romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 15:53:39 +03:00
Code Issues Projects Releases Packages Wiki Activity

mbedtls: enforce verifyhost when verifypeer is disabled

Browse source 
Verify in test 2118

Closes #22475
This commit is contained in:
Alhuda Khan 2026-08-03 20:51:52 +05:30 • committed by Daniel Stenberg
parent 1ea07d6e0a
commit 26fdb92c0a
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
5 changed files with 109 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib/vtls/mbedtls.c
View file

@ -453,9 +453,11 @@ static int mbed_verify_cb(void *ptr, mbedtls_x509_crt *crt,
mbed_extract_certinfo(data, crt);
}
/* `verifypeer` and `verifyhost` are independent, so clear the flags of a
disabled check only. The name mismatch belongs to `verifyhost`. */
if(!conn_config->verifypeer)
*flags = 0;
else if(!conn_config->verifyhost)
*flags &= MBEDTLS_X509_BADCERT_CN_MISMATCH;
if(!conn_config->verifyhost)
*flags &= ~MBEDTLS_X509_BADCERT_CN_MISMATCH;
if(*flags) {