Closed GoogleCodeExporter closed 9 years ago
The attached patch fixes this, by adding an |address| and |address_length|
field to CanonHostInfo
(I would upload it to rietveld but I can't work out the correct
codereview.settings file to make gcl happy)
Original comment by joth@chromium.org
on 23 Jun 2011 at 6:41
Attachments:
What's the use case for this?
Original comment by brettw@chromium.org
on 23 Jun 2011 at 9:33
> What's the use case for this?
When verifying an SSL certificate matches the host the client think's they are
talking to, the host must be canonicalized, and if it is an IP address then the
parsed address used in searching a match in the certificate's subject
alternative names iPAdress fields.
See http://codereview.chromium.org/7204053/ for example of how this makes life
easier. (That patch has other stuff going on too, as it's also removing a
hand-rolled host canonicalizer - but hopefully good enough for illustration)
(We've not needed it previously in chrome because NSS includes its own name
verifier, but for OpenSSL we need to roll our own)
--
regarding the issue25.patch1.txt patch I uploaded, I realized this can be
simplified by removing the address_length member of the host info -- the length
can be entirely and reliably inferred from the address family. (I could add an
AddressLength() getter to calculate this for the user)
Original comment by joth@chromium.org
on 24 Jun 2011 at 7:00
Here's the simplified version that calculates address length from the IP
address family, rather than having to carry it in an additional member of the
struct. (so now, aside from test code, this makes it a quite a small change)
Original comment by joth@chromium.org
on 24 Jun 2011 at 10:02
Attachments:
Okay, LGTM. I checked this in as googleurl@159, but didn't pull deps. Can you
please pull this into Chrome?
Original comment by bre...@gmail.com
on 8 Jul 2011 at 7:18
Original issue reported on code.google.com by
joth@chromium.org
on 23 Jun 2011 at 6:39