TLS related patch for wu_ftpd snapshot
Paul V Ford-Hutchinson <[email protected]> Tue, 11 May 2004 17:43:14 +0100
| Newsgroups | gmane.network.ftp.wuftpd.devel |
|---|---|
| Message-ID | <OFBC796972.A8B074E1-ON80256E91.005A8C07-80256E91.005BAE21@uk.ibm.com> |
This is a multipart message in MIME format.
--=_alternative 005B861D80256E91_=
Content-Type: text/plain; charset="US-ASCII"
Please apply this patch to the current (11th May 2004) snapshot
It allows the server to be configured to ask for a password as well as
having X.509 client authentication for SSL
documentation, samples and code all included.
diff -r --unified snapshot/doc/HOWTO/ssl_and_tls_ftpd.HOWTO
uncompiled/doc/HOWTO/ssl_and_tls_ftpd.HOWTO
--- snapshot/doc/HOWTO/ssl_and_tls_ftpd.HOWTO Thu Mar 25 17:55:05 2004
+++ uncompiled/doc/HOWTO/ssl_and_tls_ftpd.HOWTO Tue May 11 17:19:29 2004
@@ -14,6 +14,12 @@
ssl_and_tls_ftpd.HOWTO
+Version 0.7 - May 11th 2004
+changes v0.6->0.7
+- add -z certpass
+Version 0.6
+changes v0.5->0.6
+- add -z notls, -z allowccc, -z rsader and -z logalldata
Version 0.5 - April 30th 2002
changes v0.4->0.5
- add -z CAfile and -z CApath options
@@ -276,6 +282,18 @@
certificate and will stop if one is not
presented.
+ "-z certpass=OPTION" - default option is "certok"
+
+ This tells the server how to handle sessions that have been
+ authenticated with X.509 certificates.
+ There are two options.
+ - 'certok' The Certificate is sufficient. A password
+ will not be requested and password commands
+ from the client will be rejected.
+ - 'needpass' Even if the session is X.509 client certificate
+ authenticated, a valid password must also be
+ supplied.
+
"-z password=PASSWORD" - there is no default password
This passes the specified password to the PEM decryption
diff -r --unified snapshot/doc/examples/ftpsd.conf
uncompiled/doc/examples/ftpsd.conf
--- snapshot/doc/examples/ftpsd.conf Thu Mar 25 17:54:29 2004
+++ uncompiled/doc/examples/ftpsd.conf Tue May 11 17:19:52 2004
@@ -73,6 +73,19 @@
#
authmode=client_can
#
+# What do we want to do about any PASS command once we have a
+# successfully authenticated session?
+#
+# certok (default):-
+# successful USER is replied to by 232
+# PASS commands give "5xx"
+#
+# needpass:-
+# successful USER is replied to by 331
+# PASS commands are processed as if the SSL authentication never took
place
+#
+certpass=certok
+#
# flags (all off by default)
#
# Don't check the CA of the client
diff -r --unified snapshot/doc/ftpd.8 uncompiled/doc/ftpd.8
--- snapshot/doc/ftpd.8 Tue Mar 30 16:10:03 2004
+++ uncompiled/doc/ftpd.8 Tue May 11 17:20:15 2004
@@ -567,6 +567,9 @@
.B \-z authmode=OPTION
specifies the authentication mode of the TLS session. OPTION is one of
"server", "client_can" and "client_must". The default value is
"client_can".
.PP
+.B \-z certpass=OPTION
+specifies more authentication options for a TLS session. OPTION is one
of "certok" or "needpass". The default value is "certok". Determines the
behaviouri for PASS if the session is client authenticated.
+.PP
.B \-z password=PASSWORD
specifies the password to be used to decrypt the pem key file(s).
