mirror of
https://github.com/emmansun/gmsm.git
synced 2025-04-27 04:36:19 +08:00
smx509: properly check for IPv6 hosts in URIs #296
This commit is contained in:
parent
cb51b3657a
commit
50a5e49d38
@ -1607,6 +1607,23 @@ var nameConstraintsTests = []nameConstraintsTest{
|
|||||||
leaf: leafSpec{sans: []string{"dns:.example.com"}},
|
leaf: leafSpec{sans: []string{"dns:.example.com"}},
|
||||||
expectedError: "cannot parse dnsName \".example.com\"",
|
expectedError: "cannot parse dnsName \".example.com\"",
|
||||||
},
|
},
|
||||||
|
// #86: URIs with IPv6 addresses with zones and ports are rejected
|
||||||
|
{
|
||||||
|
roots: []constraintsSpec{
|
||||||
|
{
|
||||||
|
ok: []string{"uri:example.com"},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
intermediates: [][]constraintsSpec{
|
||||||
|
{
|
||||||
|
{},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
leaf: leafSpec{
|
||||||
|
sans: []string{"uri:http://[2006:abcd::1%25.example.com]:16/"},
|
||||||
|
},
|
||||||
|
expectedError: "URI with IP",
|
||||||
|
},
|
||||||
}
|
}
|
||||||
|
|
||||||
func makeConstraintsCACert(constraints constraintsSpec, name string, key *ecdsa.PrivateKey, parent *Certificate, parentKey *ecdsa.PrivateKey) (*Certificate, error) {
|
func makeConstraintsCACert(constraints constraintsSpec, name string, key *ecdsa.PrivateKey, parent *Certificate, parentKey *ecdsa.PrivateKey) (*Certificate, error) {
|
||||||
|
@ -8,6 +8,7 @@ import (
|
|||||||
"errors"
|
"errors"
|
||||||
"fmt"
|
"fmt"
|
||||||
"net"
|
"net"
|
||||||
|
"net/netip"
|
||||||
"net/url"
|
"net/url"
|
||||||
"reflect"
|
"reflect"
|
||||||
"runtime"
|
"runtime"
|
||||||
@ -324,8 +325,10 @@ func matchURIConstraint(uri *url.URL, constraint string) (bool, error) {
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
if strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]") ||
|
// netip.ParseAddr will reject the URI IPv6 literal form "[...]", so we
|
||||||
net.ParseIP(host) != nil {
|
// check if _either_ the string parses as an IP, or if it is enclosed in
|
||||||
|
// square brackets.
|
||||||
|
if _, err := netip.ParseAddr(host); err == nil || (strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]")) {
|
||||||
return false, fmt.Errorf("URI with IP (%q) cannot be matched against constraints", uri.String())
|
return false, fmt.Errorf("URI with IP (%q) cannot be matched against constraints", uri.String())
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -784,7 +787,7 @@ func (c *Certificate) buildChains(currentChain []*Certificate, sigChecks *int, o
|
|||||||
)
|
)
|
||||||
|
|
||||||
considerCandidate := func(certType int, candidate potentialParent) {
|
considerCandidate := func(certType int, candidate potentialParent) {
|
||||||
if candidate.cert.PublicKey == nil ||alreadyInChain(candidate.cert, currentChain) {
|
if candidate.cert.PublicKey == nil || alreadyInChain(candidate.cert, currentChain) {
|
||||||
return
|
return
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Loading…
x
Reference in New Issue
Block a user