Changeset 5452:934a802dff7f

Timestamp:

2008-07-10 23:47:01 (3 months ago)

Author:

Rocco Rutte <pdmef@…>

Branch:

HEAD

Message:

Verify hostname in (Open)SSL certificate validation

This is based on the patch by gkloepfer attached to #3087 but passes the
proper connection as argument (avoiding adding hostname to struct
sslsockdata) and validates the hostname even in case OpenSSL cannot find
the local issuer certificate. GnuTLS already supports hostname
checking. Closes #3087.

Files:

• mutt_ssl.c (modified) (9 diffs)

mutt_ssl.c

@@ -75 +75 @@
 static int ssl_socket_close (CONNECTION * conn);
 static int tls_close (CONNECTION* conn);
-static int ssl_check_certificate (sslsockdata * data);
+static int ssl_check_certificate (CONNECTION *conn, sslsockdata * data);
 static void ssl_get_client_cert(sslsockdata *ssldata, CONNECTION *conn);
 static int ssl_passwd_cb(char *buf, int size, int rwflag, void *userdata);
-static int ssl_negotiate (sslsockdata*);
+static int ssl_negotiate (CONNECTION *conn, sslsockdata*);
 
 /* mutt_ssl_starttls: Negotiate TLS over an already opened connection.
@@ -112 +112 @@
   }
 
-  if (ssl_negotiate (ssldata))
+  if (ssl_negotiate (conn, ssldata))
     goto bail_ssl;
 
@@ -291 +291 @@
   SSL_set_fd (data->ssl, conn->fd);
 
-  if (ssl_negotiate(data))
+  if (ssl_negotiate(conn, data))
   {
     mutt_socket_close (conn);
@@ -305 +305 @@
 /* ssl_negotiate: After SSL state has been initialised, attempt to negotiate
  *   SSL over the wire, including certificate checks. */
-static int ssl_negotiate (sslsockdata* ssldata)
+static int ssl_negotiate (CONNECTION *conn, sslsockdata* ssldata)
 {
   int err;
@@ -344 +344 @@
   }
 
-  if (!ssl_check_certificate (ssldata))
+  if (!ssl_check_certificate (conn, ssldata))
     return -1;
 
@@ -589 +589 @@
 }
 
-static int ssl_check_certificate (sslsockdata * data)
+static int check_certificate_hostname(X509 *peercert, const char *host)
+{
+  char cert_CN[STRING];
+
+  if (!host || !*host)
+    return 0;
+
+  X509_NAME_get_text_by_NID (X509_get_subject_name (peercert),
+                             NID_commonName, cert_CN, sizeof (cert_CN));
+
+  dprint (2, (debugfile, "check_certificate_hostname: cert=[%s] host=[%s]\n",
+              cert_CN, host));
+
+  return strcmp (cert_CN, host) == 0;
+}
+
+static int ssl_check_certificate (CONNECTION *conn, sslsockdata * data)
 {
   char *part[] =
@@ -596 +612 @@
   char buf[SHORT_STRING];
   MUTTMENU *menu;
-  int done, row, i;
+  int done, row, i, certerr_hostname = 0;
   FILE *fp;
   char *name = NULL, *c;
@@ -607 +623 @@
   }
 
-  if (check_certificate_by_signer (data->cert))
+  if (check_certificate_hostname (data->cert, conn->account.host))
+  {
+    dprint (1, (debugfile, "ssl_check_certificate: hostname check passed\n"));
+  }
+  else
+    certerr_hostname = 1;
+
+  if (!certerr_hostname && check_certificate_by_signer (data->cert))
   {
     dprint (1, (debugfile, "ssl_check_certificate: signer check passed\n"));
@@ -614 +637 @@
 
   /* automatic check from user's database */
-  if (SslCertFile && check_certificate_by_digest (data->cert))
+  if (!certerr_hostname && SslCertFile && check_certificate_by_digest (data->cert))
   {
     dprint (1, (debugfile, "ssl_check_certificate: digest check passed\n"));