Skip to content

Commit 47811e7

Browse files
chodges15saroshali-dbxChris Hodgeschodges15
authored
Client TLS: Add option to require a specific DNS name in Subject Alternate Name (#126)
 Signed-off-by: saroshali-dbx <[email protected]> Signed-off-by: chodges15 <[email protected]> Co-authored-by: saroshali-dbx <[email protected]> Co-authored-by: Chris Hodges <[email protected]> Co-authored-by: chodges15 <[email protected]>
1 parent b059844 commit 47811e7

7 files changed

+89
-15
lines changed

‎docs/web-configuration.md

+8-1
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,14 @@ tls_server_config:
3737
3838
# CA certificate for client certificate authentication to the server.
3939
[ client_ca_file: <filename> ]
40-
40+
41+
# Verify that the client certificate has a Subject Alternate Name (SAN)
42+
# which is an exact match to an entry in this list, else terminate the
43+
# connection. SAN match can be one or multiple of the following: DNS,
44+
# IP, e-mail, or URI address from https://pkg.go.dev/crypto/x509#Certificate.
45+
[ client_allowed_sans:
46+
[ - <string> ] ]
47+
4148
# Minimum TLS version that is acceptable.
4249
[ min_version: <string> | default = "TLS12" ]
4350

‎web/testdata/client2_selfsigned.key

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
-----BEGIN PRIVATE KEY-----
2-
MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDC8CYtAwKp1uLWXLXFE
3-
Ue2Bz6PijwHZcL7jAxtlk2dbW0GlRQ+rcalHCcnExIIKAAehZANiAATlPRxDnbJb
4-
Zq9u+jh7DyEJumQZFqjIDFdFxfHtI6hwyMtlL6FIwpqn3z4uXs2wx6/NsD4XOChy
5-
j/tXXKCHS/22+51TivjGA53c9bLgc4dK/uJJNSivp0kymbtA5vgKzJE=
2+
MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDCgZCrQEAUVqznwKRvu
3+
dwwi8wutaRaHHHWDd/IpjJopLhcdvONT7Fv57X0foCvmYFOhZANiAAR/zAKpT17i
4+
U9lmokwDicnziss91+vKhQjy2q4EAe1p7jJ9c/fPofP3Zd09pLhkAUONMu0myXjk
5+
piLE1vvL121tWg3E3F0MLjLBqiSWqSkEZjQj0YSk3NoGWX/gMgm8ZyA=
66
-----END PRIVATE KEY-----

‎web/testdata/client2_selfsigned.pem

+10-10
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
-----BEGIN CERTIFICATE-----
2-
MIIByjCCAU+gAwIBAgIUYcG9p4RzCRdvUGa9BWvc6rB/wMYwCgYIKoZIzj0EAwIw
3-
EDEOMAwGA1UEAwwFdGVzdDIwIBcNMjEwODIwMTUzMjE4WhgPMjEyMTA3MjcxNTMy
4-
MThaMBAxDjAMBgNVBAMMBXRlc3QyMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE5T0c
5-
Q52yW2avbvo4ew8hCbpkGRaoyAxXRcXx7SOocMjLZS+hSMKap98+Ll7NsMevzbA+
6-
Fzgoco/7V1ygh0v9tvudU4r4xgOd3PWy4HOHSv7iSTUor6dJMpm7QOb4CsyRo2gw
7-
ZjAdBgNVHQ4EFgQUWpsZ2aWo6WEI2LiNQXoWKYr0rlkwHwYDVR0jBBgwFoAUWpsZ
8-
2aWo6WEI2LiNQXoWKYr0rlkwDwYDVR0TAQH/BAUwAwEB/zATBgNVHSUEDDAKBggr
9-
BgEFBQcDAjAKBggqhkjOPQQDAgNpADBmAjEA/Mv4OjCqVw8PzxQW4FJmZNyJB4ps
10-
xkAUBRpDy75n64ICsWKX/Mille0bo+C8d63JAjEA3IH/y1O4oyCaawNpibfcwSZK
11-
7ND9Z+WTJi50EumXUWKirmb/V59ToH5nc10x7NDX
2+
MIIB3DCCAWGgAwIBAgIUJVN8KehL1MmccvLb/mHthSMfnnswCgYIKoZIzj0EAwIw
3+
EDEOMAwGA1UEAwwFdGVzdDMwIBcNMjMwMTEwMTgxMTAwWhgPMjEyMjEyMTcxODEx
4+
MDBaMBAxDjAMBgNVBAMMBXRlc3QzMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEf8wC
5+
qU9e4lPZZqJMA4nJ84rLPdfryoUI8tquBAHtae4yfXP3z6Hz92XdPaS4ZAFDjTLt
6+
Jsl45KYixNb7y9dtbVoNxNxdDC4ywaoklqkpBGY0I9GEpNzaBll/4DIJvGcgo3ow
7+
eDAdBgNVHQ4EFgQUvyvu/TnJyRS7OGdujTbWM/W07yMwHwYDVR0jBBgwFoAUvyvu
8+
/TnJyRS7OGdujTbWM/W07yMwDwYDVR0TAQH/BAUwAwEB/zAQBgNVHREECTAHggV0
9+
ZXN0MzATBgNVHSUEDDAKBggrBgEFBQcDAjAKBggqhkjOPQQDAgNpADBmAjEAt7HK
10+
knE2MzwZ2B2dgn1/q3ikWDiO20Hbd97jo3tmv87FcF2vMqqJpHjcldJqplfsAjEA
11+
sfAz49y6Sf6LNlNS+Fc/lbOOwcrlzC+J5GJ8OmNoQPsvvDvhzGbwFiVw1M2uMqtG
1212
-----END CERTIFICATE-----