.PP
diff -r --unified snapshot/src/ftpcmd.y uncompiled/src/ftpcmd.y
--- snapshot/src/ftpcmd.y Tue Mar 30 16:12:47 2004
+++ uncompiled/src/ftpcmd.y Tue May 11 17:20:29 2004
@@ -263,7 +263,8 @@
}
#if defined(USE_SECURITY)
- if (SEC_AUTH_REQUIRE_STRONG == get_auth_policy()) {
+ if (SEC_AUTH_REQUIRE_STRONG == get_auth_policy())
+ {
reply(500,"PASS command not valid");
syslog(LOG_INFO, "disallowed PASS");
} else
diff -r --unified snapshot/src/ftpd.c uncompiled/src/ftpd.c
--- snapshot/src/ftpd.c Tue May 4 12:18:00 2004
+++ uncompiled/src/ftpd.c Tue May 11 17:20:35 2004
@@ -2402,6 +2402,11 @@
tls_pass_passthrough = 1;
else
tls_pass_passthrough = 0;
+
+ if ((tls_pass_passthrough) && (! tls_allow_autologin())) {
+ tls_pass_passthrough = 0;
+ syslog(LOG_NOTICE, "User %s verified but not logged in by
TLS/X509 authentication", name);
+ }
if (tls_pass_passthrough) {
/* setting tls_pass_passthrough makes pass() skip pw check */
syslog(LOG_NOTICE, "User %s logged in by TLS/X509
authentication", name);
diff -r --unified snapshot/src/secutil.c uncompiled/src/secutil.c
--- snapshot/src/secutil.c Tue Mar 30 16:12:47 2004
+++ uncompiled/src/secutil.c Tue May 11 17:20:42 2004
@@ -184,6 +184,13 @@
{
policy = SEC_AUTH_ALLOWED_BY_PASS;
}
+ else
+ {
+ if(0 == tls_allow_autologin())
+ {
+ policy = SEC_AUTH_REQUIRE_BOTH;
+ }
+ }
break;
#endif /* USE_TLS */
default:
diff -r --unified snapshot/src/secutil.h uncompiled/src/secutil.h
--- snapshot/src/secutil.h Thu Mar 25 17:41:23 2004
+++ uncompiled/src/secutil.h Tue May 11 17:20:42 2004
@@ -101,10 +101,14 @@
* authentication mechanism which _must_ be
* used. The PASS command is never requested
nor
* accepted.
+ * SEC_AUTH_REQUIRE_BOTH - the "AUTH" mechanism has a strong
+ * authentication mechanism which _must_ be
+ * used. The PASS command also required
*/
#define SEC_AUTH_ALLOWED_BY_PASS 0
#define SEC_AUTH_REQUIRE_STRONG 1
+#define SEC_AUTH_REQUIRE_BOTH 2
/*
* SEC_CCC_ALLOWED - the 'CCC' command is allowed in an appropriate
diff -r --unified snapshot/src/tlsutil.c uncompiled/src/tlsutil.c
--- snapshot/src/tlsutil.c Thu Mar 25 17:51:13 2004
+++ uncompiled/src/tlsutil.c Tue May 11 17:20:47 2004
@@ -76,6 +76,13 @@
# define M_ASN1_BIT_STRING_cmp ASN1_BIT_STRING_cmp
# endif /* OPENSSL_VERSION_NUMBER < 0x00905100 */
+# define TLS_AUTH_SERVER 1
+# define TLS_AUTH_CLIENT_CAN 2
+# define TLS_AUTH_CLIENT_MUST 3
+
+# define TLS_CERTPASS_NOPASS 1
+# define TLS_CERTPASS_REQUIRE 2
+
# define DEFRSACERTFILE "ftpd-rsa.pem"
# define DEFRSAKEYFILE "ftpd-rsa-key.pem"
# define DEFDSACERTFILE "ftpd-dsa.pem"
@@ -87,10 +94,7 @@
# define DEFDEBUGFILE "ftpd.debug"
# define DEFSYSTEMCERTDIR "/usr/local/ftpsd/usercerts"
# define DEFAULTAUTHMODE TLS_AUTH_CLIENT_CAN
-
-# define TLS_AUTH_SERVER 1
-# define TLS_AUTH_CLIENT_CAN 2
-# define TLS_AUTH_CLIENT_MUST 3
+# define DEFAULTCERTPASSMODE TLS_CERTPASS_NOPASS
/* define if you want to check for OpenSSL-related memory leaks */
/*#define DEBUG_OPENSSL_MEM*/
@@ -122,6 +126,7 @@
int tls_force_data_prot_p;
int tls_only_client_cert_auth;
int tls_authentication_mode = DEFAULTAUTHMODE;
+int tls_certpass_mode = DEFAULTCERTPASSMODE;
char *tls_config_file = NULL;
int tls_config_file_PARM = 0;
@@ -138,6 +143,7 @@
int tls_rand_file_PARM = 0;
int tls_cipher_list_PARM = 0;
int tls_authentication_mode_PARM = 0;
+int tls_certpass_mode_PARM = 0;
void tls_start_debugging(void);
char *tls_debug_filename = NULL;
char *tls_system_certdir = NULL;
@@ -393,6 +399,18 @@
}
}
}
+ else if (!strcmp(optarg, "certpass")) {
+ if((TLS_OPTARG_PARM == parmOrFile) ||
+ (0 == tls_certpass_mode_PARM)) {
+ tls_certpass_mode_PARM = 1;
+ if(0 == strncmp(p,"certok",6)) {
+ tls_certpass_mode = TLS_CERTPASS_NOPASS;
+ }
+ if(0 == strncmp(p,"needpass",8)) {
+ tls_certpass_mode = TLS_CERTPASS_REQUIRE;
+ }
+ }
+ }
else if (!strcmp(optarg, "config")) {
