mbedtls: Fix pinned key return value on fail. draft1 #601
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Switch from verifying a pinned public key in a callback to right after the certificate verification.
|
This works for me. And it fixes the problem with checking the cert after resumption and makes it possible to disable verifypeer by also using certificate pinning. I tested it since it was created in my binary and had no issues with it. |
- A copy of the const peercert must be made in order to pass a non-const public key to mbedtls_pk_write_pubkey_der. FAIL: Currently this runs but all pinned key verification fails. I have yet to debug it.
|
Before this goes in it must be fixed so that the input for |
- More correct cleanup pattern for the copy of peer cert *p. - Add some descriptive error messages where appropriate. - Change name ret => result to eliminate variable shadowing warning. - Remove comment about no peer cert on session resume, since that's not true of mbedTLS (the comment was carried over from PolarSSL code). - Allocate cert info buffer on heap instead of stack. Prior to these changes: In draft 2 the code worked fine, however I marked it as 'FAIL' because all my tests failed due to what I later realized was just a copy&paste error on my part: I hadn't enabled curlssl_sha256sum even though I was running the sha256// tests.
jay
force-pushed
the
fix_mbedtls_pinned_key
branch
from
727d7ff
to
5972e52
Compare
jay
added a commit
that referenced
this pull request
Jan 18, 2016
- Switch from verifying a pinned public key in a callback during the certificate verification to inline after the certificate verification. The callback method had three problems: 1. If a pinned public key didn't match, CURLE_SSL_PINNEDPUBKEYNOTMATCH was not returned. 2. If peer certificate verification was disabled the pinned key verification did not take place as it should. 3. (related to #2) If there was no certificate of depth 0 the callback would not have checked the pinned public key. Though all those problems could have been fixed it would have made the code more complex. Instead we now verify inline after the certificate verification in mbedtls_connect_step2. Ref: http://curl.haxx.se/mail/lib-2016-01/0047.html Ref: #601
|
@sithglan This landed in d58ba66, thanks for your help. All the SSLpinning tests pass now. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
the certificate verification.