Commit f8eedf5e authored by Rémi Denis-Courmont's avatar Rémi Denis-Courmont

GnuTLS: fix server assertion failure in client certificate verification

(cherry picked from commit 72c07065860ad8e70674714532da05e373acdc88)

Plus an extra security check.
parent 9dd4633a
...@@ -356,8 +356,8 @@ gnutls_HandshakeAndValidate( tls_session_t *session ) ...@@ -356,8 +356,8 @@ gnutls_HandshakeAndValidate( tls_session_t *session )
goto error; goto error;
} }
assert( p_sys->psz_hostname != NULL ); if( p_sys->psz_hostname != NULL
if ( !gnutls_x509_crt_check_hostname( cert, p_sys->psz_hostname ) ) && !gnutls_x509_crt_check_hostname( cert, p_sys->psz_hostname ) )
{ {
msg_Err( session, "Certificate does not match \"%s\"", msg_Err( session, "Certificate does not match \"%s\"",
p_sys->psz_hostname ); p_sys->psz_hostname );
...@@ -731,7 +731,7 @@ static int OpenClient (vlc_object_t *obj) ...@@ -731,7 +731,7 @@ static int OpenClient (vlc_object_t *obj)
char *servername = var_GetNonEmptyString (p_session, "tls-server-name"); char *servername = var_GetNonEmptyString (p_session, "tls-server-name");
if (servername == NULL ) if (servername == NULL )
msg_Err (p_session, "server name missing for TLS session"); abort ();
else else
gnutls_server_name_set (p_sys->session.session, GNUTLS_NAME_DNS, gnutls_server_name_set (p_sys->session.session, GNUTLS_NAME_DNS,
servername, strlen (servername)); servername, strlen (servername));
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment