From c793d281ed73b08a13871fdd82a3101daff0dd0b Mon Sep 17 00:00:00 2001 From: Rob Crittenden Date: Nov 21 2018 16:50:37 +0000 Subject: Use ldap_str2dn to convert a subject into a DN Previously certmonger was parsing the subject itself using commas which didn't account for escaping. Instead rely on LDAP DN parsing. https://pagure.io/certmonger/issue/90 Signed-off-by: Rob Crittenden --- diff --git a/configure.ac b/configure.ac index 663c5b0..ad4b0ad 100644 --- a/configure.ac +++ b/configure.ac @@ -772,6 +772,8 @@ if ! ${configure_dist_target_only:-false} ; then AC_CHECK_HEADER(ldap.h,,AC_MSG_ERROR(ldap.h not found)) AC_CHECK_FUNC(ldap_initialize,,AC_CHECK_LIB(ldap,ldap_initialize)) AC_CHECK_FUNC(ldap_sasl_interactive_bind_s,,AC_CHECK_LIB(ldap,ldap_sasl_interactive_bind_s)) + AC_CHECK_FUNC(ldap_str2dn,,AC_CHECK_LIB(ldap,ldap_str2dn)) + AC_CHECK_FUNC(ldap_dnfree,,AC_CHECK_LIB(ldap,ldap_dnfree)) LDAP_CFLAGS="$CFLAGS" LDAP_LIBS="$LIBS" CFLAGS="$CFLAGSsave" diff --git a/src/Makefile.am b/src/Makefile.am index c871347..fe3b235 100644 --- a/src/Makefile.am +++ b/src/Makefile.am @@ -150,7 +150,7 @@ pkglibexecdir = $(libexecdir)/$(PACKAGE) getcert_CFLAGS = $(AM_CFLAGS) $(NSS_CFLAGS) $(UUID_CFLAGS) getcert_SOURCES = getcert.c tm.c tm.h getcert_LDADD = libcm.a $(GETCERT_LIBS) $(KRB5_LIBS) $(NSS_LIBS) $(UUID_LIBS) \ - $(POPT_LIBS) $(LTLIBICONV) + $(POPT_LIBS) $(LTLIBICONV) $(LDAP_LIBS) if WITH_IPA bin_PROGRAMS += ipa-getcert ipa_getcert_CFLAGS = $(getcert_CFLAGS) @@ -176,16 +176,16 @@ certmonger_getcert_CFLAGS = $(getcert_CFLAGS) certmonger_SOURCES = main.c env-system.c tm.c tm.h certmonger_LDADD = libcm.a \ $(OPENSSL_LIBS) $(CERTMONGER_LIBS) $(KRB5_LIBS) $(IDN_LIBS) \ - $(GMP_LIBS) $(UUID_LIBS) $(POPT_LIBS) $(LTLIBICONV) + $(GMP_LIBS) $(UUID_LIBS) $(POPT_LIBS) $(LTLIBICONV) $(LDAP_LIBS) certmonger_session_SOURCES = main.c env-session.c tm.c tm.h certmonger_session_LDADD = libcm.a \ $(OPENSSL_LIBS) $(CERTMONGER_LIBS) $(KRB5_LIBS) $(IDN_LIBS) \ - $(GMP_LIBS) $(UUID_LIBS) $(POPT_LIBS) $(LTLIBICONV) + $(GMP_LIBS) $(UUID_LIBS) $(POPT_LIBS) $(LTLIBICONV) $(LDAP_LIBS) noinst_PROGRAMS = tdbusm-check serial-check nl-check submit-x toklist tdbusm_check_SOURCES = tdbusm-check.c tm.c tm.h -tdbusm_check_LDADD = libcm.a $(CERTMONGER_LIBS) $(POPT_LIBS) -serial_check_LDADD = libcm.a $(CERTMONGER_LIBS) $(LTLIBICONV) -nl_check_LDADD = libcm.a $(CERTMONGER_LIBS) +tdbusm_check_LDADD = libcm.a $(CERTMONGER_LIBS) $(POPT_LIBS) $(LDAP_LIBS) +serial_check_LDADD = libcm.a $(CERTMONGER_LIBS) $(LTLIBICONV) $(LDAP_LIBS) +nl_check_LDADD = libcm.a $(CERTMONGER_LIBS) $(LDAP_LIBS) submit_x_CFLAGS = $(AM_CFLAGS) $(NSS_CFLAGS) -DCM_SUBMIT_X_MAIN submit_x_SOURCES = submit-x.c submit-x.h submit-u.c submit-u.h log.c log.h \ tm.c tm.h diff --git a/src/csrgen-o.c b/src/csrgen-o.c index 