Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix crash due to X.509 certificates with Subject Alternative Name other than DNS Host #3397

Closed
wants to merge 8 commits into from
Closed

Fix crash due to X.509 certificates with Subject Alternative Name other than DNS Host #3397

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
bab9851
Skip invalid DNS name
echo-branch Aug 19, 2021
5e09435
Clarify reasoning for workaround
echo-branch Aug 19, 2021
b942040
Fix stupid if check error
echo-branch Aug 20, 2021
655a518
Ok. it's a union, really should have read the struct spec...
echo-branch Aug 20, 2021
a65978e
fix mitm proxies by doing soft revocation checks
echo-branch Aug 24, 2021
eaf9f29
Remove link to chromium discussion, it's more background information
echo-branch Aug 24, 2021
98035b4
Revert context change, fix ignore revocation on client certs
echo-branch Aug 25, 2021
de6ecb9
Correct formatting. Make server cert check consistent with client cer…
echo-branch Aug 31, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions NetSSL_Win/src/SecureSocketImpl.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1317,7 +1317,7 @@ void SecureSocketImpl::verifyCertificateChainClient(PCCERT_CONTEXT pServerCert)

// Revocation check of the root certificate may fail due to missing CRL points, etc.
// We ignore all errors checking the root certificate except CRYPT_E_REVOKED.
if (!ok && (revStat.dwIndex < certs.size() - 1 || revStat.dwError == CRYPT_E_REVOKED))
if (!ok && revStat.dwIndex < certs.size() - 1 && revStat.dwError == CRYPT_E_REVOKED)
{
VerificationErrorArgs args(cert, revStat.dwIndex, revStat.dwReason, Utility::formatError(revStat.dwError));
SSLManager::instance().ClientVerificationError(this, args);
Expand Down Expand Up @@ -1421,7 +1421,10 @@ void SecureSocketImpl::serverVerifyCertificate()
CERT_VERIFY_REV_CHAIN_FLAG,
NULL,
&revStat);
if (!ok && (revStat.dwIndex < certs.size() - 1 || revStat.dwError == CRYPT_E_REVOKED))

// Revocation check of the root certificate may fail due to missing CRL points, etc.
// We ignore all errors checking the root certificate except CRYPT_E_REVOKED.
if (!ok && revStat.dwIndex < certs.size() - 1 && revStat.dwError == CRYPT_E_REVOKED)
{
VerificationErrorArgs args(cert, revStat.dwIndex, revStat.dwReason, Utility::formatError(revStat.dwReason));
SSLManager::instance().ServerVerificationError(this, args);
Expand Down
12 changes: 8 additions & 4 deletions NetSSL_Win/src/X509Certificate.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -278,10 +278,14 @@ void X509Certificate::extractNames(std::string& cmnName, std::set<std::string>&
PCERT_ALT_NAME_INFO pNameInfo = reinterpret_cast<PCERT_ALT_NAME_INFO>(buffer.begin());
for (int i = 0; i < pNameInfo->cAltEntry; i++)
{
std::wstring waltName(pNameInfo->rgAltEntry[i].pwszDNSName);
std::string altName;
Poco::UnicodeConverter::toUTF8(waltName, altName);
domainNames.insert(altName);
// Some certificates have Subject Alternative Name entries that are not DNS Name. Skip them.
if (pNameInfo->rgAltEntry[i].dwAltNameChoice == CERT_ALT_NAME_DNS_NAME)
{
std::wstring waltName(pNameInfo->rgAltEntry[i].pwszDNSName);
std::string altName;
Poco::UnicodeConverter::toUTF8(waltName, altName);
domainNames.insert(altName);
}
}
}
}
Expand Down