/proton_tests/ssl.py tests/proton_tests/ssl_db/README.txt tests/proton_tests/ssl_db/ca-private-key.pem
Date Fri, 14 Dec 2012 19:17:13 GMT
Author: kgiusti
Date: Fri Dec 14 19:17:08 2012
New Revision: 1422045

URL: http://svn.apache.org/viewvc?rev=1422045&view=rev
Log:
PROTON-161: test exact match hostname check

Added:
    qpid/proton/trunk/tests/proton_tests/ssl_db/ca-private-key.pem
Modified:
    qpid/proton/trunk/proton-c/include/proton/ssl.h
    qpid/proton/trunk/proton-c/src/ssl/openssl.c
    qpid/proton/trunk/tests/proton_tests/ssl.py
    qpid/proton/trunk/tests/proton_tests/ssl_db/README.txt

Modified: qpid/proton/trunk/proton-c/include/proton/ssl.h
URL: http://svn.apache.org/viewvc/qpid/proton/trunk/proton-c/include/proton/ssl.h?rev=1422045&r1=1422044&r2=1422045&view=diff
==============================================================================
--- qpid/proton/trunk/proton-c/include/proton/ssl.h (original)
+++ qpid/proton/trunk/proton-c/include/proton/ssl.h Fri Dec 14 19:17:08 2012
@@ -140,7 +140,7 @@ int pn_ssl_allow_unsecured_client(pn_ssl
  *  These settings can be changed via ::pn_ssl_set_peer_authentication()
  */
 typedef enum {
-  PN_SSL_VERIFY_PEER,     /**< require peer to provide a valid identifying certificate
*/
+  PN_SSL_VERIFY_PEER,     /**< require peer to provide a valid certificate */
   PN_SSL_ANONYMOUS_PEER,  /**< do not require a certificate nor cipher authorization */
 } pn_ssl_verify_mode_t;
 
@@ -212,12 +212,52 @@ bool pn_ssl_get_cipher_name(pn_ssl_t *ss
 bool pn_ssl_get_protocol_name(pn_ssl_t *ssl, char *buffer, size_t size);
 
 
+/** Set the DNS name of the server that the client expects to authenticate.
+ *
+ * Setting this name causes the client to 1) send this name to the server during the
+ * handshake (if Server Name Indication is supported), and 2) check this name against the
+ * CommonName provided in the server's certificate. If the supplied name does not exactly
+ * match a CommonName entry in the server's certificate, the server is considered
+ * unauthenticated, and the SSL connection is aborted.
+ *
+ * @note Verification of the CommonName is only done if PN_SSL_VERIFY_PEER is enabled.
+ * See ::pn_ssl_set_peer_authentication.
+ *
+ * @note the CommonName check algorithm can be modified using
+ * ::pn_ssl_set_peer_hostname_match.
+ *
+ * @param[in] ssl the ssl client
+ * @param[in] hostname the value to check against the peer's CommonName field.  Expected
+ * to conform to the syntax as given in RFC1034, Section 3.5.
+ */
 void pn_ssl_set_peer_hostname( pn_ssl_t *ssl, const char *hostname);
 
+/** Specify how to match the server's CommonName field
+ *
+ * Expects the CommonName field to contain a DNS name as described in RFC1034, Sec 3.5
+ * Host Name Syntax.
+ */
 typedef enum {
-  PN_SSL_MATCH_EXACT,
-  PN_SSL_MATCH_WILDCARD
+  PN_SSL_MATCH_EXACT,   /**< case insensitive text match */
+  PN_SSL_MATCH_WILDCARD /**< domain label wildcard match */
 } pn_ssl_match_flag;
+
+/** Check the server's CommonName field to ensure authenticity.
+ *
+ * Controls how the SSL client will check the CommonName field in the server's
+ * certificate.  This check must be used in order to ensure the certificate belongs to the
+ * expected target.  If the check fails, the SSL connection is aborted.
+ *
+ * @note Verification of the CommonName is only done if PN_SSL_VERIFY_PEER is enabled.
+ * See ::pn_ssl_set_peer_authentication.
+ *
+ * @param[in] ssl the ssl client
+ * @param[in] pattern if not NULL the pattern to use to check against the peer's
+ * CommonName field, based on the match flag.  If NULL, CommonName checking is disabled.
+ * @param[in] flag describes how pattern should be used to match against the CommonName
+ * field
+ * @return 0 if pattern/flag is valid, < 0 if error.
+ */
 int pn_ssl_set_peer_hostname_match( pn_ssl_t *ssl, const char *pattern, pn_ssl_match_flag
flag);
 
 #ifdef __cplusplus

Modified: qpid/proton/trunk/proton-c/src/ssl/openssl.c
URL: http://svn.apache.org/viewvc/qpid/proton/trunk/proton-c/src/ssl/openssl.c?rev=1422045&r1=1422044&r2=1422045&view=diff
==============================================================================
--- qpid/proton/trunk/proton-c/src/ssl/openssl.c (original)
+++ qpid/proton/trunk/proton-c/src/ssl/openssl.c Fri Dec 14 19:17:08 2012
@@ -1061,11 +1061,12 @@ void pn_ssl_set_peer_hostname( pn_ssl_t 
   }
 }
 
-// uses RFC1034, Sec 3.5 host name syntax
 int pn_ssl_set_peer_hostname_match( pn_ssl_t *ssl, const char *pattern, pn_ssl_match_flag
flag)
 {
   if (!ssl) return -1;
 
+  if (flag != PN_SSL_MATCH_EXACT) return -1;  // @todo support for wildcard
+
   if (ssl->peer_match_pattern) free(ssl->peer_match_pattern);
   ssl->peer_match_pattern = NULL;
   if (pattern) {

Modified: qpid/proton/trunk/tests/proton_tests/ssl.py
URL: http://svn.apache.org/viewvc/qpid/proton/trunk/tests/proton_tests/ssl.py?rev=1422045&r1=1422044&r2=1422045&view=diff
==============================================================================
--- qpid/proton/trunk/tests/proton_tests/ssl.py (original)
+++ qpid/proton/trunk/tests/proton_tests/ssl.py Fri Dec 14 19:17:08 2012
@@ -288,7 +288,7 @@ class SslTest(common.Test):
         #self.t_client.trace( Transport.TRACE_DRV )
         self.client.set_trusted_ca_db(self._testpath("ca-certificate.pem"))
         self.client.set_peer_authentication( SSL.VERIFY_PEER )
-        self.client.set_peer_hostname( "127.0.0.1" )
+        self.client.set_peer_hostname( "a1.good.server.domain.com" )
 
         client_conn = Connection()
         self.t_client.bind(client_conn)
@@ -313,7 +313,7 @@ class SslTest(common.Test):
         #self.t_client.trace( Transport.TRACE_DRV )
         self.client.set_trusted_ca_db(self._testpath("ca-certificate.pem"))
         self.client.set_peer_authentication( SSL.VERIFY_PEER )
-        self.client.set_peer_hostname( "127.0.0.1x" )
+        self.client.set_peer_hostname( "A1.Good.Server.domain.comx" )
 
         client_conn = Connection()
         self.t_client.bind(client_conn)

Modified: qpid/proton/trunk/tests/proton_tests/ssl_db/README.txt
URL: http://svn.apache.org/viewvc/qpid/proton/trunk/tests/proton_tests/ssl_db/README.txt?rev=1422045&r1=1422044&r2=1422045&view=diff
==============================================================================
--- qpid/proton/trunk/tests/proton_tests/ssl_db/README.txt (original)
+++ qpid/proton/trunk/tests/proton_tests/ssl_db/README.txt Fri Dec 14 19:17:08 2012
@@ -4,6 +4,9 @@ ca-certificate.pem - contains the public
 Authority.  This certificate is used to sign the certificates that identify the SSL
 servers and clients run by the tests.
 
+ca-private-key.pem - encrypted key used to sign certificate requests.  Password is
+"ca-password"
+
 client-certificate.pem - the public certificate used to identify the client.  Signed by
 the CA.
 
@@ -11,7 +14,7 @@ client-private-key.pem - encrypted key u
 "client-password"
 
 server-certificate.pem - the public certificate used to identify the server.  Signed by
-the CA.
+the CA.  The CommonName is "A1.Good.Server.domain.com", and is checked by some unit tests.
 
 server-private-key.pem - encrypted key used to create server-certificate.pem. Password is
 "server-password"

