mirror/gmsm
1
0
Fork 0
mirror of https://github.com/emmansun/gmsm.git synced 2025-04-26 20:26:19 +08:00
Code Issues Packages Projects Releases Wiki Activity

smx509: properly check for IPv6 hosts in URIs #296

Browse Source
This commit is contained in:
Sun Yimin 2025-01-17 08:30:27 +08:00 committed by GitHub
parent cb51b3657a
commit 50a5e49d38
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 25 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
smx509/name_constraints_test.go
View File

@ -1607,6 +1607,23 @@ var nameConstraintsTests = []nameConstraintsTest{
leaf: leafSpec{sans: []string{"dns:.example.com"}},
expectedError: "cannot parse dnsName \".example.com\"",
},
// #86: URIs with IPv6 addresses with zones and ports are rejected
{
roots: []constraintsSpec{
{
ok: []string{"uri:example.com"},
},
},
intermediates: [][]constraintsSpec{
{
{},
},
},
leaf: leafSpec{
sans: []string{"uri:http://[2006:abcd::1%25.example.com]:16/"},
},
expectedError: "URI with IP",
},
}
func makeConstraintsCACert(constraints constraintsSpec, name string, key *ecdsa.PrivateKey, parent *Certificate, parentKey *ecdsa.PrivateKey) (*Certificate, error) {

13
smx509/verify.go
View File

@ -8,6 +8,7 @@ import (
"errors"
"fmt"
"net"
"net/netip"
"net/url"
"reflect"
"runtime"
@ -260,7 +261,7 @@ func domainToReverseLabels(domain string) (reverseLabels []string, ok bool) {
// domain is prefixed with an empty label, append an empty
// string to reverseLabels to indicate this.
reverseLabels = append(reverseLabels, "")
}
}
}
}
@ -324,8 +325,10 @@ func matchURIConstraint(uri *url.URL, constraint string) (bool, error) {
}
}
if strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]") ||
net.ParseIP(host) != nil {
// netip.ParseAddr will reject the URI IPv6 literal form "[...]", so we
// check if _either_ the string parses as an IP, or if it is enclosed in
// square brackets.
if _, err := netip.ParseAddr(host); err == nil || (strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]")) {
return false, fmt.Errorf("URI with IP (%q) cannot be matched against constraints", uri.String())
}
@ -784,7 +787,7 @@ func (c *Certificate) buildChains(currentChain []*Certificate, sigChecks *int, o
)
considerCandidate := func(certType int, candidate potentialParent) {
if candidate.cert.PublicKey == nil ||alreadyInChain(candidate.cert, currentChain) {
if candidate.cert.PublicKey == nil || alreadyInChain(candidate.cert, currentChain) {
return
}
@ -823,7 +826,7 @@ func (c *Certificate) buildChains(currentChain []*Certificate, sigChecks *int, o
return
}
}
switch certType {
case rootCertificate:
chains = append(chains, appendToFreshChain(currentChain, candidate.cert))