|
 |
09c057 |
From 0875cd6169e876c4296a307631d49b801fc686dc Mon Sep 17 00:00:00 2001
|
|
|
09c057 |
From: Stephen Gallagher <sgallagh@redhat.com>
|
|
|
09c057 |
Date: Tue, 8 Mar 2022 16:33:35 -0500
|
|
|
09c057 |
Subject: [PATCH] Truncate IP address in SAN
|
|
|
09c057 |
|
|
|
09c057 |
In OpenSSL 1.1, this was done automatically when addind a SAN extension,
|
|
|
09c057 |
but in OpenSSL 3.0 it is rejected as an invalid input.
|
|
|
09c057 |
|
|
|
09c057 |
Signed-off-by: Stephen Gallagher <sgallagh@redhat.com>
|
|
|
09c057 |
---
|
|
|
09c057 |
src/x509.c | 15 ++++++++++++++-
|
|
|
09c057 |
1 file changed, 14 insertions(+), 1 deletion(-)
|
|
|
09c057 |
|
|
|
09c057 |
diff --git a/src/x509.c b/src/x509.c
|
|
|
09c057 |
index 7c7e4dfe56d5756862f3e0f851941e846ce96f31..e828ec725b23d7ea79393151e7bb436e2f61bdb8 100644
|
|
|
09c057 |
--- a/src/x509.c
|
|
|
09c057 |
+++ b/src/x509.c
|
|
|
09c057 |
@@ -131,10 +131,11 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
|
|
|
09c057 |
size_t i;
|
|
|
09c057 |
X509_NAME *subject;
|
|
|
09c057 |
char *alt_name = NULL;
|
|
|
09c057 |
char *tmp = NULL;
|
|
|
09c057 |
char *san = NULL;
|
|
|
09c057 |
+ char *slash = NULL;
|
|
|
09c057 |
TALLOC_CTX *tmp_ctx;
|
|
|
09c057 |
X509_EXTENSION *ex = NULL;
|
|
|
09c057 |
struct sscg_x509_req *csr;
|
|
|
09c057 |
|
|
|
09c057 |
/* Make sure we have a key available */
|
|
|
09c057 |
@@ -265,10 +266,16 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
|
|
|
09c057 |
tmp_ctx, "DNS:%s", certinfo->subject_alt_names[i]);
|
|
|
09c057 |
}
|
|
|
09c057 |
else
|
|
|
09c057 |
{
|
|
|
09c057 |
san = talloc_strdup (tmp_ctx, certinfo->subject_alt_names[i]);
|
|
|
09c057 |
+ /* SAN IP addresses cannot include the subnet mask */
|
|
|
09c057 |
+ if ((slash = strchr (san, '/')))
|
|
|
09c057 |
+ {
|
|
|
09c057 |
+ /* Truncate at the slash */
|
|
|
09c057 |
+ *slash = '\0';
|
|
|
09c057 |
+ }
|
|
|
09c057 |
}
|
|
|
09c057 |
CHECK_MEM (san);
|
|
|
09c057 |
|
|
|
09c057 |
if (strnlen (san, MAXHOSTNAMELEN + 5) > MAXHOSTNAMELEN + 4)
|
|
|
09c057 |
{
|
|
|
09c057 |
@@ -287,11 +294,17 @@ sscg_x509v3_csr_new (TALLOC_CTX *mem_ctx,
|
|
|
09c057 |
alt_name = tmp;
|
|
|
09c057 |
}
|
|
|
09c057 |
}
|
|
|
09c057 |
|
|
|
09c057 |
ex = X509V3_EXT_conf_nid (NULL, NULL, NID_subject_alt_name, alt_name);
|
|
|
09c057 |
- CHECK_MEM (ex);
|
|
|
09c057 |
+ if (!ex)
|
|
|
09c057 |
+ {
|
|
|
09c057 |
+ ret = EINVAL;
|
|
|
09c057 |
+ fprintf (stderr, "Invalid subjectAlternativeName: %s\n", alt_name);
|
|
|
09c057 |
+ goto done;
|
|
|
09c057 |
+ }
|
|
|
09c057 |
+
|
|
|
09c057 |
sk_X509_EXTENSION_push (certinfo->extensions, ex);
|
|
|
09c057 |
|
|
|
09c057 |
/* Set the public key for the certificate */
|
|
|
09c057 |
sslret = X509_REQ_set_pubkey (csr->x509_req, spkey->evp_pkey);
|
|
|
09c057 |
CHECK_SSL (sslret, X509_REQ_set_pubkey (OU));
|
|
|
09c057 |
--
|
|
|
09c057 |
2.35.1
|
|
|
09c057 |
|