55b0a59..b3f3775 100644 --- a/src/csrgen-o.c +++ b/src/csrgen-o.c @@ -34,6 +34,8 @@ #include #include +#include + #include #include "certext.h" @@ -92,7 +94,10 @@ cm_csrgen_o_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry, NETSCAPE_SPKAC spkac; EVP_PKEY *pkey; BIGNUM *serialbn; - char buf[LINE_MAX], *p, *q, *s, *nickname, *pin, *password, *filename; + char buf[LINE_MAX], *s, *nickname, *pin, *password, *filename; + LDAPDN dn = NULL; + LDAPRDN rdn = NULL; + LDAPAVA *attr = NULL; unsigned char *extensions, *upassword, *bmp, *name, *up, *uq, md[CM_DIGEST_MAX]; char *spkidec, *mcb64, *nows; const char *default_cn = CM_DEFAULT_CERT_SUBJECT_CN, *spkihex = NULL; @@ -193,33 +198,28 @@ cm_csrgen_o_main(int fd, struct cm_store_ca *ca, struct cm_store_entry *entry, if ((subject == NULL) && (entry->cm_template_subject != NULL) && (strlen(entry->cm_template_subject) != 0)) { - /* This isn't really correct, but it will - * probably do for now. */ - p = entry->cm_template_subject; - q = p + strcspn(p, ","); + int ret; subject = X509_NAME_new(); if (subject != NULL) { - while (*p != '\0') { - if ((s = memchr(p, '=', q - p)) != NULL) { - *s = '\0'; - for (i = 0; p[i] != '\0'; i++) { - p[i] = toupper(p[i]); - } - X509_NAME_add_entry_by_txt(subject, - p, astring_type(p, s + 1, q - s - 1), - (unsigned char *) (s + 1), q - s - 1, - -1, 0); - *s = '='; - } else { + ret = ldap_str2dn(entry->cm_template_subject, &dn, LDAP_DN_FORMAT_LDAPV3); + if (ret == LDAP_SUCCESS) { + for (i = 0; dn[i] != NULL; i++) { + rdn = dn[i]; + + attr = rdn[0]; X509_NAME_add_entry_by_txt(subject, - "CN", astring_type("CN", p, q - p), - (unsigned char *) p, q - p, + attr->la_attr.bv_val, astring_type(attr->la_attr.bv_val, attr->la_value.bv_val, attr->la_value.bv_len), + (unsigned char *) attr->la_value.bv_val, attr->la_value.bv_len, -1, 0); } - p = q + strspn(q, ","); - q = p + strcspn(p, ","); + if (dn != NULL) + ldap_dnfree(dn); + } else { + X509_NAME_add_entry_by_txt(subject, + "CN", astring_type("CN", entry->cm_template_subject, -1), + (unsigned char *) entry->cm_template_subject, -1, -1, 0); + } } - } } if (subject == NULL) { subject = X509_NAME_new(); diff --git a/tests/tools/Makefile.am b/tests/tools/Makefile.am index b2c42ce..39fa954 100644 --- a/tests/tools/Makefile.am +++ b/tests/tools/Makefile.am @@ -3,7 +3,8 @@ AM_CFLAGS = $(TALLOC_CFLAGS) $(TEVENT_CFLAGS) $(DBUS_CFLAGS) $(KRB5_CFLAGS) \ $(POPT_CFLAGS) -I$(top_builddir)/src -I$(top_srcdir)/src LDADD = libtools.a $(top_builddir)/src/libcm.a $(top_srcdir)/src/env-system.c \ libtools.a $(OPENSSL_LIBS) $(CERTMONGER_LIBS) $(KRB5_LIBS) $(IDN_LIBS) \ - $(GMP_LIBS) $(UUID_LIBS) $(RESOLV_LIBS) $(POPT_LIBS) $(LTLIBICONV) + $(GMP_LIBS) $(UUID_LIBS) $(RESOLV_LIBS) $(POPT_LIBS) $(LTLIBICONV) \ + $(LDAP_LIBS) noinst_SCRIPTS = cachain.sh