Vladislav Vaintroub 31c38a542d MDEV-41008: Fix X509 issuer/subject comparison for OpenSSL 3 ...

OpenSSL 3 escapes '/' and '+' in X509_NAME_oneline() output; OpenSSL 1.1
and WolfSSL don't. A REQUIRE ISSUER/SUBJECT grant from one library can
stop matching after switching to another.

Default comparison stays strcmp(). old_mode=X509_LENIENT_COMPARE opts
into falling back to an escape-aware compare, applied to whichever side
the currently-linked library's own escaping affects, at the cost of
reopening the ambiguity a crafted certificate could exploit to
impersonate another identity.

Adds regression tests against a real certificate with an ambiguous CN

Assisted-by: Claude Sonnet 5 <noreply@anthropic.com>

2026-09-29 01:13:28 +02:00

473 KiB

Raw Permalink Blame History

View Raw