Skip to content

Commit d675332

Browse files
chuckleverchucklever
committed
tlshd: Add tag filter types
To start, define a filter type for each x.509 certificate field that someone might want to match. These are defined in a table for easy extensibility, and read into a hash table at start-up so they can be looked up quickly by filter type name. (The filter type names will eventually be exposed to users). The filter types are introduced separately to give a sense of what kind of matching can be done. Signed-off-by: Chuck Lever <[email protected]>
1 parent 8891fc7 commit d675332

File tree

2 files changed

+235
-1
lines changed

2 files changed

+235
-1
lines changed

‎man/man7/tls-session-tags.7‎

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,128 @@ Each tag is a list of one or more filters (defined in the
9999
dictionary)
100100
that all must be matched in order for the tag to be assigned to a
101101
new TLS session.
102+
.SS Filter types
103+
A filter's
104+
.I type
105+
determines the part of the incoming authentication material that the
106+
.B tlshd
107+
program examines to determine if ther is a match.
108+
For example, for the
109+
.I x509.tbs.subject
110+
filter type, a string argument specifies a simple wildcard pattern
111+
that is matched against an incoming x.509 certificate's subject field.
112+
A complete list of filter types appears in the
113+
.B FILTER TYPE REFERENCE
114+
section below.
115+
116+
.SH FILTER TYPE REFERENCE
117+
The
118+
.B tlshd
119+
program currently implements the following filter types:
120+
.TP
121+
.B x509.cert.signatureAlgorithm
122+
Filters of this type examine an incoming x.509 certificate's
123+
signatureAlgorithm field,
124+
as defined in RFC 5280, Section 4.1.1.2.
125+
The filter takes an additional string wildcard pattern that
126+
can be an algorithm name or an algorithm OID.
127+
.TP
128+
.B x509.tbs.version
129+
Filters of this type examine an incoming x.509 certificate's
130+
version field,
131+
part of the To-Be-Signed section of the certificate,
132+
as defined in RFC 5280, Section 4.1.2.1.
133+
The filter takes an additional numeric value that is matched
134+
against the certificate's version.
135+
.TP
136+
.B x509.tbs.serialNumber
137+
Filters of this type examine an incoming x.509 certificate's
138+
serialNumber field,
139+
part of the To-Be-Signed section of the certificate,
140+
as defined in RFC 5280, Section 4.1.2.2.
141+
The filter takes an additional string wildcard pattern that
142+
matches a hexadecimal number.
143+
.TP
144+
.B x509.tbs.signature
145+
Filters of this type examine an incoming x.509 certificate's
146+
signature field,
147+
part of the To-Be-Signed section of the certificate,
148+
as defined in RFC 5280, Section 4.1.2.3.
149+
The filter takes an additional string wildcard pattern that
150+
matches, well, something.
151+
.TP
152+
.B x509.tbs.issuer
153+
Filters of this type examine an incoming x.509 certificate's
154+
issuer field,
155+
part of the To-Be-Signed section of the certificate,
156+
as defined in RFC 5280, Section 4.1.2.4.
157+
The filter takes an additional string wildcard pattern that
158+
matches the distinguished name part of the certificate's
159+
issuer field.
160+
.TP
161+
.B x509.tbs.validity.notBefore
162+
Filters of this type examine an incoming x.509 certificate's
163+
activation time field,
164+
part of the To-Be-Signed section of the certificate,
165+
as defined in RFC 5280, Section 4.1.2.5.
166+
The filter takes an additional string that
167+
contains a date and time. If the certificate's activation
168+
timestamp is earlier than the date and time specified in
169+
this filter, the filter does not match.
170+
.TP
171+
.B x509.tbs.validity.notAfter
172+
Filters of this type examine an incoming x.509 certificate's
173+
expiration time field,
174+
part of the To-Be-Signed section of the certificate,
175+
as defined in RFC 5280, Section 4.1.2.5.
176+
The filter takes an additional string that
177+
contains a date and time. If the certificate's expiry
178+
timestamp is later than the date and time specified in
179+
this filter, the filter does not match.
180+
.TP
181+
.B x509.tbs.subject
182+
Filters of this type examine an incoming x.509 certificate's
183+
subject field,
184+
part of the To-Be-Signed section of the certificate,
185+
as defined in RFC 5280, Section 4.1.2.6.
186+
The filter takes an additional string wildcard pattern that
187+
matches the distinguished name part of the certificate's
188+
subject field.
189+
190+
.TP
191+
.B x509.extension.keyUsage
192+
Filters of this type examine an incoming x.509 certificate's
193+
keyUsage field,
194+
one of the standard certificate extensions.
195+
The filter takes a list of bit names that must be set in the
196+
field in order for the filter to match.
197+
This list contains zero or one of the following bit names:
198+
.IR digitalSignature ,
199+
.IR nonRepudiation ,
200+
.IR keyEncipherment ,
201+
.IR dataEncipherment ,
202+
.IR keyAgreement ,
203+
.IR keyCertSign ,
204+
.IR cRLSign ,
205+
.IR encipherOnly ", or"
206+
.IR decipherOnly .
207+
.TP
208+
.B x509.extension.extendedKeyUsage
209+
Filters of this type examine an incoming x.509 certificate's
210+
extendedKeyUsage field,
211+
one of the standard certificate extensions.
212+
This filter type is not yet implemented.
213+
.TP
214+
.B x509.derived.fingerprint
215+
Filters of this type locally compute an incoming x.509 certificate's
216+
SHA1 and SHA256 fingerprint.
217+
The filter takes an additional string wildcard pattern that
218+
matches the hexadecimal value of either the derived SHA1 or
219+
derived SHA256 fingerrint.
220+
.TP
221+
.B x509.derived.selfSigned
222+
Filters of this type match when an incoming x.509 certificate's
223+
issuer and subject distinguished names are exactly equal.
102224
.SH STANDARDS
103225
x.509
104226
.BR

