Commit ced3d915 authored by Viktor Dukhovni's avatar Viktor Dukhovni
Browse files

Set optional peername when X509_check_host() succeeds. 

Pass address of X509_VERIFY_PARAM_ID peername to X509_check_host().
Document modified interface.
parent 6e661d45

apps/apps.c

+2 −1
Original line number Diff line number Diff line
@@ -2969,7 +2969,8 @@ void print_cert_checks(BIO *bio, X509 *x, 
	if (checkhost)

		{

		BIO_printf(bio, "Hostname %s does%s match certificate\n",

				checkhost, X509_check_host(x, checkhost, 0, 0)

				checkhost,

				X509_check_host(x, checkhost, 0, 0, NULL)

						? "" : " NOT");

		}

crypto/x509/x509_vfy.c

+2 −1
Original line number Diff line number Diff line
@@ -752,7 +752,8 @@ static int check_hosts(X509 *x, X509_VERIFY_PARAM_ID *id) 
	for (i = 0; i < n; ++i)

		{

		name = (unsigned char *)sk_OPENSSL_STRING_value(id->hosts, i);

		if (X509_check_host(x, name, 0, id->hostflags) > 0)

		if (X509_check_host(x, name, 0, id->hostflags,

				    &id->peername) > 0)

			return 1;

		}

	return n == 0;

crypto/x509v3/v3_utl.c

+30 −24
Original line number Diff line number Diff line
@@ -853,8 +853,11 @@ static int equal_wildcard(const unsigned char *pattern, size_t pattern_len, 


static int do_check_string(ASN1_STRING *a, int cmp_type, equal_fn equal,

				unsigned int flags,

				const unsigned char *b, size_t blen)

				const unsigned char *b, size_t blen,

				char **peername)

	{

	int rv = 0;



	if (!a->data || !a->length)

		return 0;

	if (cmp_type > 0)
@@ -862,27 +865,30 @@ static int do_check_string(ASN1_STRING *a, int cmp_type, equal_fn equal, 
		if (cmp_type != a->type)

			return 0;

		if (cmp_type == V_ASN1_IA5STRING)

			return equal(a->data, a->length, b, blen, flags);

		if (a->length == (int)blen && !memcmp(a->data, b, blen))

			return 1;

		else

			return 0;

			rv = equal(a->data, a->length, b, blen, flags);

		else if (a->length == (int)blen && !memcmp(a->data, b, blen))

			rv = 1;

		if (rv > 0 && peername)

			*peername = BUF_strndup((char *)a->data, a->length);

		}

	else

		{

		int astrlen, rv;

		int astrlen;

		unsigned char *astr;

		astrlen = ASN1_STRING_to_UTF8(&astr, a);

		if (astrlen < 0)

			return -1;

		rv = equal(astr, astrlen, b, blen, flags);

		OPENSSL_free(astr);

		return rv;

		if (rv > 0 && peername)

			*peername = BUF_strndup((char *)astr, astrlen);

		}

	return rv;

	}



static int do_x509_check(X509 *x, const unsigned char *chk, size_t chklen,

					unsigned int flags, int check_type)

					unsigned int flags, int check_type,

					char **peername)

	{

	GENERAL_NAMES *gens = NULL;

	X509_NAME *name = NULL;
@@ -890,6 +896,7 @@ static int do_x509_check(X509 *x, const unsigned char *chk, size_t chklen, 
	int cnid;

	int alt_type;

	int san_present = 0;

	int rv = 0;

	equal_fn equal;



	/* See below, this flag is internal-only */
@@ -925,7 +932,6 @@ static int do_x509_check(X509 *x, const unsigned char *chk, size_t chklen, 
	gens = X509_get_ext_d2i(x, NID_subject_alt_name, NULL, NULL);

	if (gens)

		{

		int rv = 0;

		for (i = 0; i < sk_GENERAL_NAME_num(gens); i++)

			{

			GENERAL_NAME *gen;
@@ -940,16 +946,14 @@ static int do_x509_check(X509 *x, const unsigned char *chk, size_t chklen, 
				cstr = gen->d.dNSName;

			else

				cstr = gen->d.iPAddress;

			if (do_check_string(cstr, alt_type, equal, flags,

					    chk, chklen))

				{

				rv = 1;

			/* Positive on success, negative on error! */

			if ((rv = do_check_string(cstr, alt_type, equal, flags,

						  chk, chklen, peername)) != 0)

				break;

