mirror of
https://github.com/yhirose/cpp-httplib.git
synced 2026-08-11 04:41:23 +00:00
19333f80d4
The stricter ws::Result error checks added in6018c7fand86d0210exposed two backend-parity bugs in setup_client_tls_session(), shared by SSLClient and WebSocketClient since their TLS setup was merged: - enable_server_hostname_verification(false) had no effect on Mbed TLS or wolfSSL for DNS hosts: mbedtls_ssl_set_hostname() and wolfSSL_check_domain_name() bind SNI and handshake-time identity checking together, so the identity check ran regardless of the option, failing the handshake before the post-handshake server_hostname_verification check was ever reached. - On a genuine wrong-hostname failure, Mbed TLS reported the generic Error::SSLServerVerification instead of Error::SSLServerHostnameVerification, because MBEDTLS_ERR_X509_CERT_VERIFY_FAILED was mapped without looking at which verify flag actually caused it. Fixes: - set_sni() now takes a verify_hostname flag. wolfSSL skips wolfSSL_check_domain_name() when it's false. Mbed TLS can't request SNI without also arming the CN/SAN check, so it installs a verify callback that masks the mismatch flag instead - a self-contained one when the session has no user verify callback of its own, so it never reads the process-wide set_verify_callback() slot another client may have populated (this was caught by ASAN as a stack-use-after-scope: VerifyCallbackTest.VerifyContextFields leaves a dangling lambda there because MbedTlsSession never had a reason to consult it before). - map_mbedtls_error() now takes the handshake's verify flags and reports HostnameMismatch when CN/SAN mismatch is the only one set, matching the wolfSSL mapping and the post-handshake identity check. - The duplicated verify-flags/error-mapping/backend_code logic in connect() and connect_nonblocking() is factored into fill_mbedtls_tls_error(); the duplicated flag-clearing in the two verify callbacks is factored into mbedtls_clear_cn_mismatch(); both use the existing hostname_mismatch_code() accessor instead of the raw Mbed TLS macro. Also tightens SSLClientTest.ServerHostnameVerificationError_Online to assert the specific error code now that all three backends agree, rather than accepting Mbed TLS's old fallback value. Verified full non-online suite green on OpenSSL (791), Mbed TLS (737), and wolfSSL (735), plus the split build, plus the Online hostname-mismatch test against badssl.com on all three backends.
