diff options
| author | Jeremy Harris <jgh146exb@wizmail.org> | 2014-10-26 21:06:46 +0000 |
|---|---|---|
| committer | Jeremy Harris <jgh146exb@wizmail.org> | 2014-11-05 18:22:20 +0000 |
| commit | 8d69247061599b35b60308ca4b75ba529b8dcba2 (patch) | |
| tree | 886e784e7d1825a0203c301b836d2c80b334042a /src | |
| parent | 4650b314ad07f4813d2cb826546d9048a4555c83 (diff) | |
Do not permit multi-component wildcards on certificate names (OpenSSL)
Diffstat (limited to 'src')
| -rw-r--r-- | src/src/tls-openssl.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c index 25d523274..afc898ca7 100644 --- a/src/src/tls-openssl.c +++ b/src/src/tls-openssl.c @@ -366,6 +366,9 @@ else # ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS # define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0 # endif +# ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS +# define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0 +# endif { int sep = 0; uschar * list = verify_cert_hostnames; @@ -373,7 +376,8 @@ else int rc; while ((name = string_nextinlist(&list, &sep, NULL, 0))) if ((rc = X509_check_host(cert, name, 0, - X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS))) + X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS + | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS))) { if (rc < 0) { |