Created attachment 1800753 [details]
Proposed patch for xio-openssl.c

Description of problem:

Hello! I have came across of segfault related to the absence of check for peer name to be provided in the case of IPv6 communication in socat 1.7.4.1 (this was introduced 1.7.4.x branch).

The same check is present for IPv4 addresses, but was missed for v6 protocol.


Version-Release number of selected component (if applicable):
1.7.4.1


How reproducible:
100%, every time.


Steps to Reproduce:
1. Run listener as:
socat -d -d -u -b65536 -L /tmp/randfile1234 -T 300 openssl-listen:0,reuseaddr,pf=ip6,cert=/var/certs/server.pem -
2. Execute sender as:
echo "hello" | ./socat -u -b65536 -T 300 - openssl-connect:[IPv6]:[port],cn=[fqdn-of-the-listener],cert=/var/certs/server.pem,cafile=/var/certs/ca.pem,ipv6-tclass=36
3. Observe SIGSEGV on listening side:

2021/07/09 02:06:39 socat[3299863] E exiting on signal 11


Actual results:

Segfault at stack:

(gdb) bt
#0  0x000055555557ffc3 in xioip6_pton ()
#1  0x0000555555588369 in openssl_handle_peer_certificate ()
#2  0x0000555555588be0 in _xioopen_openssl_listen ()
#3  0x000055555558a305 in xioopen_openssl_listen ()
#4  0x0000555555570408 in xioopen_single ()
#5  0x00005555555705bb in xioopen ()
#6  0x000055555556f23a in socat ()
#7  0x000055555556beca in main ()
(gdb)

Caused by unchecked string passed in line 1780 of xio-openssl.c:

xioip6_pton(peername, &ip6bin);

peername is coming from the command line arguments on the listening side, so it should be like:

openssl-listen:0,reuseaddr,pf=ip6,cert=/cert.pem,cn=[sender], but if it's not passed (at least in case of IPv4/FQDN), it should be noop with peer name never checked and operation let to be continued.

Expected results:

The message is sent successfully. Verbose log line to contain:

2021/07/12 03:25:18 socat[1732687] N trusting certificate, no check of commonName

To indicate that the peername is indeed never checked. 


Additional info:

Attaching the proposal of patch to introduce the check for peername presence same same way it is done for IPv4 and FQDN branches.