FS#3465 - libustream-wolfssl20200215 doesn't validate TLS server certificates #8526
Comments
|
ynezz: I can confirm this on 19.07 as well. It's not related to version bump from wolfssl 4.4.0 to 4.5.0 (latest stable release), I've tried to downgrade and the problem is same with the previous version as well, so the problem is probably somewhere in the libustream-wolfssl library itself. |
|
ynezz: I've just posted fixes for this issue:
The packages are available in my staging tree https://git.openwrt.org/?p=openwrt/staging/ynezz.git;a=shortlog;h=refs/heads/staging |
|
ynezz: Fixed in https://git.openwrt.org/ce1163dfa7a10c7a97cc3d236d21cea91e6bf24b and https://git.openwrt.org/23bbaa02a94ef51abbe6060f49b431eef49843f7, thanks for reporting it! |
|
hardfalcon: Thanks a lot for your fixes! Just tested them in the latest xrx200 snapshot image and they work perfectly. :) |
hardfalcon:
It appears that libustream-wolfssl20200215, which is used as the default TLS client implementation in current OpenWRT snapshot images, checks only if the CN or SAN in the server certificate matches the hostname, but not if the certificate was actually issue/signed by a trusted CA (thus making all other checks completely pointless) or if the certificate has expired.
On a device running the most recent OpenWRT snapshot image, all of the following three commands would be expected to fail with certificate errors, but they succeed without giving any error:
root@vr200v:/tmp# uclient-fetch -O - 'https://self-signed.badssl.com/'
root@vr200v:/tmp# uclient-fetch -O - 'https://untrusted-root.badssl.com/'
root@vr200v:/tmp# uclient-fetch -O - 'https://expired.badssl.com/'
Manually specifying the CA doesn't change the behavior, either:
root@vr200v:/tmp# uclient-fetch --ca-certificate=/rom/etc/ssl/certs/ca-certificates.crt -O - 'https://self-signed.badssl.com/'
root@vr200v:/tmp# uclient-fetch --ca-certificate=/tmp/ISRG_Root_X1.crt -O - 'https://self-signed.badssl.com/'
The text was updated successfully, but these errors were encountered: