-
Notifications
You must be signed in to change notification settings - Fork 2.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Verify numerical ip SubjectAlternativeName properly #2906
Conversation
@ekoby Thank you for your contribution! We have seen you have sent your CLA acceptance, we will process it. However, since this is an enhancement which doesn't require backporting, and will be merged to an Apache only branch, there is no need for a CLA to this specific PR |
CI failed in the following:
Please fix the build error. |
Is there any way to run those builds/tests on my own? |
There are several other failures now.
With win32-mingw:
With ARMC5:
Have you tried building on Visual Studio as well? I'm afraid your feature is not portable enough, and we may think of either doing a single function that implements the ip comparison, or have a different function for every c library |
@ekoby Thank you for your change!
This is probably because the decleration of |
The current CI failure is in the API\ABI checking script, not related to this PR:
|
CI passing on merge result. No backports required as this is a new capability. Needs a ChangeLog entry to explain the feature and give credit to the contributor. @ekoby Please refer to the existing ChangeLog for examples and choose how you'd like to credit yourself. |
Please rebase to remove the merge commit ("Merge remote-tracking branch 'upstream/development' into verify-ip-sa"). This makes your patch set easier to review and work with both now as well as into the future. |
e6e81bc
to
990a3e7
Compare
@Patater |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
We can resolve ChangeLog conflicts during the merge to development
.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I added a comment, which I don't think is a blocker by itself, but we are missing negative tests.
I believe it was stalled because of the reviewer churn. |
Wow. It's been 3 years. I'm sorry you put in that effort for no tangible benefit (yet). I plan to be a bit more of a thorn in #6475 to try to make some progress and I am going to try to leverage some of the work you have done here. If you see something in #6475 taken from this PR and would like me to do it differently, please let me know. (code, commit attributions, commit messages, etc) |
@ekoby I think that your implementation might allow excess characters at the end of an IPv4 address. Besides that, |
Extended from Mbed-TLS#2906 contributed by Eugene K <eugene.kobyakov@netfoundry.io> Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
Extended from Mbed-TLS#2906 contributed by Eugene K <eugene.kobyakov@netfoundry.io> Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
Extended from Mbed-TLS#2906 contributed by Eugene K <eugene.kobyakov@netfoundry.io> Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
Extended from Mbed-TLS#2906 contributed by Eugene K <eugene.kobyakov@netfoundry.io> Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
Extended from Mbed-TLS#2906 contributed by Eugene K <eugene.kobyakov@netfoundry.io> Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
Extended from Mbed-TLS#2906 contributed by Eugene K <eugene.kobyakov@netfoundry.io> Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
Extended from Mbed-TLS#2906 contributed by Eugene K <eugene.kobyakov@netfoundry.io> Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
Extended from Mbed-TLS#2906 contributed by Eugene K <eugene.kobyakov@netfoundry.io> Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
Extended from Mbed-TLS#2906 contributed by Eugene K <eugene.kobyakov@netfoundry.io> Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
Description
Fixes TLS verification failure when trying to validate server connected to by IP address and server presents certificate with IP Subject Alternate Name
Status
READY
Requires Backporting
[edited by mpg]: NO - this is a new feature
Todos
Steps to test or reproduce
try connecting to CloudFlare 1.1.1.1 server. 1.1.1.1 or 162.159.132.53 IP addresses can be used