|
 |
2a8beb |
--- openldap-2.3.43/libraries/libldap/tls.c.orig 2010-02-08 13:58:47.000000000 +0100
|
|
|
2a8beb |
+++ openldap-2.3.43/libraries/libldap/tls.c 2010-02-08 14:10:37.000000000 +0100
|
|
|
2a8beb |
@@ -981,7 +981,7 @@ ldap_pvt_tls_check_hostname( LDAP *ld, v
|
|
|
2a8beb |
X509 *x;
|
|
|
2a8beb |
const char *name;
|
|
|
2a8beb |
char *ptr;
|
|
|
2a8beb |
- int ntype = IS_DNS;
|
|
|
2a8beb |
+ int ntype = IS_DNS, nlen;
|
|
|
2a8beb |
#ifdef LDAP_PF_INET6
|
|
|
2a8beb |
struct in6_addr addr;
|
|
|
2a8beb |
#else
|
|
|
2a8beb |
@@ -995,6 +995,7 @@ ldap_pvt_tls_check_hostname( LDAP *ld, v
|
|
|
2a8beb |
} else {
|
|
|
2a8beb |
name = name_in;
|
|
|
2a8beb |
}
|
|
|
2a8beb |
+ nlen = strlen(name);
|
|
|
2a8beb |
|
|
|
2a8beb |
x = tls_get_cert((SSL *)s);
|
|
|
2a8beb |
if (!x) {
|
|
|
2a8beb |
@@ -1028,15 +1029,14 @@ ldap_pvt_tls_check_hostname( LDAP *ld, v
|
|
|
2a8beb |
ex = X509_get_ext(x, i);
|
|
|
2a8beb |
alt = X509V3_EXT_d2i(ex);
|
|
|
2a8beb |
if (alt) {
|
|
|
2a8beb |
- int n, len1 = 0, len2 = 0;
|
|
|
2a8beb |
+ int n, len2 = 0;
|
|
|
2a8beb |
char *domain = NULL;
|
|
|
2a8beb |
GENERAL_NAME *gn;
|
|
|
2a8beb |
|
|
|
2a8beb |
if (ntype == IS_DNS) {
|
|
|
2a8beb |
- len1 = strlen(name);
|
|
|
2a8beb |
domain = strchr(name, '.');
|
|
|
2a8beb |
if (domain) {
|
|
|
2a8beb |
- len2 = len1 - (domain-name);
|
|
|
2a8beb |
+ len2 = nlen - (domain-name);
|
|
|
2a8beb |
}
|
|
|
2a8beb |
}
|
|
|
2a8beb |
n = sk_GENERAL_NAME_num(alt);
|
|
|
2a8beb |
@@ -1054,7 +1054,7 @@ ldap_pvt_tls_check_hostname( LDAP *ld, v
|
|
|
2a8beb |
if (sl == 0) continue;
|
|
|
2a8beb |
|
|
|
2a8beb |
/* Is this an exact match? */
|
|
|
2a8beb |
- if ((len1 == sl) && !strncasecmp(name, sn, len1)) {
|
|
|
2a8beb |
+ if ((nlen == sl) && !strncasecmp(name, sn, nlen)) {
|
|
|
2a8beb |
break;
|
|
|
2a8beb |
}
|
|
|
2a8beb |
|
|
|
2a8beb |
@@ -1094,13 +1094,28 @@ ldap_pvt_tls_check_hostname( LDAP *ld, v
|
|
|
2a8beb |
|
|
|
2a8beb |
if (ret != LDAP_SUCCESS) {
|
|
|
2a8beb |
X509_NAME *xn;
|
|
|
2a8beb |
- char buf[2048];
|
|
|
2a8beb |
- buf[0] = '\0';
|
|
|
2a8beb |
+ X509_NAME_ENTRY *ne;
|
|
|
2a8beb |
+ ASN1_OBJECT *obj;
|
|
|
2a8beb |
+ ASN1_STRING *cn = NULL;
|
|
|
2a8beb |
+ int navas;
|
|
|
2a8beb |
+
|
|
|
2a8beb |
+ /* find the last CN */
|
|
|
2a8beb |
+ obj = OBJ_nid2obj( NID_commonName );
|
|
|
2a8beb |
+ if ( !obj ) goto no_cn; /* should never happen */
|
|
|
2a8beb |
|
|
|
2a8beb |
xn = X509_get_subject_name(x);
|
|
|
