namedconnect callback finding

[hfmanson]

int (*namedconnect) (starttls_t *tlsdata, void *privdata));

Finding

value set on call: tlsdata->localid
values that can still be altered: client certificate requirements (none needed, optional or required) PIOF_STARTTLS_REQUEST_REMOTEID and PIOF_STARTTLS_IGNORE_REMOTEID

[vanrein]

Thanks for reporting it! But there is an easy way around it using privdata.

The starttls function in libtlspool makes no assumptions at all about the privdata handle. One possible use is to pass a file descriptor in it, by treating it as an int * but it may as well be pointing to

struct {
   int plainfd_to_be;
   conn_rec lessYuckfulConnection;
} deYuckified_privdata_for_Apache;

Changes would be:

• Instantiate that, say as deYuckified_privdata_for_Apache lessYuck
• Set lessYuck.plainfd_to_be = -1
• Set lessYuck.lessYuckfulConnection = c
• Pass &lessYuck instead of &plainfd to tlspool_starttls()
• In namedconnect_vhost() fetch gConnection from the structure
• In namedconnect_vhost() do not map to * (int *) to deliver soxx [1] but instead map with ((deYuckified_privdata_for_Apache *) privdata)->plainfd_to_be

Sorry for cloning your humourous YUCK references... it's Friday ;-)

If I haven't overlooked anything, feel free to close the issue?

[hfmanson]

This works like a charm see client authentication per vhost

[hfmanson]

reopened issue without the enhancement. The finding needs to be confirmed and documented

[hfmanson]

Zie https://github.com/arpa2/tlspool/blob/master/lib/libtlspool.c#L619-L630 Moeten custom named_connect() functies hetzelfde doen als bij de else tak van de default named_connect?

…

On Fri, Jul 19, 2019 at 5:06 PM vanrein ***@***.***> wrote: Thanks for reporting it! But there is an easy way around it using privdata . The starttls function in libtlspool makes no assumptions at all about the privdata handle. One possible use is to pass a file descriptor in it, by treating it as an int * but it may as well be pointing to struct { int plainfd_to_be; conn_rec lessYuckfulConnection; } deYuckified_privdata_for_Apache; Changes would be: - Instantiate that, say as deYuckified_privdata_for_Apache lessYuck - Set lessYuck.plainfd_to_be = -1 - Set lessYuck.lessYuckfulConnection = c - Pass &lessYuck instead of &plainfd to tlspool_starttls() - In namedconnect_vhost() fetch gConnection from the structure - In namedconnect_vhost() do not map to * (int *) to deliver soxx [1] but instead map with ((deYuckified_privdata_for_Apache *) privdata)->plainfd_to_be Sorry for cloning your humourous YUCK references... it's Friday ;-) If I haven't overlooked anything, feel free to close the issue? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#131?email_source=notifications&email_token=AAN6ATETAAMWWOHL22AAUPDQAHJ5ZA5CNFSM4IE6NSU2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD2L4ZGY#issuecomment-513264795>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAN6ATELX3SROO5W5WOULQ3QAHJ5ZANCNFSM4IE6NSUQ> .