openwrt/package/libs/mbedtls/patches/100-x509-crt-verify-SAN-iPAddress.patch

From 272d48fe7a2ff00285d4ee166d3a9beca1d5122f Mon Sep 17 00:00:00 2001
From: Glenn Strauss <gstrauss@gluelogic.com>
Date: Sun, 23 Oct 2022 19:48:18 -0400
Subject: [PATCH 1/4] x509 crt verify SAN iPAddress

Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
---
 include/mbedtls/x509_crt.h |   2 +-
 library/x509_crt.c         | 115 +++++++++++++++++++++++++++++--------
 2 files changed, 93 insertions(+), 24 deletions(-)

--- a/include/mbedtls/x509_crt.h
+++ b/include/mbedtls/x509_crt.h
@@ -597,7 +597,7 @@ int mbedtls_x509_crt_verify_info( char *
  * \param cn       The expected Common Name. This will be checked to be
  *                 present in the certificate's subjectAltNames extension or,
  *                 if this extension is absent, as a CN component in its
- *                 Subject name. Currently only DNS names are supported. This
+ *                 Subject name. DNS names and IP addresses are supported. This
  *                 may be \c NULL if the CN need not be verified.
  * \param flags    The address at which to store the result of the verification.
  *                 If the verification couldn't be completed, the flag value is
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -2986,6 +2986,54 @@ find_parent:
     }
 }
 
+#ifdef _WIN32
+/* ??? */
+#elif defined(__sun)
+/* Solaris requires -lsocket -lnsl for inet_pton() */
+#elif defined(__has_include)
+#if __has_include(<sys/socket.h>)
+#include <sys/socket.h>
+#endif
+#if __has_include(<arpa/inet.h>)
+#include <arpa/inet.h>
+#endif
+#endif
+
+/* Use whether or not AF_INET6 is defined to indicate whether or not to use
+ * the platform inet_pton() or a local implementation (below).  The local
+ * implementation may be used even in cases where the platform provides
+ * inet_pton(), e.g. when there are different includes required and/or the
+ * platform implementation requires dependencies on additional libraries.
+ * Specifically, Windows requires custom includes and additional link
+ * dependencies, and Solaris requires additional link dependencies.
+ * Also, as a coarse heuristic, use the local implementation if the compiler
+ * does not support __has_include(), or if the definition of AF_INET6 is not
+ * provided by headers included (or not) via __has_include() above. */
+#ifndef AF_INET6
+
+#define x509_cn_inet_pton( cn, dst ) ( 0 )
+
+#else
+
+static int x509_inet_pton_ipv6( const char *src, void *dst )
+{
+    return( inet_pton( AF_INET6, src, dst ) == 1 ? 0 : -1 );
+}
+
+static int x509_inet_pton_ipv4( const char *src, void *dst )
+{
+    return( inet_pton( AF_INET, src, dst ) == 1 ? 0 : -1 );
+}
+
+#endif /* AF_INET6 */
+
+static size_t x509_cn_inet_pton( const char *cn, void *dst )
+{
+    return( strchr( cn, ':' ) == NULL
+            ? x509_inet_pton_ipv4( cn, dst ) == 0 ? 4 : 0
+            : x509_inet_pton_ipv6( cn, dst ) == 0 ? 16 : 0 );
+}
+
 /*
  * Check for CN match
  */
@@ -3008,23 +3056,51 @@ static int x509_crt_check_cn( const mbed
     return( -1 );
 }
 
+static int x509_crt_check_san_ip( const mbedtls_x509_sequence *san,
+                                  const char *cn, size_t cn_len )
+{
+    uint32_t ip[4];
+    cn_len = x509_cn_inet_pton( cn, ip );
+    if( cn_len == 0 )
+        return( -1 );
+
+    for( const mbedtls_x509_sequence *cur = san; cur != NULL; cur = cur->next )
+    {
+        const unsigned char san_type = (unsigned char) cur->buf.tag &
+                                       MBEDTLS_ASN1_TAG_VALUE_MASK;
+        if( san_type == MBEDTLS_X509_SAN_IP_ADDRESS &&
+            cur->buf.len == cn_len && memcmp( cur->buf.p, ip, cn_len ) == 0 )
+            return( 0 );
+    }
+
+    return( -1 );
+}
+
 /*
  * Check for SAN match, see RFC 5280 Section 4.2.1.6
  */
-static int x509_crt_check_san( const mbedtls_x509_buf *name,
+static int x509_crt_check_san( const mbedtls_x509_sequence *san,
                                const char *cn, size_t cn_len )
 {
-    const unsigned char san_type = (unsigned char) name->tag &
-                                   MBEDTLS_ASN1_TAG_VALUE_MASK;
-
-    /* dNSName */
-    if( san_type == MBEDTLS_X509_SAN_DNS_NAME )
-        return( x509_crt_check_cn( name, cn, cn_len ) );
-
-    /* (We may handle other types here later.) */
+    int san_ip = 0;
+    for( const mbedtls_x509_sequence *cur = san; cur != NULL; cur = cur->next )
+    {
+        switch( (unsigned char) cur->buf.tag & MBEDTLS_ASN1_TAG_VALUE_MASK )
+        {
+        case MBEDTLS_X509_SAN_DNS_NAME:                    /* dNSName */
+            if( x509_crt_check_cn( &cur->buf, cn, cn_len ) == 0 )
+                return( 0 );
+            break;
+        case MBEDTLS_X509_SAN_IP_ADDRESS:                  /* iPAddress */
+            san_ip = 1;
+            break;
+        /* (We may handle other types here later.) */
+        default: /* Unrecognized type */
+            break;
+        }
+    }
 
-    /* Unrecognized type */
-    return( -1 );
+    return( san_ip ? x509_crt_check_san_ip( san, cn, cn_len ) : -1 );
 }
 
 /*
@@ -3035,19 +3111,12 @@ static void x509_crt_verify_name( const
                                   uint32_t *flags )
 {
     const mbedtls_x509_name *name;
-    const mbedtls_x509_sequence *cur;
     size_t cn_len = strlen( cn );
 
     if( crt->ext_types & MBEDTLS_X509_EXT_SUBJECT_ALT_NAME )
     {
-        for( cur = &crt->subject_alt_names; cur != NULL; cur = cur->next )
-        {
-            if( x509_crt_check_san( &cur->buf, cn, cn_len ) == 0 )
-                break;
-        }
-
-        if( cur == NULL )
-            *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
+        if( x509_crt_check_san( &crt->subject_alt_names, cn, cn_len ) == 0 )
+            return;
     }
     else
     {
@@ -3056,13 +3125,13 @@ static void x509_crt_verify_name( const
             if( MBEDTLS_OID_CMP( MBEDTLS_OID_AT_CN, &name->oid ) == 0 &&
                 x509_crt_check_cn( &name->val, cn, cn_len ) == 0 )
             {
-                break;
+                return;
             }
         }
 
-        if( name == NULL )
-            *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
     }
+
+    *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
 }
 
 /*