From dcd8c2a476eeebc29b36171bf52d6db4fa255a66 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <[email protected]>
Date: Sun, 24 Apr 2016 17:52:18 +0200
Subject: [PATCH] mbedtls/polarssl: set "hostname" unconditionally

...as otherwise the TLS libs will skip the CN/SAN check and just allow
connection to any server. curl previously skipped this function when SNI
wasn't used or when connecting to an IP address specified host.

CVE-2016-3739

Bug: https://curl.haxx.se/docs/adv_20160518A.html
Reported-by: Moti Avrahami
---
# This file is not delivered in 7.45.0, so comment it out.
# lib/vtls/mbedtls.c  | 13 ++++++-------
# lib/vtls/polarssl.c | 15 +++++++--------
# 2 files changed, 13 insertions(+), 15 deletions(-)
#
#--- lib/vtls/mbedtls.c
#+++ lib/vtls/mbedtls.c
#@@ -389,17 +389,16 @@ mbed_connect_step1(struct connectdata *conn,
# 
#   if(data->set.str[STRING_KEY]) {
#     mbedtls_ssl_conf_own_cert(&connssl->config,
#                               &connssl->clicert, &connssl->pk);
#   }
#-  if(!Curl_inet_pton(AF_INET, conn->host.name, &addr) &&
#-#ifdef ENABLE_IPV6
#-     !Curl_inet_pton(AF_INET6, conn->host.name, &addr) &&
#-#endif
#-     sni && mbedtls_ssl_set_hostname(&connssl->ssl, conn->host.name)) {
#-    infof(data, "WARNING: failed to configure "
#-          "server name indication (SNI) TLS extension\n");
#+  if(mbedtls_ssl_set_hostname(&connssl->ssl, conn->host.name)) {
#+    /* mbedtls_ssl_set_hostname() sets the name to use in CN/SAN checks *and*
#+       the name to set in the SNI extension. So even if curl connects to a
#+       host specified as an IP address, this function must be used. */
#+    failf(data, "couldn't set hostname in mbedTLS");
#+    return CURLE_SSL_CONNECT_ERROR;
#   }
# 
# #ifdef HAS_ALPN
#   if(data->set.ssl_enable_alpn) {
#     const char **p = &connssl->protocols[0];
--- lib/vtls/polarssl.c
+++ lib/vtls/polarssl.c
@@ -3,11 +3,11 @@
  *  Project                     ___| | | |  _ \| |
  *                             / __| | | | |_) | |
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
  * Copyright (C) 2010 - 2011, Hoi-Ho Chan, <[email protected]>
- * Copyright (C) 2012 - 2015, Daniel Stenberg, <[email protected]>, et al.
+ * Copyright (C) 2012 - 2016, Daniel Stenberg, <[email protected]>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
  * are also available at http://curl.haxx.se/docs/copyright.html.
@@ -352,17 +352,16 @@ polarssl_connect_step1(struct connectdata *conn,
                    conn->host.name);
 
   ssl_set_own_cert_rsa(&connssl->ssl,
                        &connssl->clicert, &connssl->rsa);
 
-  if(!Curl_inet_pton(AF_INET, conn->host.name, &addr) &&
-#ifdef ENABLE_IPV6
-     !Curl_inet_pton(AF_INET6, conn->host.name, &addr) &&
-#endif
-     sni && ssl_set_hostname(&connssl->ssl, conn->host.name)) {
-     infof(data, "WARNING: failed to configure "
-                 "server name indication (SNI) TLS extension\n");
+  if(ssl_set_hostname(&connssl->ssl, conn->host.name)) {
+    /* ssl_set_hostname() sets the name to use in CN/SAN checks *and* the name
+       to set in the SNI extension. So even if curl connects to a host
+       specified as an IP address, this function must be used. */
+    failf(data, "couldn't set hostname in PolarSSL");
+    return CURLE_SSL_CONNECT_ERROR;
   }
 
 #ifdef HAS_ALPN
   if(data->set.ssl_enable_alpn) {
     static const char* protocols[3];
-- 
2.8.1