You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@thrift.apache.org by "ASF GitHub Bot (JIRA)" <ji...@apache.org> on 2016/02/04 07:13:41 UTC
[jira] [Commented] (THRIFT-3599) Validate client IP address against
cert's SubjectAltName
[ https://issues.apache.org/jira/browse/THRIFT-3599?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15131795#comment-15131795 ]
ASF GitHub Bot commented on THRIFT-3599:
----------------------------------------
GitHub user nsuke opened a pull request:
https://github.com/apache/thrift/pull/835
THRIFT-3599 Validate client IP address against cert's SubjectAltName
https://issues.apache.org/jira/browse/THRIFT-3599
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/nsuke/thrift THRIFT-3599
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/thrift/pull/835.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #835
----
commit e5d5cdc9cd7ec66657518ea1887aaf2a938adc9f
Author: Nobuaki Sukegawa <ns...@apache.org>
Date: 2016-02-04T06:08:55Z
THRIFT-2103 [python] Support for SSL certificates with Subject Alternative Names
commit c9f74cc8f5e6468d8f68b46792484690b0f0c573
Author: Nobuaki Sukegawa <ns...@apache.org>
Date: 2016-02-04T06:09:41Z
THRIFT-3599 Validate client IP address against cert's SubjectAltName
----
> Validate client IP address against cert's SubjectAltName
> --------------------------------------------------------
>
> Key: THRIFT-3599
> URL: https://issues.apache.org/jira/browse/THRIFT-3599
> Project: Thrift
> Issue Type: Bug
> Components: Python - Library
> Reporter: Aki Sukegawa
> Assignee: Aki Sukegawa
> Priority: Critical
>
> After THRIFT-3505, python TSSLSocket has client cert support but does not perform any hostname matching.
> That means clients can submit any certificate that is unrelated to them and the server side only check if the cert is in their CA.
> It is in a sense worse than nothing as it can introduce false sense of security.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)