Remove X509_VERIFY_PARAM_get0_peername
This allowed the caller to query which DNS SAN actually matched. It's
not an unreasonable API, though putting it on X509_VERIFY_PARAM is a
little odd, as is not having it for other name types. It just wasn't
const-correct. I went to fix that and found no one was using it.
We can put it back if we need it. Most of the underlying machinery needs
to stay anyway because X509_check_host has an output parameter and Node
exposes it. (Unclear if Node actually has a use case. I suspect they
just returned it because it was available.)
Change-Id: Id7f15016e29189bc4f3cebb33c680279c8cb3178
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/64252
Reviewed-by: Bob Beck <bbe@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
diff --git a/crypto/x509/internal.h b/crypto/x509/internal.h
index b67e558..842d076 100644
--- a/crypto/x509/internal.h
+++ b/crypto/x509/internal.h
@@ -283,7 +283,6 @@
// The following fields specify acceptable peer identities.
STACK_OF(OPENSSL_STRING) *hosts; // Set of acceptable names
unsigned int hostflags; // Flags to control matching features
- char *peername; // Matching hostname in peer certificate
char *email; // If not NULL email address to match
size_t emaillen;
unsigned char *ip; // If not NULL IP address to match
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index ea43b2a..b0d825a 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -692,14 +692,9 @@
size_t n = sk_OPENSSL_STRING_num(param->hosts);
char *name;
- if (param->peername != NULL) {
- OPENSSL_free(param->peername);
- param->peername = NULL;
- }
for (i = 0; i < n; ++i) {
name = sk_OPENSSL_STRING_value(param->hosts, i);
- if (X509_check_host(x, name, strlen(name), param->hostflags,
- ¶m->peername) > 0) {
+ if (X509_check_host(x, name, strlen(name), param->hostflags, NULL) > 0) {
return 1;
}
}
diff --git a/crypto/x509/x509_vpm.c b/crypto/x509/x509_vpm.c
index 2302f2e..73b6916 100644
--- a/crypto/x509/x509_vpm.c
+++ b/crypto/x509/x509_vpm.c
@@ -133,7 +133,6 @@
}
sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free);
sk_OPENSSL_STRING_pop_free(param->hosts, str_free);
- OPENSSL_free(param->peername);
OPENSSL_free(param->email);
OPENSSL_free(param->ip);
OPENSSL_free(param);
@@ -396,10 +395,6 @@
param->hostflags = flags;
}
-char *X509_VERIFY_PARAM_get0_peername(X509_VERIFY_PARAM *param) {
- return param->peername;
-}
-
int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *param, const char *email,
size_t emaillen) {
if (OPENSSL_memchr(email, '\0', emaillen) != NULL ||
diff --git a/include/openssl/x509.h b/include/openssl/x509.h
index 51ee208..cdb7b04 100644
--- a/include/openssl/x509.h
+++ b/include/openssl/x509.h
@@ -3408,8 +3408,6 @@
OPENSSL_EXPORT void X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM *param,
unsigned int flags);
-OPENSSL_EXPORT char *X509_VERIFY_PARAM_get0_peername(X509_VERIFY_PARAM *param);
-
// X509_VERIFY_PARAM_set1_email configures |param| to check for the email
// address specified by |email|. It returns one on success and zero on error.
OPENSSL_EXPORT int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *param,