kernel
/
git
mirror of https://git.kernel.org/pub/scm/git/git.git
1
0
Fork 0
Code Releases Activity

imap-send: explicitly verify the peer certificate 

It is a bug to obtain the peer certificate without verifying it.

Having said that, from my reading of
https://www.openssl.org/docs/man1.1.1/man3/SSL_set_verify.html, it would
appear that Git is saved by the fact that it calls
`SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, NULL)` already early on.

In other words, that `SSL_VERIFY_PEER` combined with the `NULL`
parameter (i.e. no overridden callback) would _already_ verify the peer
certificate.  The fact that we later call `SSL_get_peer_certificate()`
is mistaken by CodeQL to mean that that peer certificate still needs to
be verified, but that had already happened at that point.

Nevertheless, it is better to verify the peer certificate explicitly
than to rely on some side effect that is really hard to reason about
(and that took me more than one business day to analyze fully). It also
makes it easier for static analyzers to validate the correctness of the
code.

Signed-off-by: Johannes Schindelin <johannes.schindelin@gmx.de>
Signed-off-by: Junio C Hamano <gitster@pobox.com>
main
Johannes Schindelin 2025-03-24 12:28:02 +00:00 committed by Junio C Hamano
parent 683c54c999
commit fa8cd29676
1 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
imap-send.c
View File

@ -324,6 +324,8 @@ static int ssl_socket_connect(struct imap_socket *sock,
cert = SSL_get_peer_certificate(sock->ssl); cert = SSL_get_peer_certificate(sock->ssl);
if (!cert) if (!cert)
return error("unable to get peer certificate."); return error("unable to get peer certificate.");
if (SSL_get_verify_result(sock->ssl) != X509_V_OK)
return error("unable to verify peer certificate");
if (verify_hostname(cert, cfg->host) < 0) if (verify_hostname(cert, cfg->host) < 0)
return -1; return -1;
} }