[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

(racoon 818) Re: call to getaddrinfo() in oakley.c

To: racoon@kame.net
Subject: (racoon 818) Re: call to getaddrinfo() in oakley.c
From: Josef Pojsl <jp@tns.cz>
Date: Thu, 21 Oct 2004 10:04:26 +0200
Delivered-to: racoon-archive@kame.net
Delivered-to: racoon-outgo@kame.net
Delivered-to: racoon@kame.net
In-reply-to: <20040408171733Z.sakane@kame.net>
Mail-followup-to: Josef Pojsl <jp@tns.cz>, racoon@kame.net
References: <20040331133000.GH317@bertik.tns.cz> <20040408171733Z.sakane@kame.net>
Reply-to: racoon@kame.net
Sender: owner-racoon@kame.net
User-agent: Mutt/1.5.1i

Dear Shoichi,

I apologize for replying to this message that late.
In fact, I somehow missed your answer and have found it now,
when the same problem reappeared after having upgraded racoon to 20040818a.

So, as I said, the behavior is still the same as I had described
in message (racoon 459), even with 20040818a.
I am attaching both certificates; the one that is being checked
is mail-cert.pem (the certificate of our peer); our own certificate
is hci-cert.pem.

I have generated both these certificates myself. The values of subjectAltName
are altered in openssl through the file openssl.cnf where I have something
like this:

    subjectAltName=IP:1.2.3.4

Sorry for the mess and thank you.

With kind regards,
--
Josef

On Thu, Apr 08, 2004 at 05:17:33PM +0900, Shoichi Sakane wrote:
> > I have dived into the sources and found out that on line 1691 in oakley.c,
> > getaddrinfo() call returns EAI_NONAME. Its argument altname is the value
> > of altname obtained from eay_get_x509subjectaltname() a few lines above.
> > The value of altname is a network-order four-byte IP address,
> > but getaddrinfo() (at least, on FreeBSD 4.9) accepts only strings
> > in dot notation as its first argument.
> 
> when i wrote the code to get the subjectAltName from the cert
> by using the openssl function, the function returned the string of
> the subjectAltName even when the type is IP address.
> so i wrote converting the string to the binary when the type is IP
> address.  do you know that the API was changed ?
> 
> Or i suspect the value of the subjectAltName in your certificate.
> could you show me the certificate "hci-cert.pem" when you tested ?
> 
>

References:
- (racoon 459) call to getaddrinfo() in oakley.c
  - From: Josef Pojsl <jp@tns.cz>
- (racoon 467) Re: call to getaddrinfo() in oakley.c
  - From: Shoichi Sakane <sakane@kame.net>

Prev by Date: (racoon 817) Windows XP Road Warrior with x509 and/or PSK
Next by Date: (racoon 819) Re: Windows XP Road Warrior with x509 and/or PSK
Previous by thread: (racoon 467) Re: call to getaddrinfo() in oakley.c
Next by thread: (racoon 460) High number of entries in SPD.....
Index(es):
- Date
- Thread