Security: TLS client lacks hostname verification #161

New Issue

2026-07-29T18:35:45+02:00

TapTap commented

2026-07-29 18:35:45 +02:00

Description

client_connect_tls() in src/shared/transport_tls.c:134-161 enables certificate verification when a CA file is provided (SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL)), but it does not configure hostname verification. This means a client using --ca will accept any certificate signed by the CA, even if the certificate was issued for a different hostname, leaving it vulnerable to a man-in-the-middle attack with a valid but mis-issued certificate.

Location

src/shared/transport_tls.c:147-159 — SSL_new(), SSL_connect() called without setting the expected peer hostname.
src/shared/transport_tls.c:73-74 — SSL_VERIFY_PEER is set but hostname check is missing.

Suggested fix

Use SSL_set1_host(ssl, host) or X509_VERIFY_PARAM_set1_host() to verify that the certificate matches the server hostname provided via --server-host.
After SSL_connect(), optionally call SSL_get_verify_result() and confirm it is X509_V_OK.

Severity

Medium

Category

security

This issue was automatically generated by the issue-creator agent.

## Description `client_connect_tls()` in `src/shared/transport_tls.c:134-161` enables certificate verification when a CA file is provided (`SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL)`), but it does not configure hostname verification. This means a client using `--ca` will accept any certificate signed by the CA, even if the certificate was issued for a different hostname, leaving it vulnerable to a man-in-the-middle attack with a valid but mis-issued certificate. ## Location - `src/shared/transport_tls.c:147-159` — `SSL_new()`, `SSL_connect()` called without setting the expected peer hostname. - `src/shared/transport_tls.c:73-74` — `SSL_VERIFY_PEER` is set but hostname check is missing. ## Suggested fix 1. Use `SSL_set1_host(ssl, host)` or `X509_VERIFY_PARAM_set1_host()` to verify that the certificate matches the server hostname provided via `--server-host`. 2. After `SSL_connect()`, optionally call `SSL_get_verify_result()` and confirm it is `X509_V_OK`. ## Severity Medium ## Category security --- _This issue was automatically generated by the issue-creator agent._

TapTap added the security needs-triage labels 2026-07-29 18:35:45 +02:00

TapTap referenced this issue from a commit

2026-07-29 18:52:09 +02:00

fix: resolve all security issues (#154, #156, #157, #159, #160, #161, #162, #170)

TapTap referenced this issue

2026-07-29 18:52:26 +02:00

fix: resolve all security issues (#154, #156, #157, #159, #160, #161, #162, #170) #172

TapTap referenced this issue

2026-07-29 19:29:55 +02:00

Comprehensive fix: security, bugs, refactoring, tests, and rsync parity features #173

TapTap closed this issue

2026-07-30 18:17:31 +02:00