From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Wed, 13 Aug 2014 03:17:12 +0000 (+0200)
Subject: Follow the rfc6125 requirement that a single CN must be present for hostname verifica... 
X-Git-Tag: gnutls_3_4_0~1071
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fef06682fe32383fe147e4dea80b7f4c5a7f09d1;p=thirdparty%2Fgnutls.git

Follow the rfc6125 requirement that a single CN must be present for hostname verification.
---

diff --git a/lib/x509/rfc2818_hostname.c b/lib/x509/rfc2818_hostname.c
index 0b8dd7df8c..686456cfb7 100644
--- a/lib/x509/rfc2818_hostname.c
+++ b/lib/x509/rfc2818_hostname.c
@@ -156,7 +156,7 @@ gnutls_x509_crt_check_hostname2(gnutls_x509_crt_t cert,
 	 *  either of these may be of the form: *.domain.tld
 	 *
 	 *  only try (2) if there is no subjectAltName extension of
-	 *  type dNSName
+	 *  type dNSName, and there is a single CN.
 	 */
 
 	/* Check through all included subjectAltName extensions, comparing
@@ -180,22 +180,22 @@ gnutls_x509_crt_check_hostname2(gnutls_x509_crt_t cert,
 	}
 
 	if (!found_dnsname) {
-		unsigned prev_size = 0;
 		/* not got the necessary extension, use CN instead
 		 */
-		for (i=0;;i++) {
-			dnsnamesize = sizeof(dnsname);
-			ret = gnutls_x509_crt_get_dn_by_oid
-				(cert, OID_X520_COMMON_NAME, i, 0, dnsname,
-				 &dnsnamesize);
-			if (ret < 0) {
-				if (i == 0 || ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
-					return 0;
-				dnsnamesize = prev_size;
-				break;
-			}
-			prev_size = dnsnamesize;
-		}
+		dnsnamesize = sizeof(dnsname);
+		ret = gnutls_x509_crt_get_dn_by_oid
+			(cert, OID_X520_COMMON_NAME, 0, 0, dnsname,
+			 &dnsnamesize);
+		if (ret < 0)
+			return 0;
+
+		/* enforce the RFC6125 (§1.8) requirement that only
+		 * a single CN must be present */
+		ret = gnutls_x509_crt_get_dn_by_oid
+			(cert, OID_X520_COMMON_NAME, 1, 0, dnsname,
+			 &dnsnamesize);
+		if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
+			return 0;
 
 		if (_gnutls_hostname_compare
 		    (dnsname, dnsnamesize, hostname, flags)) {
diff --git a/tests/hostname-check.c b/tests/hostname-check.c
index 308c544aa1..176c1e3cf5 100644
--- a/tests/hostname-check.c
+++ b/tests/hostname-check.c
@@ -1089,8 +1089,8 @@ void doit(void)
 		fail("%d: Hostname incorrectly matches (%d)\n", __LINE__, ret);
 
 	ret = gnutls_x509_crt_check_hostname(x509, "www.example3.com");
-	if (!ret)
-		fail("%d: Hostname incorrectly does not match (%d)\n", __LINE__, ret);
+	if (ret)
+		fail("%d: Hostname incorrectly matches (%d)\n", __LINE__, ret);
 
 #ifdef ENABLE_OPENPGP
 	if (debug)