qbit/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-11-05 14:56:10 -07:00
Code Releases Activity

crypto/tls: check cert chain during VerifyHostname

Browse Source 
Fixes #9063.

Change-Id: I536ef1f0b30c94c1ebf7922d84cb2f701b7d8a1a
Reviewed-on: https://go-review.googlesource.com/12526
Reviewed-by: Adam Langley <agl@golang.org>
Run-TryBot: Adam Langley <agl@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
This commit is contained in:
Russ Cox 2015-07-22 12:54:00 -04:00
parent 1c89007669
commit 3cf15b57f7
2 changed files with 30 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/crypto/tls/conn.go
View File

@ -1025,5 +1025,8 @@ func (c *Conn) VerifyHostname(host string) error {
if !c.handshakeComplete { if !c.handshakeComplete {
return errors.New("tls: handshake has not yet been performed") return errors.New("tls: handshake has not yet been performed")
} }
if len(c.verifiedChains) == 0 {
return errors.New("tls: handshake did not verify certificate chain")
}
return c.peerCertificates[0].VerifyHostname(host) return c.peerCertificates[0].VerifyHostname(host)
} }

27
src/crypto/tls/tls_test.go
View File

@ -7,6 +7,7 @@ package tls
import ( import (
"bytes" "bytes"
"fmt" "fmt"
"internal/testenv"
"io" "io"
"net" "net"
"strings" "strings"
@ -280,3 +281,29 @@ func TestTLSUniqueMatches(t *testing.T) {
t.Error("client and server channel bindings differ when session resumption is used") t.Error("client and server channel bindings differ when session resumption is used")
} }
} }
func TestVerifyHostname(t *testing.T) {
testenv.MustHaveExternalNetwork(t)
c, err := Dial("tcp", "www.google.com:https", nil)
if err != nil {
t.Fatal(err)
}
if err := c.VerifyHostname("www.google.com"); err != nil {
t.Fatalf("verify www.google.com: %v", err)
}
if err := c.VerifyHostname("www.yahoo.com"); err == nil {
t.Fatalf("verify www.yahoo.com succeeded")
}
c, err = Dial("tcp", "www.google.com:https", &Config{InsecureSkipVerify: true})
if err != nil {
t.Fatal(err)
}
if err := c.VerifyHostname("www.google.com"); err == nil {
t.Fatalf("verify www.google.com succeeded with InsecureSkipVerify=true")
}
if err := c.VerifyHostname("www.yahoo.com"); err == nil {
t.Fatalf("verify www.google.com succeeded with InsecureSkipVerify=true")
}
}