NotificationsYou must be signed in to change notification settings
Fork6
Star31

Commit58e70cf

committed

Follow the RFCs more closely in libpq server certificate hostname check.

The RFCs say that the CN must not be checked if a subjectAltName extensionof type dNSName is present. IOW, if subjectAltName extension is present,but there are no dNSNames, we can still check the CN.Alexey Klyukin

1 parent2df465e commit58e70cfCopy full SHA for 58e70cf

File tree

1 file changed

-4

lines changed

src/interfaces/libpq
- fe-secure-openssl.c

1 file changed

-4

lines changed

`‎src/interfaces/libpq/fe-secure-openssl.c`

Lines changed: 5 additions & 4 deletions

Original file line number	Diff line number	Diff line change
`@@ -626,12 +626,13 @@ verify_peer_name_matches_certificate(PGconn *conn)`
`626`	`626`	`sk_GENERAL_NAME_free(peer_san);`
`627`	`627`	`}`
`628`	`628`	`/*`
`629`		`- * If there is no subjectAltName extension, check the Common Name.`
	`629`	`+ * If there is no subjectAltName extension of type dNSName, check the`
	`630`	`+ * Common Name.`
`630`	`631`	`*`
`631`		`- * (Per RFC 2818 and RFC 6125, if the subjectAltName extensionis present,`
`632`		`- * the CN must be ignored.)`
	`632`	`+ * (Per RFC 2818 and RFC 6125, if the subjectAltName extensionof type`
	`633`	`+ *dNSName is present,the CN must be ignored.)`
`633`	`634`	`*/`
`634`		`-else`
	`635`	`+if (names_examined==0)`
`635`	`636`	`{`
`636`	`637`	`X509_NAME*subject_name;`
`637`	`638`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit58e70cf

File tree

1 file changed

1 file changed

`‎src/interfaces/libpq/fe-secure-openssl.c`

0 commit comments