Commit afc6e500 authored by David Ryskalczyk's avatar David Ryskalczyk
Browse files

Don't omit CN verification in DarwinSSL when an IP address is used.

parent 0d9ddf91

lib/vtls/curl_darwinssl.c

+14 −8
Original line number Diff line number Diff line
@@ -1323,20 +1323,26 @@ static CURLcode darwinssl_connect_step1(struct connectdata *conn, 
  }

#endif /* CURL_BUILD_MAC_10_6 || CURL_BUILD_IOS */



  /* If this is a domain name and not an IP address, then configure SNI.

  /* Configure hostname check. SNI is used if available.

   * Both hostname check and SNI require SSLSetPeerDomainName().

   * Also: the verifyhost setting influences SNI usage */

  /* If this is a domain name and not an IP address, then configure SNI: */

  if((0 == Curl_inet_pton(AF_INET, conn->host.name, &addr)) &&

#ifdef ENABLE_IPV6

     (0 == Curl_inet_pton(AF_INET6, conn->host.name, &addr)) &&

#endif

     data->set.ssl.verifyhost) {

  if(data->set.ssl.verifyhost) {

    err = SSLSetPeerDomainName(connssl->ssl_ctx, conn->host.name,

    strlen(conn->host.name));



    if(err != noErr) {

      infof(data, "WARNING: SSL: SSLSetPeerDomainName() failed: OSStatus %d\n",

            err);

    }



    if((Curl_inet_pton(AF_INET, conn->host.name, &addr))

  #ifdef ENABLE_IPV6

    || (Curl_inet_pton(AF_INET6, conn->host.name, &addr))

  #endif

       ) {

         infof(data, "WARNING: using IP address, SNI is being disabled by "

         "the OS.\n");

    }

  }



  /* Disable cipher suites that ST supports but are not safe. These ciphers