Skip to content

Commit 1e1e34c

Browse files
embhornembhorn
committed
Fix for peer cert verify with IP address
1 parent 1d363f3 commit 1e1e34c

2 files changed

Lines changed: 166 additions & 1 deletion

File tree

‎src/internal.c‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13488,7 +13488,10 @@ int CheckHostName(DecodedCert* dCert, const char *domainName,
1348813488
}
1348913489

1349013490
#ifndef WOLFSSL_HOSTNAME_VERIFY_ALT_NAME_ONLY
13491-
if (checkCN == 1) {
13491+
/* RFC 6125: IP address identities must appear in an iPAddress SAN and
13492+
* must never be matched against the Subject Common Name. Skip the CN
13493+
* fallback when verifying an IP address. */
13494+
if (checkCN == 1 && !isIP) {
1349213495
if (MatchDomainName(dCert->subjectCN, dCert->subjectCNLen,
1349313496
domainName, (word32)domainNameLen, flags) == 1) {
1349413497
ret = 0;

‎tests/api/test_ossl_x509.c‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1060,6 +1060,168 @@ int test_wolfSSL_X509_check_ip_asc(void)
10601060
ExpectIntEQ(wolfSSL_X509_check_ip_asc(NULL, "0.0.0.0", 0), 0);
10611061
ExpectIntEQ(wolfSSL_X509_check_ip_asc(empty, "127.128.0.255", 0), 0);
10621062

