luo980/curl
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

quiche: support ca-fallback

Browse Source 
Follow-up to b01f3e679f which added this for ngtcp2/openssl

Removed from KNOWN_BUGS

Fixes #8696
Closes #8830
This commit is contained in:
Daniel Stenberg 2022-05-10 11:09:47 +02:00
parent bcf03dd213
commit fdb5e21b4d
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
2 changed files with 23 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
docs/KNOWN_BUGS
View File

@ -159,7 +159,6 @@ problems may have been fixed or changed somewhat since this was written.
18. HTTP/3
18.1 If the HTTP/3 server closes connection during upload curl hangs
18.2 Transfer closed with n bytes remaining to read
18.3 configure --with-ca-fallback is not supported by h3
18.4 timeout when reusing a http3 connection
18.9 connection migration does not work
@ -1126,10 +1125,6 @@ problems may have been fixed or changed somewhat since this was written.
https://github.com/curl/curl/issues/8523
18.3 configure --with-ca-fallback is not supported by h3
https://github.com/curl/curl/issues/8696
18.4 timeout when reusing a http3 connection
HTTP/3 with quiche seems to not work and always timeout a subsequent transfer

38
lib/vquic/quiche.c
View File

@ -201,23 +201,31 @@ static SSL_CTX *quic_ssl_ctx(struct Curl_easy *data)
{
struct connectdata *conn = data->conn;
const char * const ssl_cafile = conn->ssl_config.CAfile;
const char * const ssl_capath = conn->ssl_config.CApath;
if(conn->ssl_config.verifypeer) {
SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, NULL);
/* tell OpenSSL where to find CA certificates that are used to verify
the server's certificate. */
if(!SSL_CTX_load_verify_locations(ssl_ctx, ssl_cafile, ssl_capath)) {
/* Fail if we insist on successfully verifying the server. */
failf(data, "error setting certificate verify locations:"
" CAfile: %s CApath: %s",
ssl_cafile ? ssl_cafile : "none",
ssl_capath ? ssl_capath : "none");
return NULL;
const char * const ssl_cafile = conn->ssl_config.CAfile;
const char * const ssl_capath = conn->ssl_config.CApath;
if(ssl_cafile || ssl_capath) {
SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, NULL);
/* tell OpenSSL where to find CA certificates that are used to verify
the server's certificate. */
if(!SSL_CTX_load_verify_locations(ssl_ctx, ssl_cafile, ssl_capath)) {
/* Fail if we insist on successfully verifying the server. */
failf(data, "error setting certificate verify locations:"
" CAfile: %s CApath: %s",
ssl_cafile ? ssl_cafile : "none",
ssl_capath ? ssl_capath : "none");
return NULL;
}
infof(data, " CAfile: %s", ssl_cafile ? ssl_cafile : "none");
infof(data, " CApath: %s", ssl_capath ? ssl_capath : "none");
}
infof(data, " CAfile: %s", ssl_cafile ? ssl_cafile : "none");
infof(data, " CApath: %s", ssl_capath ? ssl_capath : "none");
#ifdef CURL_CA_FALLBACK
else {
/* verifying the peer without any CA certificates won't work so
use openssl's built-in default as fallback */
SSL_CTX_set_default_verify_paths(ssl_ctx);
}
#endif
}
}
return ssl_ctx;