From: Daniel Stenberg <daniel@haxx.se>
Date: Mon, 17 Dec 2018 12:08:41 +0000 (+0100)
Subject: mbedtls: use VERIFYHOST
X-Git-Tag: curl-7_64_0~112
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f097669248a877dece74fdb525e82bfe1b69df90;p=curl

mbedtls: use VERIFYHOST

Previously, VERIFYPEER would enable/disable all checks.

Reported-by: Eric Rosenquist
Fixes #3376
Closes #3380
---

diff --git a/lib/vtls/mbedtls.c b/lib/vtls/mbedtls.c
index 6a20e276e..ec1c13d95 100644
--- a/lib/vtls/mbedtls.c
+++ b/lib/vtls/mbedtls.c
@@ -583,14 +583,16 @@ mbed_connect_step2(struct connectdata *conn,
       return CURLE_PEER_FAILED_VERIFICATION;
     }
 
-    if(ret & MBEDTLS_X509_BADCERT_CN_MISMATCH)
-      failf(data, "Cert verify failed: BADCERT_CN_MISMATCH");
-
     if(ret & MBEDTLS_X509_BADCERT_NOT_TRUSTED)
       failf(data, "Cert verify failed: BADCERT_NOT_TRUSTED");
 
     return CURLE_PEER_FAILED_VERIFICATION;
   }
+  if(ret && SSL_CONN_CONFIG(verifyhost)) {
+    if(ret & MBEDTLS_X509_BADCERT_CN_MISMATCH)
+      failf(data, "Cert verify failed: BADCERT_CN_MISMATCH");
+    return CURLE_PEER_FAILED_VERIFICATION;
+  }
 
   peercert = mbedtls_ssl_get_peer_cert(&BACKEND->ssl);