Add OpenSSLCertUtils::getSubjectAltNameEntries

Summary:
- Add new `getSubjectAltNameEntries`, which includes all DNS, IP, and URI entries.
- Refactor `getSubjectAltNames` and `getSubjectAltNameURIs`to use the result of  `getSubjectAltNameEntries`, and filter for the correct types.

Reviewed By: mingtaoy

Differential Revision: D116701420

fbshipit-source-id: 1c77d2e58955609ba0ee7e3bcb555474266d056f

Author: Huilin Chen

folly/ssl/BUCK

@@ -43,6 +43,7 @@ fb_dirsync_cpp_library(
     ],
     exported_deps = [
         ":openssl_ptr_types",
+        "//folly:network_address",
         "//folly:optional",
         "//folly/io:iobuf",
         "//folly/portability:openssl",

folly/ssl/CMakeLists.txt

@@ -26,6 +26,7 @@ folly_add_library(
     folly_string
   EXPORTED_DEPS
     folly_io_iobuf
+    folly_network_address
     folly_optional
     folly_portability_openssl
     folly_ssl_openssl_ptr_types

folly/ssl/OpenSSLCertUtils.cpp

@@ -16,6 +16,8 @@
 
 #include <folly/ssl/OpenSSLCertUtils.h>
 
+#include <optional>
+
 #include <folly/FileUtil.h>
 #include <folly/ScopeGuard.h>
 #include <folly/String.h>
@@ -49,6 +51,45 @@ std::string asn1ToString(ASN1_STRING* a) {
   }
 }
 
+std::optional<std::string> getStringSubjectAltName(const ASN1_STRING* value) {
+  const auto* data =
+      reinterpret_cast<const char*>(ASN1_STRING_get0_data(value));
+  const int len = ASN1_STRING_length(value);
+  if (!data || len <= 0) {
+    return std::nullopt;
+  }
+  return std::string(data, len);
+}
+
+std::optional<IPAddress> getIpSubjectAltName(const ASN1_STRING* value) {
+  const auto* data = ASN1_STRING_get0_data(value);
+  const int len = ASN1_STRING_length(value);
+  if (!data || (len != 4 && len != 16)) {
+    return std::nullopt;
+  }
+  return IPAddress::fromBinary(ByteRange(data, static_cast<size_t>(len)));
+}
+
+std::optional<GeneralName> getSubjectAltName(const GENERAL_NAME& name) {
+  if (name.type == GEN_DNS) {
+    if (auto value = getStringSubjectAltName(name.d.dNSName)) {
+      return GeneralName{DnsName{std::move(*value)}};
+    }
+  }
+  if (name.type == GEN_URI) {
+    if (auto value =
+            getStringSubjectAltName(name.d.uniformResourceIdentifier)) {
+      return GeneralName{UriName{std::move(*value)}};
+    }
+  }
+  if (name.type == GEN_IPADD) {
+    if (auto value = getIpSubjectAltName(name.d.iPAddress)) {
+      return GeneralName{std::move(*value)};
+    }
+  }
+  return std::nullopt;
+}
+
 std::string getExtOid(X509_EXTENSION* extension) {
   CHECK_NOTNULL(extension);
   ASN1_OBJECT* object = X509_EXTENSION_get_object(extension);
@@ -113,34 +154,27 @@ Optional<std::string> OpenSSLCertUtils::getIssuerCommonName(const X509& x509) {
 
 std::vector<std::string> OpenSSLCertUtils::getSubjectAltNames(
     const X509& x509) {
-  auto names = reinterpret_cast<STACK_OF(GENERAL_NAME)*>(
-      X509_get_ext_d2i(&x509, NID_subject_alt_name, nullptr, nullptr));
-  if (!names) {
-    return {};
+  std::vector<std::string> result;
+  for (auto& name : getSubjectAltNameEntries(x509)) {
+    if (auto* dnsName = std::get_if<DnsName>(&name)) {
+      result.emplace_back(std::move(dnsName->value));
+    }
   }
-  SCOPE_EXIT {
-    sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free);
-  };
+  return result;
+}
 
