luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ngtcp2: add ca-fallback support for OpenSSL backend

Browse Source 
Closes #8828
This commit is contained in:
Tatsuhiro Tsujikawa 2022-05-09 21:21:32 +09:00 committed by Daniel Stenberg
parent 1645e9b445
commit b01f3e679f
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 10 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
lib/vquic/ngtcp2.c
View File

@ -264,6 +264,7 @@ static SSL_QUIC_METHOD quic_method = {quic_set_encryption_secrets,
static SSL_CTX *quic_ssl_ctx(struct Curl_easy *data) static SSL_CTX *quic_ssl_ctx(struct Curl_easy *data)
{ {
struct connectdata *conn = data->conn;
SSL_CTX *ssl_ctx = SSL_CTX_new(TLS_method()); SSL_CTX *ssl_ctx = SSL_CTX_new(TLS_method());
SSL_CTX_set_min_proto_version(ssl_ctx, TLS1_3_VERSION); SSL_CTX_set_min_proto_version(ssl_ctx, TLS1_3_VERSION);
@ -291,12 +292,11 @@ static SSL_CTX *quic_ssl_ctx(struct Curl_easy *data)
SSL_CTX_set_keylog_callback(ssl_ctx, keylog_callback); SSL_CTX_set_keylog_callback(ssl_ctx, keylog_callback);
} }
{ if(conn->ssl_config.verifypeer) {
struct connectdata *conn = data->conn;
const char * const ssl_cafile = conn->ssl_config.CAfile; const char * const ssl_cafile = conn->ssl_config.CAfile;
const char * const ssl_capath = conn->ssl_config.CApath; const char * const ssl_capath = conn->ssl_config.CApath;
if(conn->ssl_config.verifypeer) { if(ssl_cafile || ssl_capath) {
SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, NULL); SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, NULL);
/* tell OpenSSL where to find CA certificates that are used to verify /* tell OpenSSL where to find CA certificates that are used to verify
the server's certificate. */ the server's certificate. */
@ -311,6 +311,13 @@ static SSL_CTX *quic_ssl_ctx(struct Curl_easy *data)
infof(data, " CAfile: %s", ssl_cafile ? ssl_cafile : "none"); infof(data, " CAfile: %s", ssl_cafile ? ssl_cafile : "none");
infof(data, " CApath: %s", ssl_capath ? ssl_capath : "none"); infof(data, " CApath: %s", ssl_capath ? ssl_capath : "none");
} }
#ifdef CURL_CA_FALLBACK
else {
/* verifying the peer without any CA certificates won't work so
use openssl's built-in default as fallback */
SSL_CTX_set_default_verify_paths(ssl_ctx);
}
#endif
} }
return ssl_ctx; return ssl_ctx;
} }