Uploaded image for project: 'MariaDB Server'
  1. MariaDB Server
  2. MDEV-19560

Client may not compare IP address to Subject Alternative Name fields for server certificate verification

    XMLWordPrintable

Details

    • Bug
    • Status: Closed (View Workflow)
    • Major
    • Resolution: Not a Bug
    • 10.2.24, 10.1.40, 10.3.15, 10.4.5
    • N/A
    • SSL
    • None

    Description

      This is similar to CONC-413.

      Support for server certificate verification against subjectAltName (SAN) fields was added in the following Jira issues:

      However, I noticed that clients don't necessarily check the server's IP address against the subjectAltName (SAN) fields in the certificate. They only check mysql->host, which can be a host name or an IP address. If the user specifies the server's host as a host name, then I don't believe that the client will verify the certificate using the server's IP address.

      https://github.com/MariaDB/server/blob/mariadb-10.1.40/sql-common/client.c#L2647

      https://github.com/MariaDB/server/blob/mariadb-10.1.40/sql-common/client.c#L1840

      Could the IP address of the remote server be fetched in ssl_verify_server_cert() with the socket_remoteN functions by passing vio_fd(vio)?

      https://linux.die.net/man/3/socket_remote4

      https://linux.die.net/man/3/socket_remote6

      Attachments

        Issue Links

          relates to

          Task - A task that needs to be done. CONC-250 SSL hostname verification for SubjectAltNames

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. CONC-413 C/C may not compare IP address to Subject Alternative Name fields for server certificate verification

          • Major - Major loss of function.
          • Open

          Bug - A problem which impairs or prevents the functions of the product. MDEV-10594 SSL hostname verification fails for SubjectAltNames

          • Major - Major loss of function.
          • Closed

          Bug - A problem which impairs or prevents the functions of the product. MDEV-18131 MariaDB does not verify IP addresses from subject alternative names

          • Major - Major loss of function.
          • Closed

          Activity

            People

              wlad Vladislav Vaintroub
              GeoffMontee Geoff Montee (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              4 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Git Integration

                  Error rendering 'com.xiplink.jira.git.jira_git_plugin:git-issue-webpanel'. Please contact your Jira administrators.