romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-06 18:06:15 +03:00
Code Issues Projects Releases Packages Wiki Activity

ngtcp2: verify the server certificate for the gnutls case

Browse source 
Closes #8178
This commit is contained in:
Daniel Stenberg 2021-12-25 16:14:53 +01:00
parent c148f0f551
commit 8fbd6feddf
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
3 changed files with 24 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

20
lib/vtls/gtls.c
View file

@ -808,10 +808,11 @@ static CURLcode pkp_pin_peer_pubkey(struct Curl_easy *data,
static Curl_recv gtls_recv;
static Curl_send gtls_send;
static CURLcode
gtls_connect_step3(struct Curl_easy *data,
struct connectdata *conn,
int sockindex)
CURLcode
Curl_gtls_verifyserver(struct Curl_easy *data,
struct connectdata *conn,
gnutls_session_t session,
int sockindex)
{
unsigned int cert_list_size;
const gnutls_datum_t *chainp;
@ -823,9 +824,6 @@ gtls_connect_step3(struct Curl_easy *data,
size_t size;
time_t certclock;
const char *ptr;
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
struct ssl_backend_data *backend = connssl->backend;
gnutls_session_t session = backend->session;
int rc;
gnutls_datum_t proto;
CURLcode result = CURLE_OK;
@ -1269,8 +1267,6 @@ gtls_connect_step3(struct Curl_easy *data,
}
conn->ssl[sockindex].state = ssl_connection_complete;
conn->recv[sockindex] = gtls_recv;
conn->send[sockindex] = gtls_send;
if(SSL_SET_OPTION(primary.sessionid)) {
/* we always unconditionally get the session id here, as even if we
@ -1355,9 +1351,13 @@ gtls_connect_common(struct Curl_easy *data,
/* Finish connecting once the handshake is done */
if(ssl_connect_1 == connssl->connecting_state) {
rc = gtls_connect_step3(data, conn, sockindex);
struct ssl_backend_data *backend = connssl->backend;
gnutls_session_t session = backend->session;
rc = Curl_gtls_verifyserver(data, conn, session, sockindex);
if(rc)
return rc;
conn->recv[sockindex] = gtls_recv;
conn->send[sockindex] = gtls_send;
}
*done = ssl_connect_1 == connssl->connecting_state;

6
lib/vtls/gtls.h
View file

@ -7,7 +7,7 @@
* | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) 1998 - 2020, Daniel Stenberg, <daniel@haxx.se>, et al.
* Copyright (C) 1998 - 2021, Daniel Stenberg, <daniel@haxx.se>, et al.
*
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
@ -28,6 +28,10 @@
#include "urldata.h"
CURLcode
Curl_gtls_verifyserver(struct Curl_easy *data, struct connectdata *conn,
gnutls_session_t session,
int sockindex);
extern const struct Curl_ssl Curl_ssl_gnutls;
#endif /* USE_GNUTLS */