oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

(pk_verify_host): verify hostname/address

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@17332 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2006-04-28 11:23:35 +00:00
parent bfd894ccf4
commit e5194fdc60
1 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
lib/krb5/pkinit.c
View File

@@ -84,6 +84,7 @@ struct krb5_pk_init_ctx_data {
int require_binding; int require_binding;
int require_eku; int require_eku;
int require_krbtgt_otherName; int require_krbtgt_otherName;
int require_hostname_match;
}; };
void KRB5_LIB_FUNCTION void KRB5_LIB_FUNCTION
@@ -524,6 +525,13 @@ _krb5_pk_mk_padata(krb5_context context,
"pkinit_require_krbtgt_otherName", "pkinit_require_krbtgt_otherName",
NULL); NULL);
ctx->require_hostname_match =
krb5_config_get_bool_default(context, NULL,
FALSE,
"realms",
req_body->realm,
"pkinit_require_hostname_match",
NULL);
return pk_mk_padata(context, type, ctx, req_body, nonce, md); return pk_mk_padata(context, type, ctx, req_body, nonce, md);
} }
@@ -727,7 +735,6 @@ pk_verify_host(krb5_context context,
} }
if (ctx->require_krbtgt_otherName) { if (ctx->require_krbtgt_otherName) {
hx509_octet_string_list list; hx509_octet_string_list list;
krb5_error_code ret;
int i; int i;
ret = hx509_cert_find_subjectAltName_otherName(host->cert, ret = hx509_cert_find_subjectAltName_otherName(host->cert,
@@ -765,7 +772,16 @@ pk_verify_host(krb5_context context,
} }
hx509_free_octet_string_list(&list); hx509_free_octet_string_list(&list);
} }
if (ret)
return ret;
ret = hx509_verify_hostname(ctx->id->hx509ctx, host->cert,
ctx->require_hostname_match,
hi->hostname,
hi->ai->ai_addr, hi->ai->ai_addrlen);
if (ret)
krb5_clear_error_string(context);
return ret; return ret;
} }