Unverified Commit 440ede3b authored by Steven Fackler's avatar Steven Fackler Committed by GitHub
Browse files

Merge pull request #923 from sfackler/libressl-hostname 

Hostname verification support on libressl
parents b397bc45 a6fcef01

openssl-sys/build/cfgs.rs

+12 −14
Original line number Diff line number Diff line
@@ -7,37 +7,35 @@ pub fn get(openssl_version: Option<u64>, libressl_version: Option<u64>) -> Vec<& 
        if libressl_version >= 0x2_05_01_00_0 {

            cfgs.push("libressl251");

        }



        if libressl_version >= 0x2_06_01_00_0 {

            cfgs.push("libressl261");

        }



        if libressl_version >= 0x2_07_00_00_0 {

            cfgs.push("libressl270");

        }

    } else {

        let openssl_version = openssl_version.unwrap();



        if openssl_version >= 0x1_00_01_00_0 {

            cfgs.push("ossl101");

        }

        if openssl_version >= 0x1_00_02_00_0 {

            cfgs.push("ossl102");

        }

        if openssl_version >= 0x1_00_02_08_0 {

            cfgs.push("ossl102h");

        }



        if openssl_version >= 0x1_01_00_00_0 {

            cfgs.push("ossl110");

        }

        if openssl_version >= 0x1_01_00_06_0 {

            cfgs.push("ossl110f");

        }

        if openssl_version >= 0x1_01_00_07_0 {

            cfgs.push("ossl110g");

        }



        if openssl_version >= 0x1_01_01_00_0 {

            cfgs.push("ossl111");

            cfgs.push("ossl110");

        } else if openssl_version >= 0x1_01_00_06_0 {

            cfgs.push("ossl110");

            cfgs.push("ossl110f");

        } else if openssl_version >= 0x1_01_00_00_0 {

            cfgs.push("ossl110");

        } else if openssl_version >= 0x1_00_02_00_0 {

            cfgs.push("ossl102");

        } else if openssl_version >= 0x1_00_01_00_0 {

            cfgs.push("ossl101");

        }

    }

openssl-sys/src/lib.rs

+41 −41
Original line number Diff line number Diff line
@@ -1261,7 +1261,7 @@ pub const SSL_VERIFY_NONE: c_int = 0; 
pub const SSL_VERIFY_PEER: c_int = 1;

pub const SSL_VERIFY_FAIL_IF_NO_PEER_CERT: c_int = 2;



#[cfg(not(any(libressl261, ossl101)))]

#[cfg(any(ossl102, all(libressl, not(libressl261))))]

pub const SSL_OP_TLSEXT_PADDING: c_ulong = 0x00000010;

#[cfg(libressl261)]

pub const SSL_OP_TLSEXT_PADDING: c_ulong = 0x0;
@@ -1271,9 +1271,9 @@ pub const SSL_OP_CRYPTOPRO_TLSEXT_BUG: c_ulong = 0x80000000; 
#[cfg(libressl261)]

pub const SSL_OP_CRYPTOPRO_TLSEXT_BUG: c_ulong = 0x0;

pub const SSL_OP_LEGACY_SERVER_CONNECT: c_ulong = 0x00000004;

#[cfg(not(any(libressl, ossl110f, ossl111)))]

#[cfg(not(any(libressl, ossl110f)))]

pub const SSL_OP_ALL: c_ulong = 0x80000BFF;

#[cfg(any(ossl110f, ossl111))]

#[cfg(ossl110f)]

pub const SSL_OP_ALL: c_ulong = SSL_OP_CRYPTOPRO_TLSEXT_BUG

    | SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS

    | SSL_OP_LEGACY_SERVER_CONNECT
@@ -1289,7 +1289,7 @@ pub const SSL_OP_NO_TLSv1: c_ulong = 0x04000000; 
pub const SSL_OP_NO_TLSv1_1: c_ulong = 0x10000000;

pub const SSL_OP_NO_TLSv1_2: c_ulong = 0x08000000;



#[cfg(not(any(ossl101, libressl, ossl111)))]

#[cfg(all(ossl102, not(ossl111)))]

pub const SSL_OP_NO_SSL_MASK: c_ulong =

    SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2;

#[cfg(ossl111)]
@@ -1393,35 +1393,35 @@ pub const X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX: c_int = 52; 
pub const X509_V_ERR_UNSUPPORTED_NAME_SYNTAX: c_int = 53;

pub const X509_V_ERR_CRL_PATH_VALIDATION_ERROR: c_int = 54;



#[cfg(not(any(ossl101, libressl)))]

