Verified Commit 5f4beac4 authored by Camil Staps's avatar Camil Staps 🚀

Hostname verification

parent f1fb7b98
......@@ -28,11 +28,18 @@ Start w
#! (resp,w) = BIO_read_all bio w
= resp
where
host = "www.random.org"
host = "badssl.com"
//host = "untrusted-root.badssl.com"
//host = "revoked.com"
//host = "sha1-intermediate.badssl.com"
//host = "pinning-test.badssl.com"
//host = "wrong.host.badssl.com"
//host = "self-signed.badssl.com"
//host = "expired.badssl.com"
port = 443
req = { newHTTPRequest
& req_path = "/cgi-bin/randbyte?nbytes=32&format=h"
& req_path = "/"
, server_name = host
, server_port = port
}
......@@ -44,6 +51,9 @@ initSSL host port w
| meth == 0 = abort "Method was 0\n"
#! (ctx,w) = SSL_CTX_new meth w
| ctx == 0 = abort "CTX was 1\n"
#! (prm,w) = SSL_CTX_get0_param ctx w
#! (_,w) = X509_VERIFY_PARAM_set_hostflags prm 4 /* X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS */ w
#! w = X509_VERIFY_PARAM_set1_host prm host w
#! w = SSL_CTX_set_verify ctx SSL_VERIFY_PEER w
#! (res,w) = SSL_CTX_set_verify_depth ctx 4 w
#! w = SSL_CTX_set_options ctx [SSL_OP_NO_SSLv2, SSL_OP_NO_SSLv3, SSL_OP_NO_COMPRESSION] w
......@@ -80,6 +90,24 @@ SSL_CTX_new m w = code {
ccall SSL_CTX_new "p:p:A"
}
SSL_CTX_get0_param :: !SSLCTX !*World -> *(!Pointer, !*World)
SSL_CTX_get0_param ctx w = code {
ccall SSL_CTX_get0_param "p:p:A"
}
X509_VERIFY_PARAM_set_hostflags :: !Pointer !Int !*World -> *(!Int, !*World)
X509_VERIFY_PARAM_set_hostflags param flags w = code {
ccall X509_VERIFY_PARAM_set_hostflags_help "pI:I:A"
}
X509_VERIFY_PARAM_set1_host :: !Pointer !String !*World -> *World
X509_VERIFY_PARAM_set1_host param s w = snd (set param (packString s) 0 w)
where
set :: !Pointer !String !Int !*World -> *(!Int, !*World)
set param s len w = code {
ccall X509_VERIFY_PARAM_set1_host "psI:I:A"
}
SSL_CTX_set_verify :: !SSLCTX !Int !*World -> *World
SSL_CTX_set_verify ctx mode w = snd (set_verify ctx mode w)
where
......
#include <stdio.h>
#include <openssl/ssl.h>
#include <openssl/ocsp.h>
void print_cn_name(const char* label, X509_NAME* const name)
{
int idx = -1, success = 0;
unsigned char *utf8 = NULL;
do
{
if(!name) break; /* failed */
idx = X509_NAME_get_index_by_NID(name, NID_commonName, -1);
if(!(idx > -1)) break; /* failed */
X509_NAME_ENTRY* entry = X509_NAME_get_entry(name, idx);
if(!entry) break; /* failed */
ASN1_STRING* data = X509_NAME_ENTRY_get_data(entry);
if(!data) break; /* failed */
int length = ASN1_STRING_to_UTF8(&utf8, data);
if(!utf8 || !(length > 0)) break; /* failed */
fprintf(stdout, "%s: %s\n", label, utf8);
success = 1;
} while (0);
if(utf8)
OPENSSL_free(utf8);
if(!success)
fprintf(stdout, " %s: <not available>\n", label);
}
void print_san_name(const char* label, X509* const cert)
{
int success = 0;
GENERAL_NAMES* names = NULL;
unsigned char* utf8 = NULL;
do
{
if(!cert) break; /* failed */
names = X509_get_ext_d2i(cert, NID_subject_alt_name, 0, 0 );
if(!names) break;
int i = 0, count = sk_GENERAL_NAME_num(names);
if(!count) break; /* failed */
for( i = 0; i < count; ++i )
{
GENERAL_NAME* entry = sk_GENERAL_NAME_value(names, i);
if(!entry) continue;
if(GEN_DNS == entry->type)
{
int len1 = 0, len2 = -1;
len1 = ASN1_STRING_to_UTF8(&utf8, entry->d.dNSName);
if(utf8) {
len2 = (int)strlen((const char*)utf8);
}
if(len1 != len2) {
fprintf(stderr, " Strlen and ASN1_STRING size do not match (embedded null?): %d vs %d\n", len2, len1);
}
/* If there's a problem with string lengths, then */
/* we skip the candidate and move on to the next. */
/* Another policy would be to fails since it probably */
/* indicates the client is under attack. */
if(utf8 && len1 && len2 && (len1 == len2)) {
fprintf(stdout, " %s: %s\n", label, utf8);
success = 1;
}
if(utf8) {
OPENSSL_free(utf8), utf8 = NULL;
}
}
else
{
fprintf(stderr, " Unknown GENERAL_NAME type: %d\n", entry->type);
}
}
} while (0);
if(names)
GENERAL_NAMES_free(names);
if(utf8)
OPENSSL_free(utf8);
if(!success)
fprintf(stdout, " %s: <not available>\n", label);
}
int verify_callback(int preverify, X509_STORE_CTX* x509_ctx)
int SSL_CTX_set_verify_help(SSL_CTX *ctx, int mode)
{
int depth = X509_STORE_CTX_get_error_depth(x509_ctx);
int err = X509_STORE_CTX_get_error(x509_ctx);
X509* cert = X509_STORE_CTX_get_current_cert(x509_ctx);
X509_NAME* iname = cert ? X509_get_issuer_name(cert) : NULL;
X509_NAME* sname = cert ? X509_get_subject_name(cert) : NULL;
print_cn_name("Issuer (cn)", iname);
print_cn_name("Subject (cn)", sname);
if(depth == 0) {
/* If depth is 0, its the server's certificate. Print the SANs too */
print_san_name("Subject (san)", cert);
}
return preverify;
SSL_CTX_set_verify(ctx, mode, NULL);
return 1;
}
//void SSL_CTX_set_verify(SSL_CTX *ctx, int mode, int (*callback) (int, X509_STORE_CTX *));
int SSL_CTX_set_verify_help(SSL_CTX *ctx, int mode)
int X509_VERIFY_PARAM_set_hostflags_help(X509_VERIFY_PARAM *param, unsigned int flags)
{
SSL_CTX_set_verify(ctx, mode, &verify_callback);
return 37;
X509_VERIFY_PARAM_set_hostflags(param, flags);
return 1;
}
int SSL_CTX_set_verify_depth_help(SSL_CTX *ctx, int depth)
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment