Goal

This is used to get the cert chain to perform the cert intent validation, which means there's basically no performance cost to adding this validation.

Why

The scope of the certificate intent validation will include all certificates in the chain of trust, except for the trust anchor. In order to ensure that the trust anchor and any extraneous certificates are omitted from the validation, the chain of trust constructed by the libcrypto will be used as the source of the certificates to validate.

Currently, we get the constructed chain of trust from the X509_STORE_CTX_get1_chain() API. This API is inefficient because it allocates a new X509 stack and copies all of the certificates from the internal X509_STORE_CTX stack to it. On the other hand, the X509_STORE_CTX_get0_chain() API is more efficient, since it returns a pointer to the internal X509_STORE_CTX stack. However, this API is not available in OpenSSL 1.0.2.

Since the cert intent validation will be performed every time s2n-tls validates a certificate chain, it'd be better to use the more efficient API whenever it's available.

How

1. Create a feature flag to detect if the X509_STORE_CTX_get0_chain() API is available.
2. Define a struct s2n_validated_cert_chain to store the pointer to the validated cert chain.
3. Implement a getter s2n_x509_validator_get_validated_cert_chain() that calls the get0_chain API when it's available, but falls back to using the get1_chain API for OpenSSL 1.0.2.
4. For the extra allocation/copy of the get1_chain API, we need to invoke an OpenSSL API to free up the memory.
5. Replace all the instances of get1_chain with s2n_x509_validator_get_validated_cert_chain().

Testing

This change does not affect existing behaviors. CI should pass.

I also added a unit test for this getter to make sure the freeing is properly implemented.

-- feature S2N_LIBCRYPTO_SUPPORTS_GET0_CHAIN: TRUE

...

Test #274: s2n_x509_get_validated_cert_chain_test ...........   Passed    0.03 sec

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.