php/php-src — pull request #221 by johnj (2012-10-25 04:53:06+00:00)
Title: Validate CN if CURLOPT_SSL_VERIFYHOST is set to true

Per https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html - if CURLOPT_SSL_VERIFYHOST is set to "true", convert_to_long_ex sets the LVAL to 1.

libcurl handles the CURLOPT_SSL_VERIFYHOST=1 differently than the default value, 2. CURLOPT_SSL_VERIFYHOST=1 will not check the common name (essentially allowing a MITM attack). A long value of 2 will validate the common name.

http://curl.haxx.se/libcurl/c/curl_easy_setopt.html#CURLOPTSSLVERIFYHOST

I realize this may have impact to code previously setting CURLOPT_SSL_VERIFYHOST to "true" and not worrying about the CN validation - which may now break because libcurl will execute the CN validation. Don't think this is a particularly negative thing - presuming peoples' code had it set to "true" to begin with for peer + host validation.