Report X509_VERIFY_PARAM hostname/IP mismatches to the verify callback so applications can inspect or override them - #11156
Open
gasbytes wants to merge 1 commit into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates wolfSSL’s OpenSSL-compat certificate verification path to report X509_VERIFY_PARAM hostname/IP mismatches to the application’s verify callback (so the callback can inspect and optionally override by returning 1), and moves the check earlier so the callback runs while the built chain and temporary intermediates are still present.
Changes:
- Invoke the verify callback on
X509_V_ERR_HOSTNAME_MISMATCH/X509_V_ERR_IP_ADDRESS_MISMATCHinwolfSSL_X509_verify_cert()and allow callback override. - Reorder the hostname/IP check to occur before
exit:cleanup so callback inspection can see the active chain/intermediates. - Add a new API-level regression test covering callback behavior for hostname/IP mismatches.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| tests/api/test_ossl_x509_str.h | Registers the new test in declarations and the test group list. |
| tests/api/test_ossl_x509_str.c | Adds a new test validating callback invocation/override on hostname and IP mismatches. |
| src/x509_str.c | Reports hostname/IP mismatches via verify callback (OpenSSL-like check_id_error() behavior) and moves the check earlier. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
gasbytes
force-pushed
the
x509_store_ctx_verify_cb_fix
branch
from
August 12, 2026 12:27
fc70e66 to
16ab28a
Compare
gasbytes
marked this pull request as ready for review
August 12, 2026 12:39
|
retest this please |
…k so applications can inspect or override them
gasbytes
force-pushed
the
x509_store_ctx_verify_cb_fix
branch
from
August 12, 2026 12:52
16ab28a to
2c9e443
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Call the application verify callback on X509_VERIFY_PARAM hostname/IP mismatches in wolfSSL_X509_verify_cert, letting it override by returning 1, as openSSL's check_id_error() does (compat layer).
Also moved the check above the exit cleanup so the callback runs with the chain and temporary intermediates still loaded.
Testing
Added test_wolfSSL_X509_STORE_CTX_verify_cb_check_id.
Checklist