|
|
- From 5a1614cecdd57cab8b4ae3e9bc19dfff5ba77e80 Mon Sep 17 00:00:00 2001
- From: Alessandro Ghedini <alessandro@ghedini.me>
- Date: Sun, 8 Mar 2015 20:11:06 +0100
- Subject: [PATCH] gtls: add support for CURLOPT_CAPATH
-
- ---
- acinclude.m4 | 4 ++--
- docs/libcurl/opts/CURLOPT_CAPATH.3 | 5 ++---
- lib/vtls/gtls.c | 22 ++++++++++++++++++++++
- lib/vtls/gtls.h | 3 +++
- 4 files changed, 29 insertions(+), 5 deletions(-)
-
- --- a/acinclude.m4
- +++ b/acinclude.m4
- @@ -2614,8 +2614,8 @@ AC_HELP_STRING([--without-ca-path], [Don
- capath="no"
- elif test "x$want_capath" != "xno" -a "x$want_capath" != "xunset"; then
- dnl --with-ca-path given
- - if test "x$OPENSSL_ENABLED" != "x1" -a "x$POLARSSL_ENABLED" != "x1"; then
- - AC_MSG_ERROR([--with-ca-path only works with openSSL or PolarSSL])
- + if test "x$OPENSSL_ENABLED" != "x1" -a "x$GNUTLS_ENABLED" != "x1" -a "x$POLARSSL_ENABLED" != "x1"; then
- + AC_MSG_ERROR([--with-ca-path only works with OpenSSL, GnuTLS or PolarSSL])
- fi
- capath="$want_capath"
- ca="no"
- --- a/docs/libcurl/opts/CURLOPT_CAPATH.3
- +++ b/docs/libcurl/opts/CURLOPT_CAPATH.3
- @@ -43,9 +43,8 @@ All TLS based protocols: HTTPS, FTPS, IM
- .SH EXAMPLE
- TODO
- .SH AVAILABILITY
- -This option is OpenSSL-specific and does nothing if libcurl is built to use
- -GnuTLS. NSS-powered libcurl provides the option only for backward
- -compatibility.
- +This option is supported by the OpenSSL, GnuTLS and PolarSSL backends. The NSS
- +backend provides the option only for backward compatibility.
- .SH RETURN VALUE
- Returns CURLE_OK if TLS enabled, and CURLE_UNKNOWN_OPTION if not, or
- CURLE_OUT_OF_MEMORY if there was insufficient heap space.
- --- a/lib/vtls/gtls.c
- +++ b/lib/vtls/gtls.c
- @@ -98,6 +98,10 @@ static bool gtls_inited = FALSE;
- # define HAS_ALPN
- # endif
- # endif
- +
- +# if (GNUTLS_VERSION_NUMBER >= 0x030306)
- +# define HAS_CAPATH
- +# endif
- #endif
-
- /*
- @@ -463,6 +467,24 @@ gtls_connect_step1(struct connectdata *c
- rc, data->set.ssl.CAfile);
- }
-
- +#ifdef HAS_CAPATH
- + if(data->set.ssl.CApath) {
- + /* set the trusted CA cert directory */
- + rc = gnutls_certificate_set_x509_trust_dir(conn->ssl[sockindex].cred,
- + data->set.ssl.CApath,
- + GNUTLS_X509_FMT_PEM);
- + if(rc < 0) {
- + infof(data, "error reading ca cert file %s (%s)\n",
- + data->set.ssl.CAfile, gnutls_strerror(rc));
- + if(data->set.ssl.verifypeer)
- + return CURLE_SSL_CACERT_BADFILE;
- + }
- + else
- + infof(data, "found %d certificates in %s\n",
- + rc, data->set.ssl.CApath);
- + }
- +#endif
- +
- if(data->set.ssl.CRLfile) {
- /* set the CRL list file */
- rc = gnutls_certificate_set_x509_crl_file(conn->ssl[sockindex].cred,
- --- a/lib/vtls/gtls.h
- +++ b/lib/vtls/gtls.h
- @@ -53,6 +53,9 @@ void Curl_gtls_md5sum(unsigned char *tmp
- unsigned char *md5sum, /* output */
- size_t md5len);
-
- +/* this backend supports the CAPATH option */
- +#define have_curlssl_ca_path 1
- +
- /* API setup for GnuTLS */
- #define curlssl_init Curl_gtls_init
- #define curlssl_cleanup Curl_gtls_cleanup
|
