tls: add functions to verify server cert, purpose and hostname
MODIFY
include/re_tls.h
include/re_tls.h
@@ -49,6 +49,9 @@ int tls_fingerprint(const struct tls *tls, enum tls_fingerprint type,
int tls_peer_fingerprint(const struct tls_conn *tc, enum tls_fingerprint type,
uint8_t *md, size_t size);
int tls_peer_common_name(const struct tls_conn *tc, char *cn, size_t size);
+int tls_peer_set_verify_host(struct tls_conn *tc, const char *hostname);
+int tls_set_verify_purpose(struct tls *tls, const char *purpose);
+int tls_set_hostname(char *tls_hostname, const struct pl *hostname);
int tls_peer_verify(const struct tls_conn *tc);
int tls_srtp_keyinfo(const struct tls_conn *tc, enum srtp_suite *suite,
uint8_t *cli_key, size_t cli_key_size,

MODIFY
src/tls/openssl/tls.c
src/tls/openssl/tls.c
@@ -229,6 +229,90 @@ int tls_add_ca(struct tls *tls, const char *cafile)
}
+/**
+ * Set SSL verification of the certificate purpose
+ *
+ * @param tls TLS Context
+ * @param purpose Certificate purpose as string
+ *
+ * @return int 0 if success, errorcode otherwise
+ */
+int tls_set_verify_purpose(struct tls *tls, const char *purpose)
+{
+ int err;
+ int i;
+ X509_PURPOSE *xptmp;
+
+ if (!tls || !purpose)
+ return EINVAL;
+
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+ i = X509_PURPOSE_get_by_sname(purpose);
+#else
+ i = X509_PURPOSE_get_by_sname((char *) purpose);
+#endif
+
+ if (i < 0)
+ return EINVAL;
+
+ /* purpose index -> purpose object */
+ /* purpose object -> purpose value */
+ xptmp = X509_PURPOSE_get0(i);
+ i = X509_PURPOSE_get_id(xptmp);
+ err = SSL_CTX_set_purpose(tls->ctx, i);
+
+ return err == 1 ? 0 : EINVAL;
+}
+
+
+/**
+ * Set SSL verification of hostname
+ *
+ * @param tc TLS Connection
+ * @param hostname Certificate hostname
+ *
+ * @return int 0 if success, errorcode otherwise
+ */
+int tls_peer_set_verify_host(struct tls_conn *tc, const char *hostname)
+{
+ int err = 0;
+
+ if (!tc)
+ return EINVAL;
+
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+ err = SSL_set1_host(tc->ssl, hostname);
+#else
+ DEBUG_WARNING("verify hostname needs openssl version 1.1.0\n");
+ return ENOSYS;
+#endif
+
+ return err == 1 ? 0 : EINVAL;
+}
+
+
+/**
+ * Convert string hostname to pl hostname
+ *
+ * @param tls_hostname Certificate hostname as string
+ * @param hostname Certificate hostname as pl
+ *
+ * @return int 0 if success, errorcode otherwise
+ */
+int tls_set_hostname(char *tls_hostname, const struct pl *hostname)
+{
+ if (!tls_hostname || !hostname)
+ return EINVAL;
+
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+ DEBUG_WARNING("verify hostname needs openssl version 1.1.0\n");
+ return ENOSYS;
+#endif
+
+ return pl_strdup(&tls_hostname, hostname);
+}
+
+
/**
* Generate and set selfsigned certificate on TLS context
*

tls: add functions to verify server cert, purpose and hostname