if(TLS_OPTARG_PARM == parmOrFile) {
tls_update_parm(&tls_config_file,p,
@@ -837,6 +855,22 @@
return 1;
}
SSL_CTX_set_options(ssl_ctx, SSL_OP_NO_SSLv2);
+ switch(tls_certpass_mode)
+ {
+ case TLS_CERTPASS_NOPASS:
+# if defined(TLS_DEBUG)
+ tls_debug("tls - secure PASS commands will be rejected\n");
+# endif /* defined(TLS_DEBUG) */
+ break;
+ case TLS_CERTPASS_REQUIRE:
+# if defined(TLS_DEBUG)
+ tls_debug("tls - PASS required in addition to X.509 certs\n");
+# endif /* defined(TLS_DEBUG) */
+ break;
+ default:
+ syslog(LOG_ERR,"ftpsd coding error - bad certpass mode\n");
+ return 1;
+ }
switch(tls_authentication_mode)
{
case TLS_AUTH_SERVER:
@@ -2141,6 +2175,9 @@
"client_can" : "client_must")),
(tls_allow_ccc) ? "allow" : "deny",
(tls_log_all_data) ? "all" : "first tls");
+ tls_debug("wu-ftpd - certpass [%s]\n",
+ ((TLS_CERTPASS_NOPASS == tls_certpass_mode) ? "certok" :
+ "needpass" ));
tls_debug("wu-ftpd - and, finally, TLS is%sbeing used\n",
(tls_dont_use_tls) ? " not " : " ");
# endif /* defined(TLS_DEBUG) */
@@ -2253,4 +2290,20 @@
return(tls_bad_auth_ssl_reply);
}
+int tls_allow_autologin( void )
+ {
+ int autolog = 1;
+ switch(tls_certpass_mode)
+ {
+ case TLS_CERTPASS_NOPASS:
+ autolog = 1;
+ break;
+ case TLS_CERTPASS_REQUIRE:
+ autolog = 0;
+ break;
+ default:;
+ }
+ return(autolog);
+ }
+
#endif /* defined(USE_TLS) */
diff -r --unified snapshot/src/tlsutil.h uncompiled/src/tlsutil.h
--- snapshot/src/tlsutil.h Thu Mar 25 17:51:13 2004
+++ uncompiled/src/tlsutil.h Tue May 11 17:20:47 2004
@@ -106,6 +106,7 @@
void tls_ccc( void );
int tls_hack_allow_auth_ssl( void );
int tls_hack_bad_auth_ssl_reply( void );
+int tls_allow_autologin( void );
# define TLS_OPTARG_PARM 1
# define TLS_OPTARG_FILE 2
Thanks,
Paul
--
Paul Ford-Hutchinson : eCommerce application security :
[email protected]
MPT-6, IBM , PO Box 31, Birmingham Rd, Warwick, CV34 5JL +44 (0)1926
462005
http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html
--=_alternative 005B861D80256E91_=
Content-Type: text/html; charset="US-ASCII"
<br><font size=2 face="sans-serif">Please apply this patch to the current
(11th May 2004) snapshot </font>
<br>
<br><font size=2 face="sans-serif">It allows the server to be configured
to ask for a password as well as having X.509 client authentication for
SSL</font>
<br>
<br><font size=2 face="sans-serif">documentation, samples and code all
included.</font>
<br>
<br>
<br><font size=2 face="Courier New">diff -r --unified snapshot/doc/HOWTO/ssl_and_tls_ftpd.HOWTO
uncompiled/doc/HOWTO/ssl_and_tls_ftpd.HOWTO</font>
<br><font size=2 face="Courier New">--- snapshot/doc/HOWTO/ssl_and_tls_ftpd.HOWTO
Thu Mar 25 17:55:05 2004</font>
<br><font size=2 face="Courier New">+++ uncompiled/doc/HOWTO/ssl_and_tls_ftpd.HOWTO
Tue May 11 17:19:29 2004</font>
<br><font size=2 face="Courier New">@@ -14,6 +14,12 @@</font>
<br><font size=2 face="Courier New"> </font>
<br><font size=2 face="Courier New"> ssl_and_tls_ftpd.HOWTO</font>
<br><font size=2 face="Courier New"> </font>
<br><font size=2 face="Courier New">+Version 0.7 - May 11th 2004</font>
<br><font size=2 face="Courier New">+changes v0.6->0.7</font>
<br><font size=2 face="Courier New">+- add -z certpass</font>
<br><font size=2 face="Courier New">+Version 0.6</font>
<br><font size=2 face="Courier New">+changes v0.5->0.6</font>
<br><font size=2 face="Courier New">+- add -z notls, -z allowccc, -z rsader
and -z logalldata</font>
<br><font size=2 face="Courier New"> Version 0.5 - April 30th 2002</font>
<br><font size=2 face="Courier New"> changes v0.4->0.5</font>
<br><font size=2 face="Courier New"> - add -z CAfile and -z CApath
options</font>
<br><font size=2 face="Courier New">@@ -276,6 +282,18 @@</font>
<br><font size=2 face="Courier New">
certificate and
will stop if one is not</font>
<br><font size=2 face="Courier New">
