Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 578697: Wildcards and IP addresses don't mix.

Browse Source 
Patch by Nelson Bolyard.  r=wtc.
 Tag: NSS_3_12_BRANCH


git-svn-id: svn://10.0.0.236/branches/NSS_3_12_BRANCH@261100 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
wtc%google.com
2010-08-25 15:00:51 +00:00
parent 9242d4fc8e
commit 72960648d6
1 changed files with 21 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
mozilla/security/nss/lib/certdb/certdb.c
View File

@@ -39,7 +39,7 @@
/*
* Certificate handling code
*
* $Id: certdb.c,v 1.104 2010-04-25 00:44:55 nelson%bolyard.com Exp $
* $Id: certdb.c,v 1.104.2.1 2010-08-25 15:00:51 wtc%google.com Exp $
*/
#include "nssilock.h"
@@ -1415,6 +1415,15 @@ sec_lower_string(char *s)
return;
}
static PRBool
cert_IsIPAddr(const char *hn)
{
PRBool isIPaddr = PR_FALSE;
PRNetAddr netAddr;
isIPaddr = (PR_SUCCESS == PR_StringToNetAddr(hn, &netAddr));
return isIPaddr;
}
/*
** Add a domain name to the list of names that the user has explicitly
** allowed (despite cert name mismatches) for use with a server cert.
@@ -1880,7 +1889,17 @@ CERT_VerifyCertName(CERTCertificate *cert, const char *hn)
cn = CERT_GetCommonName(&cert->subject);
if ( cn ) {
rv = cert_TestHostName(cn, hn);
PRBool isIPaddr = cert_IsIPAddr(hn);
if (isIPaddr) {
if (PORT_Strcasecmp(hn, cn) == 0) {
rv = SECSuccess;
} else {
PORT_SetError(SSL_ERROR_BAD_CERT_DOMAIN);
rv = SECFailure;
}
} else {
rv = cert_TestHostName(cn, hn);
}
PORT_Free(cn);
} else
PORT_SetError(SSL_ERROR_BAD_CERT_DOMAIN);