root
/
openssl
mirror of https://github.com/openssl/openssl.git
1
0
Fork 0
Code Issues Actions 7 Packages Projects Releases Wiki Activity

Fix certificate validation for IPv6 literals in sconnect demo 

Instead of naïvely trying to truncate at the first colon, use
BIO_get_conn_hostname(). That handles IPv6 literals correctly, even
stripping the [] from around them.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9201)
This commit is contained in:
David Woodhouse 2019-06-20 21:39:38 +01:00 committed by Tomas Mraz
parent c832840e89
commit 396e720965
1 changed files with 7 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
demos/bio/sconnect.c
View File

@ -29,7 +29,7 @@ int main(int argc, char *argv[])
{ {
const char *hostport = HOSTPORT; const char *hostport = HOSTPORT;
const char *CAfile = CAFILE; const char *CAfile = CAFILE;
char *hostname; const char *hostname;
char *cp; char *cp;
BIO *out = NULL; BIO *out = NULL;
char buf[1024 * 10], *p; char buf[1024 * 10], *p;
@ -43,10 +43,6 @@ int main(int argc, char *argv[])
if (argc > 2) if (argc > 2)
CAfile = argv[2]; CAfile = argv[2];
hostname = OPENSSL_strdup(hostport);
if ((cp = strchr(hostname, ':')) != NULL)
*cp = 0;
#ifdef WATT32 #ifdef WATT32
dbug_init(); dbug_init();
sock_init(); sock_init();
@ -62,9 +58,6 @@ int main(int argc, char *argv[])
ssl = SSL_new(ssl_ctx); ssl = SSL_new(ssl_ctx);
SSL_set_connect_state(ssl); SSL_set_connect_state(ssl);
/* Enable peername verification */
if (SSL_set1_host(ssl, hostname) <= 0)
goto err;
/* Use it inside an SSL BIO */ /* Use it inside an SSL BIO */
ssl_bio = BIO_new(BIO_f_ssl()); ssl_bio = BIO_new(BIO_f_ssl());
@ -73,6 +66,12 @@ int main(int argc, char *argv[])
/* Lets use a connect BIO under the SSL BIO */ /* Lets use a connect BIO under the SSL BIO */
out = BIO_new(BIO_s_connect()); out = BIO_new(BIO_s_connect());
BIO_set_conn_hostname(out, hostport); BIO_set_conn_hostname(out, hostport);
/* The BIO has parsed the host:port and even IPv6 literals in [] */
hostname = BIO_get_conn_hostname(out);
if (!hostname || SSL_set1_host(ssl, hostname) <= 0)
goto err;
BIO_set_nbio(out, 1); BIO_set_nbio(out, 1);
out = BIO_push(ssl_bio, out); out = BIO_push(ssl_bio, out);