openssl API验证主机名

一个简单的例子验证remote主机的主机名和证书匹配。

#include <stdio.h>
#include <stdarg.h>
#include <errno.h>
#include <unistd.h>
#include <malloc.h>
#include <string.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <resolv.h>
#include <netdb.h>
#include <openssl/ssl.h>
#include <openssl/err.h>

int my_connect(const char *hostname, int port) {
    struct hostent *he;
    struct sockaddr_in addr;

    if ((he = gethostbyname(hostname)) == NULL) {
        perror("Unable to get hostname");
        return -1;
    }

    memcpy(&addr.sin_addr, he->h_addr_list[0], he->h_length);
    addr.sin_family = AF_INET;
    addr.sin_port = htons(port);

    int sock = socket(AF_INET, SOCK_STREAM, 0);
    if (sock < 0) {
        perror("Unable to create socket");
        return -1;
    }

    if (connect(sock, (struct sockaddr *)&addr, sizeof(addr)) < 0) {
        perror("Unable to connect to server");
        close(sock);
        return -1;
    }

    return sock;
}

int verify_callback(int preverify_ok, X509_STORE_CTX *ctx)
{
    char    buf[256];
    X509   *err_cert;
    int     err_num, err_depth;
    SSL    *ssl;

    my_log("verify_callback: entry(preverify_ok=%d)", preverify_ok);
    err_num   = X509_STORE_CTX_get_error(ctx);
    err_depth = X509_STORE_CTX_get_error_depth(ctx);
    err_cert  = X509_STORE_CTX_get_current_cert(ctx);

    ssl = X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx());
    if (!preverify_ok) {
        X509_NAME_oneline(X509_get_subject_name(err_cert), buf, 256);

        if (err_num == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) {
            X509_NAME_oneline(X509_get_subject_name(err_cert), buf, 256);
            my_log("verify_callback: WARNING: self-signed certificates in chain (%s)", buf);
            preverify_ok = 1;   // ignore this error
        }
        else if (err_num == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT)
        {
            X509_NAME_oneline(X509_get_issuer_name(err_cert), buf, 256);
            my_log("verify_callback: ERROR: cannnot get issuer name (%s)", buf);
        } else if (err_num == X509_V_ERR_HOSTNAME_MISMATCH) {
            my_log("verify_callback: ERROR: hostname mismatch");
        } else if (err_num == X509_V_ERR_IP_ADDRESS_MISMATCH) {
            my_log("verify_callback: ERROR: ipaddress mismatch");
        } else {
            my_log("verify_callback: ERROR: error=%d, depth=%d, content=(%s)(%s)", err_num, err_depth, X509_verify_cert_error_string(err_num), buf);
        }
    }

    return preverify_ok;
}

SSL_CTX *my_ssl_create_context(void) {
    const SSL_METHOD *method;
    SSL_CTX *ctx;

    SSL_library_init();
    OpenSSL_add_all_algorithms();  /* Load cryptos, et.al. */
    SSL_load_error_strings();   /* Bring in and register error messages */

    method = TLSv1_2_client_method();
    ctx = SSL_CTX_new(method);
    if (ctx == NULL) {
        perror("Unable to create SSL context");
        ERR_print_errors_fp(stderr);
        return NULL;
    }

    /* Set the key and cert */
    if (SSL_CTX_load_verify_locations(ctx, "certs/ca.pem", NULL) <= 0) {
        ERR_print_errors_fp(stderr);
        SSL_CTX_free(ctx);
        return NULL;
    }

    const char servername[] = "<your-host-name>";
    const char serveripaddr[] = "<your-host-ipaddr>"; // e.g., 192.168.1.1
    X509_VERIFY_PARAM * param = SSL_CTX_get0_param(ctx);
    //X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
    if (!X509_VERIFY_PARAM_set1_host(param, servername, sizeof(servername) - 1)) {
        ERR_print_errors_fp(stderr);
        SSL_CTX_free(ctx);
        return NULL;
    }
    if (!X509_VERIFY_PARAM_set1_ip_asc(param, serveripaddr)) {
        ERR_print_errors_fp(stderr);
        SSL_CTX_free(ctx);
        return NULL;
    }
    SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, verify_callback);

    return ctx;
}

void my_close(SSL *ssl, int sock) {
    SSL_shutdown(ssl);
    SSL_free(ssl);          /* release connection state */

    close(sock);            /* close socket */
}

int main(int argc, char * argv[]) {
    int clientsock = 0;

    SSL_CTX *ctx = NULL;
    SSL *ssl = NULL;

    ctx = my_ssl_create_context();

    my_log("socket connect ...");
    clientsock = my_connect("<your-host-name>", 8080);
    my_log("socket connect done");

    ssl = SSL_new(ctx);
    SSL_set_fd(ssl, clientsock);

    my_log("SSL connect ...");
    if (SSL_connect(ssl) == -1) {
        ERR_print_errors_fp(stderr);
        my_close(ssl, clientsock);
        SSL_CTX_free(ctx);              /* release context */
        return 1;
    }
    my_log("SSL connect done");

    if (SSL_get_verify_result(ssl) == X509_V_OK) {
        my_log("SSL verify success", SSL_get_verify_result(ssl));
    } else {
        my_log("SSL verify failed: (%d)", SSL_get_verify_result(ssl));
        ERR_print_errors_fp(stderr);
    }

    my_close(ssl, clientsock);

    SSL_CTX_free(ctx);

    return 0;
}

这是使用SSL_CTX_set_verify(...)的callback函数来实现，当然也可以使用X509_check_host()来主动发起主机名验证。

SSL_CTX *ctx = SSL_CTX_new(TLSv1_2_client_method());
SSL *ssl = SSL_new(ctx);

SSL_connect(ssl);

X509 * cert = SSL_get_peer_certificate(ssl);  // get server side certificate
if (X509_check_host(cert, "<your-host-name>", 0, 0, NULL) == 1) {
   printf("hostname check success\n");
} else {
   printf("hostname check failure\n");
}