From: Arran Cudbard-Bell Date: Tue, 7 Jan 2020 17:54:43 +0000 (-0600) Subject: Use correct options for specifying signing CA in rlm_rest Closes #3237 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7232c0502c8e20f6f18d56f308a7cc5d27dad4d3;p=thirdparty%2Ffreeradius-server.git Use correct options for specifying signing CA in rlm_rest Closes #3237 --- diff --git a/raddb/mods-available/rest b/raddb/mods-available/rest index 71f83fd8454..e8f3543ddb3 100644 --- a/raddb/mods-available/rest +++ b/raddb/mods-available/rest @@ -20,13 +20,76 @@ rest { # tls { # - # .Set options about the certificate. + # .Certificate validation options + # + # Specifies how the certificate(s) presented by the HTTPS server being contacted + # are validated, and which certificates (if any) to send to the HTTPS server. + # + + # + # ca_file:: PEM formatted file containing the chain to validate the HTTPS server's cert + # + # Should usually contain a concatenation of one or more intermediary CA + # files, shallowest (i.e. the one that signed the HTTPS server's cert) first, and + # deepest (the root CA) last. + # + # Providing a complete certificate chain here is the most common way of validating + # the certificate presented by a HTTPS server. + # +# ca_file = "${certdir}/cacert.pem" + + # + # ca_issuer_file:: PEM formatted file containing the CA that signed the HTTPS server's cert + # + # Specifies the certificate that directly signed the certificate presented by the + # HTTPS server. + # + # This configuration option can be used to prevent certificates passing validation that + # were signed by other intermediary CAs or root CAs in the trusted certificate chain. + # +# ca_issuer_file = "${certdir}/caissuer.pem" + + # + # ca_path:: A directory containing multiple root CA certs named by their hash + # + # See the OpenSSL documentation for more details: + # - https://www.openssl.org/docs/man1.1.0/man3/SSL_CTX_set_default_verify_paths.html + # - https://www.openssl.org/docs/man1.1.1/man1/c_rehash.html + # + # This configuration option should only be used when the HTTPS server being contacted + # is not known ahead of time (using a URL from an external source), and/or the CA used + # to sign the HTTPS server certificate is unknown. + # +# ca_path = "${certdir}" + + # + # certificate_file:: PEM formatted file containing the certificate we present to the HTTPS server + # + # Specifies a certificate and any intermediary CAs we should send to the HTTPS server. + # + # This file should usually contain the client certificate file first, then any + # intermediary signing CAs, shallowest (direct signee of the certificate_file) + # to deepest (signed directly by the root CA). + # +# certificate_file = /path/to/radius.pem + + # + # private_key_file:: PEM formatted file containing the private key for the specified certificate_file + # + # Must be specified if certificate_file is being used. # -# ca_file = ${certdir}/cacert.pem -# ca_path = ${certdir} -# certificate_file = /path/to/radius.crt # private_key_file = /path/to/radius.key + + # + # private_key_password:: Password used to decrypt the private key file. + # + # Should only be specified in the private_key_file is encrypted. + # # private_key_password = "supersecret" + + # + # random_file:: Source of random data used for various cryptographic functions. + # # random_file = /dev/urandom # @@ -37,8 +100,8 @@ rest { # [options="header,autowidth"] # |=== # | Option | Description - # | `no` | Don't even bother trying. - # | `yes` | verify the cert was issued by one of the trusted CAs. + # | `no` | Server certificate can be signed by any CA or be self-signed. + # | `yes` | Server certificate must be issued by one of the trusted CAs. # |=== # # Default is `yes` @@ -53,8 +116,8 @@ rest { # [options="header,autowidth"] # |=== # | Option | Description - # | `no` | Don't even bother trying. - # | `yes` | verify the CN in the certificate matches the host in the URI. + # | `no` | Server certificate CN can be any value. + # | `yes` | Server certificate CN matches the host in the URI. # |=== # # Default is `yes` diff --git a/src/modules/rlm_rest/rest.c b/src/modules/rlm_rest/rest.c index 63ad2239451..96aea748060 100644 --- a/src/modules/rlm_rest/rest.c +++ b/src/modules/rlm_rest/rest.c @@ -2038,7 +2038,8 @@ do {\ if (section->tls_certificate_file) SET_OPTION(CURLOPT_SSLCERT, section->tls_certificate_file); if (section->tls_private_key_file) SET_OPTION(CURLOPT_SSLKEY, section->tls_private_key_file); if (section->tls_private_key_password) SET_OPTION(CURLOPT_KEYPASSWD, section->tls_private_key_password); - if (section->tls_ca_file) SET_OPTION(CURLOPT_ISSUERCERT, section->tls_ca_file); + if (section->tls_ca_file) SET_OPTION(CURLOPT_CAINFO, section->tls_ca_file); + if (section->tls_ca_issuer_file) SET_OPTION(CURLOPT_ISSUERCERT, section->tls_ca_issuer_file); if (section->tls_ca_path) SET_OPTION(CURLOPT_CAPATH, section->tls_ca_path); if (section->tls_random_file) SET_OPTION(CURLOPT_RANDOM_FILE, section->tls_random_file); diff --git a/src/modules/rlm_rest/rest.h b/src/modules/rlm_rest/rest.h index a9596c2b193..eae0e061c15 100644 --- a/src/modules/rlm_rest/rest.h +++ b/src/modules/rlm_rest/rest.h @@ -146,6 +146,7 @@ typedef struct { char const *tls_private_key_file; char const *tls_private_key_password; char const *tls_ca_file; + char const *tls_ca_issuer_file; char const *tls_ca_path; char const *tls_random_file; bool tls_check_cert;