Changeset 6bbc00a in mod_gnutls

Timestamp:

Mar 19, 2015, 11:40:40 AM (5 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, jessie-backports, master, proxy-ticket, upstream

Children:

dda3acf

Parents:

d8ae2a0

Message:

Check hostname of proxy back end server against certificate

Previously, the server certificate was only checked for validity. With
this commit, mod_gnutls gets the expected hostname from the note
"proxy-request-hostname" which should have been set by mod_proxy and
matches it against the server certificate.

File:

• src/gnutls_hooks.c (modified) (1 diff)

src/gnutls_hooks.c

@@ -1696 +1696 @@
     unsigned int status;
 
-    int err = gnutls_certificate_verify_peers3(session, NULL, &status);
+    /* Get peer hostname from a note left by mod_proxy */
+    const char *peer_hostname =
+        apr_table_get(ctxt->c->notes, "proxy-request-hostname");
+    if (peer_hostname == NULL)
+        ap_log_cerror(APLOG_MARK, APLOG_WARNING, 0, ctxt->c,
+                      "%s: proxy-request-hostname is NULL, cannot check "
+                      "peer's hostname", __func__);
+
+    /* Verify certificate, including hostname match. Should
+     * peer_hostname be NULL for some reason, the name is not
+     * checked. */
+    int err = gnutls_certificate_verify_peers3(session, peer_hostname,
+                                               &status);
     if (err != GNUTLS_E_SUCCESS)
     {