Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 1080142 - m2crypto does not support subject alternative name with IP address
m2crypto does not support subject alternative name with IP address
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: m2crypto (Show other bugs)
7.0
Unspecified Unspecified
low Severity low
: rc
: ---
Assigned To: Miloslav Trmač
Stanislav Zidek
https://github.com/martinpaljak/M2Cry...
:
Depends On:
Blocks: 1284927
  Show dependency treegraph
 
Reported: 2014-03-24 14:25 EDT by Hubert Kario
Modified: 2015-11-24 08:22 EST (History)
2 users (show)

See Also:
Fixed In Version: m2crypto-0.21.1-17.el7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1284927 (view as bug list)
Environment:
Last Closed: 2015-11-19 07:58:25 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2015:2165 normal SHIPPED_LIVE m2crypto update 2015-11-19 06:21:50 EST

  None (edit)
Description Hubert Kario 2014-03-24 14:25:29 EDT
Description of problem:
When m2crypto client connects to a server specified only by IP address, the verification of certificate fails

Version-Release number of selected component (if applicable):
m2crypto-0.21.1-14.el7.x86_64

How reproducible:
Always

Steps to Reproduce:
1. Create a CA and sing certificate with SAN pointing to 127.0.0.1
2. Start s_server with the certificate
3. connect to local s_server using 127.0.0.1 as the hostname

Actual results:
LOOP: SSL connect: before/connect initialization
LOOP: SSL connect: SSLv2/v3 write client hello A
LOOP: SSL connect: SSLv3 read server hello A
LOOP: SSL connect: SSLv3 read server certificate A
LOOP: SSL connect: SSLv3 read server key exchange A
LOOP: SSL connect: SSLv3 read server done A
LOOP: SSL connect: SSLv3 write client key exchange A
LOOP: SSL connect: SSLv3 write change cipher spec A
LOOP: SSL connect: SSLv3 write finished A
LOOP: SSL connect: SSLv3 flush data
LOOP: SSL connect: SSLv3 read server session ticket A
LOOP: SSL connect: SSLv3 read finished A
INFO: SSL connect: SSL negotiation finished successfully
Traceback (most recent call last):
  File "sni.py", line 48, in <module>
    s.connect((host, port))
  File "/usr/lib64/python2.7/site-packages/M2Crypto/SSL/Connection.py", line 188, in connect
    if not check(self.get_peer_cert(), self.addr[0]):
  File "/usr/lib64/python2.7/site-packages/M2Crypto/SSL/Checker.py", line 98, in __call__
    fieldName='subjectAltName')
M2Crypto.SSL.Checker.WrongHost: Peer certificate subjectAltName does not match host, expected 127.0.0.1, got DNS:wronghostname.com, DNS:example.com, DNS:evenmoreincorrectname.com, IP Address:127.0.0.1
ALERT: write: warning: close notify

Expected results:
Successful connection to server

Additional info:
Comment 1 Miloslav Trmač 2014-03-24 19:19:23 EDT
Thanks for the report.  File upstream as well for reference.
Comment 2 Miloslav Trmač 2014-03-24 19:20:24 EDT
(In reply to Miloslav Trmač from comment #1)
> File upstream as well for reference.

"Filed upstream", sorry.
Comment 11 errata-xmlrpc 2015-11-19 07:58:25 EST
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-2165.html

Note You need to log in before you can comment on or make changes to this bug.