Use additional OpensslCredentials_t parameter for hostname checking.

archigup · archigup · commit 0f810df993fa · 2022-10-06T14:48:54.000-07:00
This will allow demos to disable hostname checking, allowing them to be used
with Greengrass or other endpoints that do not have the hostname in their
certificate subject.
diff --git a/demos/defender/defender_demo_json/mqtt_operations.c b/demos/defender/defender_demo_json/mqtt_operations.c
@@ -370,6 +370,7 @@ static bool connectToBrokerWithBackoffRetries( NetworkContext_t * pNetworkContex
     opensslCredentials.pClientCertPath = CLIENT_CERT_PATH;
     opensslCredentials.pPrivateKeyPath = CLIENT_PRIVATE_KEY_PATH;
     opensslCredentials.sniHostName = AWS_IOT_ENDPOINT;
+    opensslCredentials.certHostName = AWS_IOT_ENDPOINT;
 
     if( AWS_MQTT_PORT == 443 )
     {
diff --git a/demos/http/http_demo_basic_tls/http_demo_basic_tls.c b/demos/http/http_demo_basic_tls/http_demo_basic_tls.c
@@ -234,6 +234,7 @@ static int32_t connectToServer( NetworkContext_t * pNetworkContext )
     ( void ) memset( &opensslCredentials, 0, sizeof( opensslCredentials ) );
     opensslCredentials.pRootCaPath = ROOT_CA_CERT_PATH;
     opensslCredentials.sniHostName = SERVER_HOST;
+    opensslCredentials.certHostName = SERVER_HOST;
 
     /* Initialize server information. */
     serverInfo.pHostName = SERVER_HOST;
diff --git a/demos/http/http_demo_mutual_auth/http_demo_mutual_auth.c b/demos/http/http_demo_mutual_auth/http_demo_mutual_auth.c
@@ -181,6 +181,7 @@ static int32_t connectToServer( NetworkContext_t * pNetworkContext )
     opensslCredentials.pPrivateKeyPath = CLIENT_PRIVATE_KEY_PATH;
     opensslCredentials.pRootCaPath = ROOT_CA_CERT_PATH;
     opensslCredentials.sniHostName = AWS_IOT_ENDPOINT;
+    opensslCredentials.certHostName = AWS_IOT_ENDPOINT;
 
     /* ALPN is required when communicating to AWS IoT Core over port 443 through HTTP. */
     if( AWS_HTTPS_PORT == 443 )
diff --git a/demos/http/http_demo_s3_download/http_demo_s3_download.c b/demos/http/http_demo_s3_download/http_demo_s3_download.c
@@ -891,6 +891,7 @@ static int32_t connectToIotServer( NetworkContext_t * pNetworkContext )
         /* Initialize TLS credentials. */
         opensslCredentials.pRootCaPath = ROOT_CA_CERT_PATH;
         opensslCredentials.sniHostName = serverHost;
+        opensslCredentials.certHostName = serverHost;
         opensslCredentials.pClientCertPath = CLIENT_CERT_PATH;
         opensslCredentials.pPrivateKeyPath = CLIENT_PRIVATE_KEY_PATH;
 
@@ -944,6 +945,7 @@ static int32_t connectToS3Server( NetworkContext_t * pNetworkContext )
         /* Initialize TLS credentials. */
         opensslCredentials.pRootCaPath = ROOT_CA_CERT_PATH;
         opensslCredentials.sniHostName = serverHost;
+        opensslCredentials.certHostName = serverHost;
 
         /* Initialize server information. */
         serverInfo.pHostName = serverHost;
diff --git a/demos/http/http_demo_s3_download_multithreaded/http_demo_s3_download_multithreaded.c b/demos/http/http_demo_s3_download_multithreaded/http_demo_s3_download_multithreaded.c
@@ -340,6 +340,7 @@ static int connectToServer( NetworkContext_t * pNetworkContext )
     /* Initialize TLS credentials. */
     opensslCredentials.pRootCaPath = ROOT_CA_CERT_PATH;
     opensslCredentials.sniHostName = serverHost;
+    opensslCredentials.certHostName = serverHost;
 
