Skip to content

Commit e488c1d

Browse files
padelsbachpadelsbach
committed
Add IP SAN matching
1 parent b02ddde commit e488c1d

5 files changed

Lines changed: 151 additions & 1 deletion

File tree

‎src/internal.c‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8627,6 +8627,7 @@ void wolfSSL_ResourceFree(WOLFSSL* ssl)
86278627
FreeHandshakeHashes(ssl);
86288628
#endif
86298629
XFREE(ssl->buffers.domainName.buffer, ssl->heap, DYNAMIC_TYPE_DOMAIN);
8630+
XFREE(ssl->buffers.ipasc.buffer, ssl->heap, DYNAMIC_TYPE_DOMAIN);
86308631

86318632
/* clear keys struct after session */
86328633
ForceZero(&ssl->keys, sizeof(Keys));
@@ -16792,7 +16793,7 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
1679216793
(char*)ssl->buffers.domainName.buffer,
1679316794
(ssl->buffers.domainName.buffer == NULL ? 0 :
1679416795
(word32)XSTRLEN(ssl->buffers.domainName.buffer)),
16795-
NULL, 0) != 1) {
16796+
NULL, 0, 0) != 1) {
1679616797
WOLFSSL_MSG("DomainName match failed");
1679716798
/* try to get peer key still */
1679816799
ret = DOMAIN_NAME_MISMATCH;
@@ -16802,6 +16803,17 @@ int ProcessPeerCerts(WOLFSSL* ssl, byte* input, word32* inOutIdx,
1680216803
#endif /* WOLFSSL_ALL_NO_CN_IN_SAN */
1680316804
}
1680416805

16806+
#ifndef OPENSSL_EXTRA
16807+
if (!ssl->options.verifyNone && ssl->buffers.ipasc.buffer) {
16808+
if (CheckIPAddr(args->dCert,
16809+
(const char*)ssl->buffers.ipasc.buffer) != 0) {
16810+
WOLFSSL_MSG("IPAddr match on alt names failed");
16811+
ret = IPADDR_MISMATCH;
16812+
WOLFSSL_ERROR_VERBOSE(ret);
16813+
}
16814+
}
16815+
#endif
16816+
1680516817
/* decode peer key */
1680616818
switch (args->dCert->keyOID) {
1680716819
#ifndef NO_RSA

‎src/ssl.c‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7462,6 +7462,48 @@ int wolfSSL_check_domain_name(WOLFSSL* ssl, const char* dn)
74627462
}
74637463
}
74647464

7465+
/* call before SSL_connect, if verifying will add IP SAN check to
7466+
date check and signature check */
7467+
WOLFSSL_ABI
7468+
int wolfSSL_check_ip_address(WOLFSSL* ssl, const char* ipaddr)
7469+
{
7470+
WOLFSSL_ENTER("wolfSSL_check_ip_address");
7471+
7472+
if (ssl == NULL || ipaddr == NULL) {
7473+
WOLFSSL_MSG("Bad function argument: NULL");
7474+
return WOLFSSL_FAILURE;
7475+
}
7476+
7477+
if (ssl->buffers.ipasc.buffer != NULL) {
7478+
XFREE(ssl->buffers.ipasc.buffer, ssl->heap, DYNAMIC_TYPE_DOMAIN);
7479+
ssl->buffers.ipasc.buffer = NULL;
7480+
ssl->buffers.ipasc.length = 0;
7481+
}
7482+
7483+
ssl->buffers.ipasc.length = (word32)XSTRLEN(ipaddr);
7484+
ssl->buffers.ipasc.buffer = (byte*)XMALLOC(ssl->buffers.ipasc.length + 1,
7485+
ssl->heap, DYNAMIC_TYPE_DOMAIN);
7486+
if (ssl->buffers.ipasc.buffer == NULL) {
7487+
ssl->error = MEMORY_ERROR;
7488+
return WOLFSSL_FAILURE;
7489+
}
7490+
7491+
XMEMCPY(ssl->buffers.ipasc.buffer, ipaddr, ssl->buffers.ipasc.length);
7492+
ssl->buffers.ipasc.buffer[ssl->buffers.ipasc.length] = '\0';
7493+
7494+
#ifdef OPENSSL_EXTRA
7495+
if (ssl->param == NULL) {
7496+
return WOLFSSL_FAILURE;
7497+
}
7498+
if (wolfSSL_X509_VERIFY_PARAM_set1_ip_asc(ssl->param, ipaddr) !=
7499+
WOLFSSL_SUCCESS) {
7500+
return WOLFSSL_FAILURE;
7501+
}
7502+
#endif
7503+
7504+
return WOLFSSL_SUCCESS;
7505+
}
7506+
74657507
#if defined(SESSION_CERTS) && defined(OPENSSL_EXTRA)
74667508
const char *wolfSSL_get0_peername(WOLFSSL *ssl) {
74677509
if (ssl == NULL) {