1063+
/* Regression test: a certificate with CN=<ip> and no SAN extension
1064+
* must NOT be accepted for IP verification. RFC 6125 requires that IP
1065+
* identities appear in an iPAddress SAN; the Subject CN must never be
1066+
* matched against an IP address. Likewise a CN of "*.0.0.1" must not
1067+
* wildcard-match "127.0.0.1" -- RFC 6125 Section 7.2 prohibits wildcard
1068+
* matching for IP addresses. */
1069+
{
1070+
/* Self-signed cert, Subject CN="127.0.0.1", no extensions. */
1071+
static const unsigned char cn_ip_literal_der[] = {
1072+
0x30, 0x82, 0x02, 0xaf, 0x30, 0x82, 0x01, 0x97, 0x02, 0x14, 0x03,
1073+
0xe8, 0x5c, 0xb5, 0x56, 0x65, 0x58, 0xd4, 0xd9, 0x86, 0x9c, 0xe7,
1074+
0x5b, 0x71, 0xe9, 0xd3, 0x33, 0xe1, 0xa2, 0xdc, 0x30, 0x0d, 0x06,
1075+
0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05,
1076+
0x00, 0x30, 0x14, 0x31, 0x12, 0x30, 0x10, 0x06, 0x03, 0x55, 0x04,
1077+
0x03, 0x0c, 0x09, 0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, 0x30, 0x2e,
1078+
0x31, 0x30, 0x1e, 0x17, 0x0d, 0x32, 0x36, 0x30, 0x34, 0x30, 0x38,
1079+
0x32, 0x30, 0x32, 0x35, 0x33, 0x33, 0x5a, 0x17, 0x0d, 0x33, 0x36,
1080+
0x30, 0x34, 0x30, 0x35, 0x32, 0x30, 0x32, 0x35, 0x33, 0x33, 0x5a,
1081+
0x30, 0x14, 0x31, 0x12, 0x30, 0x10, 0x06, 0x03, 0x55, 0x04, 0x03,
1082+
0x0c, 0x09, 0x31, 0x32, 0x37, 0x2e, 0x30, 0x2e, 0x30, 0x2e, 0x31,
1083+
0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48,
1084+
0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01,
1085+
0x0f, 0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00,
1086+
0xb9, 0xcc, 0x99, 0xf7, 0xbf, 0x7c, 0x4f, 0xec, 0x7f, 0xe6, 0x17,
1087+
0x4e, 0xe3, 0xd9, 0xe5, 0x25, 0x7d, 0xab, 0xa8, 0x66, 0xb0, 0x4d,
1088+
0x41, 0x5c, 0x20, 0xd8, 0x67, 0xf5, 0xa3, 0xcd, 0x9e, 0x12, 0x7f,
1089+
0x09, 0x00, 0xeb, 0x6b, 0xfc, 0x7e, 0x14, 0x10, 0xa0, 0x10, 0x2e,
1090+
0x1f, 0xe8, 0xad, 0xec, 0xe8, 0x86, 0x54, 0xa2, 0xc4, 0x58, 0x65,
1091+
0x26, 0x95, 0x76, 0xa1, 0xe1, 0x02, 0x52, 0x81, 0xcb, 0x7e, 0x8e,
1092+
0xb2, 0x31, 0xc9, 0x58, 0x9a, 0xdc, 0x69, 0xab, 0x8d, 0x23, 0xcd,
1093+
0x96, 0x19, 0x1c, 0x68, 0x69, 0xb5, 0x7d, 0x23, 0xe3, 0x58, 0xe6,
1094+
0x26, 0xcc, 0x05, 0x40, 0xd2, 0xa9, 0xb1, 0x09, 0x9c, 0xc8, 0x4a,
1095+
0xfc, 0x0a, 0x20, 0xba, 0xc0, 0x12, 0x3b, 0x97, 0x44, 0x2b, 0x30,
1096+
0x50, 0x86, 0x0b, 0x27, 0x13, 0x76, 0xb5, 0xf7, 0x80, 0xf0, 0xf2,
1097+
0xf0, 0x93, 0x3b, 0x8d, 0xa8, 0x4f, 0xa3, 0xa9, 0xd2, 0xea, 0xd3,
1098+
0xc3, 0xcb, 0xcc, 0x70, 0xa0, 0x0b, 0xc7, 0xc6, 0x3e, 0xc9, 0x27,
1099+
0x4c, 0xb5, 0x23, 0x35, 0x6c, 0xb0, 0x30, 0xa2, 0xc1, 0x6d, 0x07,
1100+
0xd0, 0x9b, 0x55, 0x6a, 0xf9, 0x18, 0xf0, 0x30, 0x74, 0x3f, 0xf6,
1101+
0x17, 0x85, 0xb7, 0xcf, 0xa5, 0xd4, 0x91, 0xaa, 0x54, 0x85, 0xec,
1102+
