|
|
- From b2b0eab46a8ae36f2dd49159e65c90c1089a0f96 Mon Sep 17 00:00:00 2001
- From: "Thierry FOURNIER / OZON.IO" <thierry.fournier@ozon.io>
- Date: Thu, 6 Oct 2016 10:56:48 +0200
- Subject: [PATCH 11/26] BUG/MINOR: ssl: prevent multiple entries for the same
- certificate
-
- Today, the certificate are indexed int he SNI tree using their CN and the
- list of thier AltNames. So, Some certificates have the same names in the
- CN and one of the AltNames entries.
-
- Typically Let's Encrypt duplicate the the DNS name in the CN and the
- AltName.
-
- This patch prevents the creation of identical entries in the trees. It
- checks the same DNS name and the same SSL context.
-
- If the same certificate is registered two time it will be duplicated.
-
- This patch should be backported in the 1.6 and 1.5 version.
- (cherry picked from commit 07c3d78c2c0693ee37db71c34723597638b6ab3f)
- ---
- src/ssl_sock.c | 22 +++++++++++++++++++---
- 1 file changed, 19 insertions(+), 3 deletions(-)
-
- diff --git a/src/ssl_sock.c b/src/ssl_sock.c
- index 5f9a203..ad8054d 100644
- --- a/src/ssl_sock.c
- +++ b/src/ssl_sock.c
- @@ -1556,6 +1556,7 @@ static int ssl_sock_add_cert_sni(SSL_CTX *ctx, struct bind_conf *s, char *name,
- {
- struct sni_ctx *sc;
- int wild = 0, neg = 0;
- + struct ebmb_node *node;
-
- if (*name == '!') {
- neg = 1;
- @@ -1571,12 +1572,27 @@ static int ssl_sock_add_cert_sni(SSL_CTX *ctx, struct bind_conf *s, char *name,
- if (*name) {
- int j, len;
- len = strlen(name);
- + for (j = 0; j < len && j < trash.size; j++)
- + trash.str[j] = tolower(name[j]);
- + if (j >= trash.size)
- + return order;
- + trash.str[j] = 0;
- +
- + /* Check for duplicates. */
- + if (wild)
- + node = ebst_lookup(&s->sni_w_ctx, trash.str);
- + else
- + node = ebst_lookup(&s->sni_ctx, trash.str);
- + for (; node; node = ebmb_next_dup(node)) {
- + sc = ebmb_entry(node, struct sni_ctx, name);
- + if (sc->ctx == ctx && sc->neg == neg)
- + return order;
- + }
- +
- sc = malloc(sizeof(struct sni_ctx) + len + 1);
- if (!sc)
- return order;
- - for (j = 0; j < len; j++)
- - sc->name.key[j] = tolower(name[j]);
- - sc->name.key[len] = 0;
- + memcpy(sc->name.key, trash.str, len + 1);
- sc->ctx = ctx;
- sc->order = order++;
- sc->neg = neg;
- --
- 2.7.3
-
|
