Hostname validation - Revision history

Vdukhovni: /* Example Usage */

2018-04-28T19:15:44Z

Example Usage

Agl: Don't use the zero-length trick with X509_VERIFY_PARAM_set1_host and check for errors.

2018-03-26T22:54:28Z

Don't use the zero-length trick with X509_VERIFY_PARAM_set1_host and check for errors.

Jwalton: Tweak heading.

2017-04-23T12:24:30Z

Tweak heading.

Jwalton: Spelling

2017-04-23T12:21:56Z

Spelling

Jwalton: Improved flow.

2016-02-25T12:46:16Z

Improved flow.

Jwalton: Improved flow.

2016-02-25T11:00:06Z

Improved flow.

Jwalton: Formatting.

2016-02-25T10:58:30Z

Formatting.

Jwalton: Removed adj/adv.

2015-06-12T15:12:31Z

Removed adj/adv.

Ppelleti: better explain version situation, and add a link to mailing list discussion

2015-06-07T02:11:04Z

better explain version situation, and add a link to mailing list discussion

Ppelleti: /* cUrl code */ That's really ssl-conservatory code, not cURL code

2015-06-07T01:40:56Z

cUrl code: That's really ssl-conservatory code, not cURL code

@@ Line 25: / Line 25: @@
+}
-/* Configure a non-zero callback if desired */
+/* Enable peer verification, (with a non-null callback if desired) */
-SSL_set_verify(ssl, SSL_VERIFY_PEER, 0);
+SSL_set_verify(ssl, SSL_VERIFY_PEER, NULL);
 /*
@@ Line 37: / Line 37: @@
   */
 ...</pre>
 Wildcard support is configured via the flags documented for X509_check_host(), the two most frequently useful are:

@@ Line 9: / Line 9: @@
 The following is from [http://mid.gmane.org/20150125175706.GN8034@mournblade.imrryr.org Hostname validation] and  shows how you could use OpenSSL's built-in hostname validation.
-<pre>const char *servername = NULL;
+<pre>const char servername[] = "www.example.com";
 SSL *ssl = NULL;
 X509_VERIFY_PARAM *param = NULL;
@@ Line 20: / Line 20: @@
 /* Enable automatic hostname checks */
 X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
-X509_VERIFY_PARAM_set1_host(param, servername, 0);
+if (!X509_VERIFY_PARAM_set1_host(param, servername, sizeof(servername) - 1)) {
 /* Configure a non-zero callback if desired */

@@ Line 49: / Line 49: @@
 There is an associated new X509 error code: '''X509_V_ERR_HOSTNAME_MISMATCH'''
-== ssl-conservatory and cURL code ==
+== SSL Conservatory and cURL code ==
 This was the original information, might still be valid for < 1.0.2 openssl versions :

← Older revision		Revision as of 12:21, 23 April 2017
Line 1:		Line 1:
−	OpenSSL 1.1.0 ~~will prvide~~ built-in functionality for hostname checking and validation. Viktor Dukhovni provided the implementation in January, 2015. Its been available in Master since that time. The code is beginning to see widespread testing as the release of OpenSSL 1.1.0 approaches.	+	OpenSSL 1.1.0 provides built-in functionality for hostname checking and validation. Viktor Dukhovni provided the implementation in January, 2015. Its been available in Master since that time. The code is beginning to see widespread testing as the release of OpenSSL 1.1.0 approaches.

	One [http://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html common mistake] made by users of OpenSSL is to assume that OpenSSL will validate the hostname in the server's certificate. Versions prior to 1.0.2 did not perform hostname validation. Version 1.0.2 and up contain support for hostname validation, but they still require the user to call a few functions to set it up.		One [http://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html common mistake] made by users of OpenSSL is to assume that OpenSSL will validate the hostname in the server's certificate. Versions prior to 1.0.2 did not perform hostname validation. Version 1.0.2 and up contain support for hostname validation, but they still require the user to call a few functions to set it up.

@@ Line 7: / Line 7: @@
 ==Example Usage==
-The following shows how one could use OpenSSL's built-in hostname validation. The following is from [http://mid.gmane.org/20150125175706.GN8034@mournblade.imrryr.org Hostname validation].
+The following is from [http://mid.gmane.org/20150125175706.GN8034@mournblade.imrryr.org Hostname validation] and  shows how you could use OpenSSL's built-in hostname validation.
 <pre>const char *servername = NULL;

