imapc: Verify that SSL certificate matches the connected hostname.

diff --git a/src/lib-storage/index/imapc/imapc-connection.c b/src/lib-storage/index/imapc/imapc-connection.c
index f73229950ca70334264a20b4172865560a75e893..a256f6abbb50d7d2d2adc7c4b92be58e27b9dcac 100644 (file)
--- a/src/lib-storage/index/imapc/imapc-connection.c
+++ b/src/lib-storage/index/imapc/imapc-connection.c
@@ -966,20 +966,25 @@ static int imapc_connection_ssl_handshaked(void *context)
 {
        struct imapc_connection *conn = context;
 
-       if (ssl_iostream_has_valid_client_cert(conn->ssl_iostream)) {
+       if (!ssl_iostream_has_valid_client_cert(conn->ssl_iostream)) {
+               if (!ssl_iostream_has_broken_client_cert(conn->ssl_iostream)) {
+                       i_error("imapc(%s): SSL certificate not received",
+                               conn->name);
+               } else {
+                       i_error("imapc(%s): Received invalid SSL certificate",
+                               conn->name);
+               }
+       } else if (ssl_iostream_cert_match_name(conn->ssl_iostream,
+                                               conn->client->set.host) < 0) {
+               i_error("imapc(%s): SSL certificate doesn't match host name",
+                       conn->name);
+       } else {
                if (conn->client->set.debug) {
                        i_debug("imapc(%s): SSL handshake successful",
                                conn->name);
                }
                return 0;
        }
-
-       if (!ssl_iostream_has_broken_client_cert(conn->ssl_iostream)) {
-               i_error("imapc(%s): SSL certificate not received", conn->name);
-       } else {
-               i_error("imapc(%s): Received invalid SSL certificate",
-                       conn->name);
-       }
        i_stream_close(conn->input);
        return -1;
 }