#[cfg(ossl102)]

pub const X509_V_ERR_SUITE_B_INVALID_VERSION: c_int = 56;

#[cfg(not(any(ossl101, libressl)))]

#[cfg(ossl102)]

pub const X509_V_ERR_SUITE_B_INVALID_ALGORITHM: c_int = 57;

#[cfg(not(any(ossl101, libressl)))]

#[cfg(ossl102)]

pub const X509_V_ERR_SUITE_B_INVALID_CURVE: c_int = 58;

#[cfg(not(any(ossl101, libressl)))]

#[cfg(ossl102)]

pub const X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM: c_int = 59;

#[cfg(not(any(ossl101, libressl)))]

#[cfg(ossl102)]

pub const X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED: c_int = 60;

#[cfg(not(any(ossl101, libressl)))]

#[cfg(ossl102)]

pub const X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256: c_int = 61;



#[cfg(not(any(ossl101, libressl)))]

#[cfg(ossl102)]

pub const X509_V_ERR_HOSTNAME_MISMATCH: c_int = 62;

#[cfg(not(any(ossl101, libressl)))]

#[cfg(ossl102)]

pub const X509_V_ERR_EMAIL_MISMATCH: c_int = 63;

#[cfg(not(any(ossl101, libressl)))]

#[cfg(ossl102)]

pub const X509_V_ERR_IP_ADDRESS_MISMATCH: c_int = 64;



#[cfg(not(any(ossl101, libressl)))]

#[cfg(any(ossl102, libressl261))]

pub const X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT: c_uint = 0x1;

#[cfg(not(any(ossl101, libressl)))]

#[cfg(any(ossl102, libressl261))]

pub const X509_CHECK_FLAG_NO_WILDCARDS: c_uint = 0x2;

#[cfg(not(any(ossl101, libressl)))]

#[cfg(any(ossl102, libressl261))]

pub const X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS: c_uint = 0x4;

#[cfg(not(any(ossl101, libressl)))]

#[cfg(any(ossl102, libressl261))]

pub const X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS: c_uint = 0x8;

#[cfg(not(any(ossl101, libressl)))]

#[cfg(any(ossl102, libressl261))]

pub const X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS: c_uint = 0x10;



pub const GEN_OTHERNAME: c_int = 0;
@@ -1526,7 +1526,7 @@ pub unsafe fn SSL_CTX_add_extra_chain_cert(ctx: *mut SSL_CTX, x509: *mut X509) - 
    SSL_CTX_ctrl(ctx, SSL_CTRL_EXTRA_CHAIN_CERT, 0, x509 as *mut c_void)

}



#[cfg(not(any(ossl101, libressl)))]

#[cfg(ossl102)]

pub unsafe fn SSL_CTX_set0_verify_cert_store(ctx: *mut SSL_CTX, st: *mut X509_STORE) -> c_long {

    SSL_CTX_ctrl(ctx, SSL_CTRL_SET_VERIFY_CERT_STORE, 0, st as *mut c_void)

}
@@ -1641,9 +1641,9 @@ extern "C" { 
    pub fn BIO_new_socket(sock: c_int, close_flag: c_int) -> *mut BIO;

    pub fn BIO_read(b: *mut BIO, buf: *mut c_void, len: c_int) -> c_int;

    pub fn BIO_write(b: *mut BIO, buf: *const c_void, len: c_int) -> c_int;

    #[cfg(any(ossl101, libressl))]

    #[cfg(not(ossl102))]

    pub fn BIO_new_mem_buf(buf: *mut c_void, len: c_int) -> *mut BIO;

    #[cfg(not(any(ossl101, libressl)))]

    #[cfg(ossl102)]

    pub fn BIO_new_mem_buf(buf: *const c_void, len: c_int) -> *mut BIO;

    pub fn BIO_set_flags(b: *mut BIO, flags: c_int);

    pub fn BIO_clear_flags(b: *mut BIO, flags: c_int);
@@ -1774,11 +1774,11 @@ extern "C" { 


    pub fn DH_new() -> *mut DH;

    pub fn DH_free(dh: *mut DH);

    #[cfg(not(any(ossl101, libressl)))]

    #[cfg(ossl102)]

    pub fn DH_get_1024_160() -> *mut DH;

    #[cfg(not(any(ossl101, libressl)))]

    #[cfg(ossl102)]

    pub fn DH_get_2048_224() -> *mut DH;

    #[cfg(not(any(ossl101, libressl)))]

