From: David Woodhouse Date: Mon, 14 Oct 2019 09:46:07 +0000 (+0100) Subject: Make SSL_set1_host() and SSL_add1_host() take IP addresses X-Git-Tag: openssl-3.0.0-alpha6~19 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c832840e899091948bb7f5e9af63f929e6a18f95;p=thirdparty%2Fopenssl.git Make SSL_set1_host() and SSL_add1_host() take IP addresses There is a slight mismatch here because X509_VERIFY_PARAM copes only with a single IP address, and doesn't let it be cleared once it's set. But this fixes up the major use case, making things easier for users to get it right. The sconnect demo now works for Legacy IP literals; for IPv6 it needs to fix up the way it tries to split the host:port string, which will happen in a subsequent patch. Reviewed-by: Viktor Dukhovni Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/9201) --- diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c index 871606cfc1e..a31d2dd2ff4 100644 --- a/ssl/ssl_lib.c +++ b/ssl/ssl_lib.c @@ -955,11 +955,21 @@ int SSL_set_trust(SSL *s, int trust) int SSL_set1_host(SSL *s, const char *hostname) { + /* If a hostname is provided and parses as an IP address, + * treat it as such. */ + if (hostname && X509_VERIFY_PARAM_set1_ip_asc(s->param, hostname) == 1) + return 1; + return X509_VERIFY_PARAM_set1_host(s->param, hostname, 0); } int SSL_add1_host(SSL *s, const char *hostname) { + /* If a hostname is provided and parses as an IP address, + * treat it as such. */ + if (hostname && X509_VERIFY_PARAM_set1_ip_asc(s->param, hostname) == 1) + return 1; + return X509_VERIFY_PARAM_add1_host(s->param, hostname, 0); }