mirrors
/
FreeRDP
mirror of https://github.com/FreeRDP/FreeRDP
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Do not fail on certificates without subject 

It is possible to implement an rdp client that accepts certificates by
fingerprint by using VerifyCertificateEx. In case the server uses a
certificate without subject (which, apparently, is not mandated by X509)
freerdp_certificate_data_load_cache fails and the certificate is refused
even before calling VerifyCertificateEx. This commit changes
freerdp_certificate_data_load_cache to consider that missing subject is
the same as an empty string.

Also downgrade the log message complaining about missing subject and
issuer to a warning.
This commit is contained in:
Rubycat 2023-08-07 13:03:54 +02:00 committed by akallabeth
parent dd9757d686
commit 68b1614b66
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libfreerdp/crypto/certificate_data.c
View File

@ -70,7 +70,7 @@ static BOOL freerdp_certificate_data_load_cache(rdpCertificateData* data)
data->cached_subject = freerdp_certificate_get_subject(data->cert);
if (!data->cached_subject)
goto fail;
data->cached_subject = calloc(1, 1);
size_t pemlen = 0;
data->cached_pem = freerdp_certificate_get_pem(data->cert, &pemlen);
@ -83,7 +83,7 @@ static BOOL freerdp_certificate_data_load_cache(rdpCertificateData* data)
data->cached_issuer = freerdp_certificate_get_issuer(data->cert);
if (!data->cached_issuer)
goto fail;
data->cached_issuer = calloc(1, 1);
rc = TRUE;
fail:

4
libfreerdp/crypto/x509_utils.c
View File

@ -103,7 +103,7 @@ char* x509_utils_get_subject(const X509* xcert)
}
subject = crypto_print_name(X509_get_subject_name(xcert));
if (!subject)
WLog_ERR(TAG, "certificate does not have a subject!");
WLog_WARN(TAG, "certificate does not have a subject!");
return subject;
}
@ -524,7 +524,7 @@ char* x509_utils_get_issuer(const X509* xcert)
}
issuer = crypto_print_name(X509_get_issuer_name(xcert));
if (!issuer)
WLog_ERR(TAG, "certificate does not have an issuer!");
WLog_WARN(TAG, "certificate does not have an issuer!");
return issuer;
}