romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 14:23:30 +03:00
Code Issues Projects Releases Packages Wiki Activity

pytest tls: extend coverage

Browse source 
Add possibility to reload QUIC test server with another certificate. Add
tests for more coverage of handshakes.

Closes #17382
This commit is contained in:
Stefan Eissing 2025-05-17 12:19:01 +02:00 • committed by Daniel Stenberg
parent dd22442e3b
commit a85f1df480
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
7 changed files with 87 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

14
lib/vquic/vquic-tls.c
View file

@ -179,15 +179,13 @@ CURLcode Curl_vquic_tls_verify_peer(struct curl_tls_ctx *ctx,
#elif defined(USE_WOLFSSL)
(void)data;
if(conn_config->verifyhost) {
if(peer->sni) {
WOLFSSL_X509* cert = wolfSSL_get_peer_certificate(ctx->wssl.ssl);
if(wolfSSL_X509_check_host(cert, peer->sni, strlen(peer->sni), 0, NULL)
== WOLFSSL_FAILURE) {
result = CURLE_PEER_FAILED_VERIFICATION;
}
wolfSSL_X509_free(cert);
char *snihost = peer->sni ? peer->sni : peer->hostname;
WOLFSSL_X509* cert = wolfSSL_get_peer_certificate(ctx->wssl.ssl);
if(wolfSSL_X509_check_host(cert, snihost, strlen(snihost), 0, NULL)
== WOLFSSL_FAILURE) {
result = CURLE_PEER_FAILED_VERIFICATION;
}
wolfSSL_X509_free(cert);
}
#endif
/* on error, remove any session we might have in the pool */