← Commit list

26fdb92c0a

Alhuda Khan
Alhuda Khan
2026-08-09
SUCCESS Duration: 423s

Subject

mbedtls: enforce verifyhost when verifypeer is disabled

Binary

No binary (build failed)

Architecture & Compiler Flags

Architecture: x86_64-linux-gnu Compiler: gcc (Ubuntu 11.4.0-1ubuntu1~22.04.3) 11.4.0

—

Build Log

(log yok)

Commit Diff GitHub →

lib/vtls/mbedtls.c +4 -2tests/data/Makefile.am +1 -0tests/data/test2118 +43 -0tests/libtest/Makefile.inc +1 -1tests/libtest/lib2118.c +60 -0
lib/vtls/mbedtls.c+4 -2
@@ -453,9 +453,11 @@ static int mbed_verify_cb(void *ptr, mbedtls_x509_crt *crt,
mbed_extract_certinfo(data, crt);
}
+ /* `verifypeer` and `verifyhost` are independent, so clear the flags of a
+ disabled check only. The name mismatch belongs to `verifyhost`. */
if(!conn_config->verifypeer)
- *flags = 0;
- else if(!conn_config->verifyhost)
+ *flags &= MBEDTLS_X509_BADCERT_CN_MISMATCH;
+ if(!conn_config->verifyhost)
*flags &= ~MBEDTLS_X509_BADCERT_CN_MISMATCH;
if(*flags) {
tests/data/Makefile.am+1 -0
@@ -255,6 +255,7 @@ test2080 test2081 test2082 test2083 test2084 test2085 test2086 test2087 \
test2088 test2089 test2090 test2091 test2092 test2093 test2094 \
test2100 test2101 test2102 test2103 test2104 test2105 test2106 test2107 \
test2108 test2109 test2110 test2113 test2114 test2115 test2116 test2117 \
+test2118 \
\
test2200 test2201 test2202 test2203 test2204 test2205 test2206 test2207 \
test2208 \
tests/data/test2118+43 -0
@@ -0,0 +1,43 @@
+<?xml version="1.0" encoding="US-ASCII"?>
+<testcase>
+<info>
+<keywords>
+HTTPS
+HTTP GET
+PEM certificate
+</keywords>
+</info>
+
+# Server-side
+<reply>
+</reply>
+
+# Client-side
+<client>
+<features>
+SSL
+local-http
+!wolfssl
+!rustls
+</features>
+<server>
+https test-localhost.nn.pem
+</server>
+<tool>
+lib%TESTNUMBER
+</tool>
+<name>
+VERIFYHOST with VERIFYPEER disabled rejects a mismatching certificate
+</name>
+<command>
+https://localhost:%HTTPSPORT/%TESTNUMBER
+</command>
+</client>
+
+# Verify data after the test has been "shot"
+<verify>
+<errorcode>
+60
+</errorcode>
+</verify>
+</testcase>
tests/libtest/Makefile.inc+1 -1
@@ -117,7 +117,7 @@ TESTS_C = \
lib1955.c lib1956.c lib1957.c lib1958.c lib1959.c lib1960.c \
lib1964.c lib1965.c lib1967.c lib1970.c \
lib1971.c lib1972.c lib1973.c lib1974.c lib1975.c lib1977.c lib1978.c \
- lib2023.c lib2032.c lib2082.c \
+ lib2023.c lib2032.c lib2082.c lib2118.c \
lib2301.c lib2302.c lib2304.c lib2306.c lib2308.c lib2309.c \
lib2402.c lib2404.c lib2405.c \
lib2412.c lib2414.c \
tests/libtest/lib2118.c+60 -0
@@ -0,0 +1,60 @@
+/***************************************************************************
+ * _ _ ____ _
+ * Project ___| | | | _ \| |
+ * / __| | | | |_) | |
+ * | (__| |_| | _ <| |___
+ * \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <[email protected]>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "first.h"
+
+/* CURLOPT_SSL_VERIFYHOST is independent of CURLOPT_SSL_VERIFYPEER, so a
+ certificate issued for another name must be rejected even when the peer is
+ not verified. The server presents a certificate for "localhost.nn". */
+
+static CURLcode test_lib2118(const char *URL)
+{
+ CURLcode result;
+ CURL *curl;
+
+ if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
+ curl_mfprintf(stderr, "curl_global_init() failed\n");
+ return TEST_ERR_MAJOR_BAD;
+ }
+
+ curl = curl_easy_init();
+ if(!curl) {
+ curl_mfprintf(stderr, "curl_easy_init() failed\n");
+ curl_global_cleanup();
+ return TEST_ERR_MAJOR_BAD;
+ }
+
+ easy_setopt(curl, CURLOPT_URL, URL);
+ easy_setopt(curl, CURLOPT_VERBOSE, 1L);
+ easy_setopt(curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4);
+ easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
+ easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 1L);
+
+ result = curl_easy_perform(curl);
+
+test_cleanup:
+ curl_easy_cleanup(curl);
+ curl_global_cleanup();
+
+ return result;
+}