diff options
| author |   bcook <bcook@openbsd.org> | 2014-12-07 15:00:32 +0000 |
|---|---|---|
| committer | bcook <bcook@openbsd.org> | 2014-12-07 15:00:32 +0000 |
| commit | 31569e865c65f39e40418e8235056535ee32e422 (patch) | |
| tree | 8fab3a4cf5403dba3935c74f84231df9b9b8c4c7 /lib/libtls/tls_client.c | |
| parent | Handle GF(2^m) EC curves for C code generation. (diff) | |
| download | wireguard-openbsd-31569e865c65f39e40418e8235056535ee32e422.tar.xz wireguard-openbsd-31569e865c65f39e40418e8235056535ee32e422.zip | |
Allow specific libtls hostname validation errors to propagate.
Remove direct calls to printf from the tls_check_hostname() path. This allows
NUL byte error messages to bubble up to the caller, to be logged in a
program-appropriate way. It also removes non-portable calls to getprogname().
The semantics of tls_error() are changed slightly: the last error message is
not necessarily preserved between subsequent calls into the library.
When the previous call to libtls succeeds, client programs should treat the
return value of tls_error() as undefined.
ok tedu@
Diffstat (limited to 'lib/libtls/tls_client.c')
| -rw-r--r-- | lib/libtls/tls_client.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/lib/libtls/tls_client.c b/lib/libtls/tls_client.c index a4528b9b873..c5849a6897c 100644 --- a/lib/libtls/tls_client.c +++ b/lib/libtls/tls_client.c @@ -1,4 +1,4 @@ -/* $OpenBSD: tls_client.c,v 1.2 2014/11/02 14:45:05 jsing Exp $ */ +/* $OpenBSD: tls_client.c,v 1.3 2014/12/07 15:00:32 bcook Exp $ */ /* * Copyright (c) 2014 Joel Sing <jsing@openbsd.org> * @@ -209,9 +209,11 @@ tls_connect_fds(struct tls *ctx, int fd_read, int fd_write, tls_set_error(ctx, "no server certificate"); goto err; } - if (tls_check_hostname(cert, hostname) != 0) { - tls_set_error(ctx, "host `%s' not present in" - " server certificate", hostname); + tls_clear_error(ctx); + if (tls_check_hostname(ctx, cert, hostname) != 0) { + if (tls_error(ctx) == NULL) + tls_set_error(ctx, "host `%s' not present in" + " server certificate", hostname); goto err; } } |