Elliot,
Am 17.01.20 um 05:35 schrieb Elliot Otchet:
> An updated patch for your consideration. Let me know what you think.
>
I have some very minor suggestions:
> Subject: [PATCH] MEDIUM: ssl: Add support for returning the dn samples from
> ssl_(c|f)_(i|s)_dn in LDAP v3 (RFC2253) format.
>
> Modifies the existing sample extraction methods (smp_fetch_ssl_x_i_dn,
> smp_fetch_ssl_x_s_dn) to accommodate a third argument that indicates the DN
> should be returned in LDAP v3 format. When the third argument is present, the
> new function (ssl_sock_get_dn_formatted) is called with three parameters
> including the X509_NAME, a buffer containing the format argument, and a
> buffer for the output. If the supplied format matches the supported format
> string (currently only "rfc2253" is supported), the formatted value is
> extracted into the supplied output buffer using OpenSSL's X509_NAME_print_ex
> and BIO_s_mem. 1 is returned when a dn value is retrieved. 0 is returned
> when a value is not retrieved.
>
> Argument validation is added to each of the related sample configurations to
> ensure the third argument passed is either blank or "rfc2253". An error is
> returned if the third argument is present with any other value.
>
> Documentation was updated in configuration.txt and it was noted during
> preliminary reviews that a CLEANUP patch should follow that adjusts the
> documentation. Currently, this patch and the existing documentation are
> copied with some minor revisions for each sample configuration. It might be
> better to have one entry for all of the samples or entries for each that
> reference back to a primary entry that explains the sample in detail.
>
> Special thanks to Chris, Willy, Tim and Aleks for the feedback.
For future patches I recommend hard wrapping the commit message body at
around 74 characters for consistency with existing commit messages.
> @@ -11103,6 +11144,21 @@ err:
> }
> # endif
>
> +/* Argument validation functions */
> +
> +/* This function is used to validate the arguments passed to any "x_dn" ssl
> + * keywords. These keywords support specifying a third parameter that must be
> + * either empty or the value "rfc2253". Returns 0 on error, non-zero if OK.
> + */
> +int val_dnfmt(struct arg *arg, char **err_msg)
> +{
> + if (arg && arg[2].type == ARGT_STR && arg[2].data.str.data > 0 &&
> (strncmp(arg[2].data.str.area,"rfc2253",7) != 0)) {
I did not test, but if I am not mistaken this would allow "rfc2253XXX"
as the format parameter, no? Meaning: It allows one to append arbitrary
garbage to the rfc2253 value.
Judging from `smp_check_const_bool` in sample.c a simple strcmp should
be safe to use or you can just use the chunk_strcmp you already use in
`ssl_sock_get_dn_formatted`, I guess. Does Willy have any strong opinion
about this?
Also, minor nit: There's a space missing after the commas in the strncmp
call.
> + memprintf(err_msg, "only rfc2253 or a blank value are currently
> supported as the format argument.");
> + return 0;
> + }
> + return 1;
> +}
> +
> /* register cli keywords */
> static struct cli_kw_list cli_kws = {{ },{
> #if (defined SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB && TLS_TICKETS_NO > 0)
Best regards
Tim Düsterhus
