From 284e8f4421dffbf8354def5120b944f7b03d7759 Mon Sep 17 00:00:00 2001 From: Dmitry Podgorny Date: Sun, 10 Nov 2019 15:51:43 +0200 Subject: [PATCH] tls/openssl: check return code Check return code of SSL_CTX_set_default_verify_paths() and fail TLS on an error. However, ignore the error when XMPP_CONN_FLAG_TRUST_TLS is set. --- src/tls_openssl.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/src/tls_openssl.c b/src/tls_openssl.c index 841e34c..d948b32 100644 --- a/src/tls_openssl.c +++ b/src/tls_openssl.c @@ -136,7 +136,18 @@ tls_t *tls_new(xmpp_conn_t *conn) SSL_CTX_set_client_cert_cb(tls->ssl_ctx, NULL); SSL_CTX_set_mode(tls->ssl_ctx, SSL_MODE_ENABLE_PARTIAL_WRITE); - SSL_CTX_set_default_verify_paths(tls->ssl_ctx); + + ret = SSL_CTX_set_default_verify_paths(tls->ssl_ctx); + if (ret == 0 && !conn->tls_trust) { + /* + * Returns 1 on success and 0 on failure. A missing default + * location is still treated as a success. + * Ignore errors when XMPP_CONN_FLAG_TRUST_TLS is set. + */ + xmpp_error(tls->ctx, "tls", + "SSL_CTX_set_default_verify_paths() failed"); + goto err_free_ctx; + } tls->ssl = SSL_new(tls->ssl_ctx); if (tls->ssl == NULL)