You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
89 lines
3.2 KiB
89 lines
3.2 KiB
From 5a1614cecdd57cab8b4ae3e9bc19dfff5ba77e80 Mon Sep 17 00:00:00 2001
|
|
From: Alessandro Ghedini <alessandro@ghedini.me>
|
|
Date: Sun, 8 Mar 2015 20:11:06 +0100
|
|
Subject: [PATCH] gtls: add support for CURLOPT_CAPATH
|
|
|
|
---
|
|
acinclude.m4 | 4 ++--
|
|
docs/libcurl/opts/CURLOPT_CAPATH.3 | 5 ++---
|
|
lib/vtls/gtls.c | 22 ++++++++++++++++++++++
|
|
lib/vtls/gtls.h | 3 +++
|
|
4 files changed, 29 insertions(+), 5 deletions(-)
|
|
|
|
--- a/acinclude.m4
|
|
+++ b/acinclude.m4
|
|
@@ -2614,8 +2614,8 @@ AC_HELP_STRING([--without-ca-path], [Don
|
|
capath="no"
|
|
elif test "x$want_capath" != "xno" -a "x$want_capath" != "xunset"; then
|
|
dnl --with-ca-path given
|
|
- if test "x$OPENSSL_ENABLED" != "x1" -a "x$POLARSSL_ENABLED" != "x1"; then
|
|
- AC_MSG_ERROR([--with-ca-path only works with openSSL or PolarSSL])
|
|
+ if test "x$OPENSSL_ENABLED" != "x1" -a "x$GNUTLS_ENABLED" != "x1" -a "x$POLARSSL_ENABLED" != "x1"; then
|
|
+ AC_MSG_ERROR([--with-ca-path only works with OpenSSL, GnuTLS or PolarSSL])
|
|
fi
|
|
capath="$want_capath"
|
|
ca="no"
|
|
--- a/docs/libcurl/opts/CURLOPT_CAPATH.3
|
|
+++ b/docs/libcurl/opts/CURLOPT_CAPATH.3
|
|
@@ -43,9 +43,8 @@ All TLS based protocols: HTTPS, FTPS, IM
|
|
.SH EXAMPLE
|
|
TODO
|
|
.SH AVAILABILITY
|
|
-This option is OpenSSL-specific and does nothing if libcurl is built to use
|
|
-GnuTLS. NSS-powered libcurl provides the option only for backward
|
|
-compatibility.
|
|
+This option is supported by the OpenSSL, GnuTLS and PolarSSL backends. The NSS
|
|
+backend provides the option only for backward compatibility.
|
|
.SH RETURN VALUE
|
|
Returns CURLE_OK if TLS enabled, and CURLE_UNKNOWN_OPTION if not, or
|
|
CURLE_OUT_OF_MEMORY if there was insufficient heap space.
|
|
--- a/lib/vtls/gtls.c
|
|
+++ b/lib/vtls/gtls.c
|
|
@@ -98,6 +98,10 @@ static bool gtls_inited = FALSE;
|
|
# define HAS_ALPN
|
|
# endif
|
|
# endif
|
|
+
|
|
+# if (GNUTLS_VERSION_NUMBER >= 0x030306)
|
|
+# define HAS_CAPATH
|
|
+# endif
|
|
#endif
|
|
|
|
/*
|
|
@@ -463,6 +467,24 @@ gtls_connect_step1(struct connectdata *c
|
|
rc, data->set.ssl.CAfile);
|
|
}
|
|
|
|
+#ifdef HAS_CAPATH
|
|
+ if(data->set.ssl.CApath) {
|
|
+ /* set the trusted CA cert directory */
|
|
+ rc = gnutls_certificate_set_x509_trust_dir(conn->ssl[sockindex].cred,
|
|
+ data->set.ssl.CApath,
|
|
+ GNUTLS_X509_FMT_PEM);
|
|
+ if(rc < 0) {
|
|
+ infof(data, "error reading ca cert file %s (%s)\n",
|
|
+ data->set.ssl.CAfile, gnutls_strerror(rc));
|
|
+ if(data->set.ssl.verifypeer)
|
|
+ return CURLE_SSL_CACERT_BADFILE;
|
|
+ }
|
|
+ else
|
|
+ infof(data, "found %d certificates in %s\n",
|
|
+ rc, data->set.ssl.CApath);
|
|
+ }
|
|
+#endif
|
|
+
|
|
if(data->set.ssl.CRLfile) {
|
|
/* set the CRL list file */
|
|
rc = gnutls_certificate_set_x509_crl_file(conn->ssl[sockindex].cred,
|
|
--- a/lib/vtls/gtls.h
|
|
+++ b/lib/vtls/gtls.h
|
|
@@ -53,6 +53,9 @@ void Curl_gtls_md5sum(unsigned char *tmp
|
|
unsigned char *md5sum, /* output */
|
|
size_t md5len);
|
|
|
|
+/* this backend supports the CAPATH option */
|
|
+#define have_curlssl_ca_path 1
|
|
+
|
|
/* API setup for GnuTLS */
|
|
#define curlssl_init Curl_gtls_init
|
|
#define curlssl_cleanup Curl_gtls_cleanup
|