diff options
Diffstat (limited to 'main/libressl/s_client-add-options-verify_.patch')
| -rw-r--r-- | main/libressl/s_client-add-options-verify_.patch | 90 |
1 files changed, 90 insertions, 0 deletions
diff --git a/main/libressl/s_client-add-options-verify_.patch b/main/libressl/s_client-add-options-verify_.patch new file mode 100644 index 0000000000..85cd8092f3 --- /dev/null +++ b/main/libressl/s_client-add-options-verify_.patch @@ -0,0 +1,90 @@ +From: Jakub Jirutka <jakub@jirutka.cz> +Date: Sun, 27 May 2018 22:08:00 +0200 +Subject: [PATCH] s_client: Add options -verify_{hostname,ip} + +This code is ported from OpenSSL 1.0.2o. We need it for Busybox wget. + +Symbols X509_VERIFY_PARAM_set1_host and X509_VERIFY_PARAM_set1_ip_asc +are exposed since LibreSSL 2.7.0, so we had to backport it too. + +--- a/apps/openssl/apps.c ++++ b/apps/openssl/apps.c +@@ -1855,6 +1855,8 @@ + char **oldargs = *pargs; + char *arg = **pargs, *argn = (*pargs)[1]; + time_t at_time = 0; ++ char *hostname = NULL; ++ char *ipasc = NULL; + const char *errstr = NULL; + + if (!strcmp(arg, "-policy")) { +@@ -1915,6 +1918,16 @@ + at_time = (time_t) timestamp; + } + (*pargs)++; ++ } else if (strcmp(arg, "-verify_hostname") == 0) { ++ if (!argn) ++ *badarg = 1; ++ hostname = argn; ++ (*pargs)++; ++ } else if (strcmp(arg, "-verify_ip") == 0) { ++ if (!argn) ++ *badarg = 1; ++ ipasc = argn; ++ (*pargs)++; + } else if (!strcmp(arg, "-ignore_critical")) + flags |= X509_V_FLAG_IGNORE_CRITICAL; + else if (!strcmp(arg, "-issuer_checks")) +@@ -1969,6 +1987,12 @@ + + if (at_time) + X509_VERIFY_PARAM_set_time(*pm, at_time); ++ ++ if (hostname && !X509_VERIFY_PARAM_set1_host(*pm, hostname, 0)) ++ *badarg = 1; ++ ++ if (ipasc && !X509_VERIFY_PARAM_set1_ip_asc(*pm, ipasc)) ++ *badarg = 1; + + end: + (*pargs)++; +--- a/apps/openssl/s_client.c ++++ b/apps/openssl/s_client.c +@@ -200,8 +200,11 @@ + BIO_printf(bio_err, " -port port - use -connect instead\n"); + BIO_printf(bio_err, " -connect host:port - who to connect to (default is %s:%s)\n", SSL_HOST_NAME, PORT_STR); + BIO_printf(bio_err, " -proxy host:port - connect to http proxy\n"); ++ BIO_printf(bio_err, " -verify_hostname host - check peer certificate matches \"host\"\n"); ++ BIO_printf(bio_err, " -verify_ip ipaddr - check peer certificate matches \"ipaddr\"\n"); + + BIO_printf(bio_err, " -verify arg - turn on peer certificate verification\n"); ++ BIO_printf(bio_err, " -verify_return_error - return verification errors\n"); + BIO_printf(bio_err, " -cert arg - certificate file to use, PEM format assumed\n"); + BIO_printf(bio_err, " -certform arg - certificate format (PEM or DER) PEM default\n"); + BIO_printf(bio_err, " -key arg - Private key file to use, in cert file if\n"); +--- a/crypto/crypto.sym ++++ b/crypto/crypto.sym +@@ -2816,6 +2816,8 @@ + X509_VERIFY_PARAM_set_time + X509_VERIFY_PARAM_set_trust + X509_VERIFY_PARAM_table_cleanup ++X509_VERIFY_PARAM_set1_host ++X509_VERIFY_PARAM_set1_ip_asc + X509_add1_ext_i2d + X509_add1_reject_object + X509_add1_trust_object + +--- a/include/openssl/x509_vfy.h ++++ b/include/openssl/x509_vfy.h +@@ -542,7 +542,10 @@ + int X509_VERIFY_PARAM_set1_policies(X509_VERIFY_PARAM *param, + STACK_OF(ASN1_OBJECT) *policies); + int X509_VERIFY_PARAM_get_depth(const X509_VERIFY_PARAM *param); +- ++int X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM *param, const char *name, ++ size_t namelen); ++int X509_VERIFY_PARAM_set1_ip_asc(X509_VERIFY_PARAM *param, const char *ipasc); ++ + int X509_VERIFY_PARAM_add0_table(X509_VERIFY_PARAM *param); + const X509_VERIFY_PARAM *X509_VERIFY_PARAM_lookup(const char *name); + void X509_VERIFY_PARAM_table_cleanup(void); |