pike.git/ lib/ modules/ SSL.pmod/ Connection.pike

2015-12-03

2015-12-03 14:48:07 by Henrik Grubbström (Grubba) <grubba@grubba.org>

• 67510a29b7377eda857bf92c4647dc82b98e0734 (19 lines) (+19/-0) ^{[ Show | Annotate ]}
  Branch: 8.1

SSL.Connection: Added server_name validation against cert.

cert_data->server_name_verified will be set to 1 on success, 0 on
failure, and be UNDEFINED on unknown (ie server_name not set).

313:    context->require_trust);    };    +  if (session->server_name && sizeof(result->certificates || ({}))) { +  array(Standards.X509.TBSCertificate) certs = +  [array(Standards.X509.TBSCertificate)](result->certificates); +  Standards.X509.TBSCertificate cert = certs[-1]; +  array(string) globs = Standards.PKCS.Certificate. +  decode_distinguished_name(cert->subject)->commonNmae - ({ 0 }); +  if (cert->ext_subjectAltName_dNSName) { +  globs += cert->ext_subjectAltName_dNSName; +  } +  result->server_name_verified = 0; +  foreach(globs, string g) { +  if (glob(g, session->server_name)) { +  result->server_name_verified = 1; +  break; +  } +  } +  } +     // This data isn't actually used internally.    session->cert_data = result;