0xae, 0xc5, 0x32, 0xf2, 0xb0, 0x21, 0x5a, 0x90, 0x22, 0x66, 0x8b,
1103+
0x4b, 0x0d, 0xc3, 0x57, 0x81, 0x86, 0xf2, 0xbb, 0xd2, 0x3b, 0x8c,
1104+
0xfc, 0xee, 0xbd, 0xed, 0xf0, 0xfb, 0xa5, 0xe1, 0x91, 0x5a, 0x68,
1105+
0x07, 0x60, 0x38, 0x38, 0xe7, 0x48, 0xe3, 0x83, 0xd6, 0xaf, 0xf0,
1106+
0x03, 0x7e, 0x2e, 0x95, 0x0c, 0x33, 0xcf, 0x13, 0xe9, 0xec, 0xe7,
1107+
0xa4, 0x5e, 0xed, 0x02, 0xae, 0xf2, 0x30, 0x6f, 0x3f, 0xc4, 0x1b,
1108+
0x3a, 0x0a, 0xe8, 0xd3, 0x66, 0x32, 0xd6, 0xfd, 0x58, 0x3a, 0x65,
1109+
0x93, 0x99, 0xc7, 0x02, 0x03, 0x01, 0x00, 0x01, 0x30, 0x0d, 0x06,
1110+
0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05,
1111+
0x00, 0x03, 0x82, 0x01, 0x01, 0x00, 0x3c, 0xa7, 0xdf, 0xd1, 0x44,
1112+
0xc5, 0x4d, 0x29, 0x38, 0x51, 0x9d, 0xf6, 0xee, 0x2f, 0x0c, 0xa3,
1113+
0x8a, 0x2a, 0x7c, 0xa1, 0xb1, 0x26, 0x6d, 0xfb, 0x8b, 0x5d, 0xed,
1114+
0xdc, 0x1f, 0xf2, 0xf1, 0x99, 0x3c, 0xd8, 0x36, 0xcd, 0x48, 0xf5,
1115+
0x91, 0x5b, 0x42, 0x98, 0x89, 0x29, 0xba, 0x46, 0xad, 0x93, 0xea,
1116+
0xea, 0x53, 0x17, 0xe4, 0x6d, 0xb7, 0xdc, 0xb5, 0x4a, 0xd8, 0xed,
1117+
0x5c, 0x39, 0x0c, 0xf6, 0x1d, 0x19, 0xfb, 0x22, 0x5d, 0xe4, 0x3f,
1118+
0x07, 0x20, 0x6d, 0x2e, 0xdc, 0x92, 0xa5, 0x56, 0xb3, 0x92, 0x74,
1119+
0x05, 0xb2, 0x7c, 0xed, 0x73, 0x83, 0x70, 0x5f, 0x0e, 0x75, 0xe1,
1120+
0x71, 0x4c, 0xc5, 0xf0, 0x26, 0xc5, 0xa6, 0xd4, 0xb6, 0xb4, 0x79,
1121+
0x99, 0x54, 0xd9, 0x21, 0x48, 0x2f, 0x52, 0x6e, 0x47, 0x1d, 0x1c,
1122+
0x3a, 0x3b, 0x2a, 0x36, 0xa8, 0x88, 0x95, 0x47, 0x67, 0x59, 0xd5,
1123+
0xee, 0xb6, 0xe9, 0x5b, 0x86, 0x1b, 0x8b, 0x6c, 0xa6, 0xb2, 0x91,
1124+
0x81, 0x0c, 0xca, 0x91, 0x33, 0x32, 0xe5, 0x0d, 0x8f, 0xda, 0xc7,
1125+
0x5b, 0xa6, 0x80, 0x3f, 0x71, 0x50, 0x56, 0xd2, 0x88, 0xfc, 0x53,
1126+
0xc5, 0x11, 0x45, 0x1e, 0x8a, 0xb7, 0x0a, 0x83, 0x9e, 0x89, 0x63,
1127+
0x24, 0x3e, 0x8c, 0xbd, 0xed, 0xec, 0xf4, 0x19, 0x32, 0x13, 0xcf,
1128+
0xe7, 0xdd, 0xe6, 0x84, 0xed, 0xe7, 0xf7, 0xf9, 0x50, 0x2f, 0x7b,
1129+
0xac, 0x7d, 0xf9, 0x0f, 0x61, 0xd1, 0xf7, 0x59, 0xf0, 0x91, 0x73,
1130+
0x26, 0x5a, 0xba, 0x24, 0xc8, 0x49, 0x86, 0xc1, 0x1a, 0x42, 0x68,
1131+
0x70, 0xbf, 0x94, 0x69, 0xd0, 0xd5, 0x26, 0x7e, 0x3c, 0xa9, 0x69,
1132+
0x6f, 0xb1, 0xcc, 0xdf, 0x4d, 0xed, 0x91, 0x6d, 0xdf, 0x45, 0x71,
1133+
0xf0, 0x88, 0x69, 0x74, 0x49, 0x2c, 0x5e, 0x77, 0xed, 0x92, 0x36,
1134+
0x7f, 0x1a, 0x83, 0x36, 0x42, 0x17, 0x5a, 0xda, 0x91
1135+
};
1136+
/* Self-signed cert, Subject CN="*.0.0.1", no extensions. */
1137+
static const unsigned char cn_ip_wildcard_der[] = {
1138+
0x30, 0x82, 0x02, 0xab, 0x30, 0x82, 0x01, 0x93, 0x02, 0x14, 0x3a,
1139+
0x4e, 0xfc, 0xf1, 0x5f, 0xcb, 0xe3, 0x6a, 0xae, 0x7f, 0xd6, 0x79,
1140+
0xbd, 0x40, 0xc9, 0x64, 0x41, 0xc6, 0xf0, 0x56, 0x30, 0x0d, 0x06,
1141+
