incomplete SSL certificate verify

[Ruan Linqi]

Hi developers:
    We made a large scale security static analysis on several open source projects, and found some mistakes in tnftp-20130505. In the @src/ssl.c:555:
    void * fetch_start_ssl(int sock)
{
 [...]
 ctx = SSL_CTX_new(SSLv23_client_method());
 SSL_CTX_set_mode(ctx, SSL_MODE_AUTO_RETRY);
 ssl = SSL_new(ctx);
 if (ssl == NULL){
  fprintf(ttyout, "SSL context creation failed\n");
  SSL_CTX_free(ctx);
  return NULL;
 }
 SSL_set_fd(ssl, sock);
 while ((ret = SSL_connect(ssl)) == -1)
        [...]
 cert = SSL_get_peer_certificate(ssl);
 [...]
}

  We find that you use SSL_get_peer_certificate() to get the cert and verify some properties of it.But it still can lead to MITM attack. To guarantee the security,we recommand you add the judgement if(SSL_get_verify_result(ssl)==X509_V_OK) to make sure validation succeeds.

[Bastian Germann (bastian-germann)]

tnftp 20230409's ChangeLog has "Support SSL certificate validation by default."