romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 18:53:33 +03:00
Code Issues Projects Releases Packages Wiki Activity

vtls: move 'native_ca_store' ssl_config_data => ssl_primary_config

Browse source 
And include it as key for connection reuse matching.

Reported-by: Stanislav Fort

Closes #22668
This commit is contained in:
Daniel Stenberg 2026-08-25 13:47:11 +02:00
parent 7ea37abc6a
commit 7be1e70cb6
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
6 changed files with 16 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

6
lib/vtls/gtls.c
View file

@ -457,7 +457,7 @@ static CURLcode gtls_populate_creds(struct Curl_cfilter *cf,
} }
infof(data, "SSL Trust Anchors:"); infof(data, "SSL Trust Anchors:");
if(ssl_config->native_ca_store) { if(config->native_ca_store) {
#ifdef USE_APPLE_SECTRUST #ifdef USE_APPLE_SECTRUST
infof(data, " Native: Apple SecTrust"); infof(data, " Native: Apple SecTrust");
creds_are_empty = FALSE; creds_are_empty = FALSE;
@ -661,7 +661,7 @@ CURLcode Curl_gtls_client_trust_setup(struct Curl_cfilter *cf,
!conn_config->CApath && !conn_config->CApath &&
!conn_config->ca_info_blob && !conn_config->ca_info_blob &&
!ssl_config->primary.CRLfile && !ssl_config->primary.CRLfile &&
!ssl_config->native_ca_store && !conn_config->native_ca_store &&
!conn_config->clientcert; /* GnuTLS adds client cert to its credentials! */ !conn_config->clientcert; /* GnuTLS adds client cert to its credentials! */
if(cache_criteria_met) if(cache_criteria_met)
@ -1604,7 +1604,7 @@ static CURLcode gtls_verify_cert(struct Curl_easy *data,
infof(data, " SSL certificate verified by GnuTLS"); infof(data, " SSL certificate verified by GnuTLS");
#ifdef USE_APPLE_SECTRUST #ifdef USE_APPLE_SECTRUST
if(!verified && ssl_config->native_ca_store) { if(!verified && config->native_ca_store) {
CURLcode result = CURLcode result =
Curl_vtls_apple_verify(cf, data, peer, chain->num_certs, Curl_vtls_apple_verify(cf, data, peer, chain->num_certs,
gtls_chain_get_der, chain, NULL, 0); gtls_chain_get_der, chain, NULL, 0);

9
lib/vtls/openssl.c
View file

@ -2999,7 +2999,6 @@ static CURLcode ossl_load_trust_anchors(struct Curl_cfilter *cf,
X509_STORE *store) X509_STORE *store)
{ {
struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf); struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
CURLcode result = CURLE_OK; CURLcode result = CURLE_OK;
const char * const ssl_cafile = const char * const ssl_cafile =
/* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */ /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
@ -3008,7 +3007,7 @@ static CURLcode ossl_load_trust_anchors(struct Curl_cfilter *cf,
bool have_native_check = FALSE; bool have_native_check = FALSE;
octx->store_is_empty = TRUE; octx->store_is_empty = TRUE;
if(ssl_config->native_ca_store) { if(conn_config->native_ca_store) {
#ifdef USE_WIN32_CRYPTO #ifdef USE_WIN32_CRYPTO
bool added = FALSE; bool added = FALSE;
result = ossl_windows_load_anchors(cf, data, store, &added); result = ossl_windows_load_anchors(cf, data, store, &added);
@ -3316,7 +3315,7 @@ CURLcode Curl_ssl_setup_x509_store(struct Curl_cfilter *cf,
!conn_config->CApath && !conn_config->CApath &&
!conn_config->ca_info_blob && !conn_config->ca_info_blob &&
!ssl_config->primary.CRLfile && !ssl_config->primary.CRLfile &&
!ssl_config->native_ca_store; !conn_config->native_ca_store;
ERR_set_mark(); ERR_set_mark();
@ -3370,7 +3369,7 @@ static bool ossl_apply_session(
(SSL_get_verify_result(octx->ssl) != X509_V_OK) (SSL_get_verify_result(octx->ssl) != X509_V_OK)
#ifdef USE_APPLE_SECTRUST #ifdef USE_APPLE_SECTRUST
/* if sectrust is used and verified the session before */ /* if sectrust is used and verified the session before */
&& (!ssl_config->native_ca_store || !scs->sectrust_verified) && (!conn_cfg->native_ca_store || !scs->sectrust_verified)
#endif #endif
) { ) {
/* Session was from unverified connection, cannot reuse here */ /* Session was from unverified connection, cannot reuse here */
@ -4835,7 +4834,7 @@ CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf,
infof(data, "SSL certificate verified via OpenSSL."); infof(data, "SSL certificate verified via OpenSSL.");
#ifdef USE_APPLE_SECTRUST #ifdef USE_APPLE_SECTRUST
if(!verified && conn_config->verifypeer && ssl_config->native_ca_store) { if(!verified && conn_config->verifypeer && conn_config->native_ca_store) {
/* we verify using Apple SecTrust *unless* OpenSSL already verified. /* we verify using Apple SecTrust *unless* OpenSSL already verified.
* This may happen if the application intercepted the OpenSSL callback * This may happen if the application intercepted the OpenSSL callback
* and installed its own. */ * and installed its own. */

