[libvirt] VMware support and libcurl on rhel-u1
Daniel Veillard
veillard at redhat.com
Tue Jul 28 10:09:57 UTC 2009
On Tue, Jul 28, 2009 at 11:39:28AM +0200, Matthias Bolte wrote:
> 2009/7/28 Daniel P. Berrange <berrange at redhat.com>:
> > On Tue, Jul 28, 2009 at 02:22:25AM -0700, Shahar Klein wrote:
> >> doesn't work for me(with curl 7.15 and ESX4i)
> >>
> >> [root at rain8 libvirt]# virsh -c esx://172.30.8.63?no_verify=1
> >> Enter username for 172.30.8.63 [root]:
> >> Enter root password for 172.30.8.63:
> >> error: internal error curl_easy_perform() returned an error: SSL peer certificate was not ok (51)
> >> error: failed to connect to the hypervisor
> >>
> >> I had to set(unset) CURLOPT_SSL_VERIFYHOST in order to connect:
> >> --- a/src/esx/esx_vi.c
> >> +++ b/src/esx/esx_vi.c
> >> @@ -239,6 +239,7 @@ esxVI_Context_Connect(virConnectPtr conn, esxVI_Context *ctx, const char *url,
> >> curl_easy_setopt(ctx->curl_handle, CURLOPT_HEADER, 0);
> >> curl_easy_setopt(ctx->curl_handle, CURLOPT_FOLLOWLOCATION, 1);
> >> curl_easy_setopt(ctx->curl_handle, CURLOPT_SSL_VERIFYPEER, noVerify ? 0 : 1);
> >> + curl_easy_setopt(ctx->curl_handle, CURLOPT_SSL_VERIFYHOST, noVerify ? 0 : 1);
> >> curl_easy_setopt(ctx->curl_handle, CURLOPT_COOKIEFILE, "");
> >> curl_easy_setopt(ctx->curl_handle, CURLOPT_HTTPHEADER, ctx->curl_headers);
> >> curl_easy_setopt(ctx->curl_handle, CURLOPT_WRITEFUNCTION,
> >> ----
> >
> > ACK, this makes sense. VERIFYHOST tells curl to verify that the
> > passed in hostname matches the cname in the certifcate. VERIFYPEER
> > tells curl to verify the certificate validaty itself. So we want
> > to be disabling both when no_verify=1
> >
> > Daniel
>
> ACK, but CURLOPT_SSL_VERIFYHOST should be set to 2 (certificate must
> contain a cname and must match, the default) instead of 1 (certificate
> must contain a cname, but must not match) when no_verify=0, see
> http://curl.haxx.se/libcurl/c/curl_easy_setopt.html#CURLOPTSSLVERIFYHOST
>
> curl_easy_setopt(ctx->curl_handle, CURLOPT_SSL_VERIFYHOST, noVerify ? 0 : 2);
Okay, I will push this,
thanks !
Daniel
--
Daniel Veillard | libxml Gnome XML XSLT toolkit http://xmlsoft.org/
daniel at veillard.com | Rpmfind RPM search engine http://rpmfind.net/
http://veillard.com/ | virtualization library http://libvirt.org/
More information about the libvir-list
mailing list