0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05,
1142+
0x00, 0x30, 0x12, 0x31, 0x10, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x04,
1143+
0x03, 0x0c, 0x07, 0x2a, 0x2e, 0x30, 0x2e, 0x30, 0x2e, 0x31, 0x30,
1144+
0x1e, 0x17, 0x0d, 0x32, 0x36, 0x30, 0x34, 0x30, 0x38, 0x32, 0x30,
1145+
0x32, 0x35, 0x33, 0x33, 0x5a, 0x17, 0x0d, 0x33, 0x36, 0x30, 0x34,
1146+
0x30, 0x35, 0x32, 0x30, 0x32, 0x35, 0x33, 0x33, 0x5a, 0x30, 0x12,
1147+
0x31, 0x10, 0x30, 0x0e, 0x06, 0x03, 0x55, 0x04, 0x03, 0x0c, 0x07,
1148+
0x2a, 0x2e, 0x30, 0x2e, 0x30, 0x2e, 0x31, 0x30, 0x82, 0x01, 0x22,
1149+
0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
1150+
0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30, 0x82,
1151+
0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xb9, 0xcc, 0x99, 0xf7,
1152+
0xbf, 0x7c, 0x4f, 0xec, 0x7f, 0xe6, 0x17, 0x4e, 0xe3, 0xd9, 0xe5,
1153+
0x25, 0x7d, 0xab, 0xa8, 0x66, 0xb0, 0x4d, 0x41, 0x5c, 0x20, 0xd8,
1154+
0x67, 0xf5, 0xa3, 0xcd, 0x9e, 0x12, 0x7f, 0x09, 0x00, 0xeb, 0x6b,
1155+
0xfc, 0x7e, 0x14, 0x10, 0xa0, 0x10, 0x2e, 0x1f, 0xe8, 0xad, 0xec,
1156+
0xe8, 0x86, 0x54, 0xa2, 0xc4, 0x58, 0x65, 0x26, 0x95, 0x76, 0xa1,
1157+
0xe1, 0x02, 0x52, 0x81, 0xcb, 0x7e, 0x8e, 0xb2, 0x31, 0xc9, 0x58,
1158+
0x9a, 0xdc, 0x69, 0xab, 0x8d, 0x23, 0xcd, 0x96, 0x19, 0x1c, 0x68,
1159+
0x69, 0xb5, 0x7d, 0x23, 0xe3, 0x58, 0xe6, 0x26, 0xcc, 0x05, 0x40,
1160+
0xd2, 0xa9, 0xb1, 0x09, 0x9c, 0xc8, 0x4a, 0xfc, 0x0a, 0x20, 0xba,
1161+
0xc0, 0x12, 0x3b, 0x97, 0x44, 0x2b, 0x30, 0x50, 0x86, 0x0b, 0x27,
1162+
0x13, 0x76, 0xb5, 0xf7, 0x80, 0xf0, 0xf2, 0xf0, 0x93, 0x3b, 0x8d,
1163+
0xa8, 0x4f, 0xa3, 0xa9, 0xd2, 0xea, 0xd3, 0xc3, 0xcb, 0xcc, 0x70,
1164+
0xa0, 0x0b, 0xc7, 0xc6, 0x3e, 0xc9, 0x27, 0x4c, 0xb5, 0x23, 0x35,
1165+
0x6c, 0xb0, 0x30, 0xa2, 0xc1, 0x6d, 0x07, 0xd0, 0x9b, 0x55, 0x6a,
1166+
0xf9, 0x18, 0xf0, 0x30, 0x74, 0x3f, 0xf6, 0x17, 0x85, 0xb7, 0xcf,
1167+
0xa5, 0xd4, 0x91, 0xaa, 0x54, 0x85, 0xec, 0xae, 0xc5, 0x32, 0xf2,
1168+
0xb0, 0x21, 0x5a, 0x90, 0x22, 0x66, 0x8b, 0x4b, 0x0d, 0xc3, 0x57,
1169+
0x81, 0x86, 0xf2, 0xbb, 0xd2, 0x3b, 0x8c, 0xfc, 0xee, 0xbd, 0xed,
1170+
0xf0, 0xfb, 0xa5, 0xe1, 0x91, 0x5a, 0x68, 0x07, 0x60, 0x38, 0x38,
1171+
0xe7, 0x48, 0xe3, 0x83, 0xd6, 0xaf, 0xf0, 0x03, 0x7e, 0x2e, 0x95,
1172+
0x0c, 0x33, 0xcf, 0x13, 0xe9, 0xec, 0xe7, 0xa4, 0x5e, 0xed, 0x02,
1173+
0xae, 0xf2, 0x30, 0x6f, 0x3f, 0xc4, 0x1b, 0x3a, 0x0a, 0xe8, 0xd3,
1174+
0x66, 0x32, 0xd6, 0xfd, 0x58, 0x3a, 0x65, 0x93, 0x99, 0xc7, 0x02,
1175+
0x03, 0x01, 0x00, 0x01, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48,
1176+
0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82, 0x01,
1177+
0x01, 0x00, 0x7f, 0x3a, 0xf8, 0x93, 0x41, 0x6f, 0xaa, 0xb7, 0xca,
1178+
0x17, 0x81, 0xa7, 0x3e, 0x9f, 0x0c, 0x6d, 0x14, 0x7b, 0x6f, 0x13,
