auth: Allow ssl cert to be validated by fingerprint

diff --git a/src/auth/auth-request-handler.c b/src/auth/auth-request-handler.c
index 35acb240b99393464370efe84bdd5565e1314dc5..6e007852be18b405f798d731b2c641d5a53f643e 100644 (file)
--- a/src/auth/auth-request-handler.c
+++ b/src/auth/auth-request-handler.c
@@ -668,8 +668,20 @@ int auth_request_handler_auth_begin(struct auth_request_handler *handler,
                                        auth_request_timeout, request);
        hash_table_insert(handler->requests, POINTER_CAST(id), request);
 
+       /* If the provided certificate is not valid (untrusted CA signature),
+          we allow continuing only if there are fingerprints for the certificate
+          too. If there are no certificate fingerprints, we can already fail
+          here.
+
+          Actual validity is re-checked after authentication, so that
+          certificate fingeprints can be checked too.
+       */
        if (request->set->ssl_require_client_cert &&
-           !request->fields.valid_client_cert) {
+           !request->fields.valid_client_cert &&
+           (request->fields.ssl_client_cert_fp == NULL ||
+            *request->fields.ssl_client_cert_fp == '\0') &&
+           (request->fields.ssl_client_cert_pubkey_fp == NULL ||
+            *request->fields.ssl_client_cert_pubkey_fp == '\0')) {
                /* we fail without valid certificate */
                 auth_request_handler_auth_fail(handler, request,
                        "Client didn't present valid SSL certificate");

diff --git a/src/auth/auth-request.c b/src/auth/auth-request.c
index dab547f5e89cfd6fd9e698d58fd9d2eee136f494..07580e270e8998b17cad7b0d7b809e2c4aa6702a 100644 (file)
--- a/src/auth/auth-request.c
+++ b/src/auth/auth-request.c
@@ -702,6 +702,19 @@ void auth_request_passdb_lookup_end(struct auth_request *request,
                                    enum passdb_result result)
 {
        i_assert(array_count(&request->authdb_event) > 0);
+
+       /* If client certificates are required, ensure that something
+          checked the certificate, either it was valid due to CA checks
+          or certificate fingerprint checks. */
+       if (result == PASSDB_RESULT_OK &&
+           request->set->ssl_require_client_cert &&
+           !request->fields.valid_client_cert) {
+               const char *reply = "Client didn't present valid SSL certificate";
+               request->failed = TRUE;
+               auth_request_set_field(request, "reason", reply, STATIC_PASS_SCHEME);
+               result = PASSDB_RESULT_PASSWORD_MISMATCH;
+       }
+
        struct event *event = authdb_event(request);
        struct event_passthrough *e =
                event_create_passthrough(event)->