oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

Verify hostname and max-depth.

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@21275 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2007-06-25 04:50:10 +00:00
parent 5db583358c
commit 9341a7ec42
1 changed files with 36 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
lib/hx509/cert.c
View File

@@ -354,6 +354,12 @@ hx509_verify_set_time(hx509_verify_ctx ctx, time_t t)
ctx->time_now = t; ctx->time_now = t;
} }
void
hx509_verify_set_max_depth(hx509_verify_ctx ctx, unsigned int max_depth)
{
ctx->max_depth = max_depth;
}
void void
hx509_verify_set_proxy_certificate(hx509_verify_ctx ctx, int boolean) hx509_verify_set_proxy_certificate(hx509_verify_ctx ctx, int boolean)
{ {
@@ -1867,7 +1873,7 @@ hx509_verify_signature(hx509_context context,
return _hx509_verify_signature(context, signer->data, alg, data, sig); return _hx509_verify_signature(context, signer->data, alg, data, sig);
} }
#define HX509_VHN_F_REQUIRE_MATCH 1 #define HX509_VHN_F_ALLOW_NO_MATCH 1
int int
hx509_verify_hostname(hx509_context context, hx509_verify_hostname(hx509_context context,
@@ -1878,22 +1884,42 @@ hx509_verify_hostname(hx509_context context,
const struct sockaddr *sa, const struct sockaddr *sa,
/* XXX krb5_socklen_t */ int sa_size) /* XXX krb5_socklen_t */ int sa_size)
{ {
GeneralNames san;
int ret, i, j;
if (sa && sa_size <= 0) if (sa && sa_size <= 0)
return EINVAL; return EINVAL;
if (hostname) { memset(&san, 0, sizeof(san));
/* int ret, match = 0, same = 0; */
GeneralName n;
memset(&n, 0, sizeof(n)); i = 0;
do {
ret = find_extension_subject_alt_name(cert->data, &i, &san);
if (ret == HX509_EXTENSION_NOT_FOUND) {
ret = 0;
break;
} else if (ret != 0)
break;
n.element = choice_GeneralName_dNSName; for (j = 0; j < san.len; j++) {
n.u.dNSName = rk_UNCONST(hostname); switch (san.val[j].element) {
case choice_GeneralName_dNSName:
if (strcasecmp(san.val[j].u.dNSName, hostname) == 0) {
free_GeneralNames(&san);
return 0;
}
break;
default:
break;
}
}
free_GeneralNames(&san);
} while (1);
/* ret = match_alt_name(&n, cert->data, &same, &match); */ if ((flags & HX509_VHN_F_ALLOW_NO_MATCH) == 0)
} ret = HX509_NAME_CONSTRAINT_ERROR;
return 0; return ret;
} }
int int