- Fix #4206: support openssl 1.0.2 for TLS hostname verification,

  alongside the 1.1.0 and later support that is already there.

git-svn-id: file:///svn/unbound/trunk@5018 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/config.h.in b/config.h.in
index 2f98f193c0622591551ecf696b7acd6539bbd637..f1853ba38451f8a44c52a144d6928500c06a2f8b 100644 (file)
--- a/config.h.in
+++ b/config.h.in
@@ -586,6 +586,9 @@
 /* Define to 1 if you have the <ws2tcpip.h> header file. */
 #undef HAVE_WS2TCPIP_H
 
+/* Define to 1 if you have the `X509_VERIFY_PARAM_set1_host' function. */
+#undef HAVE_X509_VERIFY_PARAM_SET1_HOST
+
 /* Define to 1 if you have the `_beginthreadex' function. */
 #undef HAVE__BEGINTHREADEX
 

diff --git a/configure b/configure
index 9a28c76f90a4333d3a0c7783658da66c9e455e5f..21db04744335548cf7ce9f37951b9c9447d68d66 100755 (executable)
--- a/configure
+++ b/configure
@@ -18008,7 +18008,7 @@ done
 # these check_funcs need -lssl
 BAKLIBS="$LIBS"
 LIBS="-lssl $LIBS"
-for ac_func in OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername
+for ac_func in OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername X509_VERIFY_PARAM_set1_host
 do :
   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
 ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"

diff --git a/configure.ac b/configure.ac
index d6fb4349dc8f5f3af23243a1a621d39dddaac339..588d66e85b6eac6aec307a86581cdcf44e3ff995 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -785,7 +785,7 @@ AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_MD_C
 # these check_funcs need -lssl
 BAKLIBS="$LIBS"
 LIBS="-lssl $LIBS"
-AC_CHECK_FUNCS([OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername])
+AC_CHECK_FUNCS([OPENSSL_init_ssl SSL_CTX_set_security_level SSL_set1_host SSL_get0_peername X509_VERIFY_PARAM_set1_host])
 LIBS="$BAKLIBS"
 
 AC_CHECK_DECLS([SSL_COMP_get_compression_methods,sk_SSL_COMP_pop_free,SSL_CTX_set_ecdh_auto], [], [], [

diff --git a/doc/Changelog b/doc/Changelog
index aea6a776b2b1cd63a3ce9414334ddcded6f5fdbe..f20bdffc87e562ba39ae141e2825579db2902d52 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -3,6 +3,8 @@
        - ip-ratelimit-factor of 1 allows all traffic through, instead of the
          previous blocking everything.
        - Fix for FreeBSD port make with dnscrypt and dnstap enabled.
+       - Fix #4206: support openssl 1.0.2 for TLS hostname verification,
+         alongside the 1.1.0 and later support that is already there.
 
 6 December 2018: Wouter
        - Fix dns64 allocation in wrong region for returned internal queries.

diff --git a/services/outside_network.c b/services/outside_network.c
index c3569dbbfc23421d614617f3a95a7c5dd4b2bf9f..18385825b72eb75df9cf6eb098a5d2526c0913c7 100644 (file)
--- a/services/outside_network.c
+++ b/services/outside_network.c
@@ -385,6 +385,22 @@ outnet_tcp_take_into_use(struct waiting_tcp* w, uint8_t* pkt, size_t pkt_len)
                                return 0;
                        }
                }
+#elif defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
+               /* openssl 1.0.2 has this function that can be used for
+                * set1_host like verification */
+               if(w->tls_auth_name) {
+                       X509_VERIFY_PARAM* param = SSL_get0_param(pend->c->ssl);
+                       X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
+                       if(!X509_VERIFY_PARAM_set1_host(param, w->tls_auth_name, strlen(w->tls_auth_name))) {
+                               log_err("X509_VERIFY_PARAM_set1_host failed");
+                               pend->c->fd = s;
+                               SSL_free(pend->c->ssl);
+                               pend->c->ssl = NULL;
+                               comm_point_close(pend->c);
+                               return 0;
+                       }
+                       SSL_set_verify(ssl, SSL_VERIFY_PEER, NULL);
+               }
 #endif /* HAVE_SSL_SET1_HOST */
        }
        w->pkt = NULL;
@@ -2403,6 +2419,18 @@ outnet_comm_point_for_http(struct outside_network* outnet,
                                return NULL;
                        }
                }
+#elif defined(HAVE_X509_VERIFY_PARAM_SET1_HOST)
+               /* openssl 1.0.2 has this function that can be used for
+                * set1_host like verification */
+               if((SSL_CTX_get_verify_mode(outnet->sslctx)&SSL_VERIFY_PEER)) {
+                       X509_VERIFY_PARAM* param = SSL_get0_param(pend->c->ssl);
+                       X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
+                       if(!X509_VERIFY_PARAM_set1_host(param, host, strlen(host))) {
+                               log_err("X509_VERIFY_PARAM_set1_host failed");
+                               comm_point_delete(cp);
+                               return NULL;
+                       }
+               }
 #endif /* HAVE_SSL_SET1_HOST */
        }