Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TLS: Tls.vhost is not validating the common name(CN/HostName) of the server #7682

Closed
wants to merge 5 commits into from
Closed

TLS: Tls.vhost is not validating the common name(CN/HostName) of the server #7682

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
8193d88
[Bug-7178] Tls.vhost is not validating the common name of the server …
muttanna2972 Jul 11, 2023
eb3446c
Merge branch 'fluent:master' into master
muttanna2972 Aug 16, 2023
749e9d1
TLS: Tls.vhost is not validating the common name(CN/HostName) of the …
muttanna2972 Sep 1, 2023
65e5a6e
TLS: Tls.vhost is not validating the common name(CN/HostName) of the …
muttanna2972 Sep 1, 2023
ab72447
Merge branch 'master' of github.com:muttanna2972/fluent-bit
muttanna2972 Sep 29, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 16 additions & 4 deletions src/tls/openssl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -513,6 +513,7 @@ static int tls_net_handshake(struct flb_tls *tls,
char err_buf[256];
struct tls_session *session = ptr_session;
struct tls_context *ctx;
X509_VERIFY_PARAM *param;

ctx = session->parent;
pthread_mutex_lock(&ctx->mutex);
Expand All @@ -530,11 +531,22 @@ static int tls_net_handshake(struct flb_tls *tls,
return -1;
}

if (vhost != NULL) {
SSL_set_tlsext_host_name(session->ssl, vhost);
}
else if (tls->vhost) {
if (tls->vhost != NULL) {
muttanna2972 marked this conversation as resolved.
Show resolved Hide resolved
muttanna2972 marked this conversation as resolved.
Show resolved Hide resolved
SSL_set_tlsext_host_name(session->ssl, tls->vhost);
/* set host name validation only if vhost is configured
* explicitely */
if (tls->verify == FLB_TRUE) {
param = SSL_get0_param(session->ssl);
if (param) {
ret = X509_VERIFY_PARAM_set1_host(param, tls->vhost, 0);
if (ret != 1) {
flb_error("[tls] error: vhost parameter validation "
"failed for: %s", (vhost)?vhost:tls->vhost);
pthread_mutex_unlock(&ctx->mutex);
return -1;
}
}
}
}
}

Expand Down
Loading