gfwleak/tango-tfe
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

修改在可信证书存储中查找中间证书的方式：之前是通过 subject 查找，无法处理 subject 同名的问题；现修改为完全匹配

Browse Source
This commit is contained in:
luwenpeng
2020-01-06 18:17:13 +08:00
parent b8e7bd0347
commit c58e459005
1 changed files with 26 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
platform/src/ssl_fetch_cert.cpp
View File

@@ -16,7 +16,8 @@
#include <MESA/MESA_prof_load.h> #include <MESA/MESA_prof_load.h>
typedef struct x509_object_st { typedef struct x509_object_st {
int type; /* one of the above types */
X509_LOOKUP_TYPE type;
union { union {
char *ptr; char *ptr;
X509 *x509; X509 *x509;
@@ -183,28 +184,34 @@ void ssl_fetch_trusted_cert_from_chain(STACK_OF(X509) * cert_chain, X509_STORE *
char *issuer = NULL; char *issuer = NULL;
char *fingerprint = NULL; char *fingerprint = NULL;
X509 *cert = NULL; X509 *cert = NULL;
X509_LOOKUP *lookup = NULL; X509_OBJECT *obj = NULL;
X509_OBJECT stmp;
if (!g_kafka_logger || !g_kafka_logger->enable) { if (!g_kafka_logger || !g_kafka_logger->enable) {
return; return;
} }
// don`t need call X509_LOOKUP_free(lookup)
lookup = X509_STORE_add_lookup(trusted_store, X509_LOOKUP_hash_dir());
if (lookup == NULL) {
return;
}
deep = sk_X509_num(cert_chain); deep = sk_X509_num(cert_chain);
for (int i = 1; i < deep; i++) { for (int i = 1; i < deep; i++) {
// need't call X509_FREE(cert) // need't call X509_FREE(cert)
cert = sk_X509_value(cert_chain, i); cert = sk_X509_value(cert_chain, i);
assert(cert); assert(cert);
stmp.type = X509_LU_NONE; obj = X509_OBJECT_new();
stmp.data.ptr = NULL; assert(obj);
ret = X509_LOOKUP_by_subject(lookup, X509_LU_X509, X509_get_subject_name(cert), &stmp); obj->type = X509_LU_X509;
obj->data.x509 = (X509 *)cert;
// not in trusted store
if (X509_OBJECT_retrieve_match(X509_STORE_get0_objects(trusted_store), obj) == NULL)
{
ret = 0;
}
// in trusted store
else
{
ret = 1;
}
X509_OBJECT_free(obj);
subj = ssl_x509_subject(cert); subj = ssl_x509_subject(cert);
issuer = ssl_x509_issuer(cert); issuer = ssl_x509_issuer(cert);
fingerprint = ssl_x509_fingerprint(cert, 0); fingerprint = ssl_x509_fingerprint(cert, 0);