Skip to content

Commit ed33296

Browse files
Michael Gmelinvuvova
authored andcommitted
Fix LibreSSL X509 (SSL) certificate hostname checking.
(Currently) LibreSSL doesn't calculate the string length of the hostname that's passed to X509_check_host automatically in case namelen/chklen is 0. This causes server certificate validation to fail when building MariaDB with LibreSSL. The proposed fix makes MariaDB determine the string length passed to X509_check_host. As there are no ill side-effects (OpenSSL's X509_check_host also simply calls strlen if namelen == 0, see also X509_check_host(3)), this wasn't wrapped in any #ifdef like constructs. Please see here for a proposed patch to modify LibreSSL's behavior: libressl/openbsd#87
1 parent 7ffa82b commit ed33296

File tree

1 file changed

+2
-1
lines changed

1 file changed

+2
-1
lines changed

sql-common/client.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1821,7 +1821,8 @@ static int ssl_verify_server_cert(Vio *vio, const char* server_hostname, const c
18211821
*/
18221822

18231823
#ifdef HAVE_X509_check_host
1824-
ret_validation= X509_check_host(server_cert, server_hostname, 0, 0, 0) != 1;
1824+
ret_validation= X509_check_host(server_cert, server_hostname,
1825+
strlen(server_hostname), 0, 0) != 1;
18251826
#else
18261827
subject= X509_get_subject_name(server_cert);
18271828
cn_loc= X509_NAME_get_index_by_NID(subject, NID_commonName, -1);

0 commit comments

Comments
 (0)