Vulnerable code sample

import ssl

# This code is a representative example of the logic that existed in
# the wolfssl-py package prior to the fix for CVE-2025-15346.
# It simulates how the Python-level settings were translated into
# calls to the underlying wolfSSL C library.

# --- Simulated constants from the underlying wolfSSL C library ---
# In a real implementation, these would be defined by the C library binding.

# WOLFSSL_VERIFY_NONE tells wolfSSL not to verify the peer.
WOLFSSL_VERIFY_NONE = 0
# WOLFSSL_VERIFY_PEER tells wolfSSL to verify the peer certificate if presented.
# Connections are allowed if the peer does not present a certificate.
WOLFSSL_VERIFY_PEER = 1
# WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT is the flag that, when combined with
# WOLFSSL_VERIFY_PEER, enforces that a client certificate MUST be presented.
WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT = 2


class VulnerableSSLContext:
    """
    A simplified, representative model of the wolfssl.SSLContext object
    from a vulnerable version (<= 5.8.2). It demonstrates how setting
    `verify_mode` to `CERT_REQUIRED` was incorrectly handled.
    """
    def __init__(self):
        self._verify_mode = ssl.CERT_NONE
        # In the actual library, self._wolfssl_ctx would be a C pointer
        # to the wolfSSL context structure.
        self._wolfssl_ctx = object() # Placeholder for the C context

    @property
    def verify_mode(self):
        return self._verify_mode

    @verify_mode.setter
    def verify_mode(self, value):
        """
        This property setter contains the vulnerable logic. It determines which
        flags to pass to the underlying wolfSSL C library function that sets
        the verification mode.
        """
        self._verify_mode = value

        # In the actual code, a C function like wolfSSL_CTX_set_verify()
        # would be called here. We simulate the logic that determines the arguments.
        if self._verify_mode == ssl.CERT_REQUIRED:
            #
            # THE VULNERABILITY IS HERE
            #
            # The code should combine WOLFSSL_VERIFY_PEER with
            # WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT to enforce client certs.
            # However, it only sets WOLFSSL_VERIFY_PEER, which makes the
            # behavior identical to CERT_OPTIONAL: a certificate is verified
            # if sent, but the connection is NOT terminated if it is missing.
            #
            c_flags = WOLFSSL_VERIFY_PEER
            # Simulated call to the C library:
            # _lib.wolfSSL_CTX_set_verify(self._wolfssl_ctx, c_flags, callback)
            print(f"Vulnerable path: Setting C flags to {c_flags} for CERT_REQUIRED")

        elif self._verify_mode == ssl.CERT_OPTIONAL:
            # This logic is correct for CERT_OPTIONAL. The vulnerability is that
            # CERT_REQUIRED incorrectly uses this same logic.
            c_flags = WOLFSSL_VERIFY_PEER
            # Simulated call to the C library:
            # _lib.wolfSSL_CTX_set_verify(self._wolfssl_ctx, c_flags, callback)
            print(f"Correct path: Setting C flags to {c_flags} for CERT_OPTIONAL")

        else: # ssl.CERT_NONE
            c_flags = WOLFSSL_VERIFY_NONE
            # Simulated call to the C library:
            # _lib.wolfSSL_CTX_set_verify(self._wolfssl_ctx, c_flags, callback)
            print(f"Correct path: Setting C flags to {c_flags} for CERT_NONE")