denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

constraints: Match FQDN and email addresses case-insensitively

Browse Source 
The case is generally ignored when matching such identities.  So this is
an issue with excluded name constraints where a malicious intermediate
CA could evade the constraints by issuing certificates with names that
just modify the case (e.g. strongSwan.org instead strongswan.org).

Note that it's likely that permitted name constraints are preferred over
excluded name constraints as it might be difficult to come up with a
conclusive list of names to exclude.

Fixes: a2b340764f ("Implemented NameConstraint matching in constraints plugin")
Fixes: CVE-2026-35331
This commit is contained in:
Tobias Brunner
2026-04-21 16:48:56 +02:00
parent 1e0643bef1
commit c66143db48
2 changed files with 24 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/plugins/constraints/constraints_validator.c
+15 -3
View File
@@ -55,6 +55,18 @@ static bool check_pathlen(x509_t *issuer, int pathlen)
return TRUE;
}
/**
* Check if the constraint and ID strings match case-insensitively
*/
static bool string_matches(chunk_t constraint, chunk_t id)
{
/* make sure the two strings have actually the same length */
return constraint.len == id.len &&
memchr(constraint.ptr, 0, constraint.len) == NULL &&
memchr(id.ptr, 0, id.len) == NULL &&
strncasecmp(constraint.ptr, id.ptr, constraint.len) == 0;
}
/**
* Check if a FQDN constraint matches
*/
@@ -70,7 +82,7 @@ static bool fqdn_matches(identification_t *constraint, identification_t *id)
return FALSE;
}
diff = chunk_create(i.ptr, i.len - c.len);
if (!chunk_equals(c, chunk_skip(i, diff.len)))
if (!string_matches(c, chunk_skip(i, diff.len)))
{
return FALSE;
}
@@ -101,10 +113,10 @@ static bool email_matches(identification_t *constraint, identification_t *id)
}
if (memchr(c.ptr, '@', c.len))
{ /* constraint is a full email address */
return chunk_equals(c, i);
return string_matches(c, i);
}
diff = chunk_create(i.ptr, i.len - c.len);
if (!chunk_equals(c, chunk_skip(i, diff.len)))
if (!string_matches(c, chunk_skip(i, diff.len)))
{
return FALSE;
}
src/libstrongswan/tests/suites/test_certnames.c
+9
View File
@@ -207,8 +207,10 @@ static struct {
bool good;
} permitted_san[] = {
{ ".strongswan.org", "test.strongswan.org", TRUE },
{ ".strongswan.org", "test.strongSwan.org", TRUE },
{ "strongswan.org", "test.strongswan.org", TRUE },
{ "a.b.c.strongswan.org", "d.a.b.c.strongswan.org", TRUE },
{ "a.b.c.strongswan.org", "d.A.b.C.strongswan.org", TRUE },
{ "a.b.c.strongswan.org", "a.b.c.d.strongswan.org", FALSE },
{ "strongswan.org", "strongswan.org.com", FALSE },
{ ".strongswan.org", "strongswan.org", FALSE },
@@ -216,8 +218,11 @@ static struct {
{ "strongswan.org", "swan.org", FALSE },
{ "strongswan.org", "swan.org", FALSE },
{ "[email protected]", "[email protected]", TRUE },
{ "[email protected]", "[email protected]", TRUE },
{ "[email protected]", "[email protected]", TRUE },
{ "[email protected]", "[email protected]", FALSE },
{ "email:strongswan.org", "[email protected]", TRUE },
{ "email:strongswan.org", "[email protected]", TRUE },
{ "email:strongswan.org", "[email protected]", FALSE },
{ "email:.strongswan.org", "[email protected]", TRUE },
{ "email:.strongswan.org", "[email protected]", FALSE },
@@ -281,7 +286,9 @@ static struct {
} excluded_san[] = {
{ ".strongswan.org", "test.strongswan.org", FALSE },
{ "strongswan.org", "test.strongswan.org", FALSE },
{ "strongswan.org", "test.strongSwan.org", FALSE },
{ "a.b.c.strongswan.org", "d.a.b.c.strongswan.org", FALSE },
{ "a.b.c.strongswan.org", "d.a.b.C.strongswan.org", FALSE },
{ "a.b.c.strongswan.org", "a.b.c.d.strongswan.org", TRUE },
{ "strongswan.org", "strongswan.org.com", TRUE },
{ ".strongswan.org", "strongswan.org", TRUE },
@@ -289,8 +296,10 @@ static struct {
{ "strongswan.org", "swan.org", TRUE },
{ "strongswan.org", "swan.org", TRUE },
{ "[email protected]", "[email protected]", FALSE },
{ "[email protected]", "[email protected]", FALSE },
{ "[email protected]", "[email protected]", TRUE },
{ "email:strongswan.org", "[email protected]", FALSE },
{ "email:strongswan.org", "[email protected]", FALSE },
{ "email:strongswan.org", "[email protected]", TRUE },
{ "email:.strongswan.org", "[email protected]", FALSE },
{ "email:.strongswan.org", "[email protected]", TRUE },