diff -up stunnel-5.56/src/ssl.c.verify-chain stunnel-5.56/src/ssl.c
--- stunnel-5.56/src/ssl.c.verify-chain 2021-02-17 00:37:28.950981672 +0100
+++ stunnel-5.56/src/ssl.c 2021-02-17 00:37:36.047053139 +0100
@@ -1,6 +1,6 @@
/*
* stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
@@ -39,7 +39,12 @@
#include "prototypes.h"
/* global OpenSSL initialization: compression, engine, entropy */
-#if OPENSSL_VERSION_NUMBER>=0x10100000L
+NOEXPORT void cb_new_auth(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+ int idx, long argl, void *argp);
+#if OPENSSL_VERSION_NUMBER>=0x30000000L
+NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
+ void **from_d, int idx, long argl, void *argp);
+#elif OPENSSL_VERSION_NUMBER>=0x10100000L
NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
void *from_d, int idx, long argl, void *argp);
#else
@@ -72,7 +77,7 @@ int ssl_init(void) { /* init TLS before
index_ssl_ctx_opt=SSL_CTX_get_ex_new_index(0,
"SERVICE_OPTIONS pointer", NULL, NULL, NULL);
index_session_authenticated=SSL_SESSION_get_ex_new_index(0,
- "session authenticated", NULL, NULL, NULL);
+ "session authenticated", cb_new_auth, NULL, NULL);
index_session_connect_address=SSL_SESSION_get_ex_new_index(0,
"session connect address", NULL, cb_dup_addr, cb_free_addr);
if(index_ssl_cli<0 || index_ssl_ctx_opt<0 ||
@@ -104,17 +109,31 @@ int DH_set0_pqg(DH *dh, BIGNUM *p, BIGNU
BN_free(dh->p);
BN_free(dh->q);
BN_free(dh->g);
- dh->p = p;
- dh->q = q;
- dh->g = g;
+ dh->p=p;
+ dh->q=q;
+ dh->g=g;
if(q)
- dh->length = BN_num_bits(q);
+ dh->length=BN_num_bits(q);
return 1;
}
#endif
#endif
-#if OPENSSL_VERSION_NUMBER>=0x10100000L
+NOEXPORT void cb_new_auth(void *parent, void *ptr, CRYPTO_EX_DATA *ad,
+ int idx, long argl, void *argp) {
+ (void)parent; /* squash the unused parameter warning */
+ (void)ptr; /* squash the unused parameter warning */
+ (void)argl; /* squash the unused parameter warning */
+ s_log(LOG_DEBUG, "Initializing application specific data for %s",
+ (char *)argp);
+ if(!CRYPTO_set_ex_data(ad, idx, (void *)(-1)))
+ sslerror("CRYPTO_set_ex_data");
+}
+
+#if OPENSSL_VERSION_NUMBER>=0x30000000L
+NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
+ void **from_d, int idx, long argl, void *argp) {
+#elif OPENSSL_VERSION_NUMBER>=0x10100000L
NOEXPORT int cb_dup_addr(CRYPTO_EX_DATA *to, const CRYPTO_EX_DATA *from,
void *from_d, int idx, long argl, void *argp) {
#else
diff -up stunnel-5.56/src/verify.c.verify-chain stunnel-5.56/src/verify.c
--- stunnel-5.56/src/verify.c.verify-chain 2021-02-17 00:37:11.577806692 +0100
+++ stunnel-5.56/src/verify.c 2021-02-17 00:37:42.542118546 +0100
@@ -1,6 +1,6 @@
/*
* stunnel TLS offloading and load-balancing proxy
- * Copyright (C) 1998-2019 Michal Trojnara <Michal.Trojnara@stunnel.org>
+ * Copyright (C) 1998-2020 Michal Trojnara <Michal.Trojnara@stunnel.org>
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
@@ -214,11 +214,15 @@ NOEXPORT int verify_callback(int preveri
s_log(LOG_INFO, "Certificate verification disabled");
return 1; /* accept */
}
- if(verify_checks(c, preverify_ok, callback_ctx)) {
+ if(verify_checks(c, preverify_ok, callback_ctx))
+ return 1; /* accept */
+ if(c->opt->option.client || c->opt->protocol)
+ return 0; /* reject */
+ if(c->opt->redirect_addr.names) {
SSL_SESSION *sess=SSL_get1_session(c->ssl);
if(sess) {
- int ok=SSL_SESSION_set_ex_data(sess, index_session_authenticated,
- (void *)(-1));
+ int ok=SSL_SESSION_set_ex_data(sess,
+ index_session_authenticated, NULL);
SSL_SESSION_free(sess);
if(!ok) {
sslerror("SSL_SESSION_set_ex_data");
@@ -227,10 +231,6 @@ NOEXPORT int verify_callback(int preveri
}
return 1; /* accept */
}
- if(c->opt->option.client || c->opt->protocol)
- return 0; /* reject */
- if(c->opt->redirect_addr.names)
- return 1; /* accept */
return 0; /* reject */
}
diff -up stunnel-5.56/tests/recipes/028_redirect_chain.verify-chain stunnel-5.56/tests/recipes/028_redirect_chain
--- stunnel-5.56/tests/recipes/028_redirect_chain.verify-chain 2021-02-17 00:38:44.823745781 +0100
+++ stunnel-5.56/tests/recipes/028_redirect_chain 2021-02-17 00:38:16.143456937 +0100
@@ -0,0 +1,50 @@
+#!/bin/sh
+
+# Redirect TLS client connections on certificate-based authentication failures.
