1 files changed, 29 insertions, 0 deletions

diff --git a/src/nostr.cpp b/src/nostr.cpp
index 47f001c..fbae1a6 100644
--- a/src/nostr.cpp
+++ b/src/nostr.cpp
@@ -6,6 +6,7 @@
 #include "headers.h"
 #include <openssl/ssl.h>
 #include <openssl/err.h>
+#include <openssl/x509.h>
 // We link libsecp256k1 statically (without this the header assumes DLL import).
 // Both makefiles also pass -DSECP256K1_STATIC; the guard keeps that from
 // warning while leaving this file correct if built without the flag.
@@ -568,11 +569,39 @@ public:
         {
             sslctx = SSL_CTX_new(TLS_client_method());
             if (!sslctx) return false;
+
+            // SSL_CTX_new defaults to SSL_VERIFY_NONE with no trust store
+            // loaded, so until now every wss:// relay connection was accepted
+            // without looking at the certificate at all -- any on-path
+            // attacker could impersonate a relay. Our own events are signed,
+            // so a MITM cannot forge them, but it could drop the rendezvous
+            // registration (leaving the pool unreachable to miners) or answer
+            // subscriptions with whatever it liked.
+            if (!SSL_CTX_set_default_verify_paths(sslctx))
+                return error("Nostr: no system CA store available, refusing %s", host.c_str());
+            SSL_CTX_set_verify(sslctx, SSL_VERIFY_PEER, NULL);
+            SSL_CTX_set_min_proto_version(sslctx, TLS1_2_VERSION);
+
             ssl = SSL_new(sslctx);
+            if (!ssl) return false;
             SSL_set_fd(ssl, (int)hSocket);
             SSL_set_tlsext_host_name(ssl, host.c_str());  // SNI
+
+            // Verifying the chain is not enough on its own: without this the
+            // relay could present any certificate a trusted CA ever issued,
+            // for any name. SSL_set1_host binds the check to the host we asked
+            // for.
+            if (!SSL_set1_host(ssl, host.c_str()))
+                return error("Nostr: cannot pin verification to %s", host.c_str());
+
             if (SSL_connect(ssl) != 1)
+            {
+                long nVerify = SSL_get_verify_result(ssl);
+                if (nVerify != X509_V_OK)
+                    return error("Nostr: certificate for %s rejected: %s",
+                                 host.c_str(), X509_verify_cert_error_string(nVerify));
                 return error("Nostr: TLS handshake with %s failed", host.c_str());
+            }
         }
 
         // WebSocket handshake (HTTP Upgrade)