✓ProveIt
Examples / Report #3969368 Saved analysis

CVE-2026-80231: native CA store conn reuse

curl · 2026-08-2519.4s analysis · $0.023 in model calls

What the report claims

A transfer expecting SecTrust verification silently inherits an OpenSSL-only verified connection due to mismatched native_ca_store handling during connection reuse on macOS.

Compare with curl's recorded outcome

Known vulnerability

A real vulnerability: CVE-2026-80231 native CA store conn reuse

Shown for comparison after analysis. The pipeline did not see this label.

ProveIt's finding

Code supports the claim

The code supports the reported flaw. A maintainer should review its impact and decide what to do next.

Why this finding?
  • The release curl-8_21_0 lacks native_ca_store in ssl_primary_config and does not compare it in match_ssl_primary_config (lines 144-180 of vtls_config.c@curl-8_21_0).
  • Curl_ssl_easy_config_complete in the release auto-sets native_ca_store=TRUE when no custom CA is configured (line 270) and auto-fills primary.CAfile from CURL_CA_BUNDLE (lines 279-284), creating the exact mismatch the report describes.
  • Connection reuse via Curl_ssl_conn_config_match calls the flawed match_ssl_primary_config, so Transfer B silently inherits Transfer A's OpenSSL-verified connection instead of performing SecTrust verification.
  • Master (7be1e70cb6bc) already fixed this via commit 7be1e70cb6 which moved native_ca_store into ssl_primary_config and added the comparison (current master line 144), but the flaw exists in the latest release.
How this analysis ran 5 claims · 11 citations verified

Checked against curl master on 2026-08-25 (7be1e70cb6bc). Dev evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.

1 · Grounding
partially grounded
no model · 11 references checked out, 1 did not
2 · Claims
NVIDIA-Nemotron-3-Nano-30B-A3B
5 claims · 1794 tokens · $0.0002
3 · Evidence
6 code snippets
real curl source at 7be1e70cb6bc · 3 docs via Tavily
4 · Judgment
Nemotron-3-Ultra-550b-a55b
15796 tokens · 17.4s · $0.0226
5 · Receipts
11 of 11 citations verified
every citation must point at code the judge was shown
Review a draft reply to the reporter

Edit and verify before sending.

Thank you for the detailed report. The flaw exists in curl-8.21.0: native_ca_store is not part of ssl_primary_config, so match_ssl_primary_config does not compare it, causing connection reuse between transfers with different native CA store settings. Master already contains the fix (commit 7be1e70cb6). We will ensure the fix is in the next release. Could you confirm the reproduction works with curl-8.21.0?

Inspect all claims and source code 5 claims · 6 code excerpts

Report claims

C1flaw supported

native_ca_store is not part of ssl_primary_config, so match_ssl_primary_config does not compare it

Read the reasoning

In the release version (curl-8_21_0), match_ssl_primary_config compares many fields but native_ca_store is absent from both the struct and the comparison. Master (7be1e70cb6bc) fixed this via commit 7be1e70cb6 which moved native_ca_store into ssl_primary_config and added the comparison at line 144 of current master.

lib/vtls/vtls_config.c@curl-8_21_0:144 lib/vtls/vtls_config.c@curl-8_21_0:144
C2location supported

native_ca_store is in struct ssl_config_data (line 73 of vtls_config.h)

Read the reasoning

In the release, native_ca_store is a member of ssl_config_data (sslc), not ssl_primary_config. The deterministic check for master line 73 is irrelevant; the report describes the release code.

lib/vtls/vtls_config.c@curl-8_21_0:260 lib/vtls/vtls_config.c@curl-8_21_0:259
C3trigger supported

CURL_CA_BUNDLE is defined and no CURLOPT_CAINFO is set, causing auto-fill to set primary.CAfile and native_ca_store=TRUE

Read the reasoning

When CURL_CA_BUNDLE is defined and no custom CA file is set (custom_cafile=FALSE), the auto-fill sets primary.CAfile to the bundle path and also sets native_ca_store=TRUE (since custom_capath, custom_cafile, custom_cablob are all false). Transfer A explicitly sets CURLOPT_CAINFO making custom_cafile=TRUE, blocking the auto-set of native_ca_store (stays FALSE) but ending up with the same primary.CAfile.

