pajoye Fri, 09 Oct 2009 19:08:56 +0000
Revision: http://svn.php.net/viewvc?view=revision&revision=289443
Log:
- Merge: Fixed certificate validation inside
php_openssl_apply_verification_policy
Changed paths:
U php/php-src/branches/PHP_5_3_1/ext/openssl/openssl.c
Modified: php/php-src/branches/PHP_5_3_1/ext/openssl/openssl.c
===================================================================
--- php/php-src/branches/PHP_5_3_1/ext/openssl/openssl.c 2009-10-09
19:06:10 UTC (rev 289442)
+++ php/php-src/branches/PHP_5_3_1/ext/openssl/openssl.c 2009-10-09
19:08:56 UTC (rev 289443)
@@ -4323,8 +4323,15 @@
GET_VER_OPT_STRING("CN_match", cnmatch);
if (cnmatch) {
int match = 0;
+ int name_len = X509_NAME_get_text_by_NID(name, NID_commonName,
buf, sizeof(buf));
- X509_NAME_get_text_by_NID(name, NID_commonName, buf,
sizeof(buf));
+ if (name_len == -1) {
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to
locate peer certificate CN");
+ return FAILURE;
+ } else if (name_len != strlen(buf)) {
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Peer
certificate CN=`%.*s' is malformed", name_len, buf);
+ return FAILURE;
+ }
match = strcmp(cnmatch, buf) == 0;
if (!match && strlen(buf) > 3 && buf[0] == '*' && buf[1] ==
'.') {
@@ -4339,10 +4346,7 @@
if (!match) {
/* didn't match */
- php_error_docref(NULL TSRMLS_CC, E_WARNING,
- "Peer certificate CN=`%s' did not match
expected CN=`%s'",
- buf, cnmatch);
-
+ php_error_docref(NULL TSRMLS_CC, E_WARNING, "Peer
certificate CN=`%.*s' did not match expected CN=`%s'", name_len, buf, cnmatch);
return FAILURE;
}
}
--
PHP CVS Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php
