From 85f442b9807a72de444e8a0c8670310031ffd5e8 Mon Sep 17 00:00:00 2001 From: beck <> Date: Wed, 26 Aug 2026 16:25:12 +0000 Subject: Don't drop X509_V_ERR_HOSTNAME_MISMATCH when verify callback returns 1 While not the advised way of using the verify callback (either by OpenSSL or by us) in production, sometimes folks like to return 1 from everything in the callback and then check the error return and make decicions about things. This fix ensures that such callbacks will see the hostname mismatch and be able to act upon them. Reported by Alexander Aleksandrovic Klimov ok tb@ --- src/lib/libcrypto/x509/x509_verify.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'src/lib') diff --git a/src/lib/libcrypto/x509/x509_verify.c b/src/lib/libcrypto/x509/x509_verify.c index e0efa9ffc5..a8fd5a37d3 100644 --- a/src/lib/libcrypto/x509/x509_verify.c +++ b/src/lib/libcrypto/x509/x509_verify.c @@ -1,4 +1,4 @@ -/* $OpenBSD: x509_verify.c,v 1.78 2026/07/31 03:59:50 kenjiro Exp $ */ +/* $OpenBSD: x509_verify.c,v 1.79 2026/08/26 16:25:12 beck Exp $ */ /* * Copyright (c) 2020-2021 Bob Beck * @@ -760,8 +760,11 @@ x509_verify_cert_hostname(struct x509_verify_ctx *ctx, X509 *cert, char *name) if (ctx->xsc != NULL) { int ret; - if ((ret = x509_vfy_check_id(ctx->xsc)) == 0) + ret = x509_vfy_check_id(ctx->xsc); + if (ctx->xsc->error != X509_V_OK) { ctx->error = ctx->xsc->error; + ctx->error_depth = ctx->xsc->error_depth; + } return ret; } return 1; -- cgit v1.2.3-55-g6feb