|
1 From dcd8c2a476eeebc29b36171bf52d6db4fa255a66 Mon Sep 17 00:00:00 2001 |
|
2 From: Daniel Stenberg <[email protected]> |
|
3 Date: Sun, 24 Apr 2016 17:52:18 +0200 |
|
4 Subject: [PATCH] mbedtls/polarssl: set "hostname" unconditionally |
|
5 |
|
6 ...as otherwise the TLS libs will skip the CN/SAN check and just allow |
|
7 connection to any server. curl previously skipped this function when SNI |
|
8 wasn't used or when connecting to an IP address specified host. |
|
9 |
|
10 CVE-2016-3739 |
|
11 |
|
12 Bug: https://curl.haxx.se/docs/adv_20160518A.html |
|
13 Reported-by: Moti Avrahami |
|
14 --- |
|
15 # This file is not delivered in 7.45.0, so comment it out. |
|
16 # lib/vtls/mbedtls.c | 13 ++++++------- |
|
17 # lib/vtls/polarssl.c | 15 +++++++-------- |
|
18 # 2 files changed, 13 insertions(+), 15 deletions(-) |
|
19 # |
|
20 #--- lib/vtls/mbedtls.c |
|
21 #+++ lib/vtls/mbedtls.c |
|
22 #@@ -389,17 +389,16 @@ mbed_connect_step1(struct connectdata *conn, |
|
23 # |
|
24 # if(data->set.str[STRING_KEY]) { |
|
25 # mbedtls_ssl_conf_own_cert(&connssl->config, |
|
26 # &connssl->clicert, &connssl->pk); |
|
27 # } |
|
28 #- if(!Curl_inet_pton(AF_INET, conn->host.name, &addr) && |
|
29 #-#ifdef ENABLE_IPV6 |
|
30 #- !Curl_inet_pton(AF_INET6, conn->host.name, &addr) && |
|
31 #-#endif |
|
32 #- sni && mbedtls_ssl_set_hostname(&connssl->ssl, conn->host.name)) { |
|
33 #- infof(data, "WARNING: failed to configure " |
|
34 #- "server name indication (SNI) TLS extension\n"); |
|
35 #+ if(mbedtls_ssl_set_hostname(&connssl->ssl, conn->host.name)) { |
|
36 #+ /* mbedtls_ssl_set_hostname() sets the name to use in CN/SAN checks *and* |
|
37 #+ the name to set in the SNI extension. So even if curl connects to a |
|
38 #+ host specified as an IP address, this function must be used. */ |
|
39 #+ failf(data, "couldn't set hostname in mbedTLS"); |
|
40 #+ return CURLE_SSL_CONNECT_ERROR; |
|
41 # } |
|
42 # |
|
43 # #ifdef HAS_ALPN |
|
44 # if(data->set.ssl_enable_alpn) { |
|
45 # const char **p = &connssl->protocols[0]; |
|
46 --- lib/vtls/polarssl.c |
|
47 +++ lib/vtls/polarssl.c |
|
48 @@ -3,11 +3,11 @@ |
|
49 * Project ___| | | | _ \| | |
|
50 * / __| | | | |_) | | |
|
51 * | (__| |_| | _ <| |___ |
|
52 * \___|\___/|_| \_\_____| |
|
53 * |
|
54 * Copyright (C) 2010 - 2011, Hoi-Ho Chan, <[email protected]> |
|
55 - * Copyright (C) 2012 - 2015, Daniel Stenberg, <[email protected]>, et al. |
|
56 + * Copyright (C) 2012 - 2016, Daniel Stenberg, <[email protected]>, et al. |
|
57 * |
|
58 * This software is licensed as described in the file COPYING, which |
|
59 * you should have received as part of this distribution. The terms |
|
60 * are also available at http://curl.haxx.se/docs/copyright.html. |
|
61 @@ -352,17 +352,16 @@ polarssl_connect_step1(struct connectdata *conn, |
|
62 conn->host.name); |
|
63 |
|
64 ssl_set_own_cert_rsa(&connssl->ssl, |
|
65 &connssl->clicert, &connssl->rsa); |
|
66 |
|
67 - if(!Curl_inet_pton(AF_INET, conn->host.name, &addr) && |
|
68 -#ifdef ENABLE_IPV6 |
|
69 - !Curl_inet_pton(AF_INET6, conn->host.name, &addr) && |
|
70 -#endif |
|
71 - sni && ssl_set_hostname(&connssl->ssl, conn->host.name)) { |
|
72 - infof(data, "WARNING: failed to configure " |
|
73 - "server name indication (SNI) TLS extension\n"); |
|
74 + if(ssl_set_hostname(&connssl->ssl, conn->host.name)) { |
|
75 + /* ssl_set_hostname() sets the name to use in CN/SAN checks *and* the name |
|
76 + to set in the SNI extension. So even if curl connects to a host |
|
77 + specified as an IP address, this function must be used. */ |
|
78 + failf(data, "couldn't set hostname in PolarSSL"); |
|
79 + return CURLE_SSL_CONNECT_ERROR; |
|
80 } |
|
81 |
|
82 #ifdef HAS_ALPN |
|
83 if(data->set.ssl_enable_alpn) { |
|
84 static const char* protocols[3]; |
|
85 -- |
|
86 2.8.1 |
|
87 |