align X509_VERIFY_PARAM host and email behavior with OpenSSL #1062
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Issues:
Resolves
CryptoAlg-1865
Description of changes:
A dig into some of the mySQL/AWS-LC test failures revealed that this was the root cause.
BoringSSL briefly made this backwards compatible, but enforced the stricter check a week later since Chrome was not effected by this.
This doesn't apply to us however, so we're reverting the strict check in an attempt to be more compatible with OpenSSL.
Call-outs:
I've reverted the check for
X509_VERIFY_PARAM_set1_email
while I was at it as well.X509_VERIFY_PARAM_set1_ip
was using the same underlying logic asX509_VERIFY_PARAM_set1_email
which made things a bit complicated.X509_VERIFY_PARAM_set1_ip
takes anunsigned char *
, but changes to make it more compatible with OpenSSL requiredstrlen
to detect the length of the string. I've separated the logic forX509_VERIFY_PARAM_set1_email/ip
into two functions to get around this.X509_VERIFY_PARAM_set1_ip
now maintains the original BoringSSL behavior, whileX509_VERIFY_PARAM_set1_email
is compatible with OpenSSL now. We can look into makingX509_VERIFY_PARAM_set1_ip
more compatible with OpenSSL later on if needed.Testing:
CI
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.