    #[cfg(ossl102)]

    pub fn DH_get_2048_256() -> *mut DH;



    pub fn EC_KEY_new() -> *mut EC_KEY;
@@ -2036,13 +2036,13 @@ extern "C" { 
        e: *mut ENGINE,

        pkey: *mut EVP_PKEY,

    ) -> c_int;

    #[cfg(any(ossl101, libressl))]

    #[cfg(not(ossl102))]

    pub fn EVP_DigestVerifyFinal(

        ctx: *mut EVP_MD_CTX,

        sigret: *mut c_uchar,

        siglen: size_t,

    ) -> c_int;

    #[cfg(not(any(ossl101, libressl)))]

    #[cfg(ossl102)]

    pub fn EVP_DigestVerifyFinal(

        ctx: *mut EVP_MD_CTX,

        sigret: *const c_uchar,
@@ -2446,14 +2446,14 @@ extern "C" { 
    pub fn SSL_get_ex_data(ssl: *const SSL, idx: c_int) -> *mut c_void;

    pub fn SSL_get_servername(ssl: *const SSL, name_type: c_int) -> *const c_char;

    pub fn SSL_get_current_cipher(ssl: *const SSL) -> *const SSL_CIPHER;

    #[cfg(not(any(ossl101, libressl)))]

    #[cfg(any(ossl102, libressl261))]

    pub fn SSL_get0_param(ssl: *mut SSL) -> *mut X509_VERIFY_PARAM;

    pub fn SSL_get_verify_result(ssl: *const SSL) -> c_long;

    pub fn SSL_shutdown(ssl: *mut SSL) -> c_int;

    pub fn SSL_get_certificate(ssl: *const SSL) -> *mut X509;

    #[cfg(any(ossl101, libressl))]

    #[cfg(not(ossl102))]

    pub fn SSL_get_privatekey(ssl: *mut SSL) -> *mut EVP_PKEY;

    #[cfg(not(any(ossl101, libressl)))]

    #[cfg(ossl102)]

    pub fn SSL_get_privatekey(ssl: *const SSL) -> *mut EVP_PKEY;

    pub fn SSL_load_client_CA_file(file: *const c_char) -> *mut stack_st_X509_NAME;

    pub fn SSL_set_tmp_dh_callback(
@@ -2546,9 +2546,9 @@ extern "C" { 
        remove_session_cb: Option<unsafe extern "C" fn(*mut SSL_CTX, *mut SSL_SESSION)>,

    );



    #[cfg(not(any(ossl101, libressl)))]

    #[cfg(ossl102)]

    pub fn SSL_CTX_get0_certificate(ctx: *const SSL_CTX) -> *mut X509;

    #[cfg(not(any(ossl101, libressl)))]

    #[cfg(ossl102)]

    pub fn SSL_CTX_get0_privatekey(ctx: *const SSL_CTX) -> *mut EVP_PKEY;



    pub fn SSL_CTX_set_cipher_list(ssl: *mut SSL_CTX, s: *const c_char) -> c_int;
@@ -2599,9 +2599,9 @@ extern "C" { 
    );

    pub fn SSL_get_session(s: *const SSL) -> *mut SSL_SESSION;

    pub fn SSL_set_session(ssl: *mut SSL, session: *mut SSL_SESSION) -> c_int;

    #[cfg(not(any(ossl101, libressl, ossl110f, ossl111)))]

    #[cfg(all(ossl102, not(ossl110f)))]

    pub fn SSL_is_server(s: *mut SSL) -> c_int;

    #[cfg(any(ossl110f, ossl111))]

    #[cfg(ossl110f)]

    pub fn SSL_is_server(s: *const SSL) -> c_int;



    pub fn SSL_SESSION_free(s: *mut SSL_SESSION);
@@ -2614,14 +2614,14 @@ extern "C" { 
    ) -> *mut SSL_SESSION;

    pub fn i2d_SSL_SESSION(s: *mut SSL_SESSION, pp: *mut *mut c_uchar) -> c_int;



    #[cfg(not(ossl101))]

    #[cfg(ossl102)]

    pub fn SSL_CTX_set_alpn_protos(s: *mut SSL_CTX, data: *const c_uchar, len: c_uint) -> c_int;



    #[cfg(not(ossl101))]

    #[cfg(ossl102)]

    pub fn SSL_set_alpn_protos(s: *mut SSL, data: *const c_uchar, len: c_uint) -> c_int;



    // FIXME should take an Option<unsafe extern "C" fn>

    #[cfg(not(ossl101))]

