Commit d12759c7 authored Jul 11, 2007 by Daniel Stenberg

Made CURLOPT_SSL_VERIFYHOST set to 1 acts as described in the documentation:

fail to connect if there is no Common Name field found in the remote cert.
We should deprecate the support for this set to 1 anyway soon, since the
feature is pointless and most likely never really used by anyone.

parent c0095d6d

CHANGES

+6 −0

Original line number	Diff line number	Diff line
		@@ -6,6 +6,12 @@

		Changelog

		Daniel S (12 July 2007)
		- Made CURLOPT_SSL_VERIFYHOST set to 1 acts as described in the documentation:
		fail to connect if there is no Common Name field found in the remote cert.
		We should deprecate the support for this set to 1 anyway soon, since the
		feature is pointless and most likely never really used by anyone.

		Daniel S (11 July 2007)
		- Shmulik Regev fixed a bug with transfer-encoding skipping during the 407
		error pages for proxy authentication.

RELEASE-NOTES

+2 −1

Original line number	Diff line number	Diff line
		@@ -18,6 +18,7 @@ This release includes the following bugfixes:
		o test cases 31, 46, 61, 506, 517 now work in time zones that use leap seconds
		o problem with closed proxy connection during HTTP CONNECT auth negotiation
		o transfer-encoding skipping didn't ignore the 407 response bodies properly
		o CURLOPT_SSL_VERIFYHOST set to 1

		This release includes the following known bugs:

		@@ -25,7 +26,7 @@ This release includes the following known bugs:

		Other curl-related news:

		o
		o pycurl 7.16.4 was released http://pycurl.sf.net

		New curl mirrors:

lib/ssluse.c

+3 −10

Original line number	Diff line number	Diff line
		@@ -1131,17 +1131,10 @@ static CURLcode verifyhost(struct connectdata *conn,
		#endif /* CURL_DOES_CONVERSIONS */

		if (!peer_CN) {
		if(data->set.ssl.verifyhost > 1) {
		failf(data,
		"SSL: unable to obtain common name from peer certificate");
		return CURLE_SSL_PEER_CERTIFICATE;
		}
		else {
		/* Consider verifyhost == 1 as an "OK" for a missing CN field, but we
		output a note about the situation */
		infof(data, "\t common name: WARNING couldn't obtain\n");
		}
		}
		else if(!cert_hostcheck((const char *)peer_CN, conn->host.name)) {
		if(data->set.ssl.verifyhost > 1) {
		failf(data, "SSL: certificate subject name '%s' does not match "