     /* serverHost should consist only of the host address located in S3_PRESIGNED_GET_URL. */
     memcpy( serverHost, pHost, hostLen );
diff --git a/demos/http/http_demo_s3_upload/http_demo_s3_upload.c b/demos/http/http_demo_s3_upload/http_demo_s3_upload.c
@@ -285,6 +285,7 @@ static int32_t connectToServer( NetworkContext_t * pNetworkContext )
         /* Initialize TLS credentials. */
         opensslCredentials.pRootCaPath = ROOT_CA_CERT_PATH;
         opensslCredentials.sniHostName = serverHost;
+        opensslCredentials.certHostName = serverHost;
 
         /* Initialize server information. */
         serverInfo.pHostName = serverHost;
diff --git a/demos/mqtt/mqtt_demo_basic_tls/mqtt_demo_basic_tls.c b/demos/mqtt/mqtt_demo_basic_tls/mqtt_demo_basic_tls.c
@@ -480,6 +480,7 @@ static int connectToServerWithBackoffRetries( NetworkContext_t * pNetworkContext
     memset( &opensslCredentials, 0, sizeof( OpensslCredentials_t ) );
     opensslCredentials.pRootCaPath = ROOT_CA_CERT_PATH;
     opensslCredentials.sniHostName = BROKER_ENDPOINT;
+    opensslCredentials.certHostName = BROKER_ENDPOINT;
 
     /* Initialize reconnect attempts and interval */
     BackoffAlgorithm_InitializeParams( &reconnectParams,
diff --git a/demos/mqtt/mqtt_demo_mutual_auth/mqtt_demo_mutual_auth.c b/demos/mqtt/mqtt_demo_mutual_auth/mqtt_demo_mutual_auth.c
@@ -603,6 +603,9 @@ static int connectToServerWithBackoffRetries( NetworkContext_t * pNetworkContext
      * https://docs.aws.amazon.com/iot/latest/developerguide/transport-security.html */
     opensslCredentials.sniHostName = AWS_IOT_ENDPOINT;
 
+    /* Check that the server certificate matches the hostname */
+    opensslCredentials.certHostName = AWS_IOT_ENDPOINT;
+
     if( AWS_MQTT_PORT == 443 )
     {
         /* Pass the ALPN protocol name depending on the port being used.
diff --git a/demos/mqtt/mqtt_demo_subscription_manager/mqtt_demo_subscription_manager.c b/demos/mqtt/mqtt_demo_subscription_manager/mqtt_demo_subscription_manager.c
@@ -542,6 +542,7 @@ static int connectToServerWithBackoffRetries( NetworkContext_t * pNetworkContext
     memset( &opensslCredentials, 0, sizeof( OpensslCredentials_t ) );
     opensslCredentials.pRootCaPath = ROOT_CA_CERT_PATH;
     opensslCredentials.sniHostName = BROKER_ENDPOINT;
+    opensslCredentials.certHostName = BROKER_ENDPOINT;
 
     /* Seed pseudo random number generator used in the demo for
      * backoff period calculation when retrying failed network operations
diff --git a/demos/ota/ota_demo_core_http/ota_demo_core_http.c b/demos/ota/ota_demo_core_http/ota_demo_core_http.c
@@ -1076,6 +1076,9 @@ static int connectToServerWithBackoffRetries( NetworkContext_t * pNetworkContext
      * https://docs.aws.amazon.com/iot/latest/developerguide/transport-security.html */
     opensslCredentials.sniHostName = AWS_IOT_ENDPOINT;
 
+    /* Check that the server certificate matches the hostname */
+    opensslCredentials.certHostName = AWS_IOT_ENDPOINT;
+
     if( AWS_MQTT_PORT == 443 )
     {
         /* Pass the ALPN protocol name depending on the port being used.
@@ -1371,6 +1374,7 @@ static int32_t connectToS3Server( NetworkContext_t * pNetworkContext,
         serverInfo.pHostName = serverHost;
         serverInfo.hostNameLength = serverHostLength;
         serverInfo.port = AWS_HTTPS_PORT;
+        opensslCredentials.certHostName = serverHost;
 
