Applied with some edits, thanks!
On Mon, May 28, 2018 at 12:33 AM, Jakub Jirutka <ja...@jirutka.cz> wrote: > Internal TLS code (FEATURE_WGET_HTTPS) does not implement verification > of the server's certificate. It is documented in the code, but not > even mentioned in the --help message, so users typically don't know > about this behaviour. That's a crime against security! > > This patch adds a warning message; before initializing a TLS connection > using the internal TLS code (i.e. without certificate verification) > warning message is printed, unless the user specified option > "--no-check-certificate" (and FEATURE_WGET_LONG_OPTIONS is enabled). > --- > networking/wget.c | 30 +++++++++++++++++++----------- > 1 file changed, 19 insertions(+), 11 deletions(-) > > diff --git a/networking/wget.c b/networking/wget.c > index 30c339244..0a53fe3a5 100644 > --- a/networking/wget.c > +++ b/networking/wget.c > @@ -136,18 +136,21 @@ > //usage:#define wget_full_usage "\n\n" > //usage: "Retrieve files via HTTP or FTP\n" > //usage: IF_FEATURE_WGET_LONG_OPTIONS( > -//usage: "\n --spider Only check URL existence: $? is 0 if > exists" > +//usage: "\n --spider Only check URL existence: $? > is 0 if exists" > +//usage: IF_FEATURE_WGET_HTTPS( > +//usage: "\n --no-check-certificate Don't validate the server's > certificate" > +//usage: ) > //usage: ) > -//usage: "\n -c Continue retrieval of aborted > transfer" > -//usage: "\n -q Quiet" > -//usage: "\n -P DIR Save to DIR (default .)" > -//usage: "\n -S Show server response" > +//usage: "\n -c Continue retrieval of aborted > transfer" > +//usage: "\n -q Quiet" > +//usage: "\n -P DIR Save to DIR (default .)" > +//usage: "\n -S Show server response" > //usage: IF_FEATURE_WGET_TIMEOUT( > -//usage: "\n -T SEC Network read timeout is SEC seconds" > +//usage: "\n -T SEC Network read timeout is SEC > seconds" > //usage: ) > -//usage: "\n -O FILE Save to FILE ('-' for stdout)" > -//usage: "\n -U STR Use STR for User-Agent header" > -//usage: "\n -Y on/off Use proxy" > +//usage: "\n -O FILE Save to FILE ('-' for stdout)" > +//usage: "\n -U STR Use STR for User-Agent header" > +//usage: "\n -Y on/off Use proxy" > > #include "libbb.h" > > @@ -271,6 +274,7 @@ enum { > WGET_OPT_HEADER = (1 << 10) * ENABLE_FEATURE_WGET_LONG_OPTIONS, > WGET_OPT_POST_DATA = (1 << 11) * ENABLE_FEATURE_WGET_LONG_OPTIONS, > WGET_OPT_SPIDER = (1 << 12) * ENABLE_FEATURE_WGET_LONG_OPTIONS, > + WGET_OPT_NO_CHECK_CERT = (1 << 13) * ENABLE_FEATURE_WGET_LONG_OPTIONS, > }; > > enum { > @@ -714,6 +718,11 @@ static void spawn_ssl_client(const char *host, int > network_fd, int flags) > int pid; > char *servername, *p; > > +#if ENABLE_FEATURE_WGET_LONG_OPTIONS > + if (!(option_mask32 & WGET_OPT_NO_CHECK_CERT)) > +#endif > + bb_error_msg("WARNING: SSL/TLS certificate is not being > validated!"); > + > servername = xstrdup(host); > p = strrchr(servername, ':'); > if (p) *p = '\0'; > @@ -1402,10 +1411,9 @@ IF_DESKTOP( "tries\0" > Required_argument "t") > "header\0" Required_argument "\xff" > "post-data\0" Required_argument "\xfe" > "spider\0" No_argument "\xfd" > + "no-check-certificate\0" No_argument "\xfc" > /* Ignored (we always use PASV): */ > IF_DESKTOP( "passive-ftp\0" No_argument "\xf0") > - /* Ignored (we don't do ssl) */ > -IF_DESKTOP( "no-check-certificate\0" No_argument "\xf0") > /* Ignored (we don't support caching) */ > IF_DESKTOP( "no-cache\0" No_argument "\xf0") > IF_DESKTOP( "no-verbose\0" No_argument "\xf0") > -- > 2.17.0 > > _______________________________________________ > busybox mailing list > busybox@busybox.net > http://lists.busybox.net/mailman/listinfo/busybox _______________________________________________ busybox mailing list busybox@busybox.net http://lists.busybox.net/mailman/listinfo/busybox