Attachment 29499 Details for Bug 54030 – subjectAltName support for httpd-2.4.2

[patch] subjectAltName support for httpd-2.4.2

httpd-2.4.2-subjectaltname.patch (text/plain), 3.26 KB, created by Michael Weiser on 2012-10-19 21:41:18 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Michael Weiser

Created: 2012-10-19 21:41:18 UTC

Size: 3.26 KB

patch

obsolete

>--- modules/ssl/ssl_engine_io.c.orig	2011-12-05 01:08:01.000000000 +0100
>+++ modules/ssl/ssl_engine_io.c 2012-10-19 21:15:40.000000000 +0200
>@@ -1108,16 +1108,60 @@
>         }
>         if ((sc->proxy_ssl_check_peer_cn != SSL_ENABLED_FALSE) &&
>             hostname_note) {
>-            const char *hostname;
>+            apr_array_header_t *ids;
>+            char *cp;
>+            int i;
>+            char **id;
>+            BOOL is_wildcard, matched = FALSE;
> 
>-            hostname = ssl_var_lookup(NULL, server, c, NULL,
>-                                      "SSL_CLIENT_S_DN_CN");
>             apr_table_unset(c->notes, "proxy-request-hostname");
>-            if (strcasecmp(hostname, hostname_note)) {
>+            if (!SSL_X509_getIDs(c->pool, cert, &ids)) {
>+                ap_log_cerror(APLOG_MARK, APLOG_INFO, 0, c, APLOGNO()
>+                              "SSL Proxy: Failure to extract DNs from "
>+                              " peer certificate."
>+                              " Requested hostname: %s", hostname_note);
>+                /* ensure that the SSL structures etc are freed, etc: */
>+                ssl_filter_io_shutdown(filter_ctx, c, 1);
>+                apr_table_setn(c->notes, "SSL_connect_rv", "err");
>+                return HTTP_BAD_GATEWAY;
>+            }
>+
>+            id = (char **)ids->elts;
>+            for (i = 0; i < ids->nelts; i++) {
>+                if (!id[i])
>+                    continue;
>+
>+                ap_log_cerror(APLOG_MARK, APLOG_INFO, 0, c, APLOGNO()
>+                              "SSL Proxy: Peer certificate check:"
>+                              " %s == %s", hostname_note, id[i]);
>+                /*
>+                 * Determine if it is a wildcard ID - we're restrictive
>+                 * in the sense that we require the wildcard character to be
>+                 * THE left-most label (i.e., the ID must start with "*.")
>+                 */
>+                is_wildcard = (*id[i] == '*' && *(id[i]+1) == '.') ? TRUE : FALSE;
>+
>+                /*
>+                 * If the ID includes a wildcard character, check if it matches
>+                 * for the left-most DNS label (i.e., the wildcard character
>+                 * is not allowed to match a dot). Otherwise, try a simple
>+                 * string compare, case insensitively.
>+                 */
>+                if ((is_wildcard == TRUE &&
>+                     (cp = strchr(hostname_note, '.')) &&
>+                     !strcasecmp(id[i]+1, cp)) ||
>+                    !strcasecmp(id[i], hostname_note)) {
>+                    matched = TRUE;
>+                    break;
>+                }
>+            }
>+
>+            if (matched == FALSE) {
>                 ap_log_cerror(APLOG_MARK, APLOG_INFO, 0, c, APLOGNO(02005)
>                               "SSL Proxy: Peer certificate CN mismatch:"
>-                              " Certificate CN: %s Requested hostname: %s",
>-                              hostname, hostname_note);
>+                              " Requested hostname: %s."
>+                              " Last DN checked: %s.",
>+                              hostname_note, id[i-1]);
>                 /* ensure that the SSL structures etc are freed, etc: */
>                 ssl_filter_io_shutdown(filter_ctx, c, 1);
>                 apr_table_setn(c->notes, "SSL_connect_rv", "err");

Actions: View | Diff

Attachments on bug 54030: 29499 | 29500