-  std::vector<std::string> ret;
-  auto count = sk_GENERAL_NAME_num(names);
-  for (int i = 0; i < count; i++) {
-    auto genName = sk_GENERAL_NAME_value(names, i);
-    if (!genName || genName->type != GEN_DNS) {
-      continue;
-    }
-    auto nameData = reinterpret_cast<const char*>(
-        ASN1_STRING_get0_data(genName->d.dNSName));
-    auto nameLen = ASN1_STRING_length(genName->d.dNSName);
-    if (!nameData || nameLen <= 0) {
-      continue;
+std::vector<std::string> OpenSSLCertUtils::getSubjectAltNameURIs(
+    const X509& x509) {
+  std::vector<std::string> result;
+  for (auto& name : getSubjectAltNameEntries(x509)) {
+    if (auto* uriName = std::get_if<UriName>(&name)) {
+      result.emplace_back(std::move(uriName->value));
     }
-    ret.emplace_back(nameData, nameLen);
   }
-  return ret;
+  return result;
 }
 
-std::vector<std::string> OpenSSLCertUtils::getSubjectAltNameURIs(
+std::vector<GeneralName> OpenSSLCertUtils::getSubjectAltNameEntries(
     const X509& x509) {
   auto names = reinterpret_cast<STACK_OF(GENERAL_NAME)*>(
       X509_get_ext_d2i(&x509, NID_subject_alt_name, nullptr, nullptr));
@@ -152,22 +186,18 @@ std::vector<std::string> OpenSSLCertUtils::getSubjectAltNameURIs(
   };
 
   auto count = sk_GENERAL_NAME_num(names);
-  std::vector<std::string> ret;
-  ret.reserve(count);
+  std::vector<GeneralName> result;
+  result.reserve(count);
   for (int i = 0; i < count; i++) {
-    auto genName = sk_GENERAL_NAME_value(names, i);
-    if (!genName || genName->type != GEN_URI) {
+    auto name = sk_GENERAL_NAME_value(names, i);
+    if (!name) {
       continue;
     }
-    auto nameData = reinterpret_cast<const char*>(
-        ASN1_STRING_get0_data(genName->d.uniformResourceIdentifier));
-    auto nameLen = ASN1_STRING_length(genName->d.uniformResourceIdentifier);
-    if (!nameData || nameLen <= 0) {
-      continue;
+    if (auto value = getSubjectAltName(*name)) {
+      result.emplace_back(std::move(*value));
     }
-    ret.emplace_back(nameData, nameLen);
   }
-  return ret;
+  return result;
 }
 
 std::vector<std::string> OpenSSLCertUtils::getExtendedKeyUsage(

folly/ssl/OpenSSLCertUtils.h

@@ -20,8 +20,10 @@
 #include <map>
 #include <set>
 #include <string>
+#include <variant>
 #include <vector>
 
+#include <folly/IPAddress.h>
 #include <folly/Optional.h>
 #include <folly/io/IOBuf.h>
 #include <folly/portability/OpenSSL.h>
@@ -30,17 +32,33 @@
 namespace folly {
 namespace ssl {
 
+struct DnsName {
+  std::string value;
+};
+
+struct UriName {
+  std::string value;
+};
+
+using GeneralName = std::variant<DnsName, UriName, folly::IPAddress>;
+
 class OpenSSLCertUtils {
  public:
   // Note: non-const until OpenSSL 1.1.0
   static Optional<std::string> getCommonName(const X509& x509);
 
   static Optional<std::string> getIssuerCommonName(const X509& x509);
 
+  // Returns DNS name subjectAltName entries in certificate order.
   static std::vector<std::string> getSubjectAltNames(const X509& x509);
 
+  // Returns URI subjectAltName entries in certificate order.
   static std::vector<std::string> getSubjectAltNameURIs(const X509& x509);
 
