Additional EAP-TLS Logging Option
Ross, Michael
michael.ross2 at boeing.com
Mon Aug 16 16:38:44 CEST 2010
> Alan DeKok wrote:
>
> Yes, there's interest. It's hard to easily see what the feature is without a patch. There are a lot of features that get discussed, but the patches
>do something else entirely.
>
> Use "git" (http://git.freeradius.org). Or save a copy of the original file in the same directory, and do a "diff". Patches should be simple to create.
>
Here is the patch for this feature.
>From 1a10cbf69b07b049e1e452b63d1fb333650b10ac Mon Sep 17 00:00:00 2001
From: Mike Ross <Michael.Ross2 at Boeing.com>
Date: Sun, 15 Aug 2010 15:49:46 -0700
Subject: [PATCH] Added option for certificate logging to EAP TLS authentication
---
raddb/eap.conf | 9 ++
.../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c | 97 ++++++++++++++++++-
.../rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h | 3 +
3 files changed, 103 insertions(+), 6 deletions(-)
diff --git a/raddb/eap.conf b/raddb/eap.conf
index 75098b1..cf31708 100644
--- a/raddb/eap.conf
+++ b/raddb/eap.conf
@@ -249,6 +249,15 @@
#
# check_cert_cn = %{User-Name}
#
+
+ #
+ # If log_certificates is set, the Issuer,
+ # Serial Number, Expiration Date, and
+ # Subject of the client certificate are
+ # written to the log file.
+ #
+ # log_certificates = yes
+
# Set this option to specify the allowed
# TLS cipher suites. The format is listed
# in "man 1 ciphers".
diff --git a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c
index 11ed96a..466df22 100644
--- a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c
+++ b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c
@@ -20,6 +20,7 @@
* Copyright 2001 hereUare Communications, Inc. <raghud at hereuare.com>
* Copyright 2003 Alan DeKok <aland at freeradius.org>
* Copyright 2006 The FreeRADIUS server project
+ * Copyright 2010 The Boeing Company
*
*/
@@ -94,6 +95,8 @@ static CONF_PARSER module_config[] = {
offsetof(EAP_TLS_CONF, cipher_list), NULL, NULL},
{ "check_cert_issuer", PW_TYPE_STRING_PTR,
offsetof(EAP_TLS_CONF, check_cert_issuer), NULL, NULL},
+ { "log_certificates", PW_TYPE_BOOLEAN,
+ offsetof(EAP_TLS_CONF, log_certificates), NULL, "no" },
{ "make_cert_command", PW_TYPE_STRING_PTR,
offsetof(EAP_TLS_CONF, make_cert_command), NULL, NULL},
@@ -102,6 +105,77 @@ static CONF_PARSER module_config[] = {
{ NULL, -1, 0, NULL, NULL } /* end the list */
};
+/*
+ *
+ * Write the certificate serial number, expiration
+ * date, issuer, and subject to the log file
+ */
+static int log_full_cert(int ok, X509 *cert)
+{
+ const int ub_serial = 20;
+ const int ub_time = 15;
+
+ char serialNumber[2*ub_serial+1];
+ char expiration[ub_time+1];
+ char issuer[ub_name+1];
+ char subject[ub_name+1];
+ char *pTemp = NULL;
+ int local_ok = ok;
+ int i = 0;
+ ASN1_INTEGER *pSn = NULL;
+ ASN1_TIME *pTime = NULL;
+
+ /*
+ * Get the Serial Number and format for display
+ */
+ serialNumber[0] = '\0';
+ pSn = X509_get_serialNumber(cert);
+ pTemp = serialNumber;
+ if ( pSn == NULL || pSn->length > ub_serial ) {
+ radlog(L_AUTH, "rlm_eap_tls: Malformed Certificate Serial Number");
+ local_ok = 0;
+ } else {