2
lib/vtls/rustls.c
View file

@ -1049,7 +1049,7 @@ static CURLcode cr_init_backend(struct Curl_cfilter *cf,
rustls_client_config_builder_dangerous_set_certificate_verifier( rustls_client_config_builder_dangerous_set_certificate_verifier(
config_builder, cr_verify_none); config_builder, cr_verify_none);
} }
else if(ssl_config->native_ca_store) { else if(conn_config->native_ca_store) {
if(conn_config->CRLfile) { if(conn_config->CRLfile) {
failf(data, "rustls: CRL file not supported with native CA store; " failf(data, "rustls: CRL file not supported with native CA store; "
"the platform verifier has no CRL attachment API"); "the platform verifier has no CRL attachment API");

8
lib/vtls/vtls_config.c
View file

@ -141,6 +141,7 @@ static bool match_ssl_primary_config(struct Curl_easy *data,
if((c1->version == c2->version) && if((c1->version == c2->version) &&
(c1->version_max == c2->version_max) && (c1->version_max == c2->version_max) &&
(c1->ssl_options == c2->ssl_options) && (c1->ssl_options == c2->ssl_options) &&
(c1->native_ca_store == c2->native_ca_store) &&
(c1->verifypeer == c2->verifypeer) && (c1->verifypeer == c2->verifypeer) &&
(c1->verifyhost == c2->verifyhost) && (c1->verifyhost == c2->verifyhost) &&
(c1->verifystatus == c2->verifystatus) && (c1->verifystatus == c2->verifystatus) &&
@ -192,6 +193,7 @@ static bool clone_ssl_primary_config(struct ssl_primary_config *source,
dest->verifypeer = source->verifypeer; dest->verifypeer = source->verifypeer;
dest->verifyhost = source->verifyhost; dest->verifyhost = source->verifyhost;
dest->verifystatus = source->verifystatus; dest->verifystatus = source->verifystatus;
dest->native_ca_store = source->native_ca_store;
dest->cache_session = source->cache_session; dest->cache_session = source->cache_session;
dest->ssl_options = source->ssl_options; dest->ssl_options = source->ssl_options;
@ -225,7 +227,7 @@ static void ssl_easy_config_compl_options(struct Curl_peer *origin,
/* If set via CURLOPT_(PROXY_)SSL_OPTIONS, we definitely use it. /* If set via CURLOPT_(PROXY_)SSL_OPTIONS, we definitely use it.
* If not, we switch it on for supported backends if no custom * If not, we switch it on for supported backends if no custom
* CA settings exist. */ * CA settings exist. */
sslc->native_ca_store = !!(options & CURLSSLOPT_NATIVE_CA); sslc->primary.native_ca_store = !!(options & CURLSSLOPT_NATIVE_CA);
sslc->enable_beast = !!(options & CURLSSLOPT_ALLOW_BEAST); sslc->enable_beast = !!(options & CURLSSLOPT_ALLOW_BEAST);
sslc->no_partialchain = !!(options & CURLSSLOPT_NO_PARTIALCHAIN); sslc->no_partialchain = !!(options & CURLSSLOPT_NO_PARTIALCHAIN);
sslc->no_revoke = !!(options & CURLSSLOPT_NO_REVOKE); sslc->no_revoke = !!(options & CURLSSLOPT_NO_REVOKE);
@ -256,7 +258,7 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data,
if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) { if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
#if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE) #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob) if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
sslc->native_ca_store = TRUE; sslc->primary.native_ca_store = TRUE;
#endif #endif
#ifdef CURL_CA_PATH #ifdef CURL_CA_PATH
if(!sslc->custom_capath && !CURL_EASY_STR(data, STRING_SSL_CAPATH)) { if(!sslc->custom_capath && !CURL_EASY_STR(data, STRING_SSL_CAPATH)) {
@ -317,7 +319,7 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data,
if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) { if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
#if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE) #if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob) if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
sslc->native_ca_store = TRUE; sslc->primary.native_ca_store = TRUE;
#endif #endif
#ifdef CURL_CA_PATH #ifdef CURL_CA_PATH
if(!sslc->custom_capath && if(!sslc->custom_capath &&

