diff options
| author | Heikki Linnakangas <heikki.linnakangas@iki.fi> | 2014-09-15 16:14:24 +0300 |
|---|---|---|
| committer | Heikki Linnakangas <heikki.linnakangas@iki.fi> | 2014-09-15 16:16:06 +0300 |
| commit | 58e70cf9fb42c1ad60b8ba730fd129f2ce6fa332 (patch) | |
| tree | 4ea35d2ae2d9e2f425974c71af61ef8752216a1e /src/interfaces/libpq/fe-secure-openssl.c | |
| parent | 2df465e696f49bb12c0a362aa6f68f75a752d7a8 (diff) | |
| download | postgresql-58e70cf9fb42c1ad60b8ba730fd129f2ce6fa332.tar.gz postgresql-58e70cf9fb42c1ad60b8ba730fd129f2ce6fa332.zip | |
Follow the RFCs more closely in libpq server certificate hostname check.
The RFCs say that the CN must not be checked if a subjectAltName extension
of type dNSName is present. IOW, if subjectAltName extension is present,
but there are no dNSNames, we can still check the CN.
Alexey Klyukin
Diffstat (limited to 'src/interfaces/libpq/fe-secure-openssl.c')
| -rw-r--r-- | src/interfaces/libpq/fe-secure-openssl.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c index 98d02b6b634..78aa46de2f3 100644 --- a/src/interfaces/libpq/fe-secure-openssl.c +++ b/src/interfaces/libpq/fe-secure-openssl.c @@ -626,12 +626,13 @@ verify_peer_name_matches_certificate(PGconn *conn) sk_GENERAL_NAME_free(peer_san); } /* - * If there is no subjectAltName extension, check the Common Name. + * If there is no subjectAltName extension of type dNSName, check the + * Common Name. * - * (Per RFC 2818 and RFC 6125, if the subjectAltName extension is present, - * the CN must be ignored.) + * (Per RFC 2818 and RFC 6125, if the subjectAltName extension of type + * dNSName is present, the CN must be ignored.) */ - else + if (names_examined == 0) { X509_NAME *subject_name; |