BACKPORT: tlsdate-helper: fix SAN checking
Right now, SAN checking checks against the host we're opening a socket to
instead of the host we're actually trying to talk to, which is fine... as long
as we don't have a proxy. Note that this problem only manifests for hosts whose
CN is not equal to their hostname (so the default host of www.ptb.de is fine).
To observe the problem:
$ ssh -D 127.0.0.1:30000 somehost
$ tlsdate -H clients3.google.com -x socks5://127.0.0.1:30000
hostname verification failed for host 127.0.0.1!
child process failed in SSL handshake
With this fix, you instead see no output.
BUG=chromium-os:38801
TEST=adhoc
Test steps given above.
Signed-off-by: Elly Fong-Jones <ellyjones@chromium.org>
(cherry picked from commit ceb1fe26c3136fc206101b757bdae298e729acf9)
Change-Id: If57d7cc6a8c12bbbcefa95bb8414a37445434eb4
Reviewed-on: https://gerrit.chromium.org/gerrit/44277
Reviewed-by: Elly Jones <ellyjones@chromium.org>
Tested-by: Elly Jones <ellyjones@chromium.org>
Commit-Queue: Elly Jones <ellyjones@chromium.org>
1 file changed
