SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

journal-upload: also disable VERIFYHOST when --trust=all is used

Browse Source 
When --trust=all disables CURLOPT_SSL_VERIFYPEER, the residual
CURLOPT_SSL_VERIFYHOST check is ineffective since an attacker can
present a self-signed certificate with the expected hostname. Disable
both for consistency and log that server certificate verification is
disabled.

Follow-up for 8847551bcb
This commit is contained in:
Luca Boccassi
2026-04-13 22:11:50 +01:00
parent a9e9288288
commit f125fc6a22
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/journal-remote/journal-upload.c
+5 -2
View File
@@ -307,10 +307,13 @@ int start_upload(Uploader *u,
LOG_ERR, return -EXFULL);
}
if (STRPTR_IN_SET(arg_trust, "-", "all"))
if (STRPTR_IN_SET(arg_trust, "-", "all")) {
log_info("Server certificate verification disabled.");
easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L,
LOG_ERR, return -EUCLEAN);
else if (arg_trust || startswith(u->url, "https://"))
easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L,
LOG_ERR, return -EUCLEAN);
} else if (arg_trust || startswith(u->url, "https://"))
easy_setopt(curl, CURLOPT_CAINFO, arg_trust ?: TRUST_FILE,
LOG_ERR, return -EXFULL);