‎src/tlshd/tags.c‎

Lines changed: 113 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,117 @@
3030

3131
#include "tlshd.h"
3232

33+
struct tlshd_tags_filter;
34+
35+
struct tlshd_tags_filter_type {
36+
gchar *ft_name;
37+
bool (*ft_validate)(struct tlshd_tags_filter *filter);
38+
bool (*ft_match)(struct tlshd_tags_filter *filter,
39+
gnutls_session_t session);
40+
};
41+
42+
static GHashTable *tlshd_tags_filter_type_hash;
43+
44+
/* --- Filter Types --- */
45+
46+
static const struct tlshd_tags_filter_type tlshd_tags_static_filter_types[] = {
47+
48+
/* Certificate fields, RFC 5280, Section 4.1.1 */
49+
50+
{
51+
/* RFC 5280, Section 4.1.1.2 */
52+
.ft_name = "x509.cert.signatureAlgorithm",
53+
},
54+
55+
/* To-Be-Signed fields, RFC 5280, Section 4.1.2 */
56+
57+
{
58+
/* RFC 5280, Section 4.1.2.1 */
59+
.ft_name = "x509.tbs.version",
60+
},
61+
{
62+
/* RFC 5280, Section 4.1.2.2 */
63+
.ft_name = "x509.tbs.serialNumber",
64+
},
65+
{
66+
/* RFC 5280, Section 4.1.2.3 */
67+
.ft_name = "x509.tbs.signature",
68+
},
69+
{
70+
/* RFC 5280, Section 4.1.2.4 */
71+
.ft_name = "x509.tbs.issuer",
72+
},
73+
{
74+
/* RFC 5280, Section 4.1.2.5 */
75+
.ft_name = "x509.tbs.validity.notBefore",
76+
},
77+
{
78+
/* RFC 5280, Section 4.1.2.5 */
79+
.ft_name = "x509.tbs.validity.notAfter",
80+
},
81+
{
82+
/* RFC 5280, Section 4.1.2.6 */
83+
.ft_name = "x509.tbs.subject",
84+
},
85+
86+
/* Standard certificate extensions, RFC 5280, Section 4.2.1 */
87+
88+
{
89+
/* RFC 5280, Section 4.2.1.3 */
90+
.ft_name = "x509.extension.keyUsage",
91+
},
92+
{
93+
/* RFC 5280, Secttion 4.2.1.12 */
94+
.ft_name = "x509.extension.extendedKeyUsage",
95+
},
96+
97+
/* Derived fields */
98+
99+
{
100+
/* Locally implemented */
101+
.ft_name = "x509.derived.fingerprint",
102+
},
103+
{
104+
/* Locally implemented */
105+
.ft_name = "x509.derived.selfSigned",
106+
},
107+
};
108+
109+
static void tlshd_tags_filter_type_hash_destroy(void)
110+
{
111+
if (!tlshd_tags_filter_type_hash)
112+
return;
113+
114+
g_hash_table_destroy(tlshd_tags_filter_type_hash);
115+
tlshd_tags_filter_type_hash = NULL;
116+
}
117+
118+
/*
119+
* Add the internally-implemented filter types to a hash table for
120+
* fast lookup by name.
121+
*/
122+
static bool tlshd_tags_filter_type_hash_init(void)
123+
{
124+
size_t i;
125+
126+
tlshd_tags_filter_type_hash = g_hash_table_new(g_str_hash, g_str_equal);
127+
if (!tlshd_tags_filter_type_hash) {
128+
tlshd_log_error("Failed to allocate 'filter type' hash table\n");
129+
tlshd_tags_filter_type_hash = NULL;
130+
return false;
131+
}
132+
133+
for (i = 0; i < ARRAY_SIZE(tlshd_tags_static_filter_types); ++i) {
134+
const struct tlshd_tags_filter_type *filter_type;
135+
136+
filter_type = &tlshd_tags_static_filter_types[i];
137+
g_hash_table_insert(tlshd_tags_filter_type_hash,
138+
filter_type->ft_name,
139+
(gpointer)filter_type);
140+
}
141+
return true;
142+
}
143+
33144
/* --- Subsystem start-up / shutdown APIs --- */
34145

35146
/**
@@ -39,7 +150,7 @@
39150
*/
40151
bool tlshd_tags_config_init(__attribute__ ((unused)) const char *tagsdir)
41152
{
42-
return true;
153+
return tlshd_tags_filter_type_hash_init();
43154
}
44155

45156
/**
@@ -48,4 +159,5 @@ bool tlshd_tags_config_init(__attribute__ ((unused)) const char *tagsdir)
48159
*/
49160
void tlshd_tags_config_shutdown(void)
50161
{
162+
tlshd_tags_filter_type_hash_destroy();
51163
}

0 commit comments

Comments
 (0)