tlsdate-helper: fix SAN checking
Right now, SAN checking checks against the host we're opening a socket to
instead of the host we're actually trying to talk to, which is fine... as long
as we don't have a proxy. Note that this problem only manifests for hosts whose
CN is not equal to their hostname (so the default host of www.ptb.de is fine).
To observe the problem:
$ ssh -D 127.0.0.1:30000 somehost
$ tlsdate -H clients3.google.com -x socks5://127.0.0.1:30000
hostname verification failed for host 127.0.0.1!
child process failed in SSL handshake
With this fix, you instead see no output.
Signed-off-by: Elly Fong-Jones <[email protected]>
diff --git a/CHANGELOG b/CHANGELOG
index 267f79b..79b1f12 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,6 @@
0.0.7 TBD
Add -x option to tlsdated to override source proxies.
+ Correctly check SANs against target host when using proxies.
0.0.6 Mon 18 Feb, 2013
Ensure that tlsdate compiles with g++ by explicit casting rather than
implicit casting by whatever compiler is compiling tlsdate.
