moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2025-03-07 20:59:41 -05:00
Code Issues Releases Wiki Activity

openssl: accept subjectAltName iPAddress if no dNSName match

Browse Source 
Undo change introduced in d4643d6 which caused iPAddress match to be
ignored if dNSName was present but did not match.

Also, if iPAddress is present but does not match, and dNSName is not
present, fail as no-match. Prior to this change in such a case the CN
would be checked for a match.

Bug: https://github.com/curl/curl/issues/959
Reported-by: wmsch@users.noreply.github.com
This commit is contained in:
Jay Satiro 2016-08-12 04:10:29 -04:00
parent c2f9b78afe
commit b6fcdc32eb
1 changed files with 5 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
lib/vtls/openssl.c
View File

@ -1083,6 +1083,7 @@ static CURLcode verifyhost(struct connectdata *conn, X509 *server_cert)
#endif
CURLcode result = CURLE_OK;
bool dNSName = FALSE; /* if a dNSName field exists in the cert */
bool iPAddress = FALSE; /* if a iPAddress field exists in the cert */
#ifdef ENABLE_IPV6
if(conn->bits.ipv6_ip &&
@ -1115,10 +1116,10 @@ static CURLcode verifyhost(struct connectdata *conn, X509 *server_cert)
/* get a handle to alternative name number i */
const GENERAL_NAME *check = sk_GENERAL_NAME_value(altnames, i);
/* If a subjectAltName extension of type dNSName is present, that MUST
be used as the identity. / RFC2818 section 3.1 */
if(check->type == GEN_DNS)
dNSName = TRUE;
else if(check->type == GEN_IPADD)
iPAddress = TRUE;
/* only check alternatives of the same type the target is */
if(check->type == target) {
@ -1164,18 +1165,14 @@ static CURLcode verifyhost(struct connectdata *conn, X509 *server_cert)
}
GENERAL_NAMES_free(altnames);
if(dnsmatched || (!dNSName && ipmatched)) {
/* count as a match if the dnsname matched or if there was no dnsname
fields at all AND there was an IP field match */
if(dnsmatched || ipmatched)
matched = TRUE;
}
}
if(matched)
/* an alternative name matched */
;
else if(dNSName) {
/* an dNSName field existed, but didn't match and then we MUST fail */
else if(dNSName || iPAddress) {
infof(data, " subjectAltName does not match %s\n", conn->host.dispname);
failf(data, "SSL: no alternative certificate subject name matches "
"target host name '%s'", conn->host.dispname);