Edit report at http://bugs.php.net/bug.php?id=51100&edit=1

 ID:               51100
 Comment by:       
 Reported by:      bostjan at a2o dot si
 Summary:          Patch for CN_match to support wildcards
 Status:           Assigned
 Type:             Bug
 Package:          Streams related
 Operating System: Linux (Slackware
 PHP Version:      5.2.12
 Assigned To:      pajoye

 New Comment:

Current implementation supports wildcard CN in remote certificate only.



Attached patch enables you to specify: 



CN_match = *.mydomain.com



This in turn enables you to SSL connect to all hosts under given domain
(host1.mydomain.com, host2.mydomain.com).





BTW it is more useful the other way around:

- if you create a server which authenticates clients against CA
certificate

- then you can specify that you only allow certain 'type' of clients

---> i.e. CN_match=*.backbone.mydomain.com

- then all the backbone servers are able to connect.

- all the other CNs will fail (i.e. server1.db.mydomain.com)


Previous Comments:
------------------------------------------------------------------------
[2010-02-20 23:06:57] paj...@php.net

This feature is already implemented as far as I can tell, if it does not
work, then let fix it.

------------------------------------------------------------------------
[2010-02-20 19:27:11] bostjan at a2o dot si

Description:
------------
Stream context option CN_match does not support wildcard CN matching on
PHP side. It only supports matching if a client connecting to PHP
presents itself with wildcard in CN or if PHP connects to server which
presents itself with wildcard in CN.



See my comment from 20Feb2010 here:

http://www.php.net/manual/en/context.ssl.php



Here is a link to a patch which enables "limited wildcard matching" if
asterisk is present in CN_match.

http://source.a2o.si/php/php-ext-openssl-CN_match-wildcard.diff

Reproduce code:
---------------
####### SERVER

// Create context and other stuff

...



// Set relevant option

stream_context_set_option($ctx, 'ssl', 'CN_match', '*.example.org');



// Create the server socket

$server = stream_socket_server('ssl://0.0.0.0:9001', $errno, $errstr,
STREAM_SERVER_BIND|STREAM_SERVER_LISTEN, $ctx);





####### COMMAND LINE CLIENT

$ openssl s_client -host localhost -port 9001 -cert
host.example.org.cert



Expected result:
----------------
Successfull connection

Actual result:
--------------
Connection is closed with following warning message:



Warning: stream_socket_accept(): Peer certificate CN=`host.example.org'
did not match expected CN=`*.example.org' in...




------------------------------------------------------------------------



-- 
Edit this bug report at http://bugs.php.net/bug.php?id=51100&edit=1

Reply via email to