diff options
| author | David Woodhouse <dwmw2@infradead.org> | 2019-06-20 22:39:38 +0200 |
|---|---|---|
| committer | Tomas Mraz <tmraz@fedoraproject.org> | 2020-08-03 17:15:35 +0200 |
| commit | 396e72096589593cb00412c85170c7ec87d13b89 (patch) | |
| tree | cd02dd52abc26182aec10c4e4b6351cea975d032 | |
| parent | Make SSL_set1_host() and SSL_add1_host() take IP addresses (diff) | |
| download | openssl-396e72096589593cb00412c85170c7ec87d13b89.tar.xz openssl-396e72096589593cb00412c85170c7ec87d13b89.zip | |
Fix certificate validation for IPv6 literals in sconnect demo
Instead of naïvely trying to truncate at the first colon, use
BIO_get_conn_hostname(). That handles IPv6 literals correctly, even
stripping the [] from around them.
Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9201)
| -rw-r--r-- | demos/bio/sconnect.c | 15 |
1 files changed, 7 insertions, 8 deletions
diff --git a/demos/bio/sconnect.c b/demos/bio/sconnect.c index 7e46bf0ad8..19f8ee78de 100644 --- a/demos/bio/sconnect.c +++ b/demos/bio/sconnect.c @@ -29,7 +29,7 @@ int main(int argc, char *argv[]) { const char *hostport = HOSTPORT; const char *CAfile = CAFILE; - char *hostname; + const char *hostname; char *cp; BIO *out = NULL; char buf[1024 * 10], *p; @@ -43,10 +43,6 @@ int main(int argc, char *argv[]) if (argc > 2) CAfile = argv[2]; - hostname = OPENSSL_strdup(hostport); - if ((cp = strchr(hostname, ':')) != NULL) - *cp = 0; - #ifdef WATT32 dbug_init(); sock_init(); @@ -62,9 +58,6 @@ int main(int argc, char *argv[]) ssl = SSL_new(ssl_ctx); SSL_set_connect_state(ssl); - /* Enable peername verification */ - if (SSL_set1_host(ssl, hostname) <= 0) - goto err; /* Use it inside an SSL BIO */ ssl_bio = BIO_new(BIO_f_ssl()); @@ -73,6 +66,12 @@ int main(int argc, char *argv[]) /* Lets use a connect BIO under the SSL BIO */ out = BIO_new(BIO_s_connect()); BIO_set_conn_hostname(out, hostport); + + /* The BIO has parsed the host:port and even IPv6 literals in [] */ + hostname = BIO_get_conn_hostname(out); + if (!hostname || SSL_set1_host(ssl, hostname) <= 0) + goto err; + BIO_set_nbio(out, 1); out = BIO_push(ssl_bio, out); |