Purpose of mbedtls_ssl_set_hostname() ?

[bagder]

This function is documented as:

Set hostname for ServerName TLS extension (client-side only) 

... which sounds like it is used for SNI (only) ?

But if that is so, how do I tell mbedtls which host name we connect to, to use when verifying the server certificate? Isn't it so that this function is used to for that purpose as well? Shouldn't that then be documented? If not, how do I set it?

If this function is used for both, how do I set only the host name to verify the cert with, without setting the SNI name to the same?

[ciarmcom]

ARM Internal Ref: IOTSSL-716

[bagder]

It might not have been immediately obvious in my first description, but there's a security problem angle to this that we could take off the public eye until worked out.

[jcowgill]

The documentation isn't very clear, but that function does set the CN used to verify the server's certificate as well. If you just want to verify the server's certificate and not use SNI for some reason, you have to do it manually (eg using mbedtls_ssl_conf_verify) or disable SNI at compile time.

[bagder]

If I connect to an IP address and not a host name, I still need to set the IP address as the "host name" for the CN/SAN comparison's sake (to make it fail the cert test), even though it isn't a valid SNI name and not actually a host name. Yes that is confusing...

[jcowgill]

Hmm I forgot about IP addresses. mbedTLS sending them as ServerNames is probably a bug (along with the documentation clarity).

[simonbutcher]

Hi @bagder,

First, in general, if you have a security concern, please feel free to contact us through the mbed TLS website here, after which we can exchange emails and discuss any issue. Open forums aren't necessarily the best place to discuss security issues as we may not want all details to be public until we have a resolution.

Next, concerning your issue with mbedtls_ssl_set_hostname(), I will agree the documentation isn't clear and needs improvement, both for this function and also for our implementation of SNI generally, and because of that, I think unfortunately you may have jumped to the wrong conclusion on how SNI works for mbed TLS.

I will translate this issue internally into a 'Fix the SNI documentation' JIRA ticket, and we'll try and address this soon with a knowledge base entry. (We only track issues in github which can be fixed by the community, so I won't change this ticket into a documentation issue).

The function mbedtls_ssl_set_hostname() is used to define the ServerName extension used for SNI, but not as the address to use to establish the connection. For that, we use the different function mbedtls_net_connect(), where you can specify a different IP address or hostname.

Have a look at the sample client code here.

If I've missed something and you see a security issue, please contact me through the link above. I think I've answered your question as well as I can without better documentation, so I will close the issue now, but if you still have a concern, please reply or again, contact us on the link above.

[jcowgill]

This isn't about the hostname used for network connections, it is about there being two uses for the mbedtls_ssl_set_hostname function which clash if used with an IP addresses:

• Setting the hostname used for the ServerName TLS extension.
• Setting the CN used to verify server certificates.

Unless I have missed something, if you want to connect to a server with a certificate issued to an IP address you either:

• Don't call mbedtls_ssl_set_hostname and then verify the CN manually.
• Call mbedtls_ssl_set_hostname to get mbedTLS to do it, but this will violate the standards which prohibit using IP addresses in the ServerName extension.

[bagder]

@jcowgill is exactly right. So I would just beg of you that after you make the functionality clarified in the docs, you consider providing a more standard compliant way in the future, as doing our own CN/SAN verification is quite a steep step from using an API call. Thanks for your help!

[simonbutcher]

@bagder Sorry, I obviously misunderstood what you meant by connect, but I'm afraid we don't yet support certificates issued to IP addresses. This is something that's coming, but not quite available yet and involves API changes which I don't believe suffer from this problem. However, I don't want to get into code that we haven't merged yet, so am I missing something else here?

[bagder]

If we connect to a host specified as an IP address, we must still use mbedtls_ssl_set_hostname (despite the name and the documentation not making it very obvious) - since otherwise the CN/SAN check is simply skipped. (or as you say implement the check ourselves) Setting the host name is required to have mbedTLS check the cert and since it is an IP address, fail the verification.

My issue is mostly about mbedTLS silently accepting the cert if we don't set the "host name".