@@ Line 1: / Line 1: @@
 One [http://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html common mistake] made by users of OpenSSL is to assume that OpenSSL will validate the hostname in the server's certificate.  Versions prior to 1.0.2 did not perform hostname validation.  Version 1.0.2 and up contain support for hostname validation, but they still require the user to call a few functions to set it up.
-(extracted from [http://mid.gmane.org/20150125175706.GN8034@mournblade.imrryr.org mailling list discussion answer from Viktor Dukhovni] who implemented the host checking extensions)
+OpenSSL 1.1.0 will prvide built-in functionality for hostname checking and validation. Viktor Dukhovni provided the implementation in January, 2015. Its been available in Master since that time. The code is beginning to see widespread testing as the release of OpenSSL 1.1.0 approaches.
-Starting with 1.0.2 version use [https://www.openssl.org/docs/crypto/X509_check_host.html '''X509_check_host()'''] interface
+The following is extracted from [http://mid.gmane.org/20150125175706.GN8034@mournblade.imrryr.org Hostname validation]. A man page on hostname validation has been available since 1.0.2. Also see the [http://www.openssl.org/docs/crypto/X509_check_host.html '''X509_check_host()'''].
-sample :
+==Example Usage==
-<pre>
+The following shows how one could use OpenSSL's built-in hostname validation.
-	servername = "www.example.com";
+<pre>const char *servername = NULL;
-	ssl = SSL_new(...);
+SSL *ssl = NULL;
-	param = SSL_get0_param(ssl);
+X509_VERIFY_PARAM *param = NULL;
-	/* Enable automatic hostname checks */
+servername = "www.example.com";
-	X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
+ssl = SSL_new(...);
-	X509_VERIFY_PARAM_set1_host(param, servername, 0);
+param = SSL_get0_param(ssl);
-	/* Configure a non-zero callback if desired */
+/* Enable automatic hostname checks */
-	SSL_set_verify(ssl, SSL_VERIFY_PEER, 0);
+X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
-	/*
+/* Configure a non-zero callback if desired */
-	 * Establish SSL connection, hostname should be checked
+SSL_set_verify(ssl, SSL_VERIFY_PEER, 0);
-	 * automatically test with a hostname that should not match,
-	 * the connection will fail (unless you specify a callback
+/*
-	 * that returns despite the verification failure.  In that
+ * Establish SSL connection, hostname should be checked
-	 * case SSL_get_verify_status() can expose the problem after
+ * automatically test with a hostname that should not match,
-	 * connection completion.
+ * the connection will fail (unless you specify a callback
-	 */
+ * that returns despite the verification failure.  In that
-	 ...
+ * case SSL_get_verify_status() can expose the problem after
-</pre>
+ * connection completion.
 Wildcard support is configured via the flags documented for X509_check_host(), the two most frequently useful are:
 * '''X509_CHECK_FLAG_NO_WILDCARDS'''
 * '''X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS'''

← Older revision		Revision as of 15:12, 12 June 2015
Line 1:		Line 1:
−	One [~~https~~://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html ~~very~~ common mistake] made by users of OpenSSL is to assume that OpenSSL will validate the hostname in the server's certificate. Versions prior to 1.0.2 did not perform hostname validation. Version 1.0.2 and up contain support for hostname validation, but they still require the user to call a few functions to set it up.	+	One [http://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html common mistake] made by users of OpenSSL is to assume that OpenSSL will validate the hostname in the server's certificate. Versions prior to 1.0.2 did not perform hostname validation. Version 1.0.2 and up contain support for hostname validation, but they still require the user to call a few functions to set it up.

	== Recommendation ==		== Recommendation ==

@@ Line 1: / Line 1: @@
-One [https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html very common mistake] made by users of OpenSSL is to assume that OpenSSL will validate the hostname in the server's certificate.  Currently, it does not, although a future version (1.1.0?) will include this functionality.
+One [https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html very common mistake] made by users of OpenSSL is to assume that OpenSSL will validate the hostname in the server's certificate.  Versions prior to 1.0.2 did not perform hostname validation.  Version 1.0.2 and up contain support for hostname validation, but they still require the user to call a few functions to set it up.
 == Recommendation ==
-(extracted from mailling list discussion answer from Viktor Dukhovni who actual did implement part of host checking extensions )
+(extracted from [http://mid.gmane.org/20150125175706.GN8034@mournblade.imrryr.org mailling list discussion answer from Viktor Dukhovni] who implemented the host checking extensions)
-Starting with 1.0.2 version use '''X509_check_host()''' https://www.openssl.org/docs/crypto/X509_check_host.html interface
+Starting with 1.0.2 version use [https://www.openssl.org/docs/crypto/X509_check_host.html '''X509_check_host()'''] interface
 sample :

@@ Line 50: / Line 50: @@
 There is an associated new X509 error code: '''X509_V_ERR_HOSTNAME_MISMATCH'''
-== cUrl code ==
+== ssl-conservatory and cURL code ==
 This was the original information, might still be valid for < 1.0.2 openssl versions :
-[https://github.com/iSECPartners/ssl-conservatory Here is some sample code] which shows how validating the hostname can be done.  However, it does not handle wildcard certificates, so [http://archives.seul.org/libevent/users/Feb-2013/msg00043.html borrowing some code from cURL] might be one way to go.
+[https://github.com/iSECPartners/ssl-conservatory The ssl-conservatory repository] shows how validating the hostname can be done.  However, the ssl-conservatory code does not handle wildcard certificates, so [http://archives.seul.org/libevent/users/Feb-2013/msg00043.html borrowing some code from cURL] might be one way to go instead.  [https://github.com/ppelleti/libevent/commit/4db9da6bbf8ade7b126840393173b8bd053b3389 This commit] shows how to graft the wildcard-matching code from cURL into the ssl-conservatory code.
-for sake of simplicity i copied here the related code of last CURL reference :
+Below is a copy of [https://github.com/ppelleti/libevent/blob/4db9da6bbf8ade7b126840393173b8bd053b3389/sample/openssl_hostname_validation.c openssl_hostname_validation.c], although to compile it also needs the files [https://github.com/ppelleti/libevent/blob/4db9da6bbf8ade7b126840393173b8bd053b3389/sample/hostcheck.h hostcheck.h], [https://github.com/ppelleti/libevent/blob/4db9da6bbf8ade7b126840393173b8bd053b3389/sample/hostcheck.c hostcheck.c], and [https://github.com/ppelleti/libevent/blob/4db9da6bbf8ade7b126840393173b8bd053b3389/sample/openssl_hostname_validation.h openssl_hostname_validation.h].
 <pre>