romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 21:03:34 +03:00
Code Issues Projects Releases Packages Wiki Activity

mbedTLS: add support for CURLOPT_CAINFO_BLOB

Browse source 
Closes #8071
This commit is contained in:
Florian Van Heghe 2021-11-29 15:22:33 +01:00 • committed by Daniel Stenberg
parent aae235b6ba
commit 8443f975c0
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
2 changed files with 21 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
docs/libcurl/opts/CURLOPT_CAINFO_BLOB.3
View file

@ -61,7 +61,7 @@ if(curl) {
.SH AVAILABILITY
Added in 7.77.0.
This option is supported by the BearSSL (since 7.79.0),
This option is supported by the BearSSL (since 7.79.0), mbedTLS (since 7.81.0),
OpenSSL, Secure Transport and Schannel backends.
.SH RETURN VALUE
Returns CURLE_OK if the option is supported, CURLE_UNKNOWN_OPTION if not, or

21
lib/vtls/mbedtls.c
View file

@ -270,7 +270,10 @@ mbed_connect_step1(struct Curl_easy *data, struct connectdata *conn,
{
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
struct ssl_backend_data *backend = connssl->backend;
const char * const ssl_cafile = SSL_CONN_CONFIG(CAfile);
const struct curl_blob *ca_info_blob = SSL_CONN_CONFIG(ca_info_blob);
const char * const ssl_cafile =
/* CURLOPT_CAINFO_BLOB overrides CURLOPT_CAINFO */
(ca_info_blob ? NULL : SSL_CONN_CONFIG(CAfile));
const bool verifypeer = SSL_CONN_CONFIG(verifypeer);
const char * const ssl_capath = SSL_CONN_CONFIG(CApath);
char * const ssl_cert = SSL_SET_OPTION(primary.clientcert);
@ -316,6 +319,21 @@ mbed_connect_step1(struct Curl_easy *data, struct connectdata *conn,
/* Load the trusted CA */
mbedtls_x509_crt_init(&backend->cacert);
if(ca_info_blob) {
const unsigned char *blob_data = (const unsigned char *)ca_info_blob->data;
ret = mbedtls_x509_crt_parse(&backend->cacert, blob_data,
ca_info_blob->len);
if(ret<0) {
mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
failf(data, "Error importing ca cert blob %s - mbedTLS: (-0x%04X) %s",
ca_info_blob, -ret, errorbuf);
if(verifypeer)
return ret;
}
}
if(ssl_cafile) {
ret = mbedtls_x509_crt_parse_file(&backend->cacert, ssl_cafile);
@ -1154,6 +1172,7 @@ const struct Curl_ssl Curl_ssl_mbedtls = {
{ CURLSSLBACKEND_MBEDTLS, "mbedtls" }, /* info */
SSLSUPP_CA_PATH |
SSLSUPP_CAINFO_BLOB |
SSLSUPP_PINNEDPUBKEY |
SSLSUPP_SSL_CTX,