From dbfa22fb4dea13fbc3006233c835d598bff12f81 Mon Sep 17 00:00:00 2001 From: iefa m Date: Mon, 2 Nov 2026 21:37:41 +0530 Subject: [PATCH] set_tls_verify_peer: use peer_info callback for relay cert verification The relay SSL_CTX was given verify_peer_identity(), which reads a struct connection_closure from SSL ex_data slot 1. Relay connections store a struct peer_info there instead (tls_ctx_client_setup() sets it to &relay_closure->relay_name), so verify_peer() read ->name and ->ipaddr past the end of the relay_closure and passed the result to validate_hostname(). Use tls_client.c's peer_info-based callback, now exported as tls_verify_peer(), for the relay context. --- logsrvd/logsrvd.c | 9 +++++++-- logsrvd/tls_client.c | 8 ++++---- logsrvd/tls_common.h | 1 + 3 files changed, 12 insertions(+), 6 deletions(-) diff --git a/logsrvd/logsrvd.c b/logsrvd/logsrvd.c index f5eba5dda8..12447b2d5b 100644 --- a/logsrvd/logsrvd.c +++ b/logsrvd/logsrvd.c @@ -1460,10 +1460,15 @@ set_tls_verify_peer(void) } } if (relay_ctx != NULL && logsrvd_conf_relay_tls_check_peer()) { - /* Verify relay cert during the handshake. */ + /* + * Verify relay cert during the handshake. The relay connection + * stores a struct peer_info in the SSL object (see tls_ctx_client_setup()) + * so we must use tls_verify_peer(), not the connection_closure-based + * verify_peer_identity() used for accepted client connections. + */ SSL_CTX_set_verify(relay_ctx, SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT, - verify_peer_identity); + tls_verify_peer); } debug_return; diff --git a/logsrvd/tls_client.c b/logsrvd/tls_client.c index 070552ad30..b80ec2cd03 100644 --- a/logsrvd/tls_client.c +++ b/logsrvd/tls_client.c @@ -52,15 +52,15 @@ * contains the server name or IP address. * Returns 0 if the cert is invalid, else 1. */ -static int -verify_peer_identity(int preverify_ok, X509_STORE_CTX *ctx) +int +tls_verify_peer(int preverify_ok, X509_STORE_CTX *ctx) { HostnameValidationResult result; struct peer_info *peer_info; SSL *ssl; X509 *current_cert; X509 *peer_cert; - debug_decl(verify_peer_identity, SUDO_DEBUG_UTIL); + debug_decl(tls_verify_peer, SUDO_DEBUG_UTIL); current_cert = X509_STORE_CTX_get_current_cert(ctx); @@ -252,7 +252,7 @@ tls_client_setup(int sock, const char *ca_bundle_file, const char *cert_file, /* Verify server cert during the handshake. */ SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT, - verify_peer_identity); + tls_verify_peer); } debug_return_bool(tls_ctx_client_setup(ssl_ctx, sock, closure)); diff --git a/logsrvd/tls_common.h b/logsrvd/tls_common.h index ec0a4b1a63..c82655eec8 100644 --- a/logsrvd/tls_common.h +++ b/logsrvd/tls_common.h @@ -42,6 +42,7 @@ struct tls_client_closure { }; /* tls_client.c */ +int tls_verify_peer(int preverify_ok, X509_STORE_CTX *ctx); void tls_connect_cb(int sock, int what, void *v); bool tls_client_setup(int sock, const char *ca_bundle_file, const char *cert_file, const char *key_file, const char *dhparam_file, const char *ciphers_v12, const char *ciphers_v13, bool verify_server, bool check_peer, struct tls_client_closure *closure); bool tls_ctx_client_setup(SSL_CTX *ssl_ctx, int sock, struct tls_client_closure *closure);