presented.</font>
<br><font size=2 face="Courier New"> </font>
<br><font size=2 face="Courier New">+ "-z certpass=OPTION"
- default option is "certok"</font>
<br><font size=2 face="Courier New">+</font>
<br><font size=2 face="Courier New">+ This tells the
server how to handle sessions that have been </font>
<br><font size=2 face="Courier New">+ authenticated
with X.509 certificates.</font>
<br><font size=2 face="Courier New">+ There are two
options.</font>
<br><font size=2 face="Courier New">+ - 'certok'
The Certificate is sufficient. A password</font>
<br><font size=2 face="Courier New">+
will not be requested and
password commands</font>
<br><font size=2 face="Courier New">+
from the client will be
rejected.</font>
<br><font size=2 face="Courier New">+ - 'needpass'
Even if the session is X.509 client certificate</font>
<br><font size=2 face="Courier New">+
authenticated, a valid
password must also be</font>
<br><font size=2 face="Courier New">+
supplied.</font>
<br><font size=2 face="Courier New">+</font>
<br><font size=2 face="Courier New"> "-z password=PASSWORD"
- there is no default password </font>
<br><font size=2 face="Courier New"> </font>
<br><font size=2 face="Courier New"> This passes
the specified password to the PEM decryption</font>
<br><font size=2 face="Courier New">diff -r --unified snapshot/doc/examples/ftpsd.conf
uncompiled/doc/examples/ftpsd.conf</font>
<br><font size=2 face="Courier New">--- snapshot/doc/examples/ftpsd.conf
Thu Mar 25 17:54:29 2004</font>
<br><font size=2 face="Courier New">+++ uncompiled/doc/examples/ftpsd.conf
Tue May 11 17:19:52 2004</font>
<br><font size=2 face="Courier New">@@ -73,6 +73,19 @@</font>
<br><font size=2 face="Courier New"> #</font>
<br><font size=2 face="Courier New"> authmode=client_can</font>
<br><font size=2 face="Courier New"> #</font>
<br><font size=2 face="Courier New">+# What do we want to do about any
PASS command once we have a </font>
<br><font size=2 face="Courier New">+# successfully authenticated
session?</font>
<br><font size=2 face="Courier New">+#</font>
<br><font size=2 face="Courier New">+# certok (default):-</font>
<br><font size=2 face="Courier New">+# successful USER is replied
to by 232</font>
<br><font size=2 face="Courier New">+# PASS commands give "5xx"</font>
<br><font size=2 face="Courier New">+#</font>
<br><font size=2 face="Courier New">+# needpass:-</font>
<br><font size=2 face="Courier New">+# successful USER is replied
to by 331</font>
<br><font size=2 face="Courier New">+# PASS commands are processed
as if the SSL authentication never took place</font>
<br><font size=2 face="Courier New">+#</font>
<br><font size=2 face="Courier New">+certpass=certok</font>
<br><font size=2 face="Courier New">+#</font>
<br><font size=2 face="Courier New"> # flags (all off by default)</font>
<br><font size=2 face="Courier New"> #</font>
<br><font size=2 face="Courier New"> # Don't check the CA of the client</font>
<br><font size=2 face="Courier New">diff -r --unified snapshot/doc/ftpd.8
uncompiled/doc/ftpd.8</font>
<br><font size=2 face="Courier New">--- snapshot/doc/ftpd.8
Tue Mar 30 16:10:03 2004</font>
<br><font size=2 face="Courier New">+++ uncompiled/doc/ftpd.8
Tue May 11 17:20:15 2004</font>
<br><font size=2 face="Courier New">@@ -567,6 +567,9 @@</font>
<br><font size=2 face="Courier New"> .B \-z authmode=OPTION</font>
<br><font size=2 face="Courier New"> specifies the authentication
mode of the TLS session. OPTION is one of "server", "client_can"
and "client_must". The default value is "client_can".</font>
<br><font size=2 face="Courier New"> .PP</font>
<br><font size=2 face="Courier New">+.B \-z certpass=OPTION</font>
<br><font size=2 face="Courier New">+specifies more authentication options
for a TLS session. OPTION is one of "certok" or "needpass".
