com php-src: Changed return types to zend_bool, renamed test: ext/openssl/openssl.c ext/openssl/tests/san-pe er-matching.phpt
ext/openssl/tests/san_peer_matching. phpt

Commit: a40dd6e963e35ecc0708eebaa22a63700ade69e3 Author: Daniel Lowrey <rdlowrey@gmail.com> Wed, 9 Oct 2013 09:55:36 -0400 Parents: 1970b964430a357d9c9acf01268849d86a99f4ec Branches: master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=a40dd6e963e35ecc0708eebaa22a63700ade69e3 Log: Changed return types to zend_bool, renamed test Changed paths: M ext/openssl/openssl.c D ext/openssl/tests/san-peer-matching.phpt A ext/openssl/tests/san_peer_matching..phpt Diff: diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c index c774057..43b3e0c 100644 --- a/ext/openssl/openssl.c +++ b/ext/openssl/openssl.c @@ -4951,7 +4951,7 @@ static int verify_callback(int preverify_ok, X509_STORE_CTX *ctx) /* {{{ */ } /* }}} */ -static int matches_wildcard_name(const char *subjectname, const char *certname) +static zend_bool matches_wildcard_name(const char *subjectname, const char *certname) { char *wildcard; int prefix_len, suffix_len, subject_len; @@ -4983,10 +4983,12 @@ static int matches_wildcard_name(const char *subjectname, const char *certname) return 0; } -static int matches_san_list(X509 *peer, const char *subject_name) +static zend_bool matches_san_list(X509 *peer, const char *subject_name) { - int is_match, i; + int i; + zend_bool is_match = 0; unsigned char *cert_name; + GENERAL_NAMES *alt_names = X509_get_ext_d2i(peer, NID_subject_alt_name, 0, 0); int alt_name_count = sk_GENERAL_NAME_num(alt_names); @@ -5007,25 +5009,26 @@ static int matches_san_list(X509 *peer, const char *subject_name) return is_match; } -static int matches_common_name(X509 *peer, const char *subject_name) +static zend_bool matches_common_name(X509 *peer, const char *subject_name) { char buf[1024]; X509_NAME *cert_name; + zend_bool is_match = 0; + cert_name = X509_get_subject_name(peer); int cert_name_len = X509_NAME_get_text_by_NID(cert_name, NID_commonName, buf, sizeof(buf)); if (cert_name_len == -1) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to locate peer certificate CN"); - return 0; } else if (cert_name_len != strlen(buf)) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Peer certificate CN=`%.*s' is malformed", cert_name_len, buf); - return 0; } else if (matches_wildcard_name(subject_name, buf)) { - return 1; + is_match = 1; } else { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Peer certificate CN=%.*s' did not match expected CN=%s'", cert_name_len, buf, subject_name); - return 0; } + + return is_match; } int php_openssl_apply_verification_policy(SSL *ssl, X509 *peer, php_stream *stream TSRMLS_DC) /* {{{ */ diff --git a/ext/openssl/tests/san-peer-matching.phpt b/ext/openssl/tests/san-peer-matching.phpt deleted file mode 100644 index 4e6531d..0000000 --- a/ext/openssl/tests/san-peer-matching.phpt +++ /dev/null @@ -1,60 +0,0 @@ ---TEST-- -Peer verification matches SAN names ---SKIPIF-- -<?php -if (!extension_loaded("openssl")) die("skip"); -if (!function_exists('pcntl_fork')) die("skip no fork"); ---FILE-- -<?php -$context = stream_context_create(array( - 'ssl' => array( - 'local_cert' => __DIR__ . '/san-cert.pem', - 'allow_self_signed' => true, - ), -)); - -$server = stream_socket_server('ssl://127.0.0.1:64321', $errno, $errstr, - STREAM_SERVER_BIND|STREAM_SERVER_LISTEN, $context); - - -$pid = pcntl_fork(); -if ($pid == -1) { - die('could not fork'); -} else if ($pid) { - $contextC = stream_context_create( - array( - 'ssl' => array( - 'verify_peer' => true, - 'cafile' => __DIR__ . '/san-ca.pem', - 'CN_match' => 'example.org', - ) - ) - ); - var_dump(stream_socket_client("ssl://127.0.0.1:64321", $errno, $errstr, 1, - STREAM_CLIENT_CONNECT, $contextC)); - - $contextC = stream_context_create(array( - 'ssl' => array( - 'verify_peer' => true, - 'cafile' => __DIR__ . '/san-ca.pem', - 'CN_match' => 'moar.example.org', - ) - )); - - var_dump(stream_socket_client("ssl://127.0.0.1:64321", $errno, $errstr, 1, - STREAM_CLIENT_CONNECT, $contextC)); - -} else { - @pcntl_wait($status); - @stream_socket_accept($server, 1); - @stream_socket_accept($server, 1); -} ---EXPECTF-- -resource(%d) of type (stream) - -Warning: stream_socket_client(): Unable to locate peer certificate CN in %s on line %d - -Warning: stream_socket_client(): Failed to enable crypto in %s on line %d - -Warning: stream_socket_client(): unable to connect to ssl://127.0.0.1:64321 (Unknown error) in %s on line %d -bool(false) diff --git a/ext/openssl/tests/san_peer_matching.phpt b/ext/openssl/tests/san_peer_matching.phpt new file mode 100644 index 0000000..4e6531d --- /dev/null +++ b/ext/openssl/tests/san_peer_matching.phpt @@ -0,0 +1,60 @@ +--TEST-- +Peer verification matches SAN names +--SKIPIF-- +<?php +if (!extension_loaded("openssl")) die("skip"); +if (!function_exists('pcntl_fork')) die("skip no fork"); +--FILE-- +<?php +$context = stream_context_create(array( + 'ssl' => array( + 'local_cert' => __DIR__ . '/san-cert.pem', + 'allow_self_signed' => true, + ), +)); + +$server = stream_socket_server('ssl://127.0.0.1:64321', $errno, $errstr, + STREAM_SERVER_BIND|STREAM_SERVER_LISTEN, $context); + + +$pid = pcntl_fork(); +if ($pid == -1) { + die('could not fork'); +} else if ($pid) { + $contextC = stream_context_create( + array( + 'ssl' => array( + 'verify_peer' => true, + 'cafile' => __DIR__ . '/san-ca.pem', + 'CN_match' => 'example.org', + ) + ) + ); + var_dump(stream_socket_client("ssl://127.0.0.1:64321", $errno, $errstr, 1, + STREAM_CLIENT_CONNECT, $contextC)); + + $contextC = stream_context_create(array( + 'ssl' => array( + 'verify_peer' => true, + 'cafile' => __DIR__ . '/san-ca.pem', + 'CN_match' => 'moar.example.org', + ) + )); + + var_dump(stream_socket_client("ssl://127.0.0.1:64321", $errno, $errstr, 1, + STREAM_CLIENT_CONNECT, $contextC)); + +} else { + @pcntl_wait($status); + @stream_socket_accept($server, 1); + @stream_socket_accept($server, 1); +} +--EXPECTF-- +resource(%d) of type (stream) + +Warning: stream_socket_client(): Unable to locate peer certificate CN in %s on line %d + +Warning: stream_socket_client(): Failed to enable crypto in %s on line %d + +Warning: stream_socket_client(): unable to connect to ssl://127.0.0.1:64321 (Unknown error) in %s on line %d +bool(false)