ustream-mbedtls: fix certificate verification
authorPetr Štetiar <ynezz@true.cz>
Thu, 10 Dec 2020 13:51:25 +0000 (14:51 +0100)
committerPetr Štetiar <ynezz@true.cz>
Thu, 10 Dec 2020 14:18:35 +0000 (15:18 +0100)
commitcee6791b362a1b778b6e0630433052bd819943f1
tree173cb656323bc5a8ec51a6afed8b97e90e2edf99
parent55c3fd89d50805b7bdd5bcee3a43986f983f20db
ustream-mbedtls: fix certificate verification

Fixes certificate verification if no CA certificates are available, it's
visible when you run:

 $ uclient-fetch https://www.openwrt.org

(so no explicit certificate is given) and have *not* installed
`ca-certificates` or `ca-bundle` package, mbed TLS obviously can't do
verification since no root certificates are available.  But then it
simply ignores the issue and continues SSL handshake without warning.

Further, if you run it like:

 $ uclient-fetch --ca-certificate=/dev/null https://www.openwrt.org

ustream-mbedtls also does not do verification at all (gives no warning
either).

References: https://lists.infradead.org/pipermail/openwrt-devel/2018-August/019183.html
Suggested-by: Paul Wassi <p.wassi@gmx.at>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
ustream-mbedtls.c