Follow the rfc6125 requirement that a single CN must be present for hostname verifica...

diff --git a/lib/x509/rfc2818_hostname.c b/lib/x509/rfc2818_hostname.c
index 0b8dd7df8cf0e1298b128a3833facf9049f5f5b3..686456cfb7e4080feaad47f9e076e5f91c244e69 100644 (file)
--- a/lib/x509/rfc2818_hostname.c
+++ b/lib/x509/rfc2818_hostname.c
@@ -156,7 +156,7 @@ gnutls_x509_crt_check_hostname2(gnutls_x509_crt_t cert,
         *  either of these may be of the form: *.domain.tld
         *
         *  only try (2) if there is no subjectAltName extension of
-        *  type dNSName
+        *  type dNSName, and there is a single CN.
         */
 
        /* Check through all included subjectAltName extensions, comparing
@@ -180,22 +180,22 @@ gnutls_x509_crt_check_hostname2(gnutls_x509_crt_t cert,
        }
 
        if (!found_dnsname) {
-               unsigned prev_size = 0;
                /* not got the necessary extension, use CN instead
                 */
-               for (i=0;;i++) {
-                       dnsnamesize = sizeof(dnsname);
-                       ret = gnutls_x509_crt_get_dn_by_oid
-                               (cert, OID_X520_COMMON_NAME, i, 0, dnsname,
-                                &dnsnamesize);
-                       if (ret < 0) {
-                               if (i == 0 || ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
-                                       return 0;
-                               dnsnamesize = prev_size;
-                               break;
-                       }
-                       prev_size = dnsnamesize;
-               }
+               dnsnamesize = sizeof(dnsname);
+               ret = gnutls_x509_crt_get_dn_by_oid
+                       (cert, OID_X520_COMMON_NAME, 0, 0, dnsname,
+                        &dnsnamesize);
+               if (ret < 0)
+                       return 0;
+
+               /* enforce the RFC6125 (§1.8) requirement that only
+                * a single CN must be present */
+               ret = gnutls_x509_crt_get_dn_by_oid
+                       (cert, OID_X520_COMMON_NAME, 1, 0, dnsname,
+                        &dnsnamesize);
+               if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
+                       return 0;
 
                if (_gnutls_hostname_compare
                    (dnsname, dnsnamesize, hostname, flags)) {

diff --git a/tests/hostname-check.c b/tests/hostname-check.c
index 308c544aa1176643851c802d6c85ac6b3a2df032..176c1e3cf57b0c6ed539b5103995acfd0314ae98 100644 (file)
--- a/tests/hostname-check.c
+++ b/tests/hostname-check.c
@@ -1089,8 +1089,8 @@ void doit(void)
                fail("%d: Hostname incorrectly matches (%d)\n", __LINE__, ret);
 
        ret = gnutls_x509_crt_check_hostname(x509, "www.example3.com");
-       if (!ret)
-               fail("%d: Hostname incorrectly does not match (%d)\n", __LINE__, ret);
+       if (ret)
+               fail("%d: Hostname incorrectly matches (%d)\n", __LINE__, ret);
 
 #ifdef ENABLE_OPENPGP
        if (debug)