The default value is "certok". Determines the behaviouri
for PASS if the session is client authenticated.</font>
<br><font size=2 face="Courier New">+.PP</font>
<br><font size=2 face="Courier New"> .B \-z password=PASSWORD</font>
<br><font size=2 face="Courier New"> specifies the password to be
used to decrypt the pem key file(s).</font>
<br><font size=2 face="Courier New"> .PP</font>
<br><font size=2 face="Courier New">diff -r --unified snapshot/src/ftpcmd.y
uncompiled/src/ftpcmd.y</font>
<br><font size=2 face="Courier New">--- snapshot/src/ftpcmd.y
Tue Mar 30 16:12:47 2004</font>
<br><font size=2 face="Courier New">+++ uncompiled/src/ftpcmd.y
Tue May 11 17:20:29 2004</font>
<br><font size=2 face="Courier New">@@ -263,7 +263,8 @@</font>
<br><font size=2 face="Courier New">
}</font>
<br><font size=2 face="Courier New"> </font>
<br><font size=2 face="Courier New"> #if defined(USE_SECURITY)</font>
<br><font size=2 face="Courier New">-
if (SEC_AUTH_REQUIRE_STRONG == get_auth_policy()) {</font>
<br><font size=2 face="Courier New">+
if (SEC_AUTH_REQUIRE_STRONG == get_auth_policy()) </font>
<br><font size=2 face="Courier New">+
{</font>
<br><font size=2 face="Courier New">
reply(500,"PASS command not valid");</font>
<br><font size=2 face="Courier New">
syslog(LOG_INFO, "disallowed PASS");</font>
<br><font size=2 face="Courier New">
} else</font>
<br><font size=2 face="Courier New">diff -r --unified snapshot/src/ftpd.c
uncompiled/src/ftpd.c</font>
<br><font size=2 face="Courier New">--- snapshot/src/ftpd.c
Tue May 4 12:18:00 2004</font>
<br><font size=2 face="Courier New">+++ uncompiled/src/ftpd.c
Tue May 11 17:20:35 2004</font>
<br><font size=2 face="Courier New">@@ -2402,6 +2402,11 @@</font>
<br><font size=2 face="Courier New">
tls_pass_passthrough = 1;</font>
<br><font size=2 face="Courier New"> else</font>
<br><font size=2 face="Courier New">
tls_pass_passthrough = 0;</font>
<br><font size=2 face="Courier New">+</font>
<br><font size=2 face="Courier New">+ if ((tls_pass_passthrough)
&& (! tls_allow_autologin())) {</font>
<br><font size=2 face="Courier New">+
tls_pass_passthrough = 0;</font>
<br><font size=2 face="Courier New">+
syslog(LOG_NOTICE, "User %s verified but not logged in by TLS/X509
authentication", name);</font>
<br><font size=2 face="Courier New">+ }</font>
<br><font size=2 face="Courier New"> if
(tls_pass_passthrough) {</font>
<br><font size=2 face="Courier New">
/* setting tls_pass_passthrough makes pass() skip pw check
*/</font>
<br><font size=2 face="Courier New">
syslog(LOG_NOTICE, "User %s logged in by TLS/X509 authentication",
name);</font>
<br><font size=2 face="Courier New">diff -r --unified snapshot/src/secutil.c
uncompiled/src/secutil.c</font>
<br><font size=2 face="Courier New">--- snapshot/src/secutil.c
Tue Mar 30 16:12:47 2004</font>
<br><font size=2 face="Courier New">+++ uncompiled/src/secutil.c
Tue May 11 17:20:42 2004</font>
<br><font size=2 face="Courier New">@@ -184,6 +184,13 @@</font>
<br><font size=2 face="Courier New">
{</font>
<br><font size=2 face="Courier New">
policy = SEC_AUTH_ALLOWED_BY_PASS;</font>
<br><font size=2 face="Courier New">
}</font>
<br><font size=2 face="Courier New">+ else</font>
<br><font size=2 face="Courier New">+
{</font>
<br><font size=2 face="Courier New">+
if(0 == tls_allow_autologin())</font>
<br><font size=2 face="Courier New">+
{</font>
<br><font size=2 face="Courier New">+
policy = SEC_AUTH_REQUIRE_BOTH;</font>
<br><font size=2 face="Courier New">+
}</font>
<br><font size=2 face="Courier New">+
}</font>
<br><font size=2 face="Courier New">
break;</font>
<br><font size=2 face="Courier New"> #endif /* USE_TLS */</font>
<br><font size=2 face="Courier New"> default:</font>
<br><font size=2 face="Courier New">diff -r --unified snapshot/src/secutil.h
uncompiled/src/secutil.h</font>
<br><font size=2 face="Courier New">--- snapshot/src/secutil.h
Thu Mar 25 17:41:23 2004</font>
<br><font size=2 face="Courier New">+++ uncompiled/src/secutil.h
Tue May 11 17:20:42 2004</font>
<br><font size=2 face="Courier New">@@ -101,10 +101,14 @@</font>
<br><font size=2 face="Courier New"> *
authentication
mechanism which _must_ be</font>
<br><font size=2 face="Courier New"> *
used.
