Commit 0966ab5b authored by Joel Depooter's avatar Joel Depooter Committed by Jay Satiro
Browse files

darwinssl: Warn that disabling host verify also disables SNI 

In DarwinSSL the SSLSetPeerDomainName function is used to enable both
sending SNI and verifying the host. When host verification is disabled
the function cannot be called, therefore SNI is disabled as well.

Closes https://github.com/curl/curl/pull/1240
parent a162d8b2

docs/libcurl/opts/CURLOPT_SSL_VERIFYHOST.3

+10 −3
Original line number Original line Diff line number Diff line
@@ -58,9 +58,16 @@ The default value for this option is 2. 




This option controls checking the server's certificate's claimed identity.

This option controls checking the server's certificate's claimed identity.

The server could be lying.  To control lying, see

The server could be lying.  To control lying, see

\fICURLOPT_SSL_VERIFYPEER(3)\fP.  If libcurl is built against NSS and

\fICURLOPT_SSL_VERIFYPEER(3)\fP.

\fICURLOPT_SSL_VERIFYPEER(3)\fP is zero, \fICURLOPT_SSL_VERIFYHOST(3)\fP is

.SH LIMITATIONS

also set to zero and cannot be overridden.

DarwinSSL: If \fIverify\fP value is 0, then SNI is also disabled. SNI is a TLS

extension that sends the hostname to the server. The server may use that

information to do such things as sending back a specific certificate for the

hostname, or forwarding the request to a specific origin server. Some hostnames

may be inaccessible if SNI is not sent.



NSS: If \fICURLOPT_SSL_VERIFYPEER(3)\fP is zero,

\fICURLOPT_SSL_VERIFYHOST(3)\fP is also set to zero and cannot be overridden.

.SH DEFAULT

.SH DEFAULT

2

2

.SH PROTOCOLS

.SH PROTOCOLS

lib/vtls/darwinssl.c

+3 −0
Original line number Original line Diff line number Diff line
@@ -1425,6 +1425,9 @@ static CURLcode darwinssl_connect_step1(struct connectdata *conn, 
            "the OS.\n");

            "the OS.\n");

    }

    }

  }

  }

  else {

    infof(data, "WARNING: disabling hostname validation also disables SNI.\n");

  }





  /* Disable cipher suites that ST supports but are not safe. These ciphers

  /* Disable cipher suites that ST supports but are not safe. These ciphers

     are unlikely to be used in any case since ST gives other ciphers a much

     are unlikely to be used in any case since ST gives other ciphers a much