+  // Returns DNS name, URI, and IP address subjectAltName entries in certificate
+  // order. Other GENERAL_NAME types are ignored.
+  static std::vector<GeneralName> getSubjectAltNameEntries(const X509& x509);
+
   /**
    * Return the Extended Key Usage (EKU) entries, if any, from the cert.
    * Each entry is a dotted-decimal OID string (e.g., "1.3.6.1.5.5.7.3.1").

folly/ssl/test/OpenSSLCertUtilsTest.cpp

@@ -540,6 +540,22 @@ const std::string kTestCertWithMixedSan = folly::stripLeftMargin(R"(
   -----END CERTIFICATE-----
 )");
 
+// SAN: IP:127.0.0.1, IP:::1, DNS:ip.example.com
+const std::string kTestCertWithIpSan = folly::stripLeftMargin(R"(
+  -----BEGIN CERTIFICATE-----
+  MIIBrzCCAVSgAwIBAgIUCnGvdtHLIk3xpNgOyIRJx8JFEoowCgYIKoZIzj0EAwIw
+  ETEPMA0GA1UEAwwGaXB0ZXN0MCAXDTI2MDcwMjIzMjgwOFoYDzIxMjYwNjA4MjMy
+  ODA4WjARMQ8wDQYDVQQDDAZpcHRlc3QwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNC
+  AASYSO4d5hqBVTBsRVT85pazOkjix2XnlXaRGgMsDq6Q/gs/LKX7zDBxD3Wo91iN
+  0Xgsis2JTbp760eB/xtMwz8Ao4GHMIGEMB0GA1UdDgQWBBTzBGjCCQTQfI5cYw/t
+  ZcetoJon6jAfBgNVHSMEGDAWgBTzBGjCCQTQfI5cYw/tZcetoJon6jAPBgNVHRMB
+  Af8EBTADAQH/MDEGA1UdEQQqMCiHBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAGCDmlw
+  LmV4YW1wbGUuY29tMAoGCCqGSM49BAMCA0kAMEYCIQC9OqMY3kvP2rXdb+4/uBMl
+  5hHEz75dsgQi2SxQR+VY2gIhAKD8qWAzXZPWGaW8Z6uxMZahv9VCYLEnMEvXzUoW
+  FyD/
+  -----END CERTIFICATE-----
+)");
+
 TEST_P(OpenSSLCertUtilsTest, TestX509UriSans) {
   auto x509 = readCertFromData(kTestCertWithUriSan);
   EXPECT_NE(x509, nullptr);
@@ -577,6 +593,27 @@ TEST_P(OpenSSLCertUtilsTest, TestX509MixedSans) {
   EXPECT_EQ(uriSans, expectedUris);
 }
 
+TEST_P(OpenSSLCertUtilsTest, TestX509SubjectAltNameEntriesWithIPs) {
+  auto x509 = readCertFromData(kTestCertWithIpSan);
+  EXPECT_NE(x509, nullptr);
+
+  std::vector<folly::IPAddress> ips;
+  std::vector<std::string> dnsNames;
+  for (const auto& name :
+       folly::ssl::OpenSSLCertUtils::getSubjectAltNameEntries(*x509)) {
+    if (const auto* ip = std::get_if<folly::IPAddress>(&name)) {
+      ips.emplace_back(*ip);
+    } else if (const auto* dns = std::get_if<folly::ssl::DnsName>(&name)) {
+      dnsNames.emplace_back(dns->value);
+    }
+  }
+
+  const std::vector<folly::IPAddress> expected{
+      folly::IPAddress("127.0.0.1"), folly::IPAddress("::1")};
+  EXPECT_EQ(ips, expected);
+  EXPECT_EQ(dnsNames, std::vector<std::string>{"ip.example.com"});
+}
+
 TEST_P(OpenSSLCertUtilsTest, TestX509NoUriSans) {
   auto x509 = readCertFromData(kTestCertWithSan);
   EXPECT_NE(x509, nullptr);