zynk/irssi
2
0
Fork 0
mirror of https://github.com/irssi/irssi.git synced 2026-08-22 18:12:12 +02:00
Code Issues Projects Releases Packages Wiki Activity

Parse GEN_IPADD records in subjectAltName.

Browse source
This commit is contained in:
LemonBoy 2017-03-20 21:23:56 +01:00
commit 2d8c3fa04c
1 changed files with 48 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

39
src/core/network-openssl.c
View file

@ -81,6 +81,7 @@ static const char *tls_dns_name(const GENERAL_NAME * gn)
{ {
const char *dnsname; const char *dnsname;
if (gn->type == GEN_DNS) {
/* We expect the OpenSSL library to construct GEN_DNS extension objects as /* We expect the OpenSSL library to construct GEN_DNS extension objects as
ASN1_IA5STRING values. Check we got the right union member. */ ASN1_IA5STRING values. Check we got the right union member. */
if (ASN1_STRING_type(gn->d.ia5) != V_ASN1_IA5STRING) { if (ASN1_STRING_type(gn->d.ia5) != V_ASN1_IA5STRING) {
@ -95,6 +96,42 @@ static const char *tls_dns_name(const GENERAL_NAME * gn)
g_warning("Internal NUL in subjectAltName"); g_warning("Internal NUL in subjectAltName");
return NULL; return NULL;
} }
}
else if (gn->type == GEN_IPADD) {
static char ip_buf[64];
unsigned char *p;
/* Make sure this is an OCTECT_STRING. */
if (ASN1_STRING_type(gn->d.iPAddress) != V_ASN1_OCTET_STRING) {
g_warning("Invalid ASN1 value type in subjectAltName");
return NULL;
}
p = (unsigned char *) ASN1_STRING_data(gn->d.iPAddress);
/* Make sure the length is valid. */
switch (ASN1_STRING_length(gn->d.iPAddress)) {
case 4: /* ipv4 */
snprintf(ip_buf, sizeof(ip_buf), "%d.%d.%d.%d",
p[0], p[1], p[2], p[3]);
break;
case 16: /* ipv6 */
snprintf(ip_buf, sizeof(ip_buf), "%X:%X:%X:%X:%X:%X:%X:%X",
p[0] << 8 | p[1], p[2] << 8 | p[3],
p[4] << 8 | p[5], p[6] << 8 | p[7],
p[8] << 8 | p[9], p[10] << 8 | p[11],
p[12] << 8 | p[13], p[14] << 8 | p[15]);
break;
default:
g_warning("Invalid iPAddress length in subjectAltName");
return NULL;
}
dnsname = ip_buf;
}
else
/* Should never reach this, let's silence the compiler. */
g_assert(0);
return dnsname; return dnsname;
} }
@ -171,7 +208,7 @@ static gboolean irssi_ssl_verify_hostname(X509 *cert, const char *hostname)
gen_count = sk_GENERAL_NAME_num(gens); gen_count = sk_GENERAL_NAME_num(gens);
for (gen_index = 0; gen_index < gen_count && !matched; ++gen_index) { for (gen_index = 0; gen_index < gen_count && !matched; ++gen_index) {
gn = sk_GENERAL_NAME_value(gens, gen_index); gn = sk_GENERAL_NAME_value(gens, gen_index);
if (gn->type != GEN_DNS) if (gn->type != GEN_DNS && gn->type != GEN_IPADD)
continue; continue;
/* Even if we have an invalid DNS name, we still ultimately /* Even if we have an invalid DNS name, we still ultimately