‎tests/api.c‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15320,6 +15320,96 @@ static int test_wolfSSL_check_domain_basic(void)
1532015320
}
1532115321
#endif /* HAVE_SSL_MEMIO_TESTS_DEPENDENCIES */
1532215322

15323+
#if defined(OPENSSL_EXTRA) && defined(HAVE_SSL_MEMIO_TESTS_DEPENDENCIES) && \
15324+
(defined(WOLFSSL_IP_ALT_NAME) || defined(OPENSSL_ALL)) && \
15325+
!defined(OPENSSL_COMPATIBLE_DEFAULTS) && !defined(NO_SHA256)
15326+
static const char* ipaddr = NULL;
15327+
static int test_wolfSSL_check_ip_param_client_ssl(WOLFSSL* ssl)
15328+
{
15329+
EXPECT_DECLS;
15330+
X509_VERIFY_PARAM* param = NULL;
15331+
15332+
ExpectNotNull(param = SSL_get0_param(ssl));
15333+
ExpectIntEQ(X509_VERIFY_PARAM_set1_ip_asc(param, ipaddr), WOLFSSL_SUCCESS);
15334+
15335+
return EXPECT_RESULT();
15336+
}
15337+
15338+
static int test_wolfSSL_check_ip_param_basic(void)
15339+
{
15340+
EXPECT_DECLS;
15341+
test_ssl_cbf func_cb_client;
15342+
test_ssl_cbf func_cb_server;
15343+
15344+
XMEMSET(&func_cb_client, 0, sizeof(func_cb_client));
15345+
XMEMSET(&func_cb_server, 0, sizeof(func_cb_server));
15346+
15347+
func_cb_client.ssl_ready = &test_wolfSSL_check_ip_param_client_ssl;
15348+
15349+
ipaddr = "127.0.0.2";
15350+
/* Expect to fail: cert SAN IP is 127.0.0.1 */
15351+
ExpectIntEQ(test_wolfSSL_client_server_nofail_memio(&func_cb_client,
15352+
&func_cb_server, NULL), -1001);
15353+
15354+
ipaddr = "127.0.0.1";
15355+
/* Expect to succeed */
15356+
ExpectIntEQ(test_wolfSSL_client_server_nofail_memio(&func_cb_client,
15357+
&func_cb_server, NULL), TEST_SUCCESS);
15358+
15359+
return EXPECT_RESULT();
15360+
}
15361+
#else
15362+
static int test_wolfSSL_check_ip_param_basic(void)
15363+
{
15364+
EXPECT_DECLS;
15365+
return EXPECT_RESULT();
15366+
}
15367+
#endif
15368+
15369+
#if defined(HAVE_SSL_MEMIO_TESTS_DEPENDENCIES) && \
15370+
!defined(OPENSSL_COMPATIBLE_DEFAULTS) && !defined(NO_SHA256) && \
15371+
defined(WOLFSSL_IP_ALT_NAME)
15372+
static const char* ipaddr_api = NULL;
15373+
static int test_wolfSSL_check_ip_address_basic_client_ssl(WOLFSSL* ssl)
15374+
{
15375+
EXPECT_DECLS;
15376+
15377+
ExpectIntEQ(wolfSSL_check_ip_address(ssl, ipaddr_api), WOLFSSL_SUCCESS);
15378+
15379+
return EXPECT_RESULT();
15380+
}
15381+
15382+
static int test_wolfSSL_check_ip_address_basic(void)
15383+
{
15384+
EXPECT_DECLS;
15385+
test_ssl_cbf func_cb_client;
15386+
test_ssl_cbf func_cb_server;
15387+
15388+
XMEMSET(&func_cb_client, 0, sizeof(func_cb_client));
15389+
XMEMSET(&func_cb_server, 0, sizeof(func_cb_server));
15390+
15391+
func_cb_client.ssl_ready = &test_wolfSSL_check_ip_address_basic_client_ssl;
15392+
15393+
ipaddr_api = "127.0.0.2";
15394+
/* Expect to fail: cert SAN IP is 127.0.0.1 */
15395+
ExpectIntEQ(test_wolfSSL_client_server_nofail_memio(&func_cb_client,
15396+
&func_cb_server, NULL), -1001);
15397+
15398+
ipaddr_api = "127.0.0.1";
15399+
/* Expect to succeed */
15400+
ExpectIntEQ(test_wolfSSL_client_server_nofail_memio(&func_cb_client,
15401+
&func_cb_server, NULL), TEST_SUCCESS);
15402+
15403+
return EXPECT_RESULT();
15404+
}
15405+
#else
15406+
static int test_wolfSSL_check_ip_address_basic(void)
15407+
{
15408+
EXPECT_DECLS;
15409+
return EXPECT_RESULT();
15410+
}
15411+
#endif
15412+
1532315413
static int test_wolfSSL_BUF(void)
1532415414
{
1532515415
EXPECT_DECLS;
@@ -33192,6 +33282,8 @@ TEST_CASE testCases[] = {
3319233282

3319333283
TEST_DECL(test_wolfSSL_check_domain),
3319433284
TEST_DECL(test_wolfSSL_check_domain_basic),
33285+
TEST_DECL(test_wolfSSL_check_ip_param_basic),
33286+
TEST_DECL(test_wolfSSL_check_ip_address_basic),
3319533287
TEST_DECL(test_wolfSSL_cert_cb),
3319633288
TEST_DECL(test_wolfSSL_cert_cb_dyn_ciphers),
3319733289
TEST_DECL(test_wolfSSL_ciphersuite_auth),

‎wolfssl/internal.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4876,6 +4876,7 @@ typedef struct Buffers {
48764876
ThreadCrypt encrypt[WOLFSSL_THREADED_CRYPT_CNT];
48774877
#endif
48784878
buffer domainName; /* for client check */
4879+
buffer ipasc; /* for client IP SAN check */
48794880
buffer clearOutputBuffer;
48804881
buffer sig; /* signature data */
48814882
buffer digest; /* digest data */

‎wolfssl/ssl.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3356,6 +3356,9 @@ WOLFSSL_API int wolfSSL_get_chain_cert_pem(WOLFSSL_X509_CHAIN* chain, int idx,
33563356
/* call before SSL_connect, if verifying will add name check to
33573357
date check and signature check */
33583358
WOLFSSL_ABI WOLFSSL_API int wolfSSL_check_domain_name(WOLFSSL* ssl, const char* dn);
3359+
/* call before SSL_connect, if verifying will add IP address check to
3360+
date check and signature check */
3361+
WOLFSSL_ABI WOLFSSL_API int wolfSSL_check_ip_address(WOLFSSL* ssl, const char* ipaddr);
33593362

33603363

33613364
/* need to call once to load library (session cache) */

0 commit comments

Comments
 (0)