From: Daniel Stenberg <daniel@haxx.se>
Date: Wed, 2 Oct 2013 13:31:10 +0000 (+0200)
Subject: OpenSSL: acknowledge CURLOPT_SSL_VERIFYHOST without VERIFYPEER
X-Git-Tag: curl-7_33_0~15
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3c3622b6;p=thirdparty%2Fcurl.git

OpenSSL: acknowledge CURLOPT_SSL_VERIFYHOST without VERIFYPEER

Setting only CURLOPT_SSL_VERIFYHOST without CURLOPT_SSL_VERIFYPEER set
should still verify that the host name fields in the server certificate
is fine or return failure.

Bug: http://curl.haxx.se/mail/lib-2013-10/0002.html
Reported-by: Ishan SinghLevett
---

diff --git a/lib/ssluse.c b/lib/ssluse.c
index 4f3c1e15f6..9974ac85ec 100644
--- a/lib/ssluse.c
+++ b/lib/ssluse.c
@@ -2351,7 +2351,7 @@ ossl_connect_step3(struct connectdata *conn,
    * operations.
    */
 
-  if(!data->set.ssl.verifypeer)
+  if(!data->set.ssl.verifypeer && !data->set.ssl.verifyhost)
     (void)servercert(conn, connssl, FALSE);
   else
     retcode = servercert(conn, connssl, TRUE);