mirror of
https://github.com/moparisthebest/curl
synced 2024-11-14 05:25:06 -05:00
53022e1893
- New libcurl options CURLOPT_DOH_SSL_VERIFYHOST, CURLOPT_DOH_SSL_VERIFYPEER and CURLOPT_DOH_SSL_VERIFYSTATUS do the same as their respective counterparts. - New curl tool options --doh-insecure and --doh-cert-status do the same as their respective counterparts. Prior to this change DOH SSL certificate verification settings for verifyhost and verifypeer were supposed to be inherited respectively from CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER, but due to a bug were not. As a result DOH verification remained at the default, ie enabled, and it was not possible to disable. This commit changes behavior so that the DOH verification settings are independent and not inherited. Ref: https://github.com/curl/curl/pull/4579#issuecomment-554723676 Fixes https://github.com/curl/curl/issues/4578 Closes https://github.com/curl/curl/pull/6597
70 lines
2.6 KiB
Groff
70 lines
2.6 KiB
Groff
.\" **************************************************************************
|
|
.\" * _ _ ____ _
|
|
.\" * Project ___| | | | _ \| |
|
|
.\" * / __| | | | |_) | |
|
|
.\" * | (__| |_| | _ <| |___
|
|
.\" * \___|\___/|_| \_\_____|
|
|
.\" *
|
|
.\" * Copyright (C) 1998 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al.
|
|
.\" *
|
|
.\" * This software is licensed as described in the file COPYING, which
|
|
.\" * you should have received as part of this distribution. The terms
|
|
.\" * are also available at https://curl.se/docs/copyright.html.
|
|
.\" *
|
|
.\" * You may opt to use, copy, modify, merge, publish, distribute and/or sell
|
|
.\" * copies of the Software, and permit persons to whom the Software is
|
|
.\" * furnished to do so, under the terms of the COPYING file.
|
|
.\" *
|
|
.\" * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
|
|
.\" * KIND, either express or implied.
|
|
.\" *
|
|
.\" **************************************************************************
|
|
.\"
|
|
.TH CURLOPT_DOH_SSL_VERIFYSTATUS 3 "11 Feb 2021" "libcurl 7.76.0" "curl_easy_setopt options"
|
|
.SH NAME
|
|
CURLOPT_DOH_SSL_VERIFYSTATUS \- verify the DOH SSL certificate's status
|
|
.SH SYNOPSIS
|
|
#include <curl/curl.h>
|
|
|
|
CURLcode curl_easy_setopt(CURL *handle, CURLOPT_DOH_SSL_VERIFYSTATUS, long verify);
|
|
.SH DESCRIPTION
|
|
Pass a long as parameter set to 1 to enable or 0 to disable.
|
|
|
|
This option determines whether libcurl verifies the status of the DOH
|
|
(DNS-over-HTTPS) server cert using the "Certificate Status Request" TLS
|
|
extension (aka. OCSP stapling).
|
|
|
|
This option is the DOH equivalent of \fICURLOPT_SSL_VERIFYSTATUS(3)\fP and
|
|
only affects requests to the DOH server.
|
|
|
|
Note that if this option is enabled but the server does not support the TLS
|
|
extension, the verification will fail.
|
|
.SH DEFAULT
|
|
0
|
|
.SH PROTOCOLS
|
|
DOH
|
|
.SH EXAMPLE
|
|
.nf
|
|
CURL *curl = curl_easy_init();
|
|
if(curl) {
|
|
curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
|
|
|
|
curl_easy_setopt(curl, CURLOPT_DOH_URL, "https://cloudflare-dns.com/dns-query");
|
|
|
|
/* Ask for OCSP stapling when verifying the DOH server */
|
|
curl_easy_setopt(curl, CURLOPT_DOH_SSL_VERIFYSTATUS, 1L);
|
|
|
|
curl_easy_perform(curl);
|
|
}
|
|
.fi
|
|
.SH AVAILABILITY
|
|
Added in 7.76.0. This option is currently only supported by the OpenSSL, GnuTLS
|
|
and NSS TLS backends.
|
|
.SH RETURN VALUE
|
|
Returns CURLE_OK if OCSP stapling is supported by the SSL backend, otherwise
|
|
returns CURLE_NOT_BUILT_IN.
|
|
.SH "SEE ALSO"
|
|
.BR CURLOPT_DOH_SSL_VERIFYHOST "(3), "
|
|
.BR CURLOPT_DOH_SSL_VERIFYPEER "(3), "
|
|
.BR CURLOPT_SSL_VERIFYSTATUS "(3), "
|