Don't use CONF_VALUE in VerifyServerName.

webrtc/base/openssladapter.cc

 /*
  *  Copyright 2008 The WebRTC Project Authors. All rights reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 686 matching lines @@
   //LOG(LS_INFO) << " -- onStreamWriteable";
   AsyncSocketAdapter::OnWriteEvent(socket);
 }
 
 void
 OpenSSLAdapter::OnCloseEvent(AsyncSocket* socket, int err) {
   LOG(LS_INFO) << "OpenSSLAdapter::OnCloseEvent(" << err << ")";
   AsyncSocketAdapter::OnCloseEvent(socket, err);
 }
 
-// This code is taken from the "Network Security with OpenSSL"
-// sample in chapter 5
-
 bool OpenSSLAdapter::VerifyServerName(SSL* ssl, const char* host,
                                       bool ignore_bad_cert) {
   if (!host)
     return false;
 
   // Checking the return from SSL_get_peer_certificate here is not strictly
   // necessary.  With our setup, it is not possible for it to return
   // NULL.  However, it is good form to check the return.
   X509* certificate = SSL_get_peer_certificate(ssl);
   if (!certificate)
@@ skipping 12 matching lines @@
     BIO_free(mem);
 
     char* cipher_description =
       SSL_CIPHER_description(SSL_get_current_cipher(ssl), NULL, 128);
     LOG(LS_INFO) << "Cipher: " << cipher_description;
     OPENSSL_free(cipher_description);
   }
 #endif
 
   bool ok = false;
-  int extension_count = X509_get_ext_count(certificate);
-  for (int i = 0; i < extension_count; ++i) {
-    X509_EXTENSION* extension = X509_get_ext(certificate, i);
-    int extension_nid = OBJ_obj2nid(X509_EXTENSION_get_object(extension));
-
-    if (extension_nid == NID_subject_alt_name) {
-      const X509V3_EXT_METHOD* meth = X509V3_EXT_get(extension);
-      if (!meth)
+  GENERAL_NAMES* names = reinterpret_cast<GENERAL_NAMES*>(
+      X509_get_ext_d2i(certificate, NID_subject_alt_name, nullptr, nullptr));
+  if (names) {
+    for (size_t i = 0; i < sk_GENERAL_NAME_num(names); i++) {
+      const GENERAL_NAME* name = sk_GENERAL_NAME_value(names, i);
+      if (name->type != GEN_DNS)
+        continue;
+      std::string value(
+          reinterpret_cast<const char*>(ASN1_STRING_data(name->d.dNSName)),
+          ASN1_STRING_length(name->d.dNSName));
+      // string_match takes NUL-terminated strings, so check for embedded NULs.
+      if (value.find('\0') != std::string::npos)
+        continue;
+      if (string_match(host, value.c_str())) {
+        ok = true;
         break;
-
-      void* ext_str = NULL;
-
-      // We assign this to a local variable, instead of passing the address
-      // directly to ASN1_item_d2i.
-      // See http://readlist.com/lists/openssl.org/openssl-users/0/4761.html.
-      unsigned char* ext_value_data = extension->value->data;
-
-      const unsigned char **ext_value_data_ptr =
-          (const_cast<const unsigned char **>(&ext_value_data));
-
-      if (meth->it) {
-        ext_str = ASN1_item_d2i(NULL, ext_value_data_ptr,
-                                extension->value->length,
-                                ASN1_ITEM_ptr(meth->it));
-      } else {
-        ext_str = meth->d2i(NULL, ext_value_data_ptr, extension->value->length);
       }
-
-      STACK_OF(CONF_VALUE)* value = meth->i2v(meth, ext_str, NULL);
-
-      // Cast to size_t to be compilable for both OpenSSL and BoringSSL.
-      for (size_t j = 0; j < static_cast<size_t>(sk_CONF_VALUE_num(value));
-           ++j) {
-        CONF_VALUE* nval = sk_CONF_VALUE_value(value, j);
-        // The value for nval can contain wildcards
-        if (!strcmp(nval->name, "DNS") && string_match(host, nval->value)) {
-          ok = true;
-          break;
-        }
-      }
-      sk_CONF_VALUE_pop_free(value, X509V3_conf_free);
-      value = NULL;
-
-      if (meth->it) {
-        ASN1_item_free(reinterpret_cast<ASN1_VALUE*>(ext_str),
-                       ASN1_ITEM_ptr(meth->it));
-      } else {
-        meth->ext_free(ext_str);
-      }
-      ext_str = NULL;
     }
-    if (ok)
-      break;
+    GENERAL_NAMES_free(names);
   }
 
   char data[256];
   X509_NAME* subject;
   if (!ok
       && ((subject = X509_get_subject_name(certificate)) != NULL)
       && (X509_NAME_get_text_by_NID(subject, NID_commonName,
                                     data, sizeof(data)) > 0)) {
     data[sizeof(data)-1] = 0;
     if (_stricmp(data, host) == 0)
@@ skipping 151 matching lines @@
   SSL_CTX_set_cipher_list(ctx, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH");
 
   if (ssl_mode_ == SSL_MODE_DTLS) {
     SSL_CTX_set_read_ahead(ctx, 1);
   }
 
   return ctx;
 }
 
 } // namespace rtc