mirrors/mumble
2
0
Fork 0
mirror of https://github.com/mumble-voip/mumble.git synced 2025-10-26 11:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

FIX(client): properly verify certificates when SRV records are used

Browse Source 
Previously, Mumble would always use the original hostname when verifying a server certificate. When the actual server hostname (resolved through an SRV record) differs from the original hostname, it should be used instead.

Fixes #3563
This commit is contained in:
fridtjof 2022-07-20 18:48:12 +02:00
parent ff3d0a6ec8
commit e6bb01dc85
3 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/ServerResolver.cpp
View File

@ -91,7 +91,7 @@ void ServerResolverPrivate::hostResolved(QHostInfo hostInfo) {
foreach (QHostAddress ha, resolvedAddresses) { addresses << HostAddress(ha); }
qint64 priority = normalizeSrvPriority(record.priority(), record.weight());
m_resolved << ServerResolverRecord(m_origHostname, record.port(), priority, addresses);
m_resolved << ServerResolverRecord(record.target(), record.port(), priority, addresses);
}
m_srvQueueRemain -= 1;

10
src/mumble/ServerHandler.cpp
View File

@ -359,10 +359,16 @@ void ServerHandler::hostnameResolved() {
// Create the list of target host:port pairs
// that the ServerHandler should try to connect to.
QList< ServerAddress > ql;
QHash< ServerAddress, QString > qh;
foreach (ServerResolverRecord record, records) {
foreach (HostAddress addr, record.addresses()) { ql.append(ServerAddress(addr, record.port())); }
foreach (HostAddress addr, record.addresses()) {
auto sa = ServerAddress(addr, record.port());
ql.append(sa);
qh[sa] = record.hostname();
}
}
qlAddresses = ql;
qhHostnames = qh;
// Exit the event loop with 'success' status code,
// to continue connecting to the server.
@ -392,7 +398,7 @@ void ServerHandler::run() {
qbaDigest = QByteArray();
bStrong = true;
qtsSock = new QSslSocket(this);
qtsSock->setPeerVerifyName(qsHostName);
qtsSock->setPeerVerifyName(qhHostnames[saTargetServer]);
if (!Global::get().s.bSuppressIdentity && CertWizard::validateCert(Global::get().s.kpCertificate)) {
qtsSock->setPrivateKey(Global::get().s.kpCertificate.second);

1
src/mumble/ServerHandler.h
View File

@ -105,6 +105,7 @@ public:
boost::shared_ptr< VoiceRecorder > recorder;
QSslSocket *qtsSock;
QList< ServerAddress > qlAddresses;
QHash< ServerAddress, QString > qhHostnames;
ServerAddress saTargetServer;
unsigned int uiVersion;