romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-25 12:03:39 +03:00
Code Issues Projects Releases Packages Wiki Activity

CURLE_SSL_INSECURE is removed again and so is CURLOPT_SSL_INSECURE, we

Browse source 
proceed fine with the already existing options, just having a different
internal library default for capath.
This commit is contained in:
Daniel Stenberg 2002-08-30 11:09:49 +00:00
parent 5644f4a295
commit 0e0caf7c06
8 changed files with 51 additions and 62 deletions
Download patch file Download diff file Expand all files Collapse all files

1
lib/Makefile.am
View file

@ -72,5 +72,6 @@ $(srcdir)/getdate.c: getdate.y
install-data-hook:
@if test -n "@CURL_CA_BUNDLE@"; then \
$(mkinstalldirs) `dirname $(DESTDIR)@CURL_CA_BUNDLE@`; \
@INSTALL_DATA@ ca-bundle.crt $(DESTDIR)@CURL_CA_BUNDLE@; \
fi

6
lib/ssluse.c
View file

@ -722,7 +722,7 @@ Curl_SSLConnect(struct connectdata *conn)
data->set.key,
data->set.key_type)) {
/* failf() is already done in cert_stuff() */
return CURLE_SSL_CONNECT_ERROR;
return CURLE_SSL_CERTPROBLEM;
}
}
@ -730,7 +730,7 @@ Curl_SSLConnect(struct connectdata *conn)
if (!SSL_CTX_set_cipher_list(conn->ssl.ctx,
data->set.ssl.cipher_list)) {
failf(data, "failed setting cipher list");
return CURLE_SSL_CONNECT_ERROR;
return CURLE_SSL_CIPHER;
}
}
@ -743,7 +743,7 @@ Curl_SSLConnect(struct connectdata *conn)
data->set.ssl.CAfile,
data->set.ssl.CApath)) {
failf(data,"error setting cerficate verify locations");
return CURLE_SSL_CONNECT_ERROR;
return CURLE_SSL_CACERT;
}
}
else

31
lib/url.c
View file

@ -111,6 +111,7 @@
#include "ldap.h"
#include "url.h"
#include "connect.h"
#include "ca-bundle.h"
#include <curl/types.h>
@ -293,12 +294,23 @@ CURLcode Curl_open(struct SessionHandle **curl)
free(data);
return CURLE_OUT_OF_MEMORY;
}
/*
* libcurl 7.10 introduces SSL verification *by default*! This needs to be
* switched off unless wanted.
*/
data->set.ssl.verifypeer = TRUE;
data->set.ssl.verifyhost = 2;
#ifdef CURL_CA_BUNDLE
/* This is our prefered CA cert bundle since install time */
data->set.ssl.CAfile = CURL_CA_BUNDLE;
#endif
memset(data->state.connects, 0,
sizeof(struct connectdata *)*data->state.numconnects);
*curl = data;
return CURLE_OK;
}
@ -1051,10 +1063,6 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option, ...)
}
break;
case CURLOPT_SSL_INSECURE:
data->set.ssl.allow_insecure = va_arg(param, long)?TRUE:FALSE;
break;
case CURLOPT_PROXYTYPE:
/*
* Set proxy type. HTTP/SOCKS4/SOCKS5
@ -2247,17 +2255,6 @@ static CURLcode CreateConnection(struct SessionHandle *data,
return CURLE_UNSUPPORTED_PROTOCOL;
}
if(conn->protocol & PROT_SSL) {
/* If SSL is requested, require security level info */
if(!data->set.ssl.allow_insecure &&
!(data->set.ssl.CAfile || data->set.ssl.CApath)) {
failf(data, "Insecure SSL connect attempted without explicit permission granted");
return CURLE_SSL_INSECURE;
}
}
/*************************************************************
* Figure out the remote port number
*

2
lib/urldata.h
View file

@ -144,8 +144,6 @@ struct ssl_config_data {
char *random_file; /* path to file containing "random" data */
char *egdsocket; /* path to file containing the EGD daemon socket */
char *cipher_list; /* list of ciphers to use */
bool allow_insecure; /* allow connects without any CA certificate */
long numsessions; /* SSL session id cache size */
};