[OpenWrt-Devel] [PATCH ustream-ssl v2 3/3] wolfssl: enable CN validation

[Eneas U de Queiroz]

WolfSSL added a wolfSSL_X509_check_host function to perform CN
validation in v3.10.4, depending on the build-time configure options:
--enable-nginx enables it for all supported versions;
--enable-opensslextra, since v3.14.2.

If the function is unavailable, then SSL_get_verify_result will be
called, and 'valid_cert' will be true if that call suceeds and we
have a peer certificate, just as it happens with openssl. Only
'valid_cn' will not be set.

Signed-off-by: Eneas U de Queiroz <cotequeiroz at gmail.com>

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 6b3fc8c..86e1b07 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -21,6 +21,12 @@ ELSEIF(WOLFSSL)
   IF (NOT HAVE_WOLFSSL_SSLSETIORECV)
     ADD_DEFINITIONS(-DNO_WOLFSSL_SSLSETIO_SEND_RECV)
   ENDIF()
+  CHECK_SYMBOL_EXISTS (wolfSSL_X509_check_host
+		       "wolfssl/options.h;wolfssl/ssl.h"
+		       HAVE_WOLFSSL_X509_CHECK_HOST)
+  IF (NOT HAVE_WOLFSSL_X509_CHECK_HOST)
+    ADD_DEFINITIONS(-DNO_X509_CHECK_HOST)
+  ENDIF()
 ELSE()
   SET(SSL_SRC ustream-io-openssl.c ustream-openssl.c)
   SET(SSL_LIB crypto ssl)
diff --git a/ustream-openssl.c b/ustream-openssl.c
index 21abf61..c830618 100644
--- a/ustream-openssl.c
+++ b/ustream-openssl.c
@@ -203,7 +203,7 @@ static void ustream_ssl_error(struct ustream_ssl *us, int ret)
 	uloop_timeout_set(&us->error_timer, 0);
 }
 
-#ifndef WOLFSSL_OPENSSL_H_
+#ifndef NO_X509_CHECK_HOST
 
 static bool ustream_ssl_verify_cn(struct ustream_ssl *us, X509 *cert)
 {
@@ -212,10 +212,15 @@ static bool ustream_ssl_verify_cn(struct ustream_ssl *us, X509 *cert)
 	if (!us->peer_cn)
 		return false;
 
+# ifndef WOLFSSL_OPENSSL_H_
 	ret = X509_check_host(cert, us->peer_cn, 0, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS, NULL);
+# else
+	ret = wolfSSL_X509_check_host(cert, us->peer_cn, 0, 0, NULL);
+# endif
 	return ret == 1;
 }
 
+#endif
 
 static void ustream_ssl_verify_cert(struct ustream_ssl *us)
 {
@@ -235,11 +240,12 @@ static void ustream_ssl_verify_cert(struct ustream_ssl *us)
 		return;
 
 	us->valid_cert = true;
+#ifndef NO_X509_CHECK_HOST
 	us->valid_cn = ustream_ssl_verify_cn(us, cert);
+#endif
 	X509_free(cert);
 }
 
-#endif
 
 __hidden enum ssl_conn_status __ustream_ssl_connect(struct ustream_ssl *us)
 {
@@ -252,9 +258,7 @@ __hidden enum ssl_conn_status __ustream_ssl_connect(struct ustream_ssl *us)
 		r = SSL_connect(ssl);
 
 	if (r == 1) {
-#ifndef WOLFSSL_OPENSSL_H_
 		ustream_ssl_verify_cert(us);
-#endif
 		return U_SSL_OK;
 	}
 

_______________________________________________
openwrt-devel mailing list
openwrt-devel at lists.openwrt.org
https://lists.openwrt.org/mailman/listinfo/openwrt-devel