Added: qpid/proton/trunk/tests/proton_tests/ssl_db/ca-private-key.pem
URL: http://svn.apache.org/viewvc/qpid/proton/trunk/tests/proton_tests/ssl_db/ca-private-key.pem?rev=1422045&view=auto
==============================================================================
--- qpid/proton/trunk/tests/proton_tests/ssl_db/ca-private-key.pem (added)
+++ qpid/proton/trunk/tests/proton_tests/ssl_db/ca-private-key.pem Fri Dec 14 19:17:08 2012
@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFDjBABgkqhkiG9w0BBQ0wMzAbBgkqhkiG9w0BBQwwDgQIuSRTuf3QjCcCAggA
+MBQGCCqGSIb3DQMHBAgeye9bVfr9tQSCBMjnORw1m3HAovlacxIXCqAMXBFWTwhC
+X8+zHSqv+xw6Bt8UWnRsCs3/W3KfLR6mHHhqXV7PJDE8qXc3yLa1YE6JjqftoA+5
+2wxdfcodwt734g+p0WrAruUqrt0dh305Mg3CgD0gPJ/+lrbqorCHiL6gz3ndxZxT
+ut2O4dJxYHbRdx+es7IOHpIZFA9LUWFyP0LUXxwEEeUfDoN/76w2NeRANxa3QBVN
+tuPUWL8mj5albvfca7PpWMPx0fILnH2K+o1ZIxzqrnpaKLdP+w2x/9TYZd1goVZT
+cMbdsbt1Pv6KH5LLf0T0ichD1hlon8kSOs/DoF5q8zexocXhUObVWNnwC99UvZiZ
+g9BaxtkDGvNEGqEoLyf5qJp1VFbVAep16FP4SHEFm3i2WfIofE8DoXYONC4pql6v
+j5tx2b6qDnT+HKMPpMRqd66ErFYEJ7f7gE3uv/L7c4PJ95G6KhuE/MSeNQtd2zzz
+nFw0gWNBQOdkYoaFEoLWwdpRgdjfBrKjEmKio82v2UhCMISs7zRyQuaMhSpKdAnB
+qkS7S119yHqiTkr3sVgcR05w1Dny4HJW2kWGm6EBYteLqVHk6pyP21qB5gMJguKA
+iP0dt+7+P6sNQfa7tVNdyICvhY0NfVV6nRw+1/3HS3lWV+p1pompXOLImGlUufsc
+Vr/XVgONIbRir+66VX14X1ZD+wYTUsKVtBwizrCS6aPs2FqtKaKrE2e/mbmDpKt/
+eQCdULNyc4WDcfC+PTE0Wyl00PekuotaWGAiUxZ/Sqo0gKxKqn1qwsc4Rd2rey62
+mZnZMyxVY6vysnq1+/8KOshrlzJlJzR4r3yNkNtILxr7Rr1Z26z9EgxIt4DzsKWl
+7Y/oprkJuhagRiZ/ctD+0pPHfgNWmIKa/uNgZWP2w353CqHsH0NUMUBFtf6PriI0
+LQdotrYgpqKthWRkDgIs2oetMOuE56iFqzxhp9xOzVqaPK9DqWGMxnshA7Y61l0Q
+X37bBvubWzINw3qhHXdUtUzPiT6v66PoNBecAvzf1dFx8mMDEm1Ytv7abihNnAbA
+SXDLZ6U66ekGwH/vXEOq22yyBP5R2OW98E542Nvj8+b5GHwk2qtSddQzJFX72Jn6
+jr6CmBOrKlS+Ko4Pkb6GIX4yi47MXiDD9YHX9RQNFuo3MqBcuoitG4ouP9XeEHRQ
+FOzMNQi3atcM7T4yh5qlprrXYSav8+mejClSaE/Cd8vNwsD7a7wZ23TkxBA6G6uK
+79ohUeHYi1duGrcHq6SKy7gBwDAbItLnxESIExNgW5i8qrN4zdGZWDLdBilgtTEB
+9eUE9j926dyzx+S6ZG0sMr+zOpSyq4NOjx39Q9p931QXEyAzqJ1R11FMUdYlCcfi
+GQPrKtfaXNa+0Dbgu9P3jmAbwG/3FJcWqKZ2PB8j0JF6VnF1x/BQjN3QXgnayXPY
+KT+PieZkYKpQwObhlYmdqUexfFnh3/0MMU8CI32hUaqdQuRxhspXiK0ouWb/i95s
+XBTuYjdjO2nGojGWM1yDB4oACylCo0265Dw8PhpFrF7kULop3oslGs4lY4fmc9bb
+60X7LomiB/FTsH0y2HI2zH8/G2D83IBxEsUjfpG9nfyAmhv/KZDG+Dv8ZOqQ9FAb
+K6k=
+-----END ENCRYPTED PRIVATE KEY-----



---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@qpid.apache.org
For additional commands, e-mail: commits-help@qpid.apache.org


Mime
View raw message