mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2025-03-13 15:37:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

wolfssl: if CURLOPT_CAINFO_BLOB is set, ignore the CA files

Browse Source 
Ref: #11883
Reported-by: Michael Osipov
Closes #11884
This commit is contained in:
Daniel Stenberg 2023-09-19 10:53:44 +02:00
parent becd1e86a8
commit 8420fef590
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 29 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
lib/vtls/wolfssl.c
View File

@ -541,37 +541,39 @@ wolfssl_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
}
#ifndef NO_FILESYSTEM
/* load trusted cacert */
if(conn_config->CAfile) {
if(1 != wolfSSL_CTX_load_verify_locations(backend->ctx,
conn_config->CAfile,
conn_config->CApath)) {
if(conn_config->verifypeer && !imported_ca_info_blob &&
!imported_native_ca) {
/* Fail if we insist on successfully verifying the server. */
failf(data, "error setting certificate verify locations:"
" CAfile: %s CApath: %s",
conn_config->CAfile?
conn_config->CAfile: "none",
conn_config->CApath?
conn_config->CApath : "none");
return CURLE_SSL_CACERT_BADFILE;
else {
/* load trusted cacert from file if not blob */
if(conn_config->CAfile || conn_config->CApath) {
if(1 != wolfSSL_CTX_load_verify_locations(backend->ctx,
conn_config->CAfile,
conn_config->CApath)) {
if(conn_config->verifypeer && !imported_ca_info_blob &&
!imported_native_ca) {
/* Fail if we insist on successfully verifying the server. */
failf(data, "error setting certificate verify locations:"
" CAfile: %s CApath: %s",
conn_config->CAfile?
conn_config->CAfile: "none",
conn_config->CApath?
conn_config->CApath : "none");
return CURLE_SSL_CACERT_BADFILE;
}
else {
/* Just continue with a warning if no strict certificate
verification is required. */
infof(data, "error setting certificate verify locations,"
" continuing anyway:");
}
}
else {
/* Just continue with a warning if no strict certificate
verification is required. */
infof(data, "error setting certificate verify locations,"
" continuing anyway:");
/* Everything is fine. */
infof(data, "successfully set certificate verify locations:");
}
infof(data, " CAfile: %s",
conn_config->CAfile ? conn_config->CAfile : "none");
infof(data, " CApath: %s",
conn_config->CApath ? conn_config->CApath : "none");
}
else {
/* Everything is fine. */
infof(data, "successfully set certificate verify locations:");
}
infof(data, " CAfile: %s",
conn_config->CAfile ? conn_config->CAfile : "none");
infof(data, " CApath: %s",
conn_config->CApath ? conn_config->CApath : "none");
}
/* Load the client certificate, and private key */