1179+
0xf8, 0xbf, 0x63, 0x6e, 0x28, 0x57, 0x0b, 0x9a, 0xc2, 0x2a, 0x88,
1180+
0xc0, 0x35, 0x4b, 0xe3, 0x77, 0x31, 0x61, 0xff, 0xb4, 0x03, 0xe6,
1181+
0x11, 0x80, 0x1f, 0x35, 0x65, 0xf6, 0x47, 0x94, 0xe6, 0xb9, 0x60,
1182+
0x1e, 0xae, 0x9c, 0x90, 0xe8, 0x53, 0x8a, 0x46, 0x61, 0x28, 0xfa,
1183+
0x4b, 0xe0, 0x71, 0x98, 0xf4, 0x9e, 0xc8, 0x31, 0x98, 0x27, 0x71,
1184+
0x6e, 0x3c, 0x85, 0x15, 0x6d, 0x56, 0x20, 0x3b, 0x16, 0xe7, 0x64,
1185+
0xb8, 0x51, 0x9a, 0x72, 0x75, 0xa1, 0xd2, 0x2f, 0xcf, 0x2b, 0x61,
1186+
0xa2, 0xa8, 0x8b, 0x59, 0x27, 0x4c, 0x18, 0x59, 0x33, 0xbf, 0x9e,
1187+
0x5c, 0xef, 0xbe, 0x71, 0x62, 0x62, 0x20, 0xc8, 0xdc, 0xaf, 0x74,
1188+
0xaa, 0x7b, 0xaa, 0xaf, 0x37, 0x81, 0x65, 0xca, 0xf1, 0x7d, 0xd4,
1189+
0x58, 0x11, 0xd7, 0x18, 0xf7, 0x50, 0xa2, 0xa8, 0x89, 0x90, 0x7c,
1190+
0x30, 0xde, 0x2e, 0xf6, 0xbd, 0x3e, 0xbf, 0x14, 0x1e, 0xd4, 0x85,
1191+
0x8c, 0x38, 0x1c, 0xa4, 0x26, 0xb7, 0x86, 0xe5, 0x17, 0xfc, 0x67,
1192+
0x93, 0x86, 0x1c, 0x1f, 0x91, 0x6f, 0x8c, 0x99, 0xa6, 0x7f, 0x93,
1193+
0x92, 0xdb, 0x45, 0x75, 0xbb, 0xb0, 0x78, 0xa3, 0x8b, 0x67, 0xf7,
1194+
0x94, 0x26, 0xac, 0xb9, 0x4a, 0xca, 0x1f, 0x73, 0xfc, 0x52, 0x78,
1195+
0xb8, 0x14, 0x02, 0xbf, 0x69, 0x6f, 0x70, 0x21, 0xae, 0xd4, 0x12,
1196+
0x4f, 0xd1, 0x9f, 0xe6, 0x56, 0x11, 0x80, 0x39, 0x66, 0xe0, 0xd4,
1197+
0x56, 0x5b, 0x32, 0xc6, 0x6c, 0xb8, 0xd2, 0xf4, 0x23, 0x7f, 0xbb,
1198+
0x62, 0x2f, 0x5d, 0x67, 0x37, 0x38, 0x74, 0xca, 0xb3, 0x3f, 0x17,
1199+
0x53, 0x97, 0xa4, 0xbd, 0xda, 0x26, 0x6a, 0xb3, 0xd9, 0x9f, 0xac,
1200+
0xd2, 0x58, 0x4f, 0x24, 0x8c
1201+
};
1202+
WOLFSSL_X509 *cn_lit = NULL;
1203+
WOLFSSL_X509 *cn_wild = NULL;
1204+
1205+
ExpectNotNull(cn_lit = wolfSSL_X509_load_certificate_buffer(
1206+
cn_ip_literal_der, (int)sizeof(cn_ip_literal_der),
1207+
WOLFSSL_FILETYPE_ASN1));
1208+
ExpectNotNull(cn_wild = wolfSSL_X509_load_certificate_buffer(
1209+
cn_ip_wildcard_der, (int)sizeof(cn_ip_wildcard_der),
1210+
WOLFSSL_FILETYPE_ASN1));
1211+
1212+
/* CN=127.0.0.1 with no SAN must NOT match the IP "127.0.0.1". */
1213+
ExpectIntEQ(wolfSSL_X509_check_ip_asc(cn_lit, "127.0.0.1", 0), 0);
1214+
/* CN=*.0.0.1 with no SAN must NOT wildcard-match "127.0.0.1". */
1215+
ExpectIntEQ(wolfSSL_X509_check_ip_asc(cn_wild, "127.0.0.1", 0), 0);
1216+
/* CN-based hostname matching must still work for hostname checks
1217+
* (sanity check that the fix didn't over-correct). */
1218+
ExpectIntEQ(wolfSSL_X509_check_host(cn_wild, "1.0.0.1",
1219+
XSTRLEN("1.0.0.1"), 0, NULL), 1);
1220+
1221+
wolfSSL_X509_free(cn_wild);
1222+
wolfSSL_X509_free(cn_lit);
1223+
}
1224+
10631225
wolfSSL_X509_free(empty);
10641226
wolfSSL_X509_free(x509);
10651227
#endif

0 commit comments

Comments
 (0)