romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 11:53:36 +03:00
Code Issues Projects Releases Packages Wiki Activity

mbedtls: enforce verifyhost when verifypeer is disabled

Browse source 
Verify in test 2118

Closes #22475
This commit is contained in:
Alhuda Khan 2026-08-03 20:51:52 +05:30 • committed by Daniel Stenberg
parent 1ea07d6e0a
commit 26fdb92c0a
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
5 changed files with 109 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib/vtls/mbedtls.c
View file

@ -453,9 +453,11 @@ static int mbed_verify_cb(void *ptr, mbedtls_x509_crt *crt,
mbed_extract_certinfo(data, crt);
}
/* `verifypeer` and `verifyhost` are independent, so clear the flags of a
disabled check only. The name mismatch belongs to `verifyhost`. */
if(!conn_config->verifypeer)
*flags = 0;
else if(!conn_config->verifyhost)
*flags &= MBEDTLS_X509_BADCERT_CN_MISMATCH;
if(!conn_config->verifyhost)
*flags &= ~MBEDTLS_X509_BADCERT_CN_MISMATCH;
if(*flags) {

1
tests/data/Makefile.am
View file

@ -255,6 +255,7 @@ test2080 test2081 test2082 test2083 test2084 test2085 test2086 test2087 \
test2088 test2089 test2090 test2091 test2092 test2093 test2094 \
test2100 test2101 test2102 test2103 test2104 test2105 test2106 test2107 \
test2108 test2109 test2110 test2113 test2114 test2115 test2116 test2117 \
test2118 \
\
test2200 test2201 test2202 test2203 test2204 test2205 test2206 test2207 \
test2208 \

43
tests/data/test2118 Normal file
View file

@ -0,0 +1,43 @@
<?xml version="1.0" encoding="US-ASCII"?>
<testcase>
<info>
<keywords>
HTTPS
HTTP GET
PEM certificate
</keywords>
</info>
# Server-side
<reply>
</reply>
# Client-side
<client>
<features>
SSL
local-http
!wolfssl
!rustls
</features>
<server>
https test-localhost.nn.pem
</server>
<tool>
lib%TESTNUMBER
</tool>
<name>
VERIFYHOST with VERIFYPEER disabled rejects a mismatching certificate
</name>
<command>
https://localhost:%HTTPSPORT/%TESTNUMBER
</command>
</client>
# Verify data after the test has been "shot"
<verify>
<errorcode>
60
</errorcode>
</verify>
</testcase>

2
tests/libtest/Makefile.inc
View file

@ -117,7 +117,7 @@ TESTS_C = \
lib1955.c lib1956.c lib1957.c lib1958.c lib1959.c lib1960.c \
lib1964.c lib1965.c lib1967.c lib1970.c \
lib1971.c lib1972.c lib1973.c lib1974.c lib1975.c lib1977.c lib1978.c \
lib2023.c lib2032.c lib2082.c \
lib2023.c lib2032.c lib2082.c lib2118.c \
lib2301.c lib2302.c lib2304.c lib2306.c lib2308.c lib2309.c \
lib2402.c lib2404.c lib2405.c \
lib2412.c lib2414.c \

60
tests/libtest/lib2118.c Normal file
View file

@ -0,0 +1,60 @@
/***************************************************************************
* _ _ ____ _
* Project ___| | | | _ \| |
* / __| | | | |_) | |
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
* are also available at https://curl.se/docs/copyright.html.
*
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
* copies of the Software, and permit persons to whom the Software is
* furnished to do so, under the terms of the COPYING file.
*
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
* KIND, either express or implied.
*
* SPDX-License-Identifier: curl
*
***************************************************************************/
#include "first.h"
/* CURLOPT_SSL_VERIFYHOST is independent of CURLOPT_SSL_VERIFYPEER, so a
certificate issued for another name must be rejected even when the peer is
not verified. The server presents a certificate for "localhost.nn". */
static CURLcode test_lib2118(const char *URL)
{
CURLcode result;
CURL *curl;
if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) {
curl_mfprintf(stderr, "curl_global_init() failed\n");
return TEST_ERR_MAJOR_BAD;
}
curl = curl_easy_init();
if(!curl) {
curl_mfprintf(stderr, "curl_easy_init() failed\n");
curl_global_cleanup();
return TEST_ERR_MAJOR_BAD;
}
easy_setopt(curl, CURLOPT_URL, URL);
easy_setopt(curl, CURLOPT_VERBOSE, 1L);
easy_setopt(curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4);
easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 1L);
result = curl_easy_perform(curl);
test_cleanup:
curl_easy_cleanup(curl);
curl_global_cleanup();
return result;
}