- Constantine Sapuntzakis provided the fix that ensures that an SSL connection

  won't be reused unless protection level for peer and host verification match.

diff --git a/CHANGES b/CHANGES
index 47ee50df7d296f9592420b97c61b7d1d8c7aff9e..0c7f7c1b5104be7229e407a6f7b3d8f1c8f3672b 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,10 @@
 
                                   Changelog
 
+Yang Tse (14 Nov 2009)
+- Constantine Sapuntzakis provided the fix that ensures that an SSL connection
+  won't be reused unless protection level for peer and host verification match.
+
 Kamil Dudka (12 Nov 2009)
 - Kevin Baughman provided a fix preventing libcurl-NSS from crash on doubly
   closed NSPR descriptor. The issue was hard to find, reported several times

diff --git a/RELEASE-NOTES b/RELEASE-NOTES
index f68e5798e38cdbad3486f6e19b8e05cbedad7b51..25daa4368e4b18d32b6b34a185a6809cba26ab38 100644 (file)
--- a/RELEASE-NOTES
+++ b/RELEASE-NOTES
@@ -18,6 +18,7 @@ This release includes the following bugfixes:
  o progress meter/callback during FTP connection
  o DNS cache timeout while transfer in progress
  o compilation when configured --with-gssapi having GNU GSS installed
+ o SSL connection reused with mismatched protection level
 
 This release includes the following known bugs:
 

diff --git a/lib/url.c b/lib/url.c
index 8f425d4e26f0326a5c8f563cfaeee9d747867440..d3ec1c0745a43b6ac3c67ccc0d38c08d9f6f8efa 100644 (file)
--- a/lib/url.c
+++ b/lib/url.c
@@ -2689,6 +2689,12 @@ ConnectionExists(struct SessionHandle *data,
       /* don't do mixed SSL and non-SSL connections */
       continue;
 
+    if(needle->protocol&PROT_SSL) {
+      if((data->set.ssl.verifypeer != check->verifypeer) ||
+         (data->set.ssl.verifyhost != check->verifyhost))
+        continue;
+    }
+
     if(needle->bits.proxy != check->bits.proxy)
       /* don't do mixed proxy and non-proxy connections */
       continue;
@@ -4326,6 +4332,9 @@ static CURLcode create_conn(struct SessionHandle *data,
   conn->bits.ftp_use_epsv = data->set.ftp_use_epsv;
   conn->bits.ftp_use_eprt = data->set.ftp_use_eprt;
 
+  conn->verifypeer = data->set.ssl.verifypeer;
+  conn->verifyhost = data->set.ssl.verifyhost;
+
   if(data->multi && Curl_multi_canPipeline(data->multi) &&
       !conn->master_buffer) {
     /* Allocate master_buffer to be used for pipelining */

diff --git a/lib/urldata.h b/lib/urldata.h
index d3101c03acef68b4037b09a58451792a268de54c..40ed8285dface82924ed893892f5767e50cd8cce 100644 (file)
--- a/lib/urldata.h
+++ b/lib/urldata.h
@@ -1083,6 +1083,9 @@ struct connectdata {
 #if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
   int socks5_gssapi_enctype;
 #endif
+
+  long verifypeer;
+  long verifyhost;
 };
 
 /* The end of connectdata. */