From dcd8c2a476eeebc29b36171bf52d6db4fa255a66 Mon Sep 17 00:00:00 2001
From: Daniel Stenberg <daniel@haxx.se>
Date: Sun, 24 Apr 2016 17:52:18 +0200
Subject: [PATCH] mbedtls/polarssl: set "hostname" unconditionally
connection to any server. curl previously skipped this function when SNI
wasn't used or when connecting to an IP address specified host.
CVE-2016-3739
Reported-by: Moti Avrahami
---
# This file is not delivered in 7.45.0, so comment it out.
# lib/vtls/mbedtls.c | 13 ++++++-------
# lib/vtls/polarssl.c | 15 +++++++--------
# 2 files changed, 13 insertions(+), 15 deletions(-)
#
#--- lib/vtls/mbedtls.c
#+++ lib/vtls/mbedtls.c
#@@ -389,17 +389,16 @@ mbed_connect_step1(struct connectdata *conn,
#
# if(data->set.str[STRING_KEY]) {
# mbedtls_ssl_conf_own_cert(&connssl->config,
# &connssl->clicert, &connssl->pk);
# }
#- if(!Curl_inet_pton(AF_INET, conn->host.name, &addr) &&
#-#ifdef ENABLE_IPV6
#- !Curl_inet_pton(AF_INET6, conn->host.name, &addr) &&
#-#endif
#- sni && mbedtls_ssl_set_hostname(&connssl->ssl, conn->host.name)) {
#- infof(data, "WARNING: failed to configure "
#- "server name indication (SNI) TLS extension\n");
#+ if(mbedtls_ssl_set_hostname(&connssl->ssl, conn->host.name)) {
#+ /* mbedtls_ssl_set_hostname() sets the name to use in CN/SAN checks *and*
#+ the name to set in the SNI extension. So even if curl connects to a
#+ host specified as an IP address, this function must be used. */
#+ failf(data, "couldn't set hostname in mbedTLS");
#+ return CURLE_SSL_CONNECT_ERROR;
# }
#
# #ifdef HAS_ALPN
# if(data->set.ssl_enable_alpn) {
# const char **p = &connssl->protocols[0];
@@ -3,11 +3,11 @@
* Project ___| | | | _ \| |
* / __| | | | |_) | |
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) 2010 - 2011, Hoi-Ho Chan, <hoiho.chan@gmail.com>
- * Copyright (C) 2012 - 2015, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 2012 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
* are also available at http://curl.haxx.se/docs/copyright.html.
@@ -352,17 +352,16 @@ polarssl_connect_step1(struct connectdata *conn,
conn->host.name);
ssl_set_own_cert_rsa(&connssl->ssl,
&connssl->clicert, &connssl->rsa);
- if(!Curl_inet_pton(AF_INET, conn->host.name, &addr) &&
-#ifdef ENABLE_IPV6
- !Curl_inet_pton(AF_INET6, conn->host.name, &addr) &&
-#endif
- sni && ssl_set_hostname(&connssl->ssl, conn->host.name)) {
- infof(data, "WARNING: failed to configure "
- "server name indication (SNI) TLS extension\n");
+ if(ssl_set_hostname(&connssl->ssl, conn->host.name)) {
+ /* ssl_set_hostname() sets the name to use in CN/SAN checks *and* the name
+ to set in the SNI extension. So even if curl connects to a host
+ specified as an IP address, this function must be used. */
+ failf(data, "couldn't set hostname in PolarSSL");
+ return CURLE_SSL_CONNECT_ERROR;
}
#ifdef HAS_ALPN
if(data->set.ssl_enable_alpn) {
static const char* protocols[3];
--
2.8.1