    #[cfg(ossl102)]

    pub fn SSL_CTX_set_alpn_select_cb(

        ssl: *mut SSL_CTX,

        cb: extern "C" fn(
@@ -2634,7 +2634,7 @@ extern "C" { 
        ) -> c_int,

        arg: *mut c_void,

    );

    #[cfg(not(ossl101))]

    #[cfg(ossl102)]

    pub fn SSL_get0_alpn_selected(s: *const SSL, data: *mut *const c_uchar, len: *mut c_uint);



    pub fn X509_add_ext(x: *mut X509, ext: *mut X509_EXTENSION, loc: c_int) -> c_int;
@@ -2726,17 +2726,17 @@ extern "C" { 
    pub fn X509_REQ_get_extensions(req: *mut X509_REQ) -> *mut stack_st_X509_EXTENSION;

    pub fn X509_REQ_sign(x: *mut X509_REQ, pkey: *mut EVP_PKEY, md: *const EVP_MD) -> c_int;



    #[cfg(not(ossl101))]

    #[cfg(any(ossl102, libressl261))]

    pub fn X509_VERIFY_PARAM_free(param: *mut X509_VERIFY_PARAM);

    #[cfg(not(any(ossl101, libressl)))]

    #[cfg(any(ossl102, libressl261))]

    pub fn X509_VERIFY_PARAM_set_hostflags(param: *mut X509_VERIFY_PARAM, flags: c_uint);

    #[cfg(not(any(ossl101, libressl)))]

    #[cfg(any(ossl102, libressl261))]

    pub fn X509_VERIFY_PARAM_set1_host(

        param: *mut X509_VERIFY_PARAM,

        name: *const c_char,

        namelen: size_t,

    ) -> c_int;

    #[cfg(not(any(ossl101, libressl)))]

    #[cfg(any(ossl102, libressl261))]

    pub fn X509_VERIFY_PARAM_set1_ip(

        param: *mut X509_VERIFY_PARAM,

        ip: *const c_uchar,

openssl-sys/src/libressl/mod.rs

+22 −0
Original line number Diff line number Diff line
@@ -447,6 +447,28 @@ pub unsafe fn SSL_session_reused(ssl: *mut ::SSL) -> c_int { 
    ::SSL_ctrl(ssl, SSL_CTRL_GET_SESSION_REUSED, 0, ptr::null_mut()) as c_int

}



pub unsafe fn SSL_CTX_get_options(ctx: *const ::SSL_CTX) -> c_ulong {

    ::SSL_CTX_ctrl(ctx as *mut _, ::SSL_CTRL_OPTIONS, 0, ptr::null_mut()) as c_ulong

}



pub unsafe fn SSL_CTX_set_options(ctx: *const ::SSL_CTX, op: c_ulong) -> c_ulong {

    ::SSL_CTX_ctrl(

        ctx as *mut _,

        ::SSL_CTRL_OPTIONS,

        op as c_long,

        ptr::null_mut(),

    ) as c_ulong

}



pub unsafe fn SSL_CTX_clear_options(ctx: *const ::SSL_CTX, op: c_ulong) -> c_ulong {

    ::SSL_CTX_ctrl(

        ctx as *mut _,

        ::SSL_CTRL_CLEAR_OPTIONS,

        op as c_long,

        ptr::null_mut(),

    ) as c_ulong

}



extern "C" {

    pub fn BIO_new(type_: *mut BIO_METHOD) -> *mut BIO;

    pub fn BIO_s_file() -> *mut BIO_METHOD;

openssl-sys/src/openssl/mod.rs

+6 −6
Original line number Diff line number Diff line 
use libc::{c_int, c_long, c_uchar, c_uint, c_ulong};



#[cfg(any(ossl101, ossl102))]

#[cfg(not(ossl110))]

mod v10x;

#[cfg(any(ossl101, ossl102))]

#[cfg(not(ossl110))]

pub use openssl::v10x::*;



#[cfg(ossl110)]
@@ -15,7 +15,7 @@ mod v111; 
#[cfg(ossl111)]

pub use openssl::v111::*;



#[cfg(not(ossl101))]

#[cfg(ossl102)]

pub const SSL_CTRL_SET_VERIFY_CERT_STORE: c_int = 106;



pub const SSL_MODE_SEND_CLIENTHELLO_TIME: c_long = 0x20;
@@ -28,9 +28,9 @@ pub const SSL_OP_CISCO_ANYCONNECT: c_ulong = 0x00008000; 
pub const SSL_OP_NO_COMPRESSION: c_ulong = 0x00020000;

pub const SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION: c_ulong = 0x00040000;

pub const SSL_OP_NO_SSLv3: c_ulong = 0x02000000;