+ for (i = 0; i < pSn->length; i++) {
+ sprintf(pTemp, "%02x", (int)pSn->data[i]);
+ pTemp += 2;
+ }
+ }
+
+ /*
+ * Get the Expiration Date and format for display
+ */
+ expiration[0] = '\0';
+ pTime = X509_get_notAfter(cert);
+ if ( pTime == NULL || pTime->length > ub_time ) {
+ radlog(L_AUTH, "rlm_eap_tls: Malformed Certificate Expiration");
+ local_ok = 0;
+ } else {
+ strncpy(expiration, (char*) pTime->data, pTime->length);
+ expiration[pTime->length] = '\0';
+ }
+
+ /*
+ * Get the Issuer
+ */
+ issuer[0] = '\0';
+ X509_NAME_oneline(X509_get_issuer_name(cert), issuer,
+ ub_name);
+
+ /*
+ * Get the Subject
+ */
+ subject[0] = '\0';
+ X509_NAME_oneline(X509_get_subject_name(cert), subject,
+ ub_name);
+
+ /*
+ * Log required attributes
+ */
+ radlog(L_AUTH, "Certificate: Serial=%s; Expiration=%s; Issuer:%s; Subject:%s",
+ serialNumber, expiration, issuer, subject);
+
+ return local_ok;
+}
/*
* TODO: Check for the type of key exchange * like conf->dh_key
@@ -256,12 +330,6 @@ static int cbtls_verify(int ok, X509_STORE_CTX *ctx)
err = X509_STORE_CTX_get_error(ctx);
depth = X509_STORE_CTX_get_error_depth(ctx);
- if (!my_ok) {
- radlog(L_ERR,"--> verify error:num=%d:%s\n",err,
- X509_verify_cert_error_string(err));
- return my_ok;
- }
-
/*
* Retrieve the pointer to the SSL of the connection currently treated
* and the application specific data stored into the SSL object.
@@ -271,6 +339,15 @@ static int cbtls_verify(int ok, X509_STORE_CTX *ctx)
request = handler->request;
conf = (EAP_TLS_CONF *)SSL_get_ex_data(ssl, 1);
+ if (!my_ok) {
+ radlog(L_ERR,"--> verify error:num=%d:%s\n",err,
+ X509_verify_cert_error_string(err));
+ if (conf->log_certificates) {
+ log_full_cert(my_ok, client_cert);
+ }
+ return my_ok;
+ }
+
/*
* Get the Subject & Issuer
*/
@@ -346,6 +423,14 @@ static int cbtls_verify(int ok, X509_STORE_CTX *ctx)
}
}
} /* check_cert_cn */
+
+ /*
+ * If the conf telss us to, log the certificate
+ */
+ if (conf->log_certificates) {
+ my_ok = log_full_cert(my_ok, client_cert);
+ }
+
} /* depth == 0 */
if (debug_flag > 0) {
diff --git a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h
index 470dbcd..7846d1e 100644
--- a/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h
+++ b/src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.h
@@ -20,6 +20,8 @@
* Copyright 2001 hereUare Communications, Inc. <raghud at hereuare.com>
* Copyright 2003 Alan DeKok <aland at freeradius.org>
* Copyright 2006 The FreeRADIUS server project
+ * Copyright 2010 The Boeing Company
+ *
*/
#ifndef _RLM_EAP_TLS_H
#define _RLM_EAP_TLS_H
@@ -59,6 +61,7 @@ typedef struct eap_tls_conf {
char *check_cert_cn;
char *cipher_list;
char *check_cert_issuer;
+ int log_certificates;
int session_cache_enable;
int session_timeout;
--
1.7.0.4
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-Added-option-for-certificate-logging-to-EAP-TLS-auth.patch
Type: application/octet-stream
Size: 5773 bytes
Desc: 0001-Added-option-for-certificate-logging-to-EAP-TLS-auth.patch
URL: <http://lists.freeradius.org/pipermail/freeradius-devel/attachments/20100816/7b97e326/attachment.obj>
More information about the Freeradius-Devel
mailing list