generic-library/curl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge pull request #93 from d235j/darwinssl_ip_address_fix

Browse Source 
darwinssl: don't omit CN verification when an IP address is used
This commit is contained in:
nickzman 2014-02-25 17:36:44 -06:00
commit e9665e9658
1 changed files with 14 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
lib/vtls/curl_darwinssl.c
View File

@ -1323,20 +1323,26 @@ static CURLcode darwinssl_connect_step1(struct connectdata *conn,
}
#endif /* CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS */
/* If this is a domain name and not an IP address, then configure SNI.
/* Configure hostname check. SNI is used if available.
* Both hostname check and SNI require SSLSetPeerDomainName().
* Also: the verifyhost setting influences SNI usage */
/* If this is a domain name and not an IP address, then configure SNI: */
if((0 == Curl_inet_pton(AF_INET, conn->host.name, &addr)) &&
#ifdef ENABLE_IPV6
(0 == Curl_inet_pton(AF_INET6, conn->host.name, &addr)) &&
#endif
data->set.ssl.verifyhost) {
if(data->set.ssl.verifyhost) {
err = SSLSetPeerDomainName(connssl->ssl_ctx, conn->host.name,
strlen(conn->host.name));
strlen(conn->host.name));
if(err != noErr) {
infof(data, "WARNING: SSL: SSLSetPeerDomainName() failed: OSStatus %d\n",
err);
}
if((Curl_inet_pton(AF_INET, conn->host.name, &addr))
#ifdef ENABLE_IPV6
|| (Curl_inet_pton(AF_INET6, conn->host.name, &addr))
#endif
) {
infof(data, "WARNING: using IP address, SNI is being disabled by "
"the OS.\n");
}
}
/* Disable cipher suites that ST supports but are not safe. These ciphers