Map name/IP mismatches to X509_V_* codes in GetX509Error() - #11260
Open
julek-wolfssl wants to merge 1 commit into
Open
Map name/IP mismatches to X509_V_* codes in GetX509Error()#11260julek-wolfssl wants to merge 1 commit into
julek-wolfssl wants to merge 1 commit into
Conversation
|
Can one of the admins verify this patch? |
Contributor
There was a problem hiding this comment.
Pull request overview
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Maps internal peer name mismatch errors to OpenSSL-compatible X509_V_ERR_* codes so X509_STORE_CTX_get_error() reports expected values when OPENSSL_COMPATIBLE_DEFAULTS is enabled.
Changes:
- Map
DOMAIN_NAME_MISMATCHtoWOLFSSL_X509_V_ERR_HOSTNAME_MISMATCHinGetX509Error(). - Map
IPADDR_MISMATCHtoWOLFSSL_X509_V_ERR_IP_ADDRESS_MISMATCHinGetX509Error().
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
SetupStoreCtxCallback() runs the handshake store-ctx error through GetX509Error() only under OPENSSL_COMPATIBLE_DEFAULTS, and that function passed DOMAIN_NAME_MISMATCH / IPADDR_MISMATCH through unmapped, so X509_STORE_CTX_get_error() reported the internal codes for peer name mismatches in that build. Add the two cases so it reports WOLFSSL_X509_V_ERR_HOSTNAME_MISMATCH / WOLFSSL_X509_V_ERR_IP_ADDRESS_MISMATCH, matching OpenSSL. Default builds keep returning the internal codes, unchanged. src/x509_str.c: add DOMAIN_NAME_MISMATCH / IPADDR_MISMATCH cases to GetX509Error().
julek-wolfssl
force-pushed
the
x509-get-error
branch
from
August 26, 2026 11:16
df0742e to
11714e1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SetupStoreCtxCallback()runs the handshake store-ctx error throughGetX509Error()underOPENSSL_COMPATIBLE_DEFAULTS, but that function passedDOMAIN_NAME_MISMATCH/IPADDR_MISMATCHthrough unmapped, soX509_STORE_CTX_get_error()reported the internal codes for peer name mismatches in that build.src/x509_str.c: addDOMAIN_NAME_MISMATCH/IPADDR_MISMATCHcases toGetX509Error(), mapping them toWOLFSSL_X509_V_ERR_HOSTNAME_MISMATCH/WOLFSSL_X509_V_ERR_IP_ADDRESS_MISMATCHto match OpenSSL.