			}

			}

		GENERAL_NAMES_free(gens);

		if (rv)

			return 1;

		if (rv != 0)

			return rv;

		if (!cnid

		    || (san_present

		        && !(flags & X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT)))
@@ -963,14 +967,16 @@ static int do_x509_check(X509 *x, const unsigned char *chk, size_t chklen, 
		ASN1_STRING *str;

		ne = X509_NAME_get_entry(name, i);

		str = X509_NAME_ENTRY_get_data(ne);

		if (do_check_string(str, -1, equal, flags, chk, chklen))

			return 1;

		/* Positive on success, negative on error! */

		if ((rv = do_check_string(str, -1, equal, flags,

					  chk, chklen, peername)) != 0)

			return rv;

		}

	return 0;

	}



int X509_check_host(X509 *x, const unsigned char *chk, size_t chklen,

					unsigned int flags)

					unsigned int flags, char **peername)

	{

	if (chk == NULL)

		return -2;
@@ -985,7 +991,7 @@ int X509_check_host(X509 *x, const unsigned char *chk, size_t chklen, 
		return -2;

	if (chklen > 1 && chk[chklen-1] == '\0')

		--chklen;

	return do_x509_check(x, chk, chklen, flags, GEN_DNS);

	return do_x509_check(x, chk, chklen, flags, GEN_DNS, peername);

	}



int X509_check_email(X509 *x, const unsigned char *chk, size_t chklen,
@@ -1004,7 +1010,7 @@ int X509_check_email(X509 *x, const unsigned char *chk, size_t chklen, 
		return -2;

	if (chklen > 1 && chk[chklen-1] == '\0')

		--chklen;

	return do_x509_check(x, chk, chklen, flags, GEN_EMAIL);

	return do_x509_check(x, chk, chklen, flags, GEN_EMAIL, NULL);

	}



int X509_check_ip(X509 *x, const unsigned char *chk, size_t chklen,
@@ -1012,7 +1018,7 @@ int X509_check_ip(X509 *x, const unsigned char *chk, size_t chklen, 
	{

	if (chk == NULL)

		return -2;

	return do_x509_check(x, chk, chklen, flags, GEN_IPADD);

	return do_x509_check(x, chk, chklen, flags, GEN_IPADD, NULL);

	}



int X509_check_ip_asc(X509 *x, const char *ipasc, unsigned int flags)
@@ -1024,7 +1030,7 @@ int X509_check_ip_asc(X509 *x, const char *ipasc, unsigned int flags) 
	iplen = a2i_ipadd(ipout, ipasc);

	if (iplen == 0)

		return -2;

	return do_x509_check(x, ipout, (size_t)iplen, flags, GEN_IPADD);

	return do_x509_check(x, ipout, (size_t)iplen, flags, GEN_IPADD, NULL);

	}



/* Convert IP addresses both IPv4 and IPv6 into an

crypto/x509v3/v3nametest.c

+3 −2
Original line number Diff line number Diff line
@@ -276,7 +276,7 @@ static void run_cert(X509 *crt, const char *nameincert, 
		memcpy(name, *pname, namelen);



		ret = X509_check_host(crt, (const unsigned char *)name,

				      namelen, 0);

				      namelen, 0, NULL);

		match = -1;

		if (ret < 0)

			{
@@ -295,7 +295,8 @@ static void run_cert(X509 *crt, const char *nameincert, 
		check_message(fn, "host", nameincert, match, *pname);



		ret = X509_check_host(crt, (const unsigned char *)name,

				      namelen, X509_CHECK_FLAG_NO_WILDCARDS);

				      namelen, X509_CHECK_FLAG_NO_WILDCARDS,

				      NULL);

		match = -1;

		if (ret < 0)

			{

crypto/x509v3/x509v3.h

+1 −1
Original line number Diff line number Diff line
@@ -720,7 +720,7 @@ STACK_OF(OPENSSL_STRING) *X509_get1_ocsp(X509 *x); 
#define _X509_CHECK_FLAG_DOT_SUBDOMAINS 0x8000



int X509_check_host(X509 *x, const unsigned char *chk, size_t chklen,

					unsigned int flags);

					unsigned int flags, char **peername);

int X509_check_email(X509 *x, const unsigned char *chk, size_t chklen,

					unsigned int flags);

int X509_check_ip(X509 *x, const unsigned char *chk, size_t chklen,