Security: TLS client does not verify server hostname #189

New Issue

2026-07-30T18:34:16+02:00

TapTap commented

2026-07-30 18:34:16 +02:00

Severity: medium
Category: security
Location: src/shared/transport_tls.c:134-161

Description:
client_connect_tls() sets up SSL verification when a CA is provided (SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL)), but it never calls SSL_set1_host() or SSL_set_verify() with hostname verification. An attacker with a valid certificate for evil.com (signed by the configured CA) can impersonate the intended server myserver.example.com.

Suggested fix:
After creating the SSL object and before SSL_connect(), set the expected hostname:

SSL_set1_host(ssl, host);
SSL_set_hostflags(ssl, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);

Verify the result with SSL_get_verify_result(ssl) after the handshake and check that hostname verification succeeded. Alternatively, call SSL_verify_client_post_handshake() semantics or inspect the peer certificate.

Labels: security, tls

**Severity:** medium **Category:** security **Location:** `src/shared/transport_tls.c:134-161` **Description:** `client_connect_tls()` sets up SSL verification when a CA is provided (`SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL)`), but it never calls `SSL_set1_host()` or `SSL_set_verify()` with hostname verification. An attacker with a valid certificate for `evil.com` (signed by the configured CA) can impersonate the intended server `myserver.example.com`. **Suggested fix:** After creating the SSL object and before `SSL_connect()`, set the expected hostname: ```c SSL_set1_host(ssl, host); SSL_set_hostflags(ssl, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS); ``` Verify the result with `SSL_get_verify_result(ssl)` after the handshake and check that hostname verification succeeded. Alternatively, call `SSL_verify_client_post_handshake()` semantics or inspect the peer certificate. **Labels:** security, tls

TapTap added the security needs-triage labels 2026-07-30 18:34:16 +02:00

TapTap referenced this issue from a commit

2026-07-30 18:49:31 +02:00

fix: security issues #192 #191 #190 #189 #188 #187

TapTap closed this issue

2026-07-30 19:38:27 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: TapTap/FastSync#189