diff options
author | Viktor Dukhovni <openssl-users@dukhovni.org> | 2016-01-16 13:25:17 -0500 |
---|---|---|
committer | Viktor Dukhovni <openssl-users@dukhovni.org> | 2016-01-16 17:15:42 -0500 |
commit | 8d887efa2ebd8ceff261514efbd6460c262172b3 (patch) | |
tree | b7fe17c640ca22b62577805ad943f8e9e81e2fe2 /ssl/ssl_lib.c | |
parent | 0982ecaaee78a106c5db440317b0a8a9c0022bed (diff) |
Better invalid SNI name error handling
Also report an SSL_dane_enable error when the basedomain is an
invalid SNI name. Avoid side-effects when such a name is valid
with X509_VERIFY_PARAM_set1_host(), as e.g. with an empty name, by
setting the SNI name first.
Reviewed-by: Rich Salz <rsalz@openssl.org>
Diffstat (limited to 'ssl/ssl_lib.c')
-rw-r--r-- | ssl/ssl_lib.c | 18 |
1 files changed, 12 insertions, 6 deletions
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c index 90de7472c7..e922e3f07c 100644 --- a/ssl/ssl_lib.c +++ b/ssl/ssl_lib.c @@ -872,18 +872,24 @@ int SSL_dane_enable(SSL *s, const char *basedomain) return 0; } + /* + * Default SNI name. This rejects empty names, while set1_host below + * accepts them and disables host name checks. To avoid side-effects with + * invalid input, set the SNI name first. + */ + if (s->tlsext_hostname == NULL) { + if (!SSL_set_tlsext_host_name(s, basedomain)) { + SSLerr(SSL_F_SSL_DANE_ENABLE, SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN); + return -1; + } + } + /* Primary RFC6125 reference identifier */ if (!X509_VERIFY_PARAM_set1_host(s->param, basedomain, 0)) { SSLerr(SSL_F_SSL_DANE_ENABLE, SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN); return -1; } - /* Default SNI name */ - if (s->tlsext_hostname == NULL) { - if (!SSL_set_tlsext_host_name(s, basedomain)) - return -1; - } - dane->mdpth = -1; dane->pdpth = -1; dane->dctx = &s->ctx->dane; |