diff options
| author | Curl Upstream <curl-library@cool.haxx.se> | 2018-10-30 16:54:00 (GMT) |
|---|---|---|
| committer | Brad King <brad.king@kitware.com> | 2018-10-31 13:41:28 (GMT) |
| commit | 9835e9075037db3d23ade0ef865c562b08cf6023 (patch) | |
| tree | 004b65c185c842dadac199a1ecca1de6bda566a0 /lib/vtls/nss.c | |
| parent | 18812a9c3d395b368d8f3d85394b346472c8e858 (diff) | |
| download | CMake-9835e9075037db3d23ade0ef865c562b08cf6023.zip CMake-9835e9075037db3d23ade0ef865c562b08cf6023.tar.gz CMake-9835e9075037db3d23ade0ef865c562b08cf6023.tar.bz2 | |
curl 2018-10-30 (19667715)
Code extracted from:
https://github.com/curl/curl.git
at commit 196677150f711a96c38ed123e621f1d4e995b2e5 (curl-7_62_0).
Diffstat (limited to 'lib/vtls/nss.c')
| -rw-r--r-- | lib/vtls/nss.c | 17 |
1 files changed, 10 insertions, 7 deletions
diff --git a/lib/vtls/nss.c b/lib/vtls/nss.c index 89f8183..a3d3e58 100644 --- a/lib/vtls/nss.c +++ b/lib/vtls/nss.c @@ -217,10 +217,15 @@ static const cipher_s cipherlist[] = { #endif }; +#ifdef WIN32 +static const char *pem_library = "nsspem.dll"; +static const char *trust_library = "nssckbi.dll"; +#else static const char *pem_library = "libnsspem.so"; -static SECMODModule *pem_module = NULL; - static const char *trust_library = "libnssckbi.so"; +#endif + +static SECMODModule *pem_module = NULL; static SECMODModule *trust_module = NULL; /* NSPR I/O layer we use to detect blocking direction during SSL handshake */ @@ -1522,7 +1527,6 @@ static bool is_nss_error(CURLcode err) { switch(err) { case CURLE_PEER_FAILED_VERIFICATION: - case CURLE_SSL_CACERT: case CURLE_SSL_CERTPROBLEM: case CURLE_SSL_CONNECT_ERROR: case CURLE_SSL_ISSUER_ERROR: @@ -1579,8 +1583,9 @@ static CURLcode nss_load_ca_certificates(struct connectdata *conn, infof(data, "%s %s\n", (result) ? "failed to load" : "loaded", trust_library); if(result == CURLE_FAILED_INIT) - /* make the error non-fatal if we are not going to verify peer */ - result = CURLE_SSL_CACERT_BADFILE; + /* If libnssckbi.so is not available (or fails to load), one can still + use CA certificates stored in NSS database. Ignore the failure. */ + result = CURLE_OK; } else if(!use_trust_module && trust_module) { /* libnssckbi.so not needed but already loaded --> unload it! */ @@ -1715,8 +1720,6 @@ static CURLcode nss_init_sslver(SSLVersionRange *sslver, failf(data, "unsupported min version passed via CURLOPT_SSLVERSION"); return result; } - if(max == CURL_SSLVERSION_MAX_NONE) - sslver->max = sslver->min; } switch(max) { |