From 6efd2fa529a189bf41736a610f6184cd8ad94b4d Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Sun, 24 Apr 2016 17:52:18 +0200 Subject: mbedtls/polarssl: set "hostname" unconditionally ...as otherwise the TLS libs will skip the CN/SAN check and just allow connection to any server. curl previously skipped this function when SNI wasn't used or when connecting to an IP address specified host. CVE-2016-3739 Bug: https://curl.haxx.se/docs/adv_20160518A.html Reported-by: Moti Avrahami --- lib/vtls/mbedtls.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) (limited to 'lib/vtls/mbedtls.c') diff --git a/lib/vtls/mbedtls.c b/lib/vtls/mbedtls.c index f0048ef49..6fc7214ac 100644 --- a/lib/vtls/mbedtls.c +++ b/lib/vtls/mbedtls.c @@ -391,13 +391,12 @@ mbed_connect_step1(struct connectdata *conn, mbedtls_ssl_conf_own_cert(&connssl->config, &connssl->clicert, &connssl->pk); } - if(!Curl_inet_pton(AF_INET, conn->host.name, &addr) && -#ifdef ENABLE_IPV6 - !Curl_inet_pton(AF_INET6, conn->host.name, &addr) && -#endif - sni && mbedtls_ssl_set_hostname(&connssl->ssl, conn->host.name)) { - infof(data, "WARNING: failed to configure " - "server name indication (SNI) TLS extension\n"); + if(mbedtls_ssl_set_hostname(&connssl->ssl, conn->host.name)) { + /* mbedtls_ssl_set_hostname() sets the name to use in CN/SAN checks *and* + the name to set in the SNI extension. So even if curl connects to a + host specified as an IP address, this function must be used. */ + failf(data, "couldn't set hostname in mbedTLS"); + return CURLE_SSL_CONNECT_ERROR; } #ifdef HAS_ALPN -- cgit v1.2.3