]> git.ipfire.org Git - thirdparty/squid.git/commit
Do not lookup IP addresses of X509 certificate subject CNs (#1967)
authorAlex Rousskov <rousskov@measurement-factory.com>
Tue, 31 Dec 2024 19:22:21 +0000 (19:22 +0000)
committerSquid Anubis <squid-anubis@squid-cache.org>
Tue, 31 Dec 2024 19:22:32 +0000 (19:22 +0000)
commitdb2697a4da2480aed08592dc4276fd37db01bf67
tree1f0e605f21025882fc518c54ad4a18e167bcb511
parent94c40964df92cd19393a15d18c9704bec4020362
Do not lookup IP addresses of X509 certificate subject CNs (#1967)

A true-vs-false `nodns` parameter value bug in a recent commit 22b2a7a0
caused, in some environments, significant startup delays and/or runtime
stalls because getaddrinfo(3) performed blocking DNS lookups when
parsing common names of X509 certificate subjects. Squid parses CNs when
loading configured and validating received certificates. Other side
effects may have included Squid-generated certificates having wrong
alternative subject names and/or wrong certificate validation results.

Negative names and context-disassociated boolean constants strike again!
Fortunately, associated problematic Ip::Address::lookupHostIP() will be
replaced when the existing Ip::Address::Parse() TODO is addressed.
src/ip/Address.cc