From 26fdb92c0a48337a9f696b79a8922e504243a823 Mon Sep 17 00:00:00 2001 From: Alhuda Khan Date: Mon, 3 Aug 2026 20:51:52 +0530 Subject: [PATCH] mbedtls: enforce verifyhost when verifypeer is disabled Verify in test 2118 Closes #22475 --- lib/vtls/mbedtls.c | 6 ++-- tests/data/Makefile.am | 1 + tests/data/test2118 | 43 +++++++++++++++++++++++++++ tests/libtest/Makefile.inc | 2 +- tests/libtest/lib2118.c | 60 ++++++++++++++++++++++++++++++++++++++ 5 files changed, 109 insertions(+), 3 deletions(-) create mode 100644 tests/data/test2118 create mode 100644 tests/libtest/lib2118.c diff --git a/lib/vtls/mbedtls.c b/lib/vtls/mbedtls.c index f0d2f80230..664d1f97a2 100644 --- a/lib/vtls/mbedtls.c +++ b/lib/vtls/mbedtls.c @@ -453,9 +453,11 @@ static int mbed_verify_cb(void *ptr, mbedtls_x509_crt *crt, mbed_extract_certinfo(data, crt); } + /* `verifypeer` and `verifyhost` are independent, so clear the flags of a + disabled check only. The name mismatch belongs to `verifyhost`. */ if(!conn_config->verifypeer) - *flags = 0; - else if(!conn_config->verifyhost) + *flags &= MBEDTLS_X509_BADCERT_CN_MISMATCH; + if(!conn_config->verifyhost) *flags &= ~MBEDTLS_X509_BADCERT_CN_MISMATCH; if(*flags) { diff --git a/tests/data/Makefile.am b/tests/data/Makefile.am index 4993864a5a..43adb28741 100644 --- a/tests/data/Makefile.am +++ b/tests/data/Makefile.am @@ -255,6 +255,7 @@ test2080 test2081 test2082 test2083 test2084 test2085 test2086 test2087 \ test2088 test2089 test2090 test2091 test2092 test2093 test2094 \ test2100 test2101 test2102 test2103 test2104 test2105 test2106 test2107 \ test2108 test2109 test2110 test2113 test2114 test2115 test2116 test2117 \ +test2118 \ \ test2200 test2201 test2202 test2203 test2204 test2205 test2206 test2207 \ test2208 \ diff --git a/tests/data/test2118 b/tests/data/test2118 new file mode 100644 index 0000000000..a3a18e7501 --- /dev/null +++ b/tests/data/test2118 @@ -0,0 +1,43 @@ + + + + +HTTPS +HTTP GET +PEM certificate + + + +# Server-side + + + +# Client-side + + +SSL +local-http +!wolfssl +!rustls + + +https test-localhost.nn.pem + + +lib%TESTNUMBER + + +VERIFYHOST with VERIFYPEER disabled rejects a mismatching certificate + + +https://localhost:%HTTPSPORT/%TESTNUMBER + + + +# Verify data after the test has been "shot" + + +60 + + + diff --git a/tests/libtest/Makefile.inc b/tests/libtest/Makefile.inc index 0787bfc911..6311fe0b53 100644 --- a/tests/libtest/Makefile.inc +++ b/tests/libtest/Makefile.inc @@ -117,7 +117,7 @@ TESTS_C = \ lib1955.c lib1956.c lib1957.c lib1958.c lib1959.c lib1960.c \ lib1964.c lib1965.c lib1967.c lib1970.c \ lib1971.c lib1972.c lib1973.c lib1974.c lib1975.c lib1977.c lib1978.c \ - lib2023.c lib2032.c lib2082.c \ + lib2023.c lib2032.c lib2082.c lib2118.c \ lib2301.c lib2302.c lib2304.c lib2306.c lib2308.c lib2309.c \ lib2402.c lib2404.c lib2405.c \ lib2412.c lib2414.c \ diff --git a/tests/libtest/lib2118.c b/tests/libtest/lib2118.c new file mode 100644 index 0000000000..052ade0159 --- /dev/null +++ b/tests/libtest/lib2118.c @@ -0,0 +1,60 @@ +/*************************************************************************** + * _ _ ____ _ + * Project ___| | | | _ \| | + * / __| | | | |_) | | + * | (__| |_| | _ <| |___ + * \___|\___/|_| \_\_____| + * + * Copyright (C) Daniel Stenberg, , et al. + * + * This software is licensed as described in the file COPYING, which + * you should have received as part of this distribution. The terms + * are also available at https://curl.se/docs/copyright.html. + * + * You may opt to use, copy, modify, merge, publish, distribute and/or sell + * copies of the Software, and permit persons to whom the Software is + * furnished to do so, under the terms of the COPYING file. + * + * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY + * KIND, either express or implied. + * + * SPDX-License-Identifier: curl + * + ***************************************************************************/ +#include "first.h" + +/* CURLOPT_SSL_VERIFYHOST is independent of CURLOPT_SSL_VERIFYPEER, so a + certificate issued for another name must be rejected even when the peer is + not verified. The server presents a certificate for "localhost.nn". */ + +static CURLcode test_lib2118(const char *URL) +{ + CURLcode result; + CURL *curl; + + if(curl_global_init(CURL_GLOBAL_ALL) != CURLE_OK) { + curl_mfprintf(stderr, "curl_global_init() failed\n"); + return TEST_ERR_MAJOR_BAD; + } + + curl = curl_easy_init(); + if(!curl) { + curl_mfprintf(stderr, "curl_easy_init() failed\n"); + curl_global_cleanup(); + return TEST_ERR_MAJOR_BAD; + } + + easy_setopt(curl, CURLOPT_URL, URL); + easy_setopt(curl, CURLOPT_VERBOSE, 1L); + easy_setopt(curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4); + easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L); + easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 1L); + + result = curl_easy_perform(curl); + +test_cleanup: + curl_easy_cleanup(curl); + curl_global_cleanup(); + + return result; +}