imap-send: support subjectAltName as well
Check not only the common name of the certificate subject, but also check the subject alternative DNS names as well, when verifying that the certificate matches that of the host we are trying to talk to. Signed-off-by: Oswald Buddenhagen <ossi@kde.org> Signed-off-by: Junio C Hamano <gitster@pobox.com>
Oswald Buddenhagen committed
Feb 15, 2013 at 12:59 UTC
e174744ad17a55d4df68cec97bfbf6b0c28e762b
1 file changed
+19
imap-send.c
+19
@@ -30,6 +30,7 @@ typedef void *SSL;
30
#else
31
#include <openssl/evp.h>
32
#include <openssl/hmac.h>
33
+#include <openssl/x509v3.h>
34
#endif
35
36
struct store_conf {
@@ -292,6 +293,24 @@ static int verify_hostname(X509 *cert, const char *hostname)
293
int len;
294
X509_NAME *subj;
295
char cname[1000];
296
+ int i, found;
297
+ STACK_OF(GENERAL_NAME) *subj_alt_names;
298
+
299
+ /* try the DNS subjectAltNames */
300
+ found = 0;
301
+ if ((subj_alt_names = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL))) {
302
+ int num_subj_alt_names = sk_GENERAL_NAME_num(subj_alt_names);
303
+ for (i = 0; !found && i < num_subj_alt_names; i++) {
304
+ GENERAL_NAME *subj_alt_name = sk_GENERAL_NAME_value(subj_alt_names, i);
305
+ if (subj_alt_name->type == GEN_DNS &&
306
+ strlen((const char *)subj_alt_name->d.ia5->data) == (size_t)subj_alt_name->d.ia5->length &&
307
+ host_matches(hostname, (const char *)(subj_alt_name->d.ia5->data)))
308
+ found = 1;
309
+ }
310
+ sk_GENERAL_NAME_pop_free(subj_alt_names, GENERAL_NAME_free);
311
+ }
312
+ if (found)
313
+ return 0;
314
315
/* try the common name */
316
if (!(subj = X509_get_subject_name(cert)))