From 8d63a9060e66aa69c004934d5797a2a3098e9d0b Mon Sep 17 00:00:00 2001 From: Augustin Cavalier Date: Fri, 23 Aug 2019 17:50:28 -0400 Subject: [PATCH] BSecureSocket: Pass the hostname to the X509 layer to validate it. Now SSL certificates with the wrong hostname actually fail to validate. While I'm at it, remove the usage of BString and just check [0] directly. Spotted by a random commenter on Hacker News. --- src/kits/network/libnetapi/SecureSocket.cpp | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/src/kits/network/libnetapi/SecureSocket.cpp b/src/kits/network/libnetapi/SecureSocket.cpp index f1447963d2..99136c742b 100644 --- a/src/kits/network/libnetapi/SecureSocket.cpp +++ b/src/kits/network/libnetapi/SecureSocket.cpp @@ -589,13 +589,11 @@ BSecureSocket::_SetupCommon(const char* host) BIO_set_fd(fPrivate->fBIO, fSocket, BIO_NOCLOSE); SSL_set_bio(fPrivate->fSSL, fPrivate->fBIO, fPrivate->fBIO); SSL_set_ex_data(fPrivate->fSSL, Private::sDataIndex, this); - if (host != NULL) { - BString hostString = host; - if (hostString != "") - SSL_set_tlsext_host_name(fPrivate->fSSL, host); + if (host != NULL && host[0] != '\0') { + SSL_set_tlsext_host_name(fPrivate->fSSL, host); + X509_VERIFY_PARAM_set1_host(SSL_get0_param(fPrivate->fSSL), host, 0); } - return B_OK; }