Feature #7849
closed
trusted_hosts should determine hostname from certificate CN on SSL requests
Description
trusted_hosts is based on reverse DNS, but when requests come in over HTTPS, the CN should be parsed from the certificate's DN and used for comparison against the trusted hosts list.
Updated by Dominic Cleal about 10 years ago
- Related to Bug #7822: CVE-2014-3691 - Smart proxy doesn't perform verification of client SSL certificate on API requests added
Updated by Markus Frosch about 10 years ago
Updated by Dominic Cleal about 10 years ago
- Translation missing: en.field_release deleted (
21)
Updated by Lukas Zapletal about 10 years ago
Markus, are you able to file a pull request? If not, I am going to take from this point. Thanks!
Updated by Markus Frosch about 10 years ago
I didn't have the time yet, if you have, take over ;)
Please see my branch mentioned above.
This should validate the CN against the trusted_host list.
IMHO we don't need any hostname / ptr lookup.
Updated by Dominic Cleal about 10 years ago
I think we require the DNS lookup for HTTP requests, but should only use the DN parsing for HTTPS requests.
Updated by Markus Frosch almost 10 years ago
Finally(!!) had the time to work on the thing.
Result is here: https://github.com/lazyfrosch/smart-proxy/tree/feature/trusted_hosts-CN-7849
Should I open a PR or should we take care about additional tests?
I'm not sure how the test suite works though.
Updated by Dominic Cleal almost 10 years ago
Nice, please do open a pull request and we can get it merged then. (Plus Jenkins will run the test suite for us.)
Adding new tests to test/sinatra/trusted_hosts_test.rb is probably best, but we can help with that in the PR if you're unsure.
Updated by Markus Frosch almost 10 years ago
Updated by Anonymous almost 10 years ago
- Status changed from New to Ready For Testing
- Pull request https://github.com/theforeman/smart-proxy/pull/246 added
- Pull request deleted (
)
Updated by Dominic Cleal almost 10 years ago
- Translation missing: en.field_release set to 28
Updated by Markus Frosch almost 10 years ago
- Status changed from Ready For Testing to Closed
- % Done changed from 0 to 100
Applied in changeset 30aff66f53045e4c3e3e6a5f13c46f4d8b857551.
Updated by Dominic Cleal over 9 years ago
- Related to Bug #9919: trusted host test can hang during DNS lookup added
Updated by Anonymous over 9 years ago
- Related to Feature #11039: Support more specific authorization of wildcard certificates added