5267ed859d
Daniel Stenberg
2026-08-25
Subject
openssl: no server cert is only okay if also not pinned
Binary
No binary (build failed)
Architecture & Compiler Flags
—
Build Log
(log yok)
Commit Diff GitHub →
lib/vtls/openssl.c+15 -11
| @@ -4592,21 +4592,24 @@ out: | |
| return result; | |
| } | |
| - | static CURLcode ossl_check_pinned_key(struct Curl_cfilter *cf, |
| - | struct Curl_easy *data, |
| - | X509 *server_cert) |
| + | static const char *pinned(struct Curl_cfilter *cf, |
| + | struct Curl_easy *data) |
| { | |
| - | const char *ptr; |
| - | CURLcode result = CURLE_OK; |
| - | |
| (void)cf; | |
| + | return |
| #ifndef CURL_DISABLE_PROXY | |
| - | ptr = Curl_ssl_cf_is_proxy(cf) ? |
| + | Curl_ssl_cf_is_proxy(cf) ? |
| CURL_EASY_STR(data, STRING_SSL_PINNEDPUBLICKEY_PROXY) : | |
| - | CURL_EASY_STR(data, STRING_SSL_PINNEDPUBLICKEY); |
| - | #else |
| - | ptr = CURL_EASY_STR(data, STRING_SSL_PINNEDPUBLICKEY); |
| #endif | |
| + | CURL_EASY_STR(data, STRING_SSL_PINNEDPUBLICKEY); |
| + | } |
| + | |
| + | static CURLcode ossl_check_pinned_key(struct Curl_cfilter *cf, |
| + | struct Curl_easy *data, |
| + | X509 *server_cert) |
| + | { |
| + | CURLcode result = CURLE_OK; |
| + | const char *ptr = pinned(cf, data); |
| if(ptr) { | |
| result = ossl_pkp_pin_peer_pubkey(data, server_cert, ptr); | |
| if(result) | |
| @@ -4795,7 +4798,8 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf, | |
| server_cert = SSL_get1_peer_certificate(octx->ssl); | |
| if(!server_cert) { | |
| /* no verification at all, this maybe acceptable */ | |
| - | if(!(conn_config->verifypeer || conn_config->verifyhost)) |
| + | if(!(conn_config->verifypeer || conn_config->verifyhost) && |
| + | !pinned(cf, data)) |
| goto out; | |
| failf(data, "SSL: could not get peer certificate"); | |