Don't verify host name in SSL certs when GIT_SSL_NO_VERIFY is set
Originally from Mike Hommey; earlier we were disabling SSL_VERIFYPEER but SSL_VERIFYHOST was in effect even when the user asked not to with the environment variable. Signed-off-by: Junio C Hamano <gitster@pobox.com>
Junio C Hamano committed
Feb 21, 2008 at 15:10 UTC
a5ccc5979d210500d00169f98cc8567ea346fcb0
1 file changed
+10
-1
http.c
+10
-1
@@ -165,7 +165,16 @@ static CURL* get_curl_handle(void)
165
{
166
CURL* result = curl_easy_init();
167
168
- curl_easy_setopt(result, CURLOPT_SSL_VERIFYPEER, curl_ssl_verify);
168
+ if (!curl_ssl_verify) {
169
+ curl_easy_setopt(result, CURLOPT_SSL_VERIFYPEER, 0);
170
+ curl_easy_setopt(result, CURLOPT_SSL_VERIFYHOST, 0);
171
+ } else {
172
+ /* Verify authenticity of the peer's certificate */
173
+ curl_easy_setopt(result, CURLOPT_SSL_VERIFYPEER, 1);
174
+ /* The name in the cert must match whom we tried to connect */
175
+ curl_easy_setopt(result, CURLOPT_SSL_VERIFYHOST, 2);
176
+ }
177
+
178
#if LIBCURL_VERSION_NUM >= 0x070907
179
curl_easy_setopt(result, CURLOPT_NETRC, CURL_NETRC_OPTIONAL);
180
#endif