From 92d006a41b6afa1b38d0835f3bdaca42ccc6f89b Mon Sep 17 00:00:00 2001 From: Alexander Krotov Date: Fri, 23 Jun 2017 13:38:46 +0300 Subject: [PATCH] Disable hostname verification for pre-1.0.2 OpenSSL --- src/tls_openssl.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/tls_openssl.c b/src/tls_openssl.c index f96a890..c1476ca 100644 --- a/src/tls_openssl.c +++ b/src/tls_openssl.c @@ -24,6 +24,7 @@ #include #include +#include #include #include "common.h" @@ -93,6 +94,7 @@ tls_t *tls_new(xmpp_conn_t *conn) if (tls->ssl == NULL) goto err_free_ctx; +#if OPENSSL_VERSION_NUMBER >= 0x10002000L SSL_set_verify(tls->ssl, SSL_VERIFY_PEER, 0); X509_VERIFY_PARAM *param = SSL_get0_param(tls->ssl); @@ -104,6 +106,10 @@ tls_t *tls_new(xmpp_conn_t *conn) */ X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS); X509_VERIFY_PARAM_set1_host(param, conn->domain, 0); +#else + /* Hostname verification is not supported before OpenSSL 1.0.2. */ + SSL_set_verify(tls->ssl, SSL_VERIFY_NONE, 0); +#endif ret = SSL_set_fd(tls->ssl, conn->sock); if (ret <= 0)