Merging a squash
- Ubuntu's PolarSSL version 1.1.4 doesn't exist in the PolarSSL SVN trunk. Assuming 1.2.x as a different release compared to 1.1.x, changing the #if POLARSSL_VERSION_NUMBER<=0x01010400 to POLARSSL_VERSION_NUMBER<0x01020000.
- Adding RFC2818 compliance checks to axTLS. Completely new are the SubjectAltName checks. The peer CN field fallback is implemented matching the OpenSSL behaviour. VERIFYHOST 0 == 1.
- Moved the hostcheck and cert_hostcheck static functions from lib/ssluse.c to rawstr.c to make them usable by the axTLS and other SSL backends. Also prefixed the functions with Curl_
- Adding RFC2818 checks for CyaSSL. This implementation will work similar to GnuTLS and NSS, meaning that you can't distinghuish between a SubjectAltName failure and CN failure
- Split the IP address usage message from the verifyhost setting and changing the wrong message about disabling SNI (Server Name Indication, used in HTTP virtual hosting) where SAN (Subject Alternative Name) is meant according to http://msdn.microsoft.com/en-us/library/aa923430.aspx about the flag SCH_CRED_NO_SERVERNAME_CHECK
- Moved the hostmatch and cert_hostcheck function out of the rawstr.c and into new files hostcheck.c and hostcheck.h. The OpenSSL and axTLS SSL backend code is now adjusted to use the hostcheck.h header for the prototypes. The Makefile.inc is updated with these two new files and everything builds and tests nicely.
- Remote unused code and added an explicit errSSLHostNameMismatch error switch-case that changes curl's generic failure on an SSL issue (CURLE_SSL_CONNECT_ERROR) to the explicit error code CURLE_PEER_FAILED_VERIFICATION which is used in all the other SSL backends for the same situation.
- Ubuntu's PolarSSL version 1.1.4 doesn't exist in the PolarSSL SVN trunk. Assuming 1.2.x as a different release compared to 1.1.x, changing the #if POLARSSL_VERSION_NUMBER<=0x01010400 to POLARSSL_VERSION_NUMBER<0x01020000.
- Adding RFC2818 compliance checks to axTLS. Completely new are the SubjectAltName checks. The peer CN field fallback is implemented matching the OpenSSL behaviour. VERIFYHOST 0 == 1.
- Moved the hostcheck and cert_hostcheck static functions from lib/ssluse.c to rawstr.c to make them usable by the axTLS and other SSL backends. Also prefixed the functions with Curl_
- Adding RFC2818 checks for CyaSSL. This implementation will work similar to GnuTLS and NSS, meaning that you can't distinghuish between a SubjectAltName failure and CN failure
- Split the IP address usage message from the verifyhost setting and changing the wrong message about disabling SNI (Server Name Indication, used in HTTP virtual hosting) where SAN (Subject Alternative Name) is meant according to http://msdn.microsoft.com/en-us/library/aa923430.aspx about the flag SCH_CRED_NO_SERVERNAME_CHECK
- It seems Ubuntu 12.10 has a slight offset to what I found in SVN. This needs further attention, this works now with Ubuntu's libpolarssl
- Ubuntu's PolarSSL version 1.1.4 doesn't exist in the PolarSSL SVN trunk. Assuming 1.2.x as a different release compared to 1.1.x, changing the #if POLARSSL_VERSION_NUMBER<=0x01010400 to POLARSSL_VERSION_NUMBER<0x01020000.
- For the PolarSSL version 1.2.0 and up now getting the peer certificate via the function ssl_get_peer_cert() with thanks the PolarSSL twitter account for feedback.
- Compensating in the axTLS and CyaSSL code for the internal change of the set.ssl.verifyhost from an int to a boolean.