Author: rcritten
Update of /cvs/dirsec/mod_nss In directory cvs01.phx2.fedoraproject.org:/tmp/cvs-serv30758
Modified Files: TODO mod_nss.c mod_nss.h nss_engine_config.c Log Message: Compare CN value of remote host with requested host in reverse proxy. Add configuration option to disable this, defaulting to on.
591224
Index: TODO =================================================================== RCS file: /cvs/dirsec/mod_nss/TODO,v retrieving revision 1.3 retrieving revision 1.4 diff -u -r1.3 -r1.4 --- TODO 21 Jun 2006 14:42:06 -0000 1.3 +++ TODO 13 May 2010 15:21:24 -0000 1.4 @@ -1,5 +1,2 @@ -- Offer to automatically generate a self-signed cert using gencert during - install? -- Should gencert create a database with an empty password or continue - to create a protected on? - Once NSS fully supports the SNI TLS extension, add that. +- Add support for OCSP stapling
Index: mod_nss.c =================================================================== RCS file: /cvs/dirsec/mod_nss/mod_nss.c,v retrieving revision 1.18 retrieving revision 1.19 diff -u -r1.18 -r1.19 --- mod_nss.c 2 Mar 2010 20:12:04 -0000 1.18 +++ mod_nss.c 13 May 2010 15:21:25 -0000 1.19 @@ -142,6 +142,8 @@ SSL_CMD_SRV(ProxyNickname, TAKE1, "SSL Proxy: client certificate Nickname to be for proxy connections " "(`nickname')") + SSL_CMD_SRV(ProxyCheckPeerCN, FLAG, + "SSL Proxy: check the peers certificate CN")
#ifdef IGNORE /* Deprecated directives. */ @@ -238,23 +240,30 @@ SECStatus NSSBadCertHandler(void *arg, PRFileDesc * socket) { conn_rec *c = (conn_rec *)arg; + SSLSrvConfigRec *sc = mySrvConfig(c->base_server); PRErrorCode err = PR_GetError(); SECStatus rv = SECFailure; CERTCertificate *peerCert = SSL_PeerCertificate(socket); + const char *hostname_note;
switch (err) { case SSL_ERROR_BAD_CERT_DOMAIN: - if (c->remote_host != NULL) { - rv = CERT_VerifyCertName(peerCert, c->remote_host); - if (rv != SECSuccess) { - char *remote = CERT_GetCommonName(&peerCert->subject); + if (sc->proxy_ssl_check_peer_cn == TRUE) { + if ((hostname_note = apr_table_get(c->notes, "proxy-request-hostname")) != NULL) { + apr_table_unset(c->notes, "proxy-request-hostname"); + rv = CERT_VerifyCertName(peerCert, hostname_note); + if (rv != SECSuccess) { + char *remote = CERT_GetCommonName(&peerCert->subject); + ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL, + "SSL Proxy: Possible man-in-the-middle attack. The remove server is %s, we expected %s", remote, hostname_note); + PORT_Free(remote); + } + } else { ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL, - "SSL Proxy: Possible man-in-the-middle attack. The remove server is %s, we expected %s", remote, c->remote_host); - PORT_Free(remote); + "SSL Proxy: I don't have the name of the host we're supposed to connect to so I can't verify that we are connecting to who we think we should be. Giving up."); } } else { - ap_log_error(APLOG_MARK, APLOG_ERR, 0, NULL, - "SSL Proxy: I don't have the name of the host we're supposed to connect to so I can't verify that we are connecting to who we think we should be. Giving up. Hint: See Apache bug 36468."); + rv = SECSuccess; } break; default:
Index: mod_nss.h =================================================================== RCS file: /cvs/dirsec/mod_nss/mod_nss.h,v retrieving revision 1.21 retrieving revision 1.22 diff -u -r1.21 -r1.22 --- mod_nss.h 2 Mar 2010 20:12:04 -0000 1.21 +++ mod_nss.h 13 May 2010 15:21:25 -0000 1.22 @@ -306,6 +306,7 @@ int vhost_id_len; modnss_ctx_t *server; modnss_ctx_t *proxy; + BOOL proxy_ssl_check_peer_cn; };
/* @@ -410,6 +411,7 @@ const char *nss_cmd_NSSProxyProtocol(cmd_parms *, void *, const char *); const char *nss_cmd_NSSProxyCipherSuite(cmd_parms *, void *, const char *); const char *nss_cmd_NSSProxyNickname(cmd_parms *cmd, void *dcfg, const char *arg); +const char *nss_cmd_NSSProxyCheckPeerCN(cmd_parms *cmd, void *dcfg, int flag);
/* module initialization */ int nss_init_Module(apr_pool_t *, apr_pool_t *, apr_pool_t *, server_rec *);
Index: nss_engine_config.c =================================================================== RCS file: /cvs/dirsec/mod_nss/nss_engine_config.c,v retrieving revision 1.16 retrieving revision 1.17 diff -u -r1.16 -r1.17 --- nss_engine_config.c 2 Mar 2010 20:12:05 -0000 1.16 +++ nss_engine_config.c 13 May 2010 15:21:25 -0000 1.17 @@ -140,6 +140,7 @@ sc->vhost_id_len = 0; /* set during module init */ sc->proxy = NULL; sc->server = NULL; + sc->proxy_ssl_check_peer_cn = TRUE;
modnss_ctx_init_proxy(sc, p);
@@ -214,6 +215,7 @@ cfgMergeBool(fips); cfgMergeBool(enabled); cfgMergeBool(proxy_enabled); + cfgMergeBool(proxy_ssl_check_peer_cn);
modnss_ctx_cfg_merge_proxy(base->proxy, add->proxy, mrg->proxy);
@@ -544,6 +546,15 @@ return NULL; }
+const char *nss_cmd_NSSProxyCheckPeerCN(cmd_parms *cmd, void *dcfg, int flag) +{ + SSLSrvConfigRec *sc = mySrvConfig(cmd->server); + + sc->proxy_ssl_check_peer_cn = flag ? TRUE : FALSE; + + return NULL; +} + const char *nss_cmd_NSSEnforceValidCerts(cmd_parms *cmd, void *dcfg, int flag)
389-commits@lists.fedoraproject.org