The PASS command is never requested nor</font>
<br><font size=2 face="Courier New"> *
accepted.</font>
<br><font size=2 face="Courier New">+ * SEC_AUTH_REQUIRE_BOTH -
the "AUTH" mechanism has a strong </font>
<br><font size=2 face="Courier New">+ *
authentication
mechanism which _must_ be</font>
<br><font size=2 face="Courier New">+ *
used. The
PASS command also required</font>
<br><font size=2 face="Courier New"> */</font>
<br><font size=2 face="Courier New"> </font>
<br><font size=2 face="Courier New"> #define SEC_AUTH_ALLOWED_BY_PASS
0</font>
<br><font size=2 face="Courier New"> #define SEC_AUTH_REQUIRE_STRONG
1</font>
<br><font size=2 face="Courier New">+#define SEC_AUTH_REQUIRE_BOTH
2</font>
<br><font size=2 face="Courier New"> </font>
<br><font size=2 face="Courier New"> /*</font>
<br><font size=2 face="Courier New"> * SEC_CCC_ALLOWED
- the 'CCC' command is allowed in an appropriate</font>
<br><font size=2 face="Courier New">diff -r --unified snapshot/src/tlsutil.c
uncompiled/src/tlsutil.c</font>
<br><font size=2 face="Courier New">--- snapshot/src/tlsutil.c
Thu Mar 25 17:51:13 2004</font>
<br><font size=2 face="Courier New">+++ uncompiled/src/tlsutil.c
Tue May 11 17:20:47 2004</font>
<br><font size=2 face="Courier New">@@ -76,6 +76,13 @@</font>
<br><font size=2 face="Courier New"> # define M_ASN1_BIT_STRING_cmp
ASN1_BIT_STRING_cmp</font>
<br><font size=2 face="Courier New"> # endif /* OPENSSL_VERSION_NUMBER
< 0x00905100 */ </font>
<br><font size=2 face="Courier New"> </font>
<br><font size=2 face="Courier New">+# define TLS_AUTH_SERVER
1</font>
<br><font size=2 face="Courier New">+# define TLS_AUTH_CLIENT_CAN
2</font>
<br><font size=2 face="Courier New">+# define TLS_AUTH_CLIENT_MUST
3</font>
<br><font size=2 face="Courier New">+</font>
<br><font size=2 face="Courier New">+# define TLS_CERTPASS_NOPASS
1</font>
<br><font size=2 face="Courier New">+# define TLS_CERTPASS_REQUIRE
2</font>
<br><font size=2 face="Courier New">+</font>
<br><font size=2 face="Courier New"> # define DEFRSACERTFILE
"ftpd-rsa.pem"</font>
<br><font size=2 face="Courier New"> # define DEFRSAKEYFILE
"ftpd-rsa-key.pem"
</font>
<br><font size=2 face="Courier New"> # define DEFDSACERTFILE
"ftpd-dsa.pem"</font>
<br><font size=2 face="Courier New">@@ -87,10 +94,7 @@</font>
<br><font size=2 face="Courier New"> # define DEFDEBUGFILE
"ftpd.debug"</font>
<br><font size=2 face="Courier New"> # define DEFSYSTEMCERTDIR
"/usr/local/ftpsd/usercerts"</font>
<br><font size=2 face="Courier New"> # define DEFAULTAUTHMODE
TLS_AUTH_CLIENT_CAN</font>
<br><font size=2 face="Courier New">-</font>
<br><font size=2 face="Courier New">-# define TLS_AUTH_SERVER
1</font>
<br><font size=2 face="Courier New">-# define TLS_AUTH_CLIENT_CAN
2</font>
<br><font size=2 face="Courier New">-# define TLS_AUTH_CLIENT_MUST
3</font>
<br><font size=2 face="Courier New">+# define DEFAULTCERTPASSMODE
TLS_CERTPASS_NOPASS</font>
<br><font size=2 face="Courier New"> </font>
<br><font size=2 face="Courier New"> /* define if you want to check
for OpenSSL-related memory leaks */</font>
<br><font size=2 face="Courier New"> /*#define DEBUG_OPENSSL_MEM*/</font>
<br><font size=2 face="Courier New">@@ -122,6 +126,7 @@</font>
<br><font size=2 face="Courier New"> int tls_force_data_prot_p;</font>
<br><font size=2 face="Courier New"> int tls_only_client_cert_auth;</font>
<br><font size=2 face="Courier New"> int
tls_authentication_mode = DEFAULTAUTHMODE;</font>
<br><font size=2 face="Courier New">+int tls_certpass_mode
