subjectAltName related fixes

diff --git a/lib/gnutls_cert.c b/lib/gnutls_cert.c
index 3d2fa568a6fd3724f8fe73ade04f18e6209ac970..fcebcb6060319f238e97c92596992d8e364aeea4 100644 (file)
--- a/lib/gnutls_cert.c
+++ b/lib/gnutls_cert.c
@@ -939,7 +939,7 @@ int _gnutls_cert_supported_kx(gnutls_cert * cert, KXAlgorithm ** alg,
 }
 
 /* finds a certificate in the cert list that contains
- * common_name field similar to name
+ * common_name (or subjectAltName) field similar to name
  */
 gnutls_cert *_gnutls_find_cert(gnutls_cert ** cert_list,
                               int cert_list_length, char *name)
@@ -949,7 +949,7 @@ gnutls_cert *_gnutls_find_cert(gnutls_cert ** cert_list,
 
        for (i = 0; i < cert_list_length; i++) {
                if (cert_list[i][0].cert_info.common_name[0] != 0) {
-                       if (strcmp(cert_list[i][0].cert_info.common_name, name) == 0) {
+                       if (strcasecmp(cert_list[i][0].cert_info.common_name, name) == 0 || strcasecmp(cert_list[i][0].subjectAltName, name) == 0) {
                                cert = &cert_list[i][0];
                                break;
                        }

diff --git a/src/cli.c b/src/cli.c
index 6ed2da416267c50dd05cde682a801a59463a0661..c96c7cef9ecee3480b6a61941151064e8c7f4576 100644 (file)
--- a/src/cli.c
+++ b/src/cli.c
@@ -170,7 +170,7 @@ int main(int argc, char** argv)
        gnutls_init(&state, GNUTLS_CLIENT);
        
        gnutls_set_protocol_priority( state, GNUTLS_TLS1, GNUTLS_SSL3, 0);
-       gnutls_set_cipher_priority( state, GNUTLS_3DES_CBC, GNUTLS_RIJNDAEL_CBC, 0);
+       gnutls_set_cipher_priority( state, GNUTLS_ARCFOUR, GNUTLS_3DES_CBC, GNUTLS_RIJNDAEL_CBC, 0);
        gnutls_set_compression_priority( state, GNUTLS_ZLIB, GNUTLS_NULL_COMPRESSION, 0);
        gnutls_set_kx_priority( state, GNUTLS_KX_RSA, GNUTLS_KX_SRP, GNUTLS_KX_DH_ANON, 0);
        gnutls_set_mac_priority( state, GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, 0);
@@ -179,7 +179,10 @@ int main(int argc, char** argv)
        gnutls_set_cred( state, GNUTLS_SRP, cred);
        gnutls_set_cred( state, GNUTLS_X509PKI, xcred);
 
-//     gnutls_ext_set_dnsname( state, "localhost");
+/* This TLS extension may break old implementations.
+ *
+ *     gnutls_ext_set_dnsname( state, "localhost"); 
+ */
 
        ret = gnutls_handshake(sd, state);
 
@@ -222,7 +225,7 @@ int main(int argc, char** argv)
        gnutls_init(&state, GNUTLS_CLIENT);
        
        gnutls_set_protocol_priority( state, GNUTLS_TLS1, GNUTLS_SSL3, 0);
-       gnutls_set_cipher_priority( state, GNUTLS_3DES_CBC, GNUTLS_TWOFISH_CBC, GNUTLS_RIJNDAEL_CBC, 0);
+       gnutls_set_cipher_priority( state, GNUTLS_ARCFOUR, GNUTLS_3DES_CBC, GNUTLS_TWOFISH_CBC, GNUTLS_RIJNDAEL_CBC, 0);
        gnutls_set_compression_priority( state, GNUTLS_NULL_COMPRESSION, 0);
        gnutls_set_kx_priority( state, GNUTLS_KX_RSA, GNUTLS_KX_SRP, GNUTLS_KX_DH_ANON, 0);