moparisthebest/curl
1
0
Fork 0
mirror of https://github.com/moparisthebest/curl synced 2025-02-28 09:21:50 -05:00
Code Issues Releases Wiki Activity

cyassl: deal with lack of *get_peer_certificate

Browse Source 
The function is only present in wolfssl/cyassl if it was built with
--enable-opensslextra. With these checks added, pinning support is disabled
unless the TLS lib has that function available.

Also fix the mistake in configure that checks for the wrong lib name.

Closes #566
This commit is contained in:
Daniel Stenberg 2015-12-16 10:25:31 +01:00
parent 1ff3a07be9
commit 151da51404
2 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
configure.ac
View File

@ -2182,7 +2182,7 @@ if test "$curl_ssl_msg" = "$init_ssl_msg"; then
fi
if test "x$USE_CYASSL" = "xyes"; then
AC_MSG_NOTICE([detected CyaSSL])
AC_MSG_NOTICE([detected $cyassllibname])
dnl cyassl/ctaocrypt/types.h needs SIZEOF_LONG_LONG defined!
AC_CHECK_SIZEOF(long long)
@ -2195,9 +2195,14 @@ if test "$curl_ssl_msg" = "$init_ssl_msg"; then
LIBS="-l$cyassllibname -lm $LIBS"
if test "x$cyassllib" = "xwolfssl"; then
if test "x$cyassllibname" = "xwolfssl"; then
dnl Recent WolfSSL versions build without SSLv3 by default
AC_CHECK_FUNCS(wolfSSLv3_client_method)
dnl WolfSSL needs configure --enable-opensslextra to have *get_peer*
AC_CHECK_FUNCS(wolfSSLv3_client_method \
wolfSSL_get_peer_certificate)
else
dnl Cyassl needs configure --enable-opensslextra to have *get_peer*
AC_CHECK_FUNCS(CyaSSL_get_peer_certificate)
fi
if test -n "$cyassllib"; then

6
lib/vtls/cyassl.c
View File

@ -413,6 +413,8 @@ cyassl_connect_step2(struct connectdata *conn,
}
if(data->set.str[STRING_SSL_PINNEDPUBLICKEY]) {
#if defined(HAVE_WOLFSSL_GET_PEER_CERTIFICATE) || \
defined(HAVE_CYASSL_GET_PEER_CERTIFICATE)
X509 *x509;
const char *x509_der;
int x509_der_len;
@ -449,6 +451,10 @@ cyassl_connect_step2(struct connectdata *conn,
failf(data, "SSL: public key does not match pinned public key!");
return result;
}
#else
failf(data, "Library lacks pinning support built-in");
return CURLE_NOT_BUILT_IN;
#endif
}
conssl->connecting_state = ssl_connect_3;