         /* Establish a TLS session with the HTTP server. This example connects
          * to the HTTP server as specified in SERVER_HOST and HTTPS_PORT in
diff --git a/demos/ota/ota_demo_core_mqtt/ota_demo_core_mqtt.c b/demos/ota/ota_demo_core_mqtt/ota_demo_core_mqtt.c
@@ -945,6 +945,9 @@ static int connectToServerWithBackoffRetries( NetworkContext_t * pNetworkContext
      * https://docs.aws.amazon.com/iot/latest/developerguide/transport-security.html */
     opensslCredentials.sniHostName = AWS_IOT_ENDPOINT;
 
+    /* Check that the server certificate matches the hostname */
+    opensslCredentials.certHostName = AWS_IOT_ENDPOINT;
+
     if( AWS_MQTT_PORT == 443 )
     {
         /* Pass the ALPN protocol name depending on the port being used.
diff --git a/demos/shadow/shadow_demo_main/shadow_demo_helpers.c b/demos/shadow/shadow_demo_main/shadow_demo_helpers.c
@@ -353,6 +353,7 @@ static int connectToServerWithBackoffRetries( NetworkContext_t * pNetworkContext
     opensslCredentials.pClientCertPath = CLIENT_CERT_PATH;
     opensslCredentials.pPrivateKeyPath = CLIENT_PRIVATE_KEY_PATH;
     opensslCredentials.sniHostName = AWS_IOT_ENDPOINT;
+    opensslCredentials.certHostName = AWS_IOT_ENDPOINT;
 
     if( AWS_MQTT_PORT == 443 )
     {
diff --git a/platform/posix/transport/include/openssl_posix.h b/platform/posix/transport/include/openssl_posix.h
@@ -118,6 +118,14 @@ typedef struct OpensslCredentials
      */
     const char * sniHostName;
 
+    /**
+     * @brief Set a host name for validating server's certificate subject. Set
+     * to NULL to disable hostname checking.
+     *
+     * @note This string must be NULL-terminated because the OpenSSL API requires it to be.
+     */
+    const char * certHostName;
+
     /**
      * @brief Set the value for the TLS max fragment length (TLS MFLN)
      *
diff --git a/platform/posix/transport/src/openssl_posix.c b/platform/posix/transport/src/openssl_posix.c
@@ -243,8 +243,11 @@ static OpensslStatus_t tlsHandshake( const ServerInfo_t * pServerInfo,
     OpensslStatus_t returnStatus = OPENSSL_SUCCESS;
     int32_t sslStatus = -1, verifyPeerCertStatus = X509_V_OK;
 
-    /* Validate the hostname against the server's certificate. */
-    sslStatus = SSL_set1_host( pOpensslParams->pSsl, pServerInfo->pHostName );
+    if( pOpensslCredentials->certHostName != NULL )
+    {
+        /* Validate the hostname against the server's certificate. */
+        sslStatus = SSL_set1_host( pOpensslParams->pSsl, pOpensslCredentials->certHostName );
+    }
 
     if( sslStatus != 1 )
     {

Original file line number	Diff line number	Diff line change
`@@ -370,6 +370,7 @@ static bool connectToBrokerWithBackoffRetries( NetworkContext_t * pNetworkContex`
`370`	`370`	`opensslCredentials.pClientCertPath = CLIENT_CERT_PATH;`
`371`	`371`	`opensslCredentials.pPrivateKeyPath = CLIENT_PRIVATE_KEY_PATH;`
`372`	`372`	`opensslCredentials.sniHostName = AWS_IOT_ENDPOINT;`
	`373`	`+ opensslCredentials.certHostName = AWS_IOT_ENDPOINT;`
`373`	`374`
`374`	`375`	`if( AWS_MQTT_PORT == 443 )`
`375`	`376`	`{`
Original file line number	Diff line number	Diff line change
`@@ -603,6 +603,9 @@ static int connectToServerWithBackoffRetries( NetworkContext_t * pNetworkContext`
`603`	`603`	`* https://docs.aws.amazon.com/iot/latest/developerguide/transport-security.html */`
`604`	`604`	`opensslCredentials.sniHostName = AWS_IOT_ENDPOINT;`
`605`	`605`
	`606`	`+ /* Check that the server certificate matches the hostname */`
	`607`	`+ opensslCredentials.certHostName = AWS_IOT_ENDPOINT;`
	`608`	`+`
`606`	`609`	`if( AWS_MQTT_PORT == 443 )`
`607`	`610`	`{`
`608`	`611`	`/* Pass the ALPN protocol name depending on the port being used.`