commit f78fe19fc98e0e6f760e05c6b9d48725004700d0
author David Benjamin <davidben@google.com> Sat Nov 25 02:17:55 2023 -0500
committer Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> Fri Dec 01 21:09:26 2023 +0000
tree f4157da0b3b353f8deae40396dfd76da92a86142
parent e6ce79a89f031af791fe0910dc11d811cbfd3bc7

Remove X509_VERIFY_PARAM_get0_peername

This allowed the caller to query which DNS SAN actually matched. It's
not an unreasonable API, though putting it on X509_VERIFY_PARAM is a
little odd, as is not having it for other name types. It just wasn't
const-correct. I went to fix that and found no one was using it.

We can put it back if we need it. Most of the underlying machinery needs
to stay anyway because X509_check_host has an output parameter and Node
exposes it. (Unclear if Node actually has a use case. I suspect they
just returned it because it was available.)

Change-Id: Id7f15016e29189bc4f3cebb33c680279c8cb3178
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/64252
Reviewed-by: Bob Beck <bbe@google.com>
Commit-Queue: David Benjamin <davidben@google.com>

crypto/x509/internal.h

diff --git a/crypto/x509/internal.h b/crypto/x509/internal.h
index b67e558..842d076 100644
--- a/crypto/x509/internal.h
+++ b/crypto/x509/internal.h
@@ -283,7 +283,6 @@
   // The following fields specify acceptable peer identities.
   STACK_OF(OPENSSL_STRING) *hosts;  // Set of acceptable names
   unsigned int hostflags;           // Flags to control matching features
-  char *peername;                   // Matching hostname in peer certificate
   char *email;                      // If not NULL email address to match
   size_t emaillen;
   unsigned char *ip;     // If not NULL IP address to match

crypto/x509/x509_vfy.c

diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index ea43b2a..b0d825a 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -692,14 +692,9 @@
   size_t n = sk_OPENSSL_STRING_num(param->hosts);
   char *name;
 
-  if (param->peername != NULL) {
-    OPENSSL_free(param->peername);
-    param->peername = NULL;
-  }
   for (i = 0; i < n; ++i) {
     name = sk_OPENSSL_STRING_value(param->hosts, i);
-    if (X509_check_host(x, name, strlen(name), param->hostflags,
-                        &param->peername) > 0) {
+    if (X509_check_host(x, name, strlen(name), param->hostflags, NULL) > 0) {
       return 1;
     }
   }

crypto/x509/x509_vpm.c

diff --git a/crypto/x509/x509_vpm.c b/crypto/x509/x509_vpm.c
index 2302f2e..73b6916 100644
--- a/crypto/x509/x509_vpm.c
+++ b/crypto/x509/x509_vpm.c
@@ -133,7 +133,6 @@
   }
   sk_ASN1_OBJECT_pop_free(param->policies, ASN1_OBJECT_free);
   sk_OPENSSL_STRING_pop_free(param->hosts, str_free);
-  OPENSSL_free(param->peername);
   OPENSSL_free(param->email);
   OPENSSL_free(param->ip);
   OPENSSL_free(param);
@@ -396,10 +395,6 @@
   param->hostflags = flags;
 }
 
-char *X509_VERIFY_PARAM_get0_peername(X509_VERIFY_PARAM *param) {
-  return param->peername;
-}
-
 int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *param, const char *email,
                                  size_t emaillen) {
   if (OPENSSL_memchr(email, '\0', emaillen) != NULL ||

include/openssl/x509.h

diff --git a/include/openssl/x509.h b/include/openssl/x509.h
index 51ee208..cdb7b04 100644
--- a/include/openssl/x509.h
+++ b/include/openssl/x509.h
@@ -3408,8 +3408,6 @@
 OPENSSL_EXPORT void X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM *param,
                                                     unsigned int flags);
 
-OPENSSL_EXPORT char *X509_VERIFY_PARAM_get0_peername(X509_VERIFY_PARAM *param);
-
 // X509_VERIFY_PARAM_set1_email configures |param| to check for the email
 // address specified by |email|. It returns one on success and zero on error.
 OPENSSL_EXPORT int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *param,