Way to unset `X509_VERIFY_PARAM` fields

[daurnimator]

Currently there is no API to clear various members of a X509_VERIFY_PARAM e.g. an IP set with X509_VERIFY_PARAM_set1_ip

In my particular case, I have a SSL_CTX* that has an ip set, however I want to un-set it in a single one of the derived SSL* objects

Potential solutions:

• A flag (modifiable via X509_VERIFY_PARAM_set_flags) that allows to opt-out of a field
• X509_VERIFY_PARAM_set1_ip(param, NULL, 0) should clear the value

[daurnimator]

Anyone able to look at this? With the structure being opaque in 1.1.0 I can't hack around it at the project level.

[daurnimator]

Ping?

[richsalz]

Yes it's a bug caused by the opaque structure work. Someone will get around to it, or you can create a PR.

[daurnimator]

I can send a PR. Any preferences on the two solutions I mentioned in OP?

[mattcaswell]

The second option looks good to me.

[daurnimator]

So looking through the code again; X509_VERIFY_PARAM_set1_ip(param, NULL, 0) already works.
The issue is that if the ip is set to NULL, it doesn't get inherited when you use X509_VERIFY_PARAM_set1 e.g. via SSL_set1_param.

Now, you can get around that via setting X509_VP_FLAG_OVERWRITE. However that isn't granular on a per-field basis (which can be worked around).

Reviewing what I was trying to do from a higher level: I want to set the ip field, only if the existing ip and host fields are both unset; additionally I want to be able to set the host field, only if the existing ip and host fields are unset.

Perhaps the missing thing is getters? e.g. X509_VERIFY_PARAM_get_ip?

[mattcaswell]

Adding new getters still seems like a reasonable thing to want to add. So if that resolves your issue - then go for it (although perhaps it should be X509_VERIFY_PARAM_get0_ip or a get1 equivalent)?

[mattcaswell]

This impacts 1.1.0 too, so removing the 1.1.1 milestone.