Repository: pyca/cryptography

Issue:
Failing X509_VERIFY_PARAM_set_hostflags with openssl-1.0.2-b2
```
x86_64-pc-linux-gnu-gcc -march=barcelona -mtune=barcelona -O2 -pipe -fPIC -I/usr/include/python3.3 -c cryptography/hazmat/bindings/__pycache__/_Cryptography_cffi_4f32d02dx3a8a382.c -o /var/tmp/portage/dev-python/cryptography-0.5.3/work/cryptography-0.5.3/cryptography/hazmat/bindings/__pycache__/cryptography/hazmat/bindings/__pycache__/_Cryptography_cffi_4f32d02dx3a8a382.o
cryptography/hazmat/bindings/__pycache__/_Cryptography_cffi_4f32d02dx3a8a382.c:2045:8: error: ‘X509_VERIFY_PARAM_set_hostflags’ redeclared as different kind of symbol
 void (*X509_VERIFY_PARAM_set_hostflags)(X509_VERIFY_PARAM *,
        ^
In file included from /usr/include/openssl/x509.h:601:0,
                 from /usr/include/openssl/cms.h:58,
                 from cryptography/hazmat/bindings/__pycache__/_Cryptography_cffi_4f32d02dx3a8a382.c:217:
/usr/include/openssl/x509_vfy.h:565:6: note: previous declaration of ‘X509_VERIFY_PARAM_set_hostflags’ was here
 void X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM *param,
      ^
Traceback (most recent call last):
  File "/usr/lib64/python3.3/distutils/unixccompiler.py", line 126, in _compile
    extra_postargs)
  File "/usr/lib64/python3.3/distutils/ccompiler.py", line 909, in spawn
    spawn(cmd, dry_run=self.dry_run)
  File "/usr/lib64/python3.3/distutils/spawn.py", line 32, in spawn
    _spawn_posix(cmd, search_path, dry_run=dry_run)
  File "/usr/lib64/python3.3/distutils/spawn.py", line 163, in _spawn_posix
    % (cmd[0], exit_status))
distutils.errors.DistutilsExecError: command 'x86_64-pc-linux-gnu-gcc' failed with exit status 1
```

As reported here: https://bugs.gentoo.org/show_bug.cgi?id=519508.



Discussion:
I'm actually a little confused how that code ever worked, I'm pretty sure `#ifdef` does not work in the manner that it seems to assume.

@lvh Can you explain why this `#define` was used? https://github.com/pyca/cryptography/pull/1144/files#diff-4cb58295ca24023049bfb38850131c47R91

I am guessing that we can move this method into the main 1.0.2 group now that it has actual beta releases?

I'd guess it appeared to work because it never took the true branch and we were testing on beta 1 (and actually I need to upgrade the builder to beta 2 still).


Resolving patch:
diff --git a/cryptography/hazmat/bindings/openssl/x509_vfy.py b/cryptography/hazmat/bindings/openssl/x509_vfy.py
--- a/cryptography/hazmat/bindings/openssl/x509_vfy.py
+++ b/cryptography/hazmat/bindings/openssl/x509_vfy.py
@@ -27,7 +27,6 @@
 """
 
 TYPES = """
-static const long Cryptography_HAS_X509_VERIFY_PARAM_SET_HOSTFLAGS;
 static const long Cryptography_HAS_102_VERIFICATION_ERROR_CODES;
 static const long Cryptography_HAS_102_VERIFICATION_PARAMS;
 static const long Cryptography_HAS_X509_V_FLAG_TRUSTED_FIRST;
@@ -186,10 +185,10 @@
                               Cryptography_STACK_OF_X509_CRL *);
 
 /* X509_VERIFY_PARAM */
-int X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM *, const unsigned char *,
+int X509_VERIFY_PARAM_set1_host(X509_VERIFY_PARAM *, const char *,
                                 size_t);
 void X509_VERIFY_PARAM_set_hostflags(X509_VERIFY_PARAM *, unsigned int);
-int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *, const unsigned char *,
+int X509_VERIFY_PARAM_set1_email(X509_VERIFY_PARAM *, const char *,
                                  size_t);
 int X509_VERIFY_PARAM_set1_ip(X509_VERIFY_PARAM *, const unsigned char *,
                               size_t);
@@ -197,15 +196,6 @@
 """
 
 CUSTOMIZATIONS = """
-/* OpenSSL 1.0.2+, but only some very new releases */
-#ifdef X509_VERIFY_PARAM_set_hostflags
-static const long Cryptography_HAS_X509_VERIFY_PARAM_SET_HOSTFLAGS = 1;
-#else
-static const long Cryptography_HAS_X509_VERIFY_PARAM_SET_HOSTFLAGS = 0;
-void (*X509_VERIFY_PARAM_set_hostflags)(X509_VERIFY_PARAM *,
-                                        unsigned int) = NULL;
-#endif
-
 /* OpenSSL 1.0.2+ verification error codes */
 #if OPENSSL_VERSION_NUMBER >= 0x10002000L
 static const long Cryptography_HAS_102_VERIFICATION_ERROR_CODES = 1;
@@ -234,13 +224,15 @@
 static const long X509_V_FLAG_SUITEB_128_LOS = 0;
 static const long X509_V_FLAG_PARTIAL_CHAIN = 0;
 
-int (*X509_VERIFY_PARAM_set1_host)(X509_VERIFY_PARAM *, const unsigned char *,
+int (*X509_VERIFY_PARAM_set1_host)(X509_VERIFY_PARAM *, const char *,
                                    size_t) = NULL;
-int (*X509_VERIFY_PARAM_set1_email)(X509_VERIFY_PARAM *, const unsigned char *,
+int (*X509_VERIFY_PARAM_set1_email)(X509_VERIFY_PARAM *, const char *,
                                     size_t) = NULL;
 int (*X509_VERIFY_PARAM_set1_ip)(X509_VERIFY_PARAM *, const unsigned char *,
                                  size_t) = NULL;
 int (*X509_VERIFY_PARAM_set1_ip_asc)(X509_VERIFY_PARAM *, const char *) = NULL;
+void (*X509_VERIFY_PARAM_set_hostflags)(X509_VERIFY_PARAM *,
+                                        unsigned int) = NULL;
 #endif
 
 /* OpenSSL 1.0.2+, *or* Fedora 20's flavor of OpenSSL 1.0.1e... */
@@ -286,9 +278,6 @@
 """
 
 CONDITIONAL_NAMES = {
-    "Cryptography_HAS_X509_VERIFY_PARAM_SET_HOSTFLAGS": [
-        "X509_VERIFY_PARAM_set_hostflags",
-    ],
     "Cryptography_HAS_102_VERIFICATION_ERROR_CODES": [
         'X509_V_ERR_SUITE_B_INVALID_VERSION',
         'X509_V_ERR_SUITE_B_INVALID_ALGORITHM',
@@ -310,6 +299,7 @@
         "X509_VERIFY_PARAM_set1_email",
         "X509_VERIFY_PARAM_set1_ip",
         "X509_VERIFY_PARAM_set1_ip_asc",
+        "X509_VERIFY_PARAM_set_hostflags",
     ],
     "Cryptography_HAS_X509_V_FLAG_TRUSTED_FIRST": [
         "X509_V_FLAG_TRUSTED_FIRST",


Test patch: