sstp-client: unconditionally disables certificate validation
Open
Nobody has claimed this yet.
- Dominant language
- Makefile
- Stars
- 4.6k
- Forks
- 4k
- Avg merge
- 3d 12h
- Merged PRs (30d)
- 134
Description
Maintainer: @vgaetera @fededim
Environment: Any, for example, TP-Link Archer C7 v2 on OpenWrt 23.05.5
Description:
The sstp.sh protocol handler disables SSL certificate validation unconditionally by passing the --cert-warn option to sstpc. This is a security problem.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect the sstp.sh protocol handler and the sstpc invocation, focusing on the unconditional --cert-warn option described in the issue. Done means certificate validation is no longer disabled unconditionally; verify the resulting handler behavior on an OpenWrt environment or with the available sstpc command.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, shell
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100