Properly unpack SAN items of type IP, fixes #642

openxpki · Nov 13, 2020 · 672fe9f · 672fe9f
1 parent 0c681c4
commit 672fe9f
Showing 1 changed file with 11 additions and 1 deletion.
diff --git a/core/server/OpenXPKI/Crypt/X509.pm b/core/server/OpenXPKI/Crypt/X509.pm
@@ -276,7 +276,17 @@ sub _build_san {
             foreach my $type (keys %{$name}) {
                 my $san_type = $san_map->{$type};
                 next unless($san_type);
-                push @san_list, [ $san_type, $name->{$type} ];
+                my $san_val = $name->{$type};
+                # IPs are raw byte sequence, copied from Crypt::PKCS10
+                if ($type eq 'iPAddress') {
+                    if( length $san_val == 4 ) {
+                        $san_val = sprintf( '%vd', $san_val );
+                    } else {
+                        $san_val = sprintf( '%*v02X', ':', $san_val );
+                        $san_val =~ s/([[:xdigit:]]{2}):([[:xdigit:]]{2})/$1$2/g;
+                    }
+                }
+                push @san_list, [ $san_type, $san_val ];
             }
         }
     }