eiac/crypto
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

acme/autocert: validate SNI value even more

Browse Source 
Follow-up to https://golang.org/cl/42497

Change-Id: I638e7ba5e924a74ce5318e4b50fb18082fd1a43f
Reviewed-on: https://go-review.googlesource.com/42499
Reviewed-by: Alex Vaghin <ddos@google.com>
This commit is contained in:
Brad Fitzpatrick
2017-05-04 15:16:30 +00:00
parent 04eae0b62f
commit 5a033cc77e
2 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
acme/autocert/autocert.go
+4 -2
View File
@@ -176,9 +176,11 @@ func (m *Manager) GetCertificate(hello *tls.ClientHelloInfo) (*tls.Certificate,
if name == "" {
return nil, errors.New("acme/autocert: missing server name")
}
if !strings.Contains(strings.Trim(name, "."), ".") {
return nil, errors.New("acme/autocert: server name component count invalid")
}
if strings.ContainsAny(name, `/\`) {
return nil, errors.New("acme/autocert: bogus SNI value")
return nil, errors.New("acme/autocert: server name contains invalid character")
}
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
acme/autocert/autocert_test.go
+6 -1
View File
@@ -588,8 +588,13 @@ func TestManagerGetCertificateBogusSNI(t *testing.T) {
}{
{"foo.com", "cache.Get of foo.com"},
{"foo.com.", "cache.Get of foo.com"},
{`a\b`, "acme/autocert: bogus SNI value"},
{`a\b.com`, "acme/autocert: server name contains invalid character"},
{`a/b.com`, "acme/autocert: server name contains invalid character"},
{"", "acme/autocert: missing server name"},
{"foo", "acme/autocert: server name component count invalid"},
{".foo", "acme/autocert: server name component count invalid"},
{"foo.", "acme/autocert: server name component count invalid"},
{"fo.o", "cache.Get of fo.o"},
}
for _, tt := range tests {
_, err := m.GetCertificate(&tls.ClientHelloInfo{ServerName: tt.name})