From: Jeremy Harris Date: Wed, 5 Nov 2014 18:24:00 +0000 (+0000) Subject: Do not permit multi-component wildcards on certificate names (OpenSSL, EXPERIMENTAL_C... X-Git-Tag: exim-4_85_RC1~9 X-Git-Url: https://git.exim.org/exim.git/commitdiff_plain/09c17790eec23907b93df1ec7cee746b28dfc836?hp=f6da88972f6404c77bc873873de5f298399cce5b Do not permit multi-component wildcards on certificate names (OpenSSL, EXPERIMENTAL_CERTNAMES) --- diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog index 5a298d161..997a459c8 100644 --- a/doc/doc-txt/ChangeLog +++ b/doc/doc-txt/ChangeLog @@ -62,6 +62,11 @@ JH/08 Rename the TPDA expermimental facility to Event Actions. The #ifdef TL/06 In test suite, disable OCSP for old versions of openssl which contained early OCSP support, but no stapling (appears to be less than 1.0.0). +JH/09 When compiled with OpenSSL and EXPERIMENTAL_CERTNAMES, the checks on + server certificate names available under the smtp transport option + "tls_verify_cert_hostname" now do not permit multi-component wildcard + matches. + Exim version 4.84 ----------------- diff --git a/doc/doc-txt/experimental-spec.txt b/doc/doc-txt/experimental-spec.txt index faa64df68..266e19891 100644 --- a/doc/doc-txt/experimental-spec.txt +++ b/doc/doc-txt/experimental-spec.txt @@ -1144,6 +1144,8 @@ the next hop does not support DSN. Adding it to a redirect router makes no difference. + + Certificate name checking -------------------------------------------------------------- The X509 certificates used for TLS are supposed be verified @@ -1151,16 +1153,30 @@ that they are owned by the expected host. The coding of TLS support to date has not made these checks. If built with EXPERIMENTAL_CERTNAMES defined, code is -included to do so, and a new smtp transport option -"tls_verify_cert_hostname" supported which takes a list of -names for which the checks must be made. The host must -also be in "tls_verify_hosts". +included to do so for server certificates, and a new smtp transport option +"tls_verify_cert_hostnames" supported which takes a list of +names for which the additional checks must be made. +The option currently defaults to empty, but this may change in +the future. "*" is probably a suitable value. +Whether certificate verification is done at all, and the result of +it failing, is stll under the control of "tls_verify_hosts" nad +"tls_try_verify_hosts". Both Subject and Subject-Alternate-Name certificate fields are supported, as are wildcard certificates (limited to a single wildcard being the initial component of a 3-or-more component FQDN). +The equivalent check on the server for client certificates is not +implemented. At least one major email provider is using a client +certificate which fails this check. They do not retry either without +hte client certificate or in clear. + +It is possible to duplicate the effect of this checking by +creative use of Events. + + + DANE ------------------------------------------------------------ @@ -1304,7 +1320,7 @@ in the delivery log line will show as "CV=dane". There is a new variable $tls_out_dane which will have "yes" if verification succeeded using DANE and "no" otherwise (only useful -in combination with EXPERIMENTAL_TPDA), and a new variable +in combination with EXPERIMENTAL_EVENT), and a new variable $tls_out_tlsa_usage (detailed above). diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c index fe1b208ac..63bf83b1d 100644 --- a/src/src/tls-openssl.c +++ b/src/src/tls-openssl.c @@ -369,6 +369,9 @@ else # if EXIM_HAVE_OPENSSL_CHECKHOST # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0 +# endif +# ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS +# define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0 # endif { int sep = 0; @@ -377,7 +380,8 @@ else int rc; while ((name = string_nextinlist(&list, &sep, NULL, 0))) if ((rc = X509_check_host(cert, name, 0, - X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS))) + X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS + | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS))) { if (rc < 0) {