Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

spnego_gssapi: implement TLS channel bindings for openssl #13098

Open
wants to merge 6 commits into
base: master
Choose a base branch
from
Open

spnego_gssapi: implement TLS channel bindings for openssl #13098

wants to merge 6 commits into from
+169 −1

Commits on Apr 30, 2024

  1. spnego_gssapi: implement TLS channel bindings for openssl 

    Channel Bindings are used to tie the session context to a specific
TLS channel. This is to provide additional proof of valid identity,
mitigating authentication relay attacks.

Major web servers have the ability to require (None/Accept/Require)
GSSAPI channel binding, rendering Curl unable to connect to such
websites unless support for channel bindings is implemented.

IIS calls this feature Extended Protection (EPA), which is used in
Enterprise environments using Kerberos for authentication.

This change require krb5 >= 1.19, otherwise channel bindings won't be
forwarded through SPNEGO.

Co-Authored-By: Steffen Kieß <947515+steffen-kiess@users.noreply.github.com>
    @SGA-max-faxalv @steffen-kiess
    SGA-max-faxalv and steffen-kiess committed Apr 30, 2024
    Configuration menu
    Copy the full SHA
    2e02fe5 View commit details
    Browse the repository at this point in the history

  2. Use SSL_get1_peer_certificate

    @SGA-max-faxalv
    SGA-max-faxalv committed Apr 30, 2024
    Configuration menu
    Copy the full SHA
    7da35a4 View commit details
    Browse the repository at this point in the history

  3. Only fetch channel binding data if conn using SSL

    @SGA-max-faxalv
    SGA-max-faxalv committed Apr 30, 2024
    Configuration menu
    Copy the full SHA
    a6b68a5 View commit details
    Browse the repository at this point in the history

  4. Rebase Fix: ossl_ssl_backend_data -> ossl_ctx

    @SGA-max-faxalv
    SGA-max-faxalv committed Apr 30, 2024
    Configuration menu
    Copy the full SHA
    9d1d99b View commit details
    Browse the repository at this point in the history

  5. Change "u_char" to "unsigned char"

    @SGA-max-faxalv
    SGA-max-faxalv committed Apr 30, 2024
    Configuration menu
    Copy the full SHA
    02c7711 View commit details
    Browse the repository at this point in the history

  6. Use explicit fetching in OpenSSL 3.x

    @SGA-max-faxalv
    SGA-max-faxalv committed Apr 30, 2024
    Configuration menu
    Copy the full SHA
    3d924fa View commit details
    Browse the repository at this point in the history