#[cfg(not(ossl101))]

#[cfg(ossl102)]

pub const SSL_OP_NO_DTLSv1: c_ulong = 0x04000000;

#[cfg(not(ossl101))]

#[cfg(ossl102)]

pub const SSL_OP_NO_DTLSv1_2: c_ulong = 0x08000000;



pub const X509_V_ERR_UNSPECIFIED: c_int = 1;
@@ -55,7 +55,7 @@ pub const CMS_PARTIAL: c_uint = 0x4000; 
pub const CMS_REUSE_DIGEST: c_uint = 0x8000;

pub const CMS_USE_KEYID: c_uint = 0x10000;

pub const CMS_DEBUG_DECRYPT: c_uint = 0x20000;

#[cfg(not(ossl101))]

#[cfg(ossl102)]

pub const CMS_KEY_PARAM: c_uint = 0x40000;



extern "C" {

openssl-sys/src/openssl/v10x.rs

+28 −9
Original line number Diff line number Diff line
@@ -5,7 +5,7 @@ use std::ptr; 
use std::sync::{Mutex, MutexGuard};

use std::sync::{Once, ONCE_INIT};



#[cfg(not(ossl101))]

#[cfg(ossl102)]

use libc::time_t;

use libc::{c_char, c_int, c_long, c_uchar, c_uint, c_ulong, c_void, size_t};
@@ -573,9 +573,6 @@ pub struct SSL_CTX { 


    #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), ossl101))]

    srtp_profiles: *mut c_void,



    #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), ossl102))]

    srtp_profiles: *mut c_void,

    #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), ossl102))]

    alpn_select_cb: *mut c_void,

    #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), ossl102))]
@@ -669,7 +666,7 @@ pub struct SRP_CTX { 
}



#[repr(C)]

#[cfg(not(ossl101))]

#[cfg(ossl102)]

pub struct X509_VERIFY_PARAM {

    pub name: *mut c_char,

    pub check_time: time_t,
@@ -682,7 +679,7 @@ pub struct X509_VERIFY_PARAM { 
    pub id: *mut X509_VERIFY_PARAM_ID,

}



#[cfg(not(ossl101))]

#[cfg(ossl102)]

pub enum X509_VERIFY_PARAM_ID {}

pub enum PKCS12 {}
@@ -810,6 +807,28 @@ pub unsafe fn SSL_session_reused(ssl: *mut ::SSL) -> c_int { 
    ::SSL_ctrl(ssl, SSL_CTRL_GET_SESSION_REUSED, 0, ptr::null_mut()) as c_int

}



pub unsafe fn SSL_CTX_get_options(ctx: *const ::SSL_CTX) -> c_ulong {

    ::SSL_CTX_ctrl(ctx as *mut _, ::SSL_CTRL_OPTIONS, 0, ptr::null_mut()) as c_ulong

}



pub unsafe fn SSL_CTX_set_options(ctx: *const ::SSL_CTX, op: c_ulong) -> c_ulong {

    ::SSL_CTX_ctrl(

        ctx as *mut _,

        ::SSL_CTRL_OPTIONS,

        op as c_long,

        ptr::null_mut(),

    ) as c_ulong

}



pub unsafe fn SSL_CTX_clear_options(ctx: *const ::SSL_CTX, op: c_ulong) -> c_ulong {

    ::SSL_CTX_ctrl(

        ctx as *mut _,

        ::SSL_CTRL_CLEAR_OPTIONS,

        op as c_long,

        ptr::null_mut(),

    ) as c_ulong

}



extern "C" {

    pub fn BIO_new(type_: *mut BIO_METHOD) -> *mut BIO;

    pub fn BIO_s_file() -> *mut BIO_METHOD;
@@ -925,15 +944,15 @@ extern "C" { 
        loc: c_int,

        set: c_int,

    ) -> c_int;

    #[cfg(not(ossl101))]

    #[cfg(ossl102)]

    pub fn X509_get0_signature(

        psig: *mut *mut ::ASN1_BIT_STRING,

        palg: *mut *mut ::X509_ALGOR,

        x: *const ::X509,

    );

    #[cfg(not(ossl101))]

    #[cfg(ossl102)]

    pub fn X509_get_signature_nid(x: *const X509) -> c_int;

    #[cfg(not(ossl101))]

    #[cfg(ossl102)]

    pub fn X509_ALGOR_get0(

        paobj: *mut *mut ::ASN1_OBJECT,

        pptype: *mut c_int,