romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-24 14:43:31 +03:00
Code Issues Projects Releases Packages Wiki Activity

- Curt Bogmine reported a problem with SNI enabled on a particular server. We

Browse source 
should introduce an option to disable SNI, but as we're in feature freeze
  now I've addressed the obvious bug here (pointed out by Peter Sylvester): we
  shouldn't try to enable SNI when SSLv2 or SSLv3 is explicitly selected.
  Code for OpenSSL and GnuTLS was fixed. NSS doesn't seem to have a particular
  option for SNI, or are we simply not using it?
This commit is contained in:
Daniel Stenberg 2009-08-01 22:11:58 +00:00
parent c0e8bed5bf
commit 6d891d2a3b
5 changed files with 18 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/gtls.c
View file

@ -260,6 +260,7 @@ Curl_gtls_connect(struct connectdata *conn,
const char *ptr;
void *ssl_sessionid;
size_t ssl_idsize;
bool sni = TRUE; /* default is SNI enabled */
#ifdef ENABLE_IPV6
struct in6_addr addr;
#else
@ -279,6 +280,8 @@ Curl_gtls_connect(struct connectdata *conn,
failf(data, "GnuTLS does not support SSLv2");
return CURLE_SSL_CONNECT_ERROR;
}
else if(data->set.ssl.version == CURL_SSLVERSION_SSLv3)
sni = FALSE; /* SSLv3 has no SNI */
/* allocate a cred struct */
rc = gnutls_certificate_allocate_credentials(&conn->ssl[sockindex].cred);
@ -335,6 +338,7 @@ Curl_gtls_connect(struct connectdata *conn,
#ifdef ENABLE_IPV6
(0 == Curl_inet_pton(AF_INET6, conn->host.name, &addr)) &&
#endif
sni &&
(gnutls_server_name_set(session, GNUTLS_NAME_DNS, conn->host.name,
strlen(conn->host.name)) < 0))
infof(data, "WARNING: failed to configure server name indication (SNI) "

4
lib/ssluse.c
View file

@ -1351,6 +1351,7 @@ ossl_connect_step1(struct connectdata *conn,
X509_LOOKUP *lookup=NULL;
curl_socket_t sockfd = conn->sock[sockindex];
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
bool sni = TRUE; /* default is SNI enabled */
#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
#ifdef ENABLE_IPV6
struct in6_addr addr;
@ -1376,9 +1377,11 @@ ossl_connect_step1(struct connectdata *conn,
break;
case CURL_SSLVERSION_SSLv2:
req_method = SSLv2_client_method();
sni = FALSE;
break;
case CURL_SSLVERSION_SSLv3:
req_method = SSLv3_client_method();
sni = FALSE;
break;
}
@ -1565,6 +1568,7 @@ ossl_connect_step1(struct connectdata *conn,
#ifdef ENABLE_IPV6
(0 == Curl_inet_pton(AF_INET6, conn->host.name, &addr)) &&
#endif
sni &&
!SSL_set_tlsext_host_name(connssl->handle, conn->host.name))
infof(data, "WARNING: failed to configure server name indication (SNI) "
"TLS extension\n");