package/libs/wolfssl/patches/200-fix-checkhostname-matching.patch

   1 From ea5c290d605b2af7b10d6e5ce69aa3534f52385f Mon Sep 17 00:00:00 2001
   2 From: Eric Blankenhorn <eric@wolfssl.com>
   3 Date: Fri, 17 Jul 2020 08:37:02 -0500
   4 Subject: [PATCH] Fix CheckHostName matching
   5
   6 ---
   7  src/internal.c | 18 ++++++++++++------
   8  src/ssl.c      |  5 +++++
   9  tests/api.c    | 30 ++++++++++++++++++++++++++++++
  10  3 files changed, 47 insertions(+), 6 deletions(-)
  11
  12 diff --git a/src/internal.c b/src/internal.c
  13 index dc57df0242..cda815d875 100644
  14 --- a/src/internal.c
  15 +++ b/src/internal.c
  16 @@ -9346,7 +9346,7 @@ int CheckForAltNames(DecodedCert* dCert, const char* domain, int* checkCN)
  17          altName = dCert->altNames;
  18
  19      if (checkCN != NULL) {
  20 -        *checkCN = altName == NULL;
  21 +        *checkCN = (altName == NULL) ? 1 : 0;
  22      }
  23
  24      while (altName) {
  25 @@ -9415,23 +9415,29 @@ int CheckForAltNames(DecodedCert* dCert, const char* domain, int* checkCN)
  26  int CheckHostName(DecodedCert* dCert, const char *domainName, size_t domainNameLen)
  27  {
  28      int checkCN;
  29 +    int ret = DOMAIN_NAME_MISMATCH;
  30
  31      /* Assume name is NUL terminated. */
  32      (void)domainNameLen;
  33
  34      if (CheckForAltNames(dCert, domainName, &checkCN) != 1) {
  35 -        WOLFSSL_MSG("DomainName match on alt names failed too");
  36 -        return DOMAIN_NAME_MISMATCH;
  37 +        WOLFSSL_MSG("DomainName match on alt names failed");
  38      }
  39 +    else {
  40 +        ret = 0;
  41 +    }
  42 +
  43      if (checkCN == 1) {
  44          if (MatchDomainName(dCert->subjectCN, dCert->subjectCNLen,
  45 -                            domainName) == 0) {
  46 +                            domainName) == 1) {
  47 +            ret = 0;
  48 +        }
  49 +        else {
  50              WOLFSSL_MSG("DomainName match on common name failed");
  51 -            return DOMAIN_NAME_MISMATCH;
  52          }
  53      }
  54
  55 -    return 0;
  56 +    return ret;
  57  }
  58
  59  int CheckIPAddr(DecodedCert* dCert, const char* ipasc)
  60 diff --git a/src/ssl.c b/src/ssl.c
  61 index 11bc08a3cb..59ad9bae60 100644
  62 --- a/src/ssl.c
  63 +++ b/src/ssl.c
  64 @@ -43661,6 +43661,11 @@ int wolfSSL_X509_check_host(WOLFSSL_X509 *x, const char *chk, size_t chklen,
  65      (void)flags;
  66      (void)peername;
  67
  68 +    if ((x == NULL) || (chk == NULL)) {
  69 +        WOLFSSL_MSG("Invalid parameter");
  70 +        return WOLFSSL_FAILURE;
  71 +    }
  72 +
  73      if (flags == WOLFSSL_NO_WILDCARDS) {
  74          WOLFSSL_MSG("X509_CHECK_FLAG_NO_WILDCARDS not yet implemented");
  75          return WOLFSSL_FAILURE;
  76 diff --git a/tests/api.c b/tests/api.c
  77 index 774a332968..db888952d4 100644
  78 --- a/tests/api.c
  79 +++ b/tests/api.c
  80 @@ -23875,6 +23875,35 @@ static void test_wolfSSL_X509_issuer_name_hash(void)
  81  #endif
  82  }
  83
  84 +static void test_wolfSSL_X509_check_host(void)
  85 +{
  86 +#if defined(OPENSSL_EXTRA) && !defined(NO_CERTS) && !defined(NO_FILESYSTEM) \
  87 +    && !defined(NO_SHA) && !defined(NO_RSA)
  88 +
  89 +    X509* x509;
  90 +    const char altName[] = "example.com";
  91 +
  92 +    printf(testingFmt, "wolfSSL_X509_check_host()");
  93 +
  94 +    AssertNotNull(x509 = wolfSSL_X509_load_certificate_file(cliCertFile,
  95 +                SSL_FILETYPE_PEM));
  96 +
  97 +    AssertIntEQ(X509_check_host(x509, altName, XSTRLEN(altName), 0, NULL),
  98 +            WOLFSSL_SUCCESS);
  99 +
 100 +    AssertIntEQ(X509_check_host(x509, NULL, 0, 0, NULL),
 101 +            WOLFSSL_FAILURE);
 102 +
 103 +    X509_free(x509);
 104 +
 105 +    AssertIntEQ(X509_check_host(NULL, altName, XSTRLEN(altName), 0, NULL),
 106 +            WOLFSSL_FAILURE);
 107 +
 108 +    printf(resultFmt, passed);
 109 +
 110 +#endif
 111 +}
 112 +
 113  static void test_wolfSSL_DES(void)
 114  {
 115      #if defined(OPENSSL_EXTRA) && !defined(NO_DES3)
 116 @@ -36407,6 +36436,7 @@ void ApiTest(void)
 117      test_wolfSSL_X509_INFO();
 118      test_wolfSSL_X509_subject_name_hash();
 119      test_wolfSSL_X509_issuer_name_hash();
 120 +    test_wolfSSL_X509_check_host();
 121      test_wolfSSL_DES();
 122      test_wolfSSL_certs();
 123      test_wolfSSL_ASN1_TIME_print();