Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: default s2nc should accept default s2nd cert #4670

Merged
merged 3 commits into from
Jul 30, 2024
Merged

fix: default s2nc should accept default s2nd cert #4670

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9c79d3f
fix: default s2nc should accept default s2nd cert
lrstewart Jul 29, 2024
42015e5
Fix comment typo
lrstewart Jul 29, 2024
64b57d5
Merge branch 'main' into fix
lrstewart Jul 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions bin/common.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -489,9 +489,15 @@ uint8_t unsafe_verify_host(const char *host_name, size_t host_name_len, void *da
return (uint8_t) (strcasecmp(suffix, host_name + 1) == 0);
}

if (strcasecmp(host_name, "localhost") == 0 || strcasecmp(host_name, "127.0.0.1") == 0) {
return (uint8_t) (strcasecmp(verify_data->trusted_host, "localhost") == 0
|| strcasecmp(verify_data->trusted_host, "127.0.0.1") == 0);
/* If we're connecting to localhost, accept any values that represents localhost */
lrstewart marked this conversation as resolved.
Show resolved Hide resolved
bool is_localhost = (strcasecmp(verify_data->trusted_host, "localhost") == 0);
is_localhost |= (strcasecmp(verify_data->trusted_host, "127.0.0.1") == 0);
if (is_localhost) {
bool match = (strcasecmp(host_name, "localhost") == 0);
match |= (strcasecmp(host_name, "127.0.0.1") == 0);
/* Some of our older test certificates use odd common names */
match |= (strcasecmp(host_name, "s2nTestServer") == 0);
return (uint8_t) match;
Comment on lines +495 to +500
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this was added just as an additional sanity check?

Copy link
Contributor Author

@lrstewart lrstewart Jul 29, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure I'd call it an additional sanity check. The verify_host callback has to accept the certificate. Before it was rejecting it because the common name was s2nTestServer. But I suppose you could call it a sanity check since it'd probably be just as valid to implement verify_host to accept any host name when connecting to localhost.

}

return (uint8_t) (strcasecmp(host_name, verify_data->trusted_host) == 0);
Expand Down
24 changes: 24 additions & 0 deletions bin/s2nc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,28 @@
#define OPT_SERIALIZE_OUT 1008
#define OPT_DESERIALIZE_IN 1009

/* This should match the final cert in the s2nd default_certificate_chain */
const char default_trusted_cert[] =
"-----BEGIN CERTIFICATE-----"
"MIIC/jCCAeagAwIBAgIUFFjxpSf0mUsrVbyLPQhccDYfixowDQYJKoZIhvcNAQEL"
"BQAwFjEUMBIGA1UEAwwLczJuVGVzdFJvb3QwIBcNMjAwMTI0MDEwODIyWhgPMjEx"
"OTEyMzEwMTA4MjJaMBYxFDASBgNVBAMMC3MyblRlc3RSb290MIIBIjANBgkqhkiG"
"9w0BAQEFAAOCAQ8AMIIBCgKCAQEAz3AaOAlkcxJHryCI9SfwB9q4PA53hv5tz4ZL"
"be37b69v58mfP+D18cWIBHUmkmN6gWWoWZ/9hv75pxcNXW0zPn7+wOVvXLUjtmkq"
"1IGT/mykhasw00viaBFAuBHZ5iLwfc4/cjUFAPVCKLmfv5Xs7TJVzWA/0mR4r1h8"
"uFqqXczkVMklIbsOIrlZXz8ifQs3DpFA2FeoziEh+Pcb4c3QBPgCHFDEGyTSdqo9"
"+NbS+iRlw0T6tqUOpC0DdKXo/3mJNBmy4XPahTi9zgsu7b+UVqemL7eXXf/iSr5y"
"iwJKJjz+N/rLpcF1VJtF8q0fpHagzljQaN7/emjg7BplUUyLawIDAQABo0IwQDAP"
"BgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTDmXkyQEJ7ZciyE4KF7wAJKDxMfDAO"
"BgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQADggEBAFobyhsc7mYoGaA7N4Pp"
"it+MQZZNzWte5vWal/3/2V7ZGrJsgeCPwLblzzTmey85RilX6ovMQHEqT1vBFSHq"
"nntMZnHkEl2QLU8XopJWR4MXK7LzjjQYaXiZhGbJbtylVSfATAa/ZzdgjBx1C8aD"
"IM1+ELGCP/UHD0YEJkFoxSUwXGAXoV8I+cPDAWHC6VnC4mY8qubhx95FpX02ERnz"
"1Cw2YWtntyO8P52dEJD1+0EJjtVX4Bj5wwgJHHbDkPP1IzFrR/uBC2LCjtRY+UtZ"
"kfoDfWu2tslkLK7/LaC5qZyCPKnpPHLLz8gUWKlvbuejM99FTlBg/tcH+bv5x7WB"
"MZ8="
"-----END CERTIFICATE-----";

/*
* s2nc is an example client that uses many s2n-tls APIs.
* It is intended for testing purposes only, and should not be used in production.
Expand Down Expand Up @@ -616,6 +638,8 @@ int main(int argc, char *const *argv)
GUARD_EXIT(s2n_config_add_cert_chain_and_key_to_store(config, chain_and_key), "Error setting certificate/key");
}

GUARD_EXIT(s2n_config_add_pem_to_trust_store(config, default_trusted_cert),
"Error adding default cert to trust store.");
if (ca_file || ca_dir) {
GUARD_EXIT(s2n_config_wipe_trust_store(config), "Error wiping trust store");
if (s2n_config_set_verification_ca_location(config, ca_file, ca_dir) < 0) {
Expand Down
Loading