]> granicus.if.org Git - libevent/commit
use iSECPartners code to validate hostname in certificate
authorPatrick Pelletier <code@funwithsoftware.org>
Thu, 28 Feb 2013 01:16:27 +0000 (17:16 -0800)
committerPatrick Pelletier <code@funwithsoftware.org>
Thu, 28 Feb 2013 05:22:03 +0000 (21:22 -0800)
commit64d9f161fe6c476fc7a335187527e98d3c668c1c
treedbe687d6d349f15a08a804515bb1d219447ee8f9
parentaacd674c94719f852d1b2a1591266c28b4b42df2
use iSECPartners code to validate hostname in certificate

The problem is that if you go to a website whose certificate does not
match its hostname, it should fail.  Try this in a web browser for
https://www.kegel.com/ for example.  Your web browser will say the
certificate is for *.pair.com, not for www.kegel.com, and won't let
you visit it without clicking through a bunch of scary warnings.

However, prior to this commit, https-client was happy to fetch
https://www.kegel.com/ without complaining.  That is bad.  Now, with
this commit, it will properly complain, which is good:

pelletier@chives:~/src/libevent/sample$ ./https-client https://www.kegel.com/
Got 'MatchNotFound' for hostname 'www.kegel.com' and certificate:
/C=US/postalCode=15203/ST=Pennsylvania/L=Pittsburgh/street=Suite 210/street=2403 Sidney Street/O=pair Networks, Inc./OU=Provided by pair Networks, Inc./OU=PairWildcardSSL $250,000/CN=*.pair.com
some request failed - no idea which one though!
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
ppelletier@chives:~/src/libevent/sample$

It will still succeed for sites with an exactly-matching certificate,
such as https://github.com/ and that is also good!

However, the problem is that the iSECPartners code doesn't handle
wildcards, which means we reject https://ip.appspot.com/ even though
it is perfectly legitimate, because we don't understand the wildcard:

ppelletier@chives:~/src/libevent/sample$ ./https-client https://ip.appspot.com/
Got 'MatchNotFound' for hostname 'ip.appspot.com' and certificate:
/C=US/ST=California/L=Mountain View/O=Google Inc/CN=*.appspot.com
some request failed - no idea which one though!
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
ppelletier@chives:~/src/libevent/sample$

So, we need to fix this.  In other words, "to be continued..."
sample/https-client.c
sample/include.am
sample/openssl_hostname_validation.c [new file with mode: 0644]
sample/openssl_hostname_validation.h [new file with mode: 0644]