Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for ssl peer fingerprint #136

Merged
merged 3 commits into from
Jul 17, 2024
Merged

Add support for ssl peer fingerprint #136

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
db2b8c4
tls-session: fix whitespace issues
bazsi Jun 2, 2024
fc94e9f
transport-tls: add ${.tls.x509_fp} variable to contain the X.509 fing…
bazsi Jun 2, 2024
23c28a5
news: added news entry
bazsi Jul 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions lib/transport/tls-session.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,7 @@ tls_session_verify_fingerprint(X509_STORE_CTX *ctx)
if (strcmp((const gchar *)(current_fingerprint->data), hash->str) == 0)
{
match = TRUE;
g_strlcpy(self->peer_info.fingerprint, hash->str, sizeof(self->peer_info.fingerprint));
break;
}
}
Expand Down Expand Up @@ -523,7 +524,7 @@ void
tls_session_info_callback(const SSL *ssl, int where, int ret)
{
TLSSession *self = (TLSSession *)SSL_get_app_data(ssl);
if( !self->peer_info.found && where == (SSL_ST_ACCEPT|SSL_CB_LOOP) )
if (!self->peer_info.found && where == (SSL_ST_ACCEPT|SSL_CB_LOOP))
{
X509 *cert = SSL_get_peer_certificate(ssl);

Expand All @@ -532,9 +533,9 @@ tls_session_info_callback(const SSL *ssl, int where, int ret)
self->peer_info.found = 1; /* mark this found so we don't keep checking on every callback */
X509_NAME *name = X509_get_subject_name(cert);

X509_NAME_get_text_by_NID( name, NID_commonName, self->peer_info.cn, X509_MAX_CN_LEN );
X509_NAME_get_text_by_NID( name, NID_organizationName, self->peer_info.o, X509_MAX_O_LEN );
X509_NAME_get_text_by_NID( name, NID_organizationalUnitName, self->peer_info.ou, X509_MAX_OU_LEN );
X509_NAME_get_text_by_NID(name, NID_commonName, self->peer_info.cn, X509_MAX_CN_LEN);
X509_NAME_get_text_by_NID(name, NID_organizationName, self->peer_info.o, X509_MAX_O_LEN);
X509_NAME_get_text_by_NID(name, NID_organizationalUnitName, self->peer_info.ou, X509_MAX_OU_LEN);

X509_free(cert);
}
Expand Down
2 changes: 2 additions & 0 deletions lib/transport/tls-session.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@
#define X509_MAX_CN_LEN 64
#define X509_MAX_O_LEN 64
#define X509_MAX_OU_LEN 32
#define X509_MAX_FP_LEN 256

typedef struct _TLSContext TLSContext;
typedef struct _TLSSession
Expand All @@ -41,6 +42,7 @@ typedef struct _TLSSession
gchar o[X509_MAX_O_LEN];
gchar ou[X509_MAX_OU_LEN];
gchar cn[X509_MAX_CN_LEN];
gchar fingerprint[X509_MAX_FP_LEN];
} peer_info;
} TLSSession;

Expand Down
2 changes: 2 additions & 0 deletions lib/transport/transport-tls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,8 @@ log_transport_tls_read_method(LogTransport *s, gpointer buf, gsize buflen, LogTr
log_transport_aux_data_add_nv_pair(aux, ".tls.x509_o", self->tls_session->peer_info.o);
log_transport_aux_data_add_nv_pair(aux, ".tls.x509_ou", self->tls_session->peer_info.ou);
}
if (self->tls_session->peer_info.fingerprint[0])
log_transport_aux_data_add_nv_pair(aux, ".tls.x509_fp", self->tls_session->peer_info.fingerprint);

/* NOTE: we only support TLS on top of TCP for now. We could reuse the
* proto auto detection code from transport-socket to make this more
Expand Down
3 changes: 3 additions & 0 deletions news/feature-136.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
`tls()`: expose the key fingerprint of the peer in ${.tls.x509_fp} if
trusted-keys() is used to retain the actual peer identity in received
messages.
Loading