Skip to content

add runtime option to override IP check with client #489

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ejohnstown merged 2 commits into from
Mar 10, 2023
Merged

add runtime option to override IP check with client #489

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6c1d0d7
add runtime option to override IP check with client
JacobBarthelmeh Jan 20, 2023
ca36b31
add IP override for sftp client
JacobBarthelmeh Jan 20, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 13 additions & 2 deletions examples/client/client.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,6 +195,7 @@ static void ShowUsage(void)
printf(" Certificate example : client -u orange \\\n");
printf(" -J orange-cert.der -i orange-key.der\n");
printf(" -A <filename> filename for DER CA certificate to verify host\n");
printf(" -X Ignore IP checks on peer vs peer certificate\n");
#endif
}

Expand Down Expand Up @@ -493,6 +494,10 @@ static inline void ato32(const byte* c, word32* u32)

#if defined(WOLFSSH_CERTS) && \
(defined(OPENSSL_ALL) || defined(WOLFSSL_IP_ALT_NAME))

/* when set as true then ignore miss matching IP addresses */
static int IPOverride = 0;

static int ParseRFC6187(const byte* in, word32 inSz, byte** leafOut,
word32* leafOutSz)
{
Expand Down Expand Up @@ -592,7 +597,9 @@ static int wsPublicKeyCheck(const byte* pubKey, word32 pubKeySz, void* ctx)

if (ipMatch == 0) {
printf("IP did not match expected IP\n");
ret = -1;
if (!IPOverride) {
ret = -1;
}
}
}
FreeDecodedCert(&dCert);
Expand Down Expand Up @@ -1027,7 +1034,7 @@ THREAD_RETURN WOLFSSH_THREAD client_test(void* args)
char** argv = ((func_args*)args)->argv;
((func_args*)args)->return_code = 0;

while ((ch = mygetopt(argc, argv, "?ac:eh:i:j:p:tu:xzNP:RJ:A:")) != -1) {
while ((ch = mygetopt(argc, argv, "?ac:eh:i:j:p:tu:xzNP:RJ:A:X")) != -1) {
switch (ch) {
case 'h':
host = myoptarg;
Expand Down Expand Up @@ -1077,6 +1084,10 @@ THREAD_RETURN WOLFSSH_THREAD client_test(void* args)
caCert = myoptarg;
break;

case 'X':
IPOverride = 1;
break;

#endif

case 'x':
Expand Down
13 changes: 11 additions & 2 deletions examples/sftpclient/sftpclient.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -372,6 +372,7 @@ static void ShowUsage(void)
printf(" Certificate example : client -u orange \\\n");
printf(" -J orange-cert.der -i orange-key.der\n");
printf(" -A <filename> filename for DER CA certificate to verify host\n");
printf(" -X Ignore IP checks on peer vs peer certificate\n");
#endif

ShowCommands();
Expand Down Expand Up @@ -718,6 +719,8 @@ static inline void ato32(const byte* c, word32* u32)
*u32 = (c[0] << 24) | (c[1] << 16) | (c[2] << 8) | c[3];
}

/* when set as true then ignore miss matching IP addresses */
static int IPOverride = 0;

static int ParseRFC6187(const byte* in, word32 inSz, byte** leafOut,
word32* leafOutSz)
Expand Down Expand Up @@ -817,7 +820,9 @@ static int wsPublicKeyCheck(const byte* pubKey, word32 pubKeySz, void* ctx)

if (ipMatch == 0) {
printf("IP did not match expected IP\n");
ret = -1;
if (!IPOverride) {
ret = -1;
}
}
}
FreeDecodedCert(&dCert);
Expand Down Expand Up @@ -1566,7 +1571,7 @@ THREAD_RETURN WOLFSSH_THREAD sftpclient_test(void* args)
char** argv = ((func_args*)args)->argv;
((func_args*)args)->return_code = 0;

while ((ch = mygetopt(argc, argv, "?d:egh:i:j:l:p:r:u:EGNP:J:A:")) != -1) {
while ((ch = mygetopt(argc, argv, "?d:egh:i:j:l:p:r:u:EGNP:J:A:X")) != -1) {
switch (ch) {
case 'd':
defaultSftpPath = myoptarg;
Expand Down Expand Up @@ -1641,6 +1646,10 @@ THREAD_RETURN WOLFSSH_THREAD sftpclient_test(void* args)
caCert = myoptarg;
break;

case 'X':
IPOverride = 1;
break;

#endif

case '?':
Expand Down