feedc0de/wolfssl
1
0
Fork 0
forked from wolfSSL/wolfssl
Code Pull Requests Activity

Merge pull request #5242 from SKlimaRA/SKlimaRA/strict-verification

Browse Source 
zd14249
This commit is contained in:
Sean Parkinson
2022-06-30 08:19:42 +10:00
committed by GitHub
parent 28d149a103 ce977e8c0b
commit f2acaa8ee9
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/internal.c
View File

@@ -72,6 +72,10 @@
* less). On the other hand, if a valid SessionID is collected, forged * less). On the other hand, if a valid SessionID is collected, forged
* clientHello messages will consume resources on the server. * clientHello messages will consume resources on the server.
* This define is turned off by default. * This define is turned off by default.
* WOLFSSL_HOSTNAME_VERIFY_ALT_NAME_ONLY
* Verify hostname/ip address using alternate name (SAN) only and do not
* use the common name. Forces use of the alternate name, so certificates
* missing SAN will be rejected during the handshake
*/ */
@@ -10897,6 +10901,7 @@ int CheckHostName(DecodedCert* dCert, const char *domainName, size_t domainNameL
ret = 0; ret = 0;
} }
#ifndef WOLFSSL_HOSTNAME_VERIFY_ALT_NAME_ONLY
if (checkCN == 1) { if (checkCN == 1) {
if (MatchDomainName(dCert->subjectCN, dCert->subjectCNLen, if (MatchDomainName(dCert->subjectCN, dCert->subjectCNLen,
domainName) == 1) { domainName) == 1) {
@@ -10906,6 +10911,7 @@ int CheckHostName(DecodedCert* dCert, const char *domainName, size_t domainNameL
WOLFSSL_MSG("DomainName match on common name failed"); WOLFSSL_MSG("DomainName match on common name failed");
} }
} }
#endif /* !WOLFSSL_HOSTNAME_VERIFY_ALT_NAME_ONLY */
return ret; return ret;
} }
@@ -11730,6 +11736,7 @@ int DoVerifyCallback(WOLFSSL_CERT_MANAGER* cm, WOLFSSL* ssl, int ret,
} }
} }
} }
#ifndef WOLFSSL_HOSTNAME_VERIFY_ALT_NAME_ONLY
else { else {
if (args->dCert->subjectCN) { if (args->dCert->subjectCN) {
if (MatchDomainName(args->dCert->subjectCN, if (MatchDomainName(args->dCert->subjectCN,
@@ -11741,6 +11748,13 @@ int DoVerifyCallback(WOLFSSL_CERT_MANAGER* cm, WOLFSSL* ssl, int ret,
} }
} }
} }
#else
else {
if (ret == 0) {
ret = DOMAIN_NAME_MISMATCH;
}
}
#endif /* !WOLFSSL_HOSTNAME_VERIFY_ALT_NAME_ONLY */
} }
/* perform IP address check on the peer certificate */ /* perform IP address check on the peer certificate */