mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-03-31 20:10:45 +08:00
Code Issues Packages Projects Releases Wiki Activity

Make SSL_set1_host() and SSL_add1_host() take IP addresses

Browse Source 
There is a slight mismatch here because X509_VERIFY_PARAM copes only
with a single IP address, and doesn't let it be cleared once it's set.
But this fixes up the major use case, making things easier for users to
get it right.

The sconnect demo now works for Legacy IP literals; for IPv6 it needs to
fix up the way it tries to split the host:port string, which will happen
in a subsequent patch.

Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
(Merged from https://github.com/openssl/openssl/pull/9201)
This commit is contained in:
David Woodhouse 2019-10-14 10:46:07 +01:00 committed by Tomas Mraz
parent a677190779
commit c832840e89
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
ssl/ssl_lib.c
View File

@ -955,11 +955,21 @@ int SSL_set_trust(SSL *s, int trust)
int SSL_set1_host(SSL *s, const char *hostname)
{
/* If a hostname is provided and parses as an IP address,
* treat it as such. */
if (hostname && X509_VERIFY_PARAM_set1_ip_asc(s->param, hostname) == 1)
return 1;
return X509_VERIFY_PARAM_set1_host(s->param, hostname, 0);
}
int SSL_add1_host(SSL *s, const char *hostname)
{
/* If a hostname is provided and parses as an IP address,
* treat it as such. */
if (hostname && X509_VERIFY_PARAM_set1_ip_asc(s->param, hostname) == 1)
return 1;
return X509_VERIFY_PARAM_add1_host(s->param, hostname, 0);
}