= DEFAULTCERTPASSMODE;</font>
<br><font size=2 face="Courier New"> char
*tls_config_file = NULL;</font>
<br><font size=2 face="Courier New"> </font>
<br><font size=2 face="Courier New"> int
tls_config_file_PARM = 0;</font>
<br><font size=2 face="Courier New">@@ -138,6 +143,7 @@</font>
<br><font size=2 face="Courier New"> int
tls_rand_file_PARM = 0;</font>
<br><font size=2 face="Courier New"> int
tls_cipher_list_PARM = 0;</font>
<br><font size=2 face="Courier New"> int
tls_authentication_mode_PARM = 0;</font>
<br><font size=2 face="Courier New">+int tls_certpass_mode_PARM
= 0;</font>
<br><font size=2 face="Courier New"> void tls_start_debugging(void);</font>
<br><font size=2 face="Courier New"> char *tls_debug_filename
= NULL;</font>
<br><font size=2 face="Courier New"> char *tls_system_certdir
= NULL;</font>
<br><font size=2 face="Courier New">@@ -393,6 +399,18 @@</font>
<br><font size=2 face="Courier New">
}</font>
<br><font size=2 face="Courier New">
}</font>
<br><font size=2 face="Courier New"> }</font>
<br><font size=2 face="Courier New">+ else
if (!strcmp(optarg, "certpass")) {</font>
<br><font size=2 face="Courier New">+
if((TLS_OPTARG_PARM == parmOrFile) ||</font>
<br><font size=2 face="Courier New">+
(0 == tls_certpass_mode_PARM)) {</font>
<br><font size=2 face="Courier New">+
tls_certpass_mode_PARM = 1;</font>
<br><font size=2 face="Courier New">+
if(0 == strncmp(p,"certok",6)) {</font>
<br><font size=2 face="Courier New">+
tls_certpass_mode = TLS_CERTPASS_NOPASS;</font>
<br><font size=2 face="Courier New">+
}</font>
<br><font size=2 face="Courier New">+
if(0 == strncmp(p,"needpass",8)) {</font>
<br><font size=2 face="Courier New">+
tls_certpass_mode = TLS_CERTPASS_REQUIRE;</font>
<br><font size=2 face="Courier New">+
}</font>
<br><font size=2 face="Courier New">+
}</font>
<br><font size=2 face="Courier New">+ }</font>
<br><font size=2 face="Courier New"> else
if (!strcmp(optarg, "config")) {</font>
<br><font size=2 face="Courier New">
if(TLS_OPTARG_PARM == parmOrFile) {</font>
<br><font size=2 face="Courier New">
tls_update_parm(&tls_config_file,p,</font>
<br><font size=2 face="Courier New">@@ -837,6 +855,22 @@</font>
<br><font size=2 face="Courier New"> return
1;</font>
<br><font size=2 face="Courier New"> }</font>
<br><font size=2 face="Courier New"> SSL_CTX_set_options(ssl_ctx,
SSL_OP_NO_SSLv2);</font>
<br><font size=2 face="Courier New">+ switch(tls_certpass_mode)</font>
<br><font size=2 face="Courier New">+ {</font>
<br><font size=2 face="Courier New">+ case TLS_CERTPASS_NOPASS:</font>
<br><font size=2 face="Courier New">+# if defined(TLS_DEBUG)</font>
<br><font size=2 face="Courier New">+ tls_debug("tls
- secure PASS commands will be rejected\n");</font>
<br><font size=2 face="Courier New">+# endif /* defined(TLS_DEBUG)
*/ </font>
<br><font size=2 face="Courier New">+ break;</font>
<br><font size=2 face="Courier New">+ case TLS_CERTPASS_REQUIRE:</font>
<br><font size=2 face="Courier New">+# if defined(TLS_DEBUG)</font>
<br><font size=2 face="Courier New">+ tls_debug("tls
- PASS required in addition to X.509 certs\n");</font>
<br><font size=2 face="Courier New">+# endif /* defined(TLS_DEBUG)
*/ </font>
<br><font size=2 face="Courier New">+ break;</font>
<br><font size=2 face="Courier New">+ default:</font>
<br><font size=2 face="Courier New">+ syslog(LOG_ERR,"ftpsd
coding error - bad certpass mode\n");</font>
<br><font size=2 face="Courier New">+ return
1;</font>
<br><font size=2 face="Courier New">+ }</font>
