Commit f2c60574 authored by Daniel Stenberg's avatar Daniel Stenberg
Browse files

curl now uses stricter VERIFYHOST by default and only uses a lesser check 

if --insecure is used. Reported by Hamish Mackenzie.
parent 169b2eeb

src/main.c

+6 −6
Original line number Diff line number Diff line
@@ -2828,6 +2828,8 @@ operate(struct Configurable *config, int argc, char *argv[]) 
      curl_easy_setopt(curl, CURLOPT_SSLKEYTYPE, config->key_type);

      curl_easy_setopt(curl, CURLOPT_SSLKEYPASSWD, config->key_passwd);



      /* default to strict verifyhost */

      curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2);

      if(config->cacert || config->capath) {

        if (config->cacert)

          curl_easy_setopt(curl, CURLOPT_CAINFO, config->cacert);
@@ -2835,13 +2837,11 @@ operate(struct Configurable *config, int argc, char *argv[]) 
        if (config->capath)

          curl_easy_setopt(curl, CURLOPT_CAPATH, config->capath);

        curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, TRUE);

        curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 2);

      }

      else {

        if(config->insecure_ok)

      else

        if(config->insecure_ok) {

          /* new stuff needed for libcurl 7.10 */

          curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, FALSE);



          curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 1);

        }