[OpenWrt-Devel] [PATCH ustream-ssl 2/2] ustream-openssl.c: do CN validation with wolfssl

[Eneas U de Queiroz]

ustream uses X509_check_host to perform the validation, and that call is
present in wolfssl since v3.10.4, depending on the build-time configure
options.  Currently, openwrt always builds support for it.  It currently
does not support X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS, so no flags are
being used, which should be good enough.

Nonetheless, the call is being checked in CMakeLists.txt, just in case
wolfssl build options change.

Without CN validation, uclient-fetch will fail to run unless the
--no-check-certificate option is used.

Signed-off-by: Eneas U de Queiroz <cotequeiroz at gmail.com>

---
This was run-tested on WRT3200ACM running openwrt master

diff --git a/CMakeLists.txt b/CMakeLists.txt
index b99b242..8dbdb89 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -23,6 +23,11 @@ ELSEIF(CYASSL)
     IF (HAVE_WOLFSSL_SSLSETIORECV)
       ADD_DEFINITIONS(-DWOLFSSL_SSLSETIO_SEND_RECV)
     ENDIF()
+    CHECK_SYMBOL_EXISTS (X509_check_host "openssl/ssl.h"
+			 HAVE_X509_CHECK_HOST)
+    IF (HAVE_X509_CHECK_HOST)
+      ADD_DEFINITIONS(-DHAVE_X509_CHECK_HOST)
+    ENDIF()
   ENDIF()
   ADD_DEFINITIONS(-DHAVE_CYASSL)
   SET(SSL_SRC ustream-io-cyassl.c ustream-openssl.c)
diff --git a/ustream-openssl.c b/ustream-openssl.c
index b2df362..ab763f3 100644
--- a/ustream-openssl.c
+++ b/ustream-openssl.c
@@ -203,7 +203,7 @@ static void ustream_ssl_error(struct ustream_ssl *us, int ret)
 	uloop_timeout_set(&us->error_timer, 0);
 }
 
-#ifndef CYASSL_OPENSSL_H_
+#if !defined(CYASSL_OPENSSL_H_) || defined(HAVE_X509_CHECK_HOST)
 
 static bool ustream_ssl_verify_cn(struct ustream_ssl *us, X509 *cert)
 {
@@ -212,7 +212,11 @@ static bool ustream_ssl_verify_cn(struct ustream_ssl *us, X509 *cert)
 	if (!us->peer_cn)
 		return false;
 
+# ifndef CYASSL_OPENSSL_H_
 	ret = X509_check_host(cert, us->peer_cn, 0, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS, NULL);
+# else
+	ret = X509_check_host(cert, us->peer_cn, 0, 0, NULL);
+# endif
 	return ret == 1;
 }
 
@@ -252,7 +256,7 @@ __hidden enum ssl_conn_status __ustream_ssl_connect(struct ustream_ssl *us)
 		r = SSL_connect(ssl);
 
 	if (r == 1) {
-#ifndef CYASSL_OPENSSL_H_
+#if !defined(CYASSL_OPENSSL_H_) || defined(HAVE_X509_CHECK_HOST)
 		ustream_ssl_verify_cert(us);
 #endif
 		return U_SSL_OK;

_______________________________________________
openwrt-devel mailing list
openwrt-devel at lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel