romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 19:53:31 +03:00
Code Issues Projects Releases Packages Wiki Activity

schannel: verify hostname independent of verify cert

Browse source 
Prior to this change when CURLOPT_SSL_VERIFYPEER (verifypeer) was off
and CURLOPT_SSL_VERIFYHOST (verifyhost) was on we did not verify the
hostname in schannel code.

This fixes KNOWN_BUG 2.8 "Schannel disable CURLOPT_SSL_VERIFYPEER and
verify hostname". We discussed a fix several years ago in #3285 but it
went stale.

Assisted-by: Daniel Stenberg

Bug: https://curl.haxx.se/mail/lib-2018-10/0113.html
Reported-by: Martin Galvan

Ref: https://github.com/curl/curl/pull/3285

Fixes https://github.com/curl/curl/issues/3284
Closes https://github.com/curl/curl/pull/10056
This commit is contained in:
Jay Satiro 2022-12-08 01:26:13 -05:00
parent c7056759be
commit 889c071d3c
5 changed files with 101 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

7
docs/KNOWN_BUGS
View file

@ -21,7 +21,6 @@ problems may have been fixed or changed somewhat since this was written.
2.4 Secure Transport will not import PKCS#12 client certificates without a password
2.5 Client cert handling with Issuer DN differs between backends
2.7 Client cert (MTLS) issues with Schannel
2.8 Schannel disable CURLOPT_SSL_VERIFYPEER and verify hostname
2.11 Schannel TLS 1.2 handshake bug in old Windows versions
2.12 FTPS with Schannel times out file list operation
2.13 CURLOPT_CERTINFO results in CURLE_OUT_OF_MEMORY with Schannel
@ -163,12 +162,6 @@ problems may have been fixed or changed somewhat since this was written.
See https://github.com/curl/curl/issues/3145
2.8 Schannel disable CURLOPT_SSL_VERIFYPEER and verify hostname
This seems to be a limitation in the underlying Schannel API.
https://github.com/curl/curl/issues/3284
2.11 Schannel TLS 1.2 handshake bug in old Windows versions
In old versions of Windows such as 7 and 8.1 the Schannel TLS 1.2 handshake