summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorJeremy Harris <jgh146exb@wizmail.org>2014-10-26 21:06:46 +0000
committerJeremy Harris <jgh146exb@wizmail.org>2014-11-05 18:22:20 +0000
commit8d69247061599b35b60308ca4b75ba529b8dcba2 (patch)
tree886e784e7d1825a0203c301b836d2c80b334042a /src
parent4650b314ad07f4813d2cb826546d9048a4555c83 (diff)
Do not permit multi-component wildcards on certificate names (OpenSSL)
Diffstat (limited to 'src')
-rw-r--r--src/src/tls-openssl.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/src/src/tls-openssl.c b/src/src/tls-openssl.c
index 25d523274..afc898ca7 100644
--- a/src/src/tls-openssl.c
+++ b/src/src/tls-openssl.c
@@ -366,6 +366,9 @@ else
# ifndef X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
# define X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS 0
# endif
+# ifndef X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS
+# define X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS 0
+# endif
{
int sep = 0;
uschar * list = verify_cert_hostnames;
@@ -373,7 +376,8 @@ else
int rc;
while ((name = string_nextinlist(&list, &sep, NULL, 0)))
if ((rc = X509_check_host(cert, name, 0,
- X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS)))
+ X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS
+ | X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS)))
{
if (rc < 0)
{