From: Timo Sirainen <tss@iki.fi>
Date: Tue, 6 Sep 2011 13:33:09 +0000 (+0300)
Subject: imapc: Verify that SSL certificate matches the connected hostname.
X-Git-Tag: 2.1.alpha2~67
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e1895a14356c2b321ea6289f4aedbcfed7140cce;p=thirdparty%2Fdovecot%2Fcore.git

imapc: Verify that SSL certificate matches the connected hostname.
---

diff --git a/src/lib-storage/index/imapc/imapc-connection.c b/src/lib-storage/index/imapc/imapc-connection.c
index f73229950c..a256f6abbb 100644
--- a/src/lib-storage/index/imapc/imapc-connection.c
+++ b/src/lib-storage/index/imapc/imapc-connection.c
@@ -966,20 +966,25 @@ static int imapc_connection_ssl_handshaked(void *context)
 {
 	struct imapc_connection *conn = context;
 
-	if (ssl_iostream_has_valid_client_cert(conn->ssl_iostream)) {
+	if (!ssl_iostream_has_valid_client_cert(conn->ssl_iostream)) {
+		if (!ssl_iostream_has_broken_client_cert(conn->ssl_iostream)) {
+			i_error("imapc(%s): SSL certificate not received",
+				conn->name);
+		} else {
+			i_error("imapc(%s): Received invalid SSL certificate",
+				conn->name);
+		}
+	} else if (ssl_iostream_cert_match_name(conn->ssl_iostream,
+						conn->client->set.host) < 0) {
+		i_error("imapc(%s): SSL certificate doesn't match host name",
+			conn->name);
+	} else {
 		if (conn->client->set.debug) {
 			i_debug("imapc(%s): SSL handshake successful",
 				conn->name);
 		}
 		return 0;
 	}
-
-	if (!ssl_iostream_has_broken_client_cert(conn->ssl_iostream)) {
-		i_error("imapc(%s): SSL certificate not received", conn->name);
-	} else {
-		i_error("imapc(%s): Received invalid SSL certificate",
-			conn->name);
-	}
 	i_stream_close(conn->input);
 	return -1;
 }