2a8beb |
- if( X509_NAME_get_text_by_NID( xn, NID_commonName,
|
|
|
2a8beb |
- buf, sizeof(buf)) == -1)
|
|
|
2a8beb |
- {
|
|
|
2a8beb |
+ navas = X509_NAME_entry_count( xn );
|
|
|
2a8beb |
+ for ( i=navas-1; i>=0; i-- ) {
|
|
|
2a8beb |
+ ne = X509_NAME_get_entry( xn, i );
|
|
|
2a8beb |
+ if ( !OBJ_cmp( ne->object, obj )) {
|
|
|
2a8beb |
+ cn = X509_NAME_ENTRY_get_data( ne );
|
|
|
2a8beb |
+ break;
|
|
|
2a8beb |
+ }
|
|
|
2a8beb |
+ }
|
|
|
2a8beb |
+
|
|
|
2a8beb |
+ if( !cn )
|
|
|
2a8beb |
+ {
|
|
|
2a8beb |
+no_cn:
|
|
|
2a8beb |
Debug( LDAP_DEBUG_ANY,
|
|
|
2a8beb |
"TLS: unable to get common name from peer certificate.\n",
|
|
|
2a8beb |
0, 0, 0 );
|
|
|
2a8beb |
@@ -1111,21 +1126,20 @@ ldap_pvt_tls_check_hostname( LDAP *ld, v
|
|
|
2a8beb |
ld->ld_error = LDAP_STRDUP(
|
|
|
2a8beb |
_("TLS: unable to get CN from peer certificate"));
|
|
|
2a8beb |
|
|
|
2a8beb |
- } else if (strcasecmp(name, buf) == 0 ) {
|
|
|
2a8beb |
+ } else if ( cn->length == nlen &&
|
|
|
2a8beb |
+ strncasecmp( name, (char *) cn->data, nlen ) == 0 ) {
|
|
|
2a8beb |
ret = LDAP_SUCCESS;
|
|
|
2a8beb |
|
|
|
2a8beb |
- } else if (( buf[0] == '*' ) && ( buf[1] == '.' )) {
|
|
|
2a8beb |
+ } else if (( cn->data[0] == '*' ) && ( cn->data[1] == '.' )) {
|
|
|
2a8beb |
char *domain = strchr(name, '.');
|
|
|
2a8beb |
if( domain ) {
|
|
|
2a8beb |
- size_t dlen = 0;
|
|
|
2a8beb |
- size_t sl;
|
|
|
2a8beb |
+ size_t dlen;
|
|
|
2a8beb |
|
|
|
2a8beb |
- sl = strlen(name);
|
|
|
2a8beb |
- dlen = sl - (domain-name);
|
|
|
2a8beb |
- sl = strlen(buf);
|
|
|
2a8beb |
+ dlen = nlen - (domain-name);
|
|
|
2a8beb |
|
|
|
2a8beb |
/* Is this a wildcard match? */
|
|
|
2a8beb |
- if ((dlen == sl-1) && !strncasecmp(domain, &buf[1], dlen)) {
|
|
|
2a8beb |
+ if ((dlen == cn->length-1) &&
|
|
|
2a8beb |
+ !strncasecmp(domain, (char *) &cn->data[1], dlen)) {
|
|
|
2a8beb |
ret = LDAP_SUCCESS;
|
|
|
2a8beb |
}
|
|
|
2a8beb |
}
|
|
|
2a8beb |
@@ -1133,8 +1147,8 @@ ldap_pvt_tls_check_hostname( LDAP *ld, v
|
|
|
2a8beb |
|
|
|
2a8beb |
if( ret == LDAP_LOCAL_ERROR ) {
|
|
|
2a8beb |
Debug( LDAP_DEBUG_ANY, "TLS: hostname (%s) does not match "
|
|
|
2a8beb |
- "common name in certificate (%s).\n",
|
|
|
2a8beb |
- name, buf, 0 );
|
|
|
2a8beb |
+ "common name in certificate (%.*s).\n",
|
|
|
2a8beb |
+ name, cn->length, cn->data );
|
|
|
2a8beb |
ret = LDAP_CONNECT_ERROR;
|
|
|
2a8beb |
if ( ld->ld_error ) {
|
|
|
2a8beb |
LDAP_FREE( ld->ld_error );
|