+# [client_1] -> [server_1] -> [client_2] -> [server_2]
+# The success is expected because the client presents the *wrong* certificate
+# and the client connection is redirected.
+# Checking if the verifyChain option verifies the peer certificate starting from the root CA.
+
+. $(dirname $0)/../test_library
+
+start() {
+ ../../src/stunnel -fd 0 <<EOT
+ debug = debug
+ syslog = no
+ pid = ${result_path}/stunnel.pid
+ output = ${result_path}/stunnel.log
+
+ [client_1]
+ client = yes
+ accept = 127.0.0.1:${http1}
+ connect = 127.0.0.1:${https1}
+ ;cert = ${script_path}/certs/client_cert.pem
+;wrong self signed certificate
+ cert = ${script_path}/certs/stunnel.pem
+
+ [client_2]
+ client = yes
+ accept = 127.0.0.1:${http2}
+ connect = 127.0.0.1:${https2}
+
+ [server_1]
+ accept = 127.0.0.1:${https1}
+ exec = ${script_path}/execute
+ execArgs = execute 028_redirect_chain_error
+ redirect = ${http2}
+ cert = ${script_path}/certs/server_cert.pem
+ verifyChain = yes
+ CAfile = ${script_path}/certs/CACert.pem
+
+ [server_2]
+ accept = 127.0.0.1:${https2}
+ cert = ${script_path}/certs/server_cert.pem
+ exec = ${script_path}/execute
+ execArgs = execute 028_redirect_chain
+
+EOT
+}
+
+test_log_for "028_redirect_chain" "execute" "0" "$1" "$2" "$3" 2>> "stderr.log"
+exit $?
diff -up stunnel-5.56/tests/recipes/029_no_redirect_chain.verify-chain stunnel-5.56/tests/recipes/029_no_redirect_chain
--- stunnel-5.56/tests/recipes/029_no_redirect_chain.verify-chain 2021-02-17 00:38:57.819876672 +0100
+++ stunnel-5.56/tests/recipes/029_no_redirect_chain 2021-02-17 00:38:24.895545080 +0100
@@ -0,0 +1,49 @@
+#!/bin/sh
+
+# Do not redirect TLS client connections on certificate-based authentication success.
+# [client_1] -> [server_1]
+# The success is expected because the client presents the *correct* certificate
+# and the client connection isn't redirected.
+# Checking if the verifyChain option verifies the peer certificate starting from the root CA.
+
+. $(dirname $0)/../test_library
+
+start() {
+ ../../src/stunnel -fd 0 <<EOT
+ debug = debug
+ syslog = no
+ pid = ${result_path}/stunnel.pid
+ output = ${result_path}/stunnel.log
+
+ [client_1]
+ client = yes
+ accept = 127.0.0.1:${http1}
+ connect = 127.0.0.1:${https1}
+;correct certificate
+ cert = ${script_path}/certs/client_cert.pem
+
+ [client_2]
+ client = yes
+ accept = 127.0.0.1:${http2}
+ connect = 127.0.0.1:${https2}
+
+ [server_1]
+ accept = 127.0.0.1:${https1}
+ exec = ${script_path}/execute
+ execArgs = execute 029_no_redirect_chain
+ redirect = ${http2}
+ cert = ${script_path}/certs/server_cert.pem
+ verifyChain = yes
+ CAfile = ${script_path}/certs/CACert.pem
+
+ [server_2]
+ accept = 127.0.0.1:${https2}
+ cert = ${script_path}/certs/server_cert.pem
+ exec = ${script_path}/execute
+ execArgs = execute 029_no_redirect_chain_error
+
+EOT
+}
+
+test_log_for "029_no_redirect_chain" "execute" "0" "$1" "$2" "$3" 2>> "stderr.log"
+exit $?