2
lib/vtls/vtls_config.h
View file

@ -54,6 +54,7 @@ struct ssl_primary_config {
BIT(verifypeer); /* set TRUE if this is desired */ BIT(verifypeer); /* set TRUE if this is desired */
BIT(verifyhost); /* set TRUE if CN/SAN must match hostname */ BIT(verifyhost); /* set TRUE if CN/SAN must match hostname */
BIT(verifystatus); /* set TRUE if certificate status must be checked */ BIT(verifystatus); /* set TRUE if certificate status must be checked */
BIT(native_ca_store); /* use the native CA store of operating system */
BIT(cache_session); /* cache session or not */ BIT(cache_session); /* cache session or not */
BIT(deep_copy); /* members are deep copies, eg. owned here */ BIT(deep_copy); /* members are deep copies, eg. owned here */
}; };
@ -70,7 +71,6 @@ struct ssl_config_data {
BIT(no_partialchain); /* do not accept partial certificate chains */ BIT(no_partialchain); /* do not accept partial certificate chains */
BIT(revoke_best_effort); /* ignore SSL revocation offline/missing revocation BIT(revoke_best_effort); /* ignore SSL revocation offline/missing revocation
list errors */ list errors */
BIT(native_ca_store); /* use the native CA store of operating system */
BIT(auto_client_cert); /* automatically locate and use a client BIT(auto_client_cert); /* automatically locate and use a client
certificate for authentication (Schannel) */ certificate for authentication (Schannel) */
BIT(custom_cafile); /* application has set custom CA file */ BIT(custom_cafile); /* application has set custom CA file */

5
lib/vtls/wolfssl.c
View file

@ -592,7 +592,6 @@ static CURLcode wssl_populate_x509_store(struct Curl_cfilter *cf,
/* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */ /* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
(ca_info_blob ? NULL : conn_config->CAfile); (ca_info_blob ? NULL : conn_config->CAfile);
const char * const ssl_capath = conn_config->CApath; const char * const ssl_capath = conn_config->CApath;
struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
bool imported_native_ca = FALSE; bool imported_native_ca = FALSE;
bool imported_ca_info_blob = FALSE; bool imported_ca_info_blob = FALSE;
@ -601,7 +600,7 @@ static CURLcode wssl_populate_x509_store(struct Curl_cfilter *cf,
#ifndef NO_FILESYSTEM #ifndef NO_FILESYSTEM
/* load native CA certificates */ /* load native CA certificates */
if(ssl_config->native_ca_store) { if(conn_config->native_ca_store) {
#ifdef WOLFSSL_SYS_CA_CERTS #ifdef WOLFSSL_SYS_CA_CERTS
if(wolfSSL_CTX_load_system_CA_certs(wssl->ssl_ctx) != WOLFSSL_SUCCESS) { if(wolfSSL_CTX_load_system_CA_certs(wssl->ssl_ctx) != WOLFSSL_SUCCESS) {
infof(data, "error importing native CA store, continuing anyway"); infof(data, "error importing native CA store, continuing anyway");
@ -809,7 +808,7 @@ CURLcode Curl_wssl_setup_x509_store(struct Curl_cfilter *cf,
!conn_config->CApath && !conn_config->CApath &&
!conn_config->ca_info_blob && !conn_config->ca_info_blob &&
!ssl_config->primary.CRLfile && !ssl_config->primary.CRLfile &&
!ssl_config->native_ca_store; !conn_config->native_ca_store;
cached_store = cache_criteria_met ? wssl_get_cached_x509_store(cf, data) cached_store = cache_criteria_met ? wssl_get_cached_x509_store(cf, data)
: NULL; : NULL;