‎web/testdata/web_config_auth_client_san.bad.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
tls_server_config:
2+
cert_file: "server.crt"
3+
key_file: "server.key"
4+
client_auth_type: "RequireAndVerifyClientCert"
5+
client_ca_file: "client2_selfsigned.pem"
6+
client_allowed_sans:
7+
- "bad"

‎web/testdata/web_config_auth_client_san.good.yaml

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
tls_server_config:
2+
cert_file: "server.crt"
3+
key_file: "server.key"
4+
client_auth_type: "RequireAndVerifyClientCert"
5+
client_ca_file: "client2_selfsigned.pem"
6+
client_allowed_sans:
7+
- "one"
8+
- "test3"
9+
- "two"

‎web/tls_config.go

+36
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@ type TLSConfig struct {
5252
MinVersion TLSVersion `yaml:"min_version"`
5353
MaxVersion TLSVersion `yaml:"max_version"`
5454
PreferServerCipherSuites bool `yaml:"prefer_server_cipher_suites"`
55+
ClientAllowedSans []string `yaml:"client_allowed_sans"`
5556
}
5657

5758
type FlagConfig struct {
@@ -67,6 +68,36 @@ func (t *TLSConfig) SetDirectory(dir string) {
6768
t.ClientCAs = config_util.JoinDir(dir, t.ClientCAs)
6869
}
6970

71+
// VerifyPeerCertificate will check the SAN entries of the client cert if there is configuration for it
72+
func (t *TLSConfig) VerifyPeerCertificate(rawCerts [][]byte, _ [][]*x509.Certificate) error {
73+
// sender cert comes first, see https://www.rfc-editor.org/rfc/rfc5246#section-7.4.2
74+
cert, err := x509.ParseCertificate(rawCerts[0])
75+
if err != nil {
76+
return fmt.Errorf("error parsing client certificate: %s", err)
77+
}
78+
79+
// Build up a slice of strings with all Subject Alternate Name values
80+
sanValues := append(cert.DNSNames, cert.EmailAddresses...)
81+
82+
for _, ip := range cert.IPAddresses {
83+
sanValues = append(sanValues, ip.String())
84+
}
85+
86+
for _, uri := range cert.URIs {
87+
sanValues = append(sanValues, uri.String())
88+
}
89+
90+
for _, sanValue := range sanValues {
91+
for _, allowedSan := range t.ClientAllowedSans {
92+
if sanValue == allowedSan {
93+
return nil
94+
}
95+
}
96+
}
97+
98+
return fmt.Errorf("could not find allowed SANs in client cert, found: %v", t.ClientAllowedSans)
99+
}
100+
70101
type HTTPConfig struct {
71102
HTTP2 bool `yaml:"http2"`
72103
Header map[string]string `yaml:"headers,omitempty"`
@@ -164,6 +195,11 @@ func ConfigToTLSConfig(c *TLSConfig) (*tls.Config, error) {
164195
cfg.ClientCAs = clientCAPool
165196
}
166197

198+
if c.ClientAllowedSans != nil {
199+
// verify that the client cert contains an allowed SAN
200+
cfg.VerifyPeerCertificate = c.VerifyPeerCertificate
201+
}
202+
167203
switch c.ClientAuth {
168204
case "RequestClientCert":
169205
cfg.ClientAuth = tls.RequestClientCert

‎web/tls_config_test.go

+15
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ var (
6767
"Bad certificate": regexp.MustCompile(`bad certificate`),
6868
"Invalid value": regexp.MustCompile(`invalid value for`),
6969
"Invalid header": regexp.MustCompile(`HTTP header ".*" can not be configured`),
70+
"Invalid client cert": regexp.MustCompile(`bad certificate`),
7071
}
7172
)
7273

@@ -347,6 +348,20 @@ func TestServerBehaviour(t *testing.T) {
347348
ClientCertificate: "client2_selfsigned",
348349
ExpectedError: ErrorMap["Bad certificate"],
349350
},
351+
{
352+
Name: `valid tls config yml and tls client with VerifyPeerCertificate (present good SAN DNS entry)`,
353+
YAMLConfigPath: "testdata/web_config_auth_client_san.good.yaml",
354+
UseTLSClient: true,
355+
ClientCertificate: "client2_selfsigned",
356+
ExpectedError: nil,
357+
},
358+
{
359+
Name: `valid tls config yml and tls client with VerifyPeerCertificate (present invalid SAN DNS entries)`,
360+
YAMLConfigPath: "testdata/web_config_auth_client_san.bad.yaml",
361+
UseTLSClient: true,
362+
ClientCertificate: "client2_selfsigned",
363+
ExpectedError: ErrorMap["Invalid client cert"],
364+
},
350365
}
351366
for _, testInputs := range testTables {
352367
t.Run(testInputs.Name, testInputs.Test)

0 commit comments

Comments
 (0)