romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 04:53:32 +03:00
Code Issues Projects Releases Packages Wiki Activity

openssl: CURLSSLOPT_NO_PARTIALCHAIN can disable partial cert chains

Browse source 
Closes #4655
This commit is contained in:
Daniel Stenberg 2019-12-02 10:55:33 +01:00
parent 94f1f77158
commit 564d88a8bd
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
6 changed files with 36 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

1
lib/setopt.c
View file

@ -2133,6 +2133,7 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
data->set.ssl.enable_beast =
(bool)((arg&CURLSSLOPT_ALLOW_BEAST) ? TRUE : FALSE);
data->set.ssl.no_revoke = !!(arg & CURLSSLOPT_NO_REVOKE);
data->set.ssl.no_partialchain = !!(arg & CURLSSLOPT_NO_PARTIALCHAIN);
break;
#ifndef CURL_DISABLE_PROXY

1
lib/urldata.h
View file

@ -257,6 +257,7 @@ struct ssl_config_data {
BIT(falsestart);
BIT(enable_beast); /* allow this flaw for interoperability's sake*/
BIT(no_revoke); /* disable SSL certificate revocation checks */
BIT(no_partialchain); /* don't accept partial certificate chains */
};
struct ssl_general_config {

14
lib/vtls/openssl.c
View file

@ -2786,12 +2786,14 @@ static CURLcode ossl_connect_step1(struct connectdata *conn, int sockindex)
X509_V_FLAG_TRUSTED_FIRST);
#endif
#ifdef X509_V_FLAG_PARTIAL_CHAIN
/* Have intermediate certificates in the trust store be treated as
trust-anchors, in the same way as self-signed root CA certificates
are. This allows users to verify servers using the intermediate cert
only, instead of needing the whole chain. */
X509_STORE_set_flags(SSL_CTX_get_cert_store(BACKEND->ctx),
X509_V_FLAG_PARTIAL_CHAIN);
if(!SSL_SET_OPTION(no_partialchain)) {
/* Have intermediate certificates in the trust store be treated as
trust-anchors, in the same way as self-signed root CA certificates
are. This allows users to verify servers using the intermediate cert
only, instead of needing the whole chain. */
X509_STORE_set_flags(SSL_CTX_get_cert_store(BACKEND->ctx),
X509_V_FLAG_PARTIAL_CHAIN);
}
#endif
}