Full_Name: Giampaolo Tomassoni
Version: 2.4.24
OS: Linux 2.6.39-gentoo-r3
URL:
Submission from: (NULL) (79.23.61.128)
A triky mistake (is it a typo?) in libraries/libldap/tls_g.c:tlsg_x509_cert_dn
prevents a gnutls-enabled server to correctly obtain the "subject" ASN.1 tree
from the client's certificate.
This is the needed patch:
--- libraries/libldap/tls_g.c.wrong 2011-09-25 14:58:30.000000000 +0200
+++ libraries/libldap/tls_g.c 2011-09-25 14:35:06.000000000 +0200
@@ -530,7 +530,7 @@
ber_init2( ber, cert, LBER_USE_DER );
tag = ber_skip_tag( ber, &len ); /* Sequence */
tag = ber_skip_tag( ber, &len ); /* Sequence */
- tag = ber_skip_tag( ber, &len ); /* Context + Constructed
(version) */
+ tag = ber_peek_tag( ber, &len ); /* Context + Constructed
(version) */
if ( tag == 0xa0 ) /* Version is optional */
tag = ber_get_int( ber, &i ); /* Int: Version */
tag = ber_skip_tag( ber, &len ); /* Int: Serial (can be longer
than ber_int_t) */
Basically, the optional version field in the certificate wasn't peeked, but
rather skipped. This resulted in walking in the certificate tree in the wrong
way, thereby impairing a correct result from
libraries/libldap/tls2.c:ldap_pvt_tls_get_peer_dn.
I'm not using sasl, so I can't be sure about this, but I guess this problem
could impair client authentication via certificate using the sasl external
method.