<br><font size=2 face="Courier New"> switch(tls_authentication_mode)</font>
<br><font size=2 face="Courier New"> {</font>
<br><font size=2 face="Courier New"> case TLS_AUTH_SERVER:</font>
<br><font size=2 face="Courier New">@@ -2141,6 +2175,9 @@</font>
<br><font size=2 face="Courier New">
"client_can" : "client_must")),</font>
<br><font size=2 face="Courier New">
(tls_allow_ccc) ? "allow" : "deny",</font>
<br><font size=2 face="Courier New">
(tls_log_all_data) ? "all" : "first tls");</font>
<br><font size=2 face="Courier New">+ tls_debug("wu-ftpd -
certpass [%s]\n",</font>
<br><font size=2 face="Courier New">+
((TLS_CERTPASS_NOPASS == tls_certpass_mode) ? "certok"
:</font>
<br><font size=2 face="Courier New">+
"needpass" ));</font>
<br><font size=2 face="Courier New"> tls_debug("wu-ftpd
- and, finally, TLS is%sbeing used\n",</font>
<br><font size=2 face="Courier New">
(tls_dont_use_tls) ? " not " : " ");</font>
<br><font size=2 face="Courier New"> # endif /* defined(TLS_DEBUG)
*/ </font>
<br><font size=2 face="Courier New">@@ -2253,4 +2290,20 @@</font>
<br><font size=2 face="Courier New"> return(tls_bad_auth_ssl_reply);</font>
<br><font size=2 face="Courier New"> }</font>
<br><font size=2 face="Courier New"> </font>
<br><font size=2 face="Courier New">+int tls_allow_autologin( void )</font>
<br><font size=2 face="Courier New">+ {</font>
<br><font size=2 face="Courier New">+ int autolog = 1;</font>
<br><font size=2 face="Courier New">+ switch(tls_certpass_mode)</font>
<br><font size=2 face="Courier New">+ {</font>
<br><font size=2 face="Courier New">+ case TLS_CERTPASS_NOPASS:</font>
<br><font size=2 face="Courier New">+ autolog
= 1;</font>
<br><font size=2 face="Courier New">+ break;</font>
<br><font size=2 face="Courier New">+ case TLS_CERTPASS_REQUIRE:</font>
<br><font size=2 face="Courier New">+ autolog
= 0;</font>
<br><font size=2 face="Courier New">+ break;</font>
<br><font size=2 face="Courier New">+ default:;</font>
<br><font size=2 face="Courier New">+ }</font>
<br><font size=2 face="Courier New">+ return(autolog);</font>
<br><font size=2 face="Courier New">+ }</font>
<br><font size=2 face="Courier New">+</font>
<br><font size=2 face="Courier New"> #endif /* defined(USE_TLS) */
</font>
<br><font size=2 face="Courier New">diff -r --unified snapshot/src/tlsutil.h
uncompiled/src/tlsutil.h</font>
<br><font size=2 face="Courier New">--- snapshot/src/tlsutil.h
Thu Mar 25 17:51:13 2004</font>
<br><font size=2 face="Courier New">+++ uncompiled/src/tlsutil.h
Tue May 11 17:20:47 2004</font>
<br><font size=2 face="Courier New">@@ -106,6 +106,7 @@</font>
<br><font size=2 face="Courier New"> void tls_ccc( void );</font>
<br><font size=2 face="Courier New"> int tls_hack_allow_auth_ssl(
void );</font>
<br><font size=2 face="Courier New"> int tls_hack_bad_auth_ssl_reply(
void );</font>
<br><font size=2 face="Courier New">+int tls_allow_autologin( void );</font>
<br><font size=2 face="Courier New"> </font>
<br><font size=2 face="Courier New"> # define TLS_OPTARG_PARM
1</font>
<br><font size=2 face="Courier New"> # define TLS_OPTARG_FILE
2</font>
<br>
<br><font size=2 face="sans-serif">Thanks,</font>
<br><font size=2 face="sans-serif">Paul</font>
<br><font size=2 face="sans-serif"><br>
--<br>
Paul Ford-Hutchinson : eCommerce application security : [email protected]<br>
MPT-6, IBM , PO Box 31, Birmingham Rd, Warwick, CV34 5JL +44 (0)1926 462005<br>
http://www.ford-hutchinson.com/~fh-1-pfh/ftps-ext.html<br>
</font>
--=_alternative 005B861D80256E91_=--