generic-library/curl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

cyassl.c: return the correct error code on no CA cert

Browse Source 
CyaSSL 3.0.0 returns a unique error code if no CA cert is available,
so translate that into CURLE_SSL_CACERT_BADFILE when peer verification
is requested.
This commit is contained in:
Dan Fandrich 2014-07-23 00:43:47 +02:00
parent cc52d776dd
commit 713f96ee0c
1 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
lib/vtls/cyassl.c
View File

@ -144,7 +144,7 @@ cyassl_connect_step1(struct connectdata *conn,
data->set.str[STRING_SSL_CAFILE], data->set.str[STRING_SSL_CAFILE],
data->set.str[STRING_SSL_CAPATH])) { data->set.str[STRING_SSL_CAPATH])) {
if(data->set.ssl.verifypeer) { if(data->set.ssl.verifypeer) {
/* Fail if we insiste on successfully verifying the server. */ /* Fail if we insist on successfully verifying the server. */
failf(data,"error setting certificate verify locations:\n" failf(data,"error setting certificate verify locations:\n"
" CAfile: %s\n CApath: %s", " CAfile: %s\n CApath: %s",
data->set.str[STRING_SSL_CAFILE]? data->set.str[STRING_SSL_CAFILE]?
@ -154,7 +154,7 @@ cyassl_connect_step1(struct connectdata *conn,
return CURLE_SSL_CACERT_BADFILE; return CURLE_SSL_CACERT_BADFILE;
} }
else { else {
/* Just continue with a warning if no strict certificate /* Just continue with a warning if no strict certificate
verification is required. */ verification is required. */
infof(data, "error setting certificate verify locations," infof(data, "error setting certificate verify locations,"
" continuing anyway:\n"); " continuing anyway:\n");
@ -299,6 +299,18 @@ cyassl_connect_step2(struct connectdata *conn,
} }
#endif #endif
} }
else if(ASN_NO_SIGNER_E == detail) {
if(data->set.ssl.verifypeer) {
failf(data, "\tCA signer not available for verification\n");
return CURLE_SSL_CACERT_BADFILE;
}
else {
/* Just continue with a warning if no strict certificate
verification is required. */
infof(data, "CA signer not available for verification, "
"continuing anyway\n");
}
}
else { else {
failf(data, "SSL_connect failed with error %d: %s", detail, failf(data, "SSL_connect failed with error %d: %s", detail,
ERR_error_string(detail, error_buffer)); ERR_error_string(detail, error_buffer));