generic-library/curl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

openssl: do public key pinning check independently

Browse Source 
... of the other cert verification checks so that you can set verifyhost
and verifypeer to FALSE and still check the public key.

Bug: http://curl.haxx.se/bug/view.cgi?id=1471
Reported-by: Kyle J. McKay
This commit is contained in:
Daniel Stenberg 2015-01-19 23:18:58 +01:00
parent fca58f6212
commit be57f689b0
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
lib/vtls/openssl.c
View File

@ -5,7 +5,7 @@
* | (__| |_| | _ <| |___ * | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____| * \___|\___/|_| \_\_____|
* *
* Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al. * Copyright (C) 1998 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
* *
* This software is licensed as described in the file COPYING, which * This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms * you should have received as part of this distribution. The terms
@ -2592,6 +2592,10 @@ static CURLcode servercert(struct connectdata *conn,
infof(data, "\t SSL certificate verify ok.\n"); infof(data, "\t SSL certificate verify ok.\n");
} }
if(!strict)
/* when not strict, we don't bother about the verify cert problems */
result = CURLE_OK;
ptr = data->set.str[STRING_SSL_PINNEDPUBLICKEY]; ptr = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
if(!result && ptr) { if(!result && ptr) {
result = pkp_pin_peer_pubkey(connssl->server_cert, ptr); result = pkp_pin_peer_pubkey(connssl->server_cert, ptr);
@ -2671,10 +2675,8 @@ static CURLcode ossl_connect_step3(struct connectdata *conn, int sockindex)
* operations. * operations.
*/ */
if(!data->set.ssl.verifypeer && !data->set.ssl.verifyhost) result = servercert(conn, connssl,
(void)servercert(conn, connssl, FALSE); (data->set.ssl.verifypeer || data->set.ssl.verifyhost));
else
result = servercert(conn, connssl, TRUE);
if(!result) if(!result)
connssl->connecting_state = ssl_connect_done; connssl->connecting_state = ssl_connect_done;