Repository navigation
curl verifies incorrect subject alternative name when contacting https proxy #12831
Description
Activity
I didn't spend time working on a repro but we fairly sure that there is at least inconsistent output where there shouldn't be.
- That curl version is 5.4 years out of date. Does this reproduce with a recent version? What TLS library are you using?
Hi Dan,
Yes, it is reproducible using the latest curl./src/.libs/curl --version curl 8.6.0-DEV (x86_64-pc-linux-gnu)we are using openssl.
@HsiehYuho I added a test case using '127.0.0.1' for the proxy and gave it a certificate with a x590 IPAddress in the alt names. This test works with curl 8.6.0.
Could you recheck your findings? Is there anything specific in your ipv6 address spec that we may not account for?
Reacted by Yuho- added a commit that references this issue
on Feb 6, 2024 - added a commit that references this issue
on Feb 13, 2024 @knekritz, @HsiehYuho thanks, that is exactly the right spot. Would you be able to verify that #12931 fixes the issue for you as well?
@icing i tried to verify it. I git clone your branch and follow https://github.com/curl/curl/blob/master/GIT-INFO to
makethe binary, then execute it through[yhhsieh@mydev ~/curl (proxy-ipv6-cert-check)]$ ./src/.libs/curl telnet://DESTINATION_HOSTNAME:PORT -p -x https://[PROXY:IPV6]:8082 --proxy-cert $PROXY_CERT --proxy-key $PRXOY_KEY -vvvbut it seems not hit you fix. I suspect my build is wrong. the
./src/.libs/curlwas built but the commit seems not applied. Did i do anything wrong ?./src/.libs/curl
Use src/curl instead, which may be a libtool wrapper script that uses LD_LIBRARY_PATH to load the libcurl that's in lib/.libs
Reacted by Yuho@HsiehYuho if you run ./src/curl with options
-v --trace-config alland your other arguments, what is the output?- added a commit that references this issue
on Mar 31, 2025
I did this
I tried
It gives me SAN match failure.
However, the [proxy:ipv6] is in the proxy cert SAN field.
When switching to
the curl succeeds.
We (my colleagues and me) are suspecting checks around here https://github.com/curl/curl/blob/master/lib/vtls/openssl.c#L2152 lead to that curl only checks the proxy SAN type that is same as the destination type
I expected the following
should at least give me the same result
curl/libcurl version
curl 7.61.1 (x86_64-redhat-linux-gnu)
operating system
Linux, but our company (meta) dev our own linux ..