Join GitHub today
GitHub is home to over 20 million developers working together to host and review code, manage projects, and build software together.
Bug in SubjectAltName field extractor (invalid X509_get_ext_by_NID usage) #1946
Comments
alandekok
added a commit
that referenced
this issue
Mar 20, 2017
|
|
alandekok |
This commit was signed with a verified signature.
alandekok
Alan DeKok
|
dae5661
|
alandekok
closed this
Mar 20, 2017
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Jean-Daniel commentedMar 20, 2017
•
edited
Issue type
Defect/Feature description
The eap-TLS module is supposed to extract "TLS-Client-Cert-Subject-Alt-Name" from the certificate when available.
Unfortunately, if the alt name extension is the first one in the certificate, the TLS module fails to read it and ignore the alt names completely.
The bug reside in src/tls.c:961:
loc = X509_get_ext_by_NID(cert, NID_subject_alt_name, 0);When looking for an attribute, the last parameter of X509_get_ext_by_NID() must be -1 and not 0.
When passing 0, the lookup starts at position 1 and ignore the first extension.