zqz/platform-external-webrtc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fixed Hostname Validation in OpenSSLAdapter.

Browse Source 
This changeset addresses concerns about how the OpenSSLAdapter does certificate
name matching. The current approach has a number of issues which are outlined
in the bug description. The approach taken in this changeset is to use the
standard function X509_check_host which should correctly parse the wildcard
expansions and is directly supported in OpenSSL instead of attempting my own
implementation. This changeset uses this as an opportunity to add additional
parameter checking and refactoring logging code out of the main code path.

Bug: webrtc:8888
Change-Id: Iaffe1daddcd52193ba674489f613ce8515b81e91
Reviewed-on: https://webrtc-review.googlesource.com/65022
Commit-Queue: Benjamin Wright <benwright@webrtc.org>
Reviewed-by: Taylor Brandstetter <deadbeef@webrtc.org>
Reviewed-by: Emad Omara <emadomara@webrtc.org>
Cr-Commit-Position: refs/heads/master@{#22755}
This commit is contained in:
Benjamin Wright
2018-04-05 12:12:26 -07:00
committed by Commit Bot
parent 5150ee40f4
commit 9201d1aa8a
6 changed files with 293 additions and 93 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
rtc_base/openssladapter.h
View File

@ -91,9 +91,8 @@ class OpenSSLAdapter : public SSLAdapter, public MessageHandler {
void OnMessage(Message* msg) override;
static bool VerifyServerName(SSL* ssl, const char* host,
bool ignore_bad_cert);
bool SSLPostConnectionCheck(SSL* ssl, const char* host);
bool SSLPostConnectionCheck(SSL* ssl, const std::string& host);
#if !defined(NDEBUG)
// In debug builds, logs info about the state of the SSL connection.
static void SSLInfoCallback(const SSL* ssl, int where, int ret);
@ -152,7 +151,6 @@ class OpenSSLAdapterFactory : public SSLAdapterFactory {
void SetMode(SSLMode mode) override;
OpenSSLAdapter* CreateAdapter(AsyncSocket* socket) override;
static OpenSSLAdapterFactory* Create();
private: