SSL (patch 4)

Started by Bear Gilesabout 24 years ago3 messagespatches
Jump to latest
#1Bear Giles
bgiles@coyotesong.com

This patch adds a check that the server certificate common name
resolves to the other side of the socket.

It also seems to have bits that were supposed to be in the
previous patch. Probably operator error - a combined patch
will be posted in a few minutes.

Bear

Attachments:

patch4text/plain; charset=US-ASCIIDownload+212-56
#2Peter Eisentraut
peter_e@gmx.net
In reply to: Bear Giles (#1)
Re: SSL (patch 4)

Bear Giles writes:

This patch adds a check that the server certificate common name
resolves to the other side of the socket.

gethostbyname2() is a GNU thing. AF_INET6 code needs to be #ifdef'd to
something because not every host handles IPv6. Avoid using fixed-size
arrays for names if possible.

--
Peter Eisentraut peter_e@gmx.net

#3Bear Giles
bgiles@coyotesong.com
In reply to: Peter Eisentraut (#2)
Re: SSL (patch 4)

gethostbyname2() is a GNU thing.

Curiously this worked when I just tried compiling this on OpenBSD,
but

AF_INET6 code needs to be #ifdef'd to
something because not every host handles IPv6.

that particular code didn't work and I was already debating trying
to remove it. I'll add this to the list...

Bear