diff options
| author | Andrey Hristov <andrey@php.net> | 2015-10-27 12:59:09 +0100 |
|---|---|---|
| committer | Andrey Hristov <andrey@php.net> | 2015-10-27 12:59:09 +0100 |
| commit | 6d51b7b2e3468601acdaaf9041c9131b5aa47f98 (patch) | |
| tree | 2f2c193dc999941727f61c118ef06f532ff3e7e9 /ext/mysqlnd/mysqlnd.c | |
| parent | 2f7a8515ca7f3ab4b0640677e4f476f87642ff61 (diff) | |
| download | php-git-6d51b7b2e3468601acdaaf9041c9131b5aa47f98.tar.gz | |
Another Fix for Bug #68344 MySQLi does not provide way to disable peer certificate validation
Added the possibility to explicitly state that the peer certificate should not be checked.
Back to the default - checking the certificate.
Exported MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT
Usage : mysqli_real_connect( , , , , , MYSQLI_CLIENT_SSL | MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT)
If mysqli_ssl_set() is not called, but only MYSQLI_CLIENT_SSL is passed, without the (don't) very flag,
then no verification takes place.
Diffstat (limited to 'ext/mysqlnd/mysqlnd.c')
| -rw-r--r-- | ext/mysqlnd/mysqlnd.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/ext/mysqlnd/mysqlnd.c b/ext/mysqlnd/mysqlnd.c index f008986227..94a314964d 100644 --- a/ext/mysqlnd/mysqlnd.c +++ b/ext/mysqlnd/mysqlnd.c @@ -472,6 +472,7 @@ mysqlnd_switch_to_ssl_if_needed( DBG_INF_FMT("CLIENT_PLUGIN_AUTH_LENENC_CLIENT_DATA= %d", mysql_flags & CLIENT_PLUGIN_AUTH_LENENC_CLIENT_DATA? 1:0); DBG_INF_FMT("CLIENT_CAN_HANDLE_EXPIRED_PASSWORDS= %d", mysql_flags & CLIENT_CAN_HANDLE_EXPIRED_PASSWORDS? 1:0); DBG_INF_FMT("CLIENT_SESSION_TRACK= %d", mysql_flags & CLIENT_SESSION_TRACK? 1:0); + DBG_INF_FMT("CLIENT_SSL_DONT_VERIFY_SERVER_CERT= %d", mysql_flags & CLIENT_SSL_DONT_VERIFY_SERVER_CERT? 1:0); DBG_INF_FMT("CLIENT_SSL_VERIFY_SERVER_CERT= %d", mysql_flags & CLIENT_SSL_VERIFY_SERVER_CERT? 1:0); DBG_INF_FMT("CLIENT_REMEMBER_OPTIONS= %d", mysql_flags & CLIENT_REMEMBER_OPTIONS? 1:0); @@ -495,7 +496,11 @@ mysqlnd_switch_to_ssl_if_needed( if (server_has_ssl == FALSE) { goto close_conn; } else { - zend_bool verify = mysql_flags & CLIENT_SSL_VERIFY_SERVER_CERT? TRUE:FALSE; + enum mysqlnd_ssl_peer verify = mysql_flags & CLIENT_SSL_VERIFY_SERVER_CERT? + MYSQLND_SSL_PEER_VERIFY: + (mysql_flags & CLIENT_SSL_DONT_VERIFY_SERVER_CERT? + MYSQLND_SSL_PEER_DONT_VERIFY: + MYSQLND_SSL_PEER_DEFAULT); DBG_INF("Switching to SSL"); if (!PACKET_WRITE(auth_packet, conn)) { goto close_conn; |