lib/vtls/vtls_config.c@curl-8_21_0:269 lib/vtls/vtls_config.c@curl-8_21_0:279 lib/vtls/vtls_config.c@curl-8_21_0:287
C4impact supported

Transfer B inherits Transfer A's connection without SecTrust verification running

Read the reasoning

Because match_ssl_primary_config in the release does not compare native_ca_store, two transfers with identical primary.CAfile and ssl_options but different native_ca_store (FALSE vs TRUE) will match, causing connection reuse. Transfer B inherits Transfer A's OpenSSL-verified connection without SecTrust running.

lib/vtls/vtls_config.c@curl-8_21_0:144 lib/vtls/vtls_config.c:171
C5reproduction supported

macOS baremetal build with -DUSE_APPLE_SECTRUST=ON -DCURL_CA_BUNDLE=<path> -DCURL_USE_OPENSSL=ON shows "Reusing existing https: connection" for Transfer B

Read the reasoning

The code path matches the reproduction: with USE_APPLE_SECTRUST and CURL_CA_BUNDLE defined, Transfer A (explicit CAINFO) gets native_ca_store=FALSE, Transfer B (no CAINFO) gets native_ca_store=TRUE and same CAfile. match_ssl_primary_config in release sees them as equal, logs connection reuse. The exact log message is not in provided snippets but the logic is sound.

lib/vtls/vtls_config.c@curl-8_21_0:269 lib/vtls/vtls_config.c@curl-8_21_0:279

Deterministic checks that failed

  • line none of native_ca_store, ssl_primary_config, match_ssl_primary_config, Curl_ssl_easy_config_complete appear near line 73 at 7be1e70cb6bc; it reads: 'list errors */'
Read the original report

Full report on HackerOne ↗

## Summary `native_ca_store` is in `struct ssl_config_data` (line 73 of `vtls_config.h`), not `ssl_primary_config`. `match_ssl_primary_config()` does not compare it. On macOS, `Curl_ssl_easy_config_complete()` (line 258) auto-sets `native_ca_store = TRUE` when no custom CA is configured — without modifying `ssl_options`. When `CURL_CA_BUNDLE` is defined, the auto-fill gives both transfers the same `primary.CAfile`, making all primary config fields match while `native_ca_store` differs. Transfer A (explicit `CURLOPT_CAINFO` = `CURL_CA_BUNDLE` path): `custom_cafile=TRUE`, auto-setting prevented, `native_ca_store=FALSE` — OpenSSL-only verification. Transfer B (no `CURLOPT_CAINFO`): auto-fill sets same `CAfile`, `custom_cafile=FALSE`, auto `native_ca_store=TRUE` — intended SecTrust verification. `match_ssl_primary_config` sees matching `CAfile` + `ssl_options` → connection reused. B inherits A's connection without SecTrust ever running. ## Reproduction macOS baremetal (`poc-native-ca.c`), built with `-DUSE_APPLE_SECTRUST=ON -DCURL_CA_BUNDLE=<path> -DCURL_USE_OPENSSL=ON`: 1. Transfer A: explicit `CURLOPT_CAINFO` = `CURL_CA_BUNDLE` path → OpenSSL verifies 2. Transfer B: no `CAINFO` → auto-fill, auto `native_ca_store=TRUE` → should use SecTrust 3. Observe: `"Reusing existing https: connection"` — SecTrust never runs ## Root cause trace 1. `Curl_ssl_easy_config_complete()` (line 258): `!custom_capath && !custom_cafile && !custom_cablob` → `native_ca_store = TRUE`. Does NOT modify `ssl_options`. 2. `CURL_CA_BUNDLE` auto-fill (line 269): sets `STRING_SSL_CAFILE` → `primary.CAfile` = bundle path. 3. Transfer A explicitly sets `CURLOPT_CAINFO` to the same path → `custom_cafile=TRUE`, auto-setting prevented, `native_ca_store=FALSE`. Same `primary.CAfile`, same `ssl_options=0`. 4. `match_ssl_primary_config` matches all fields → connection reused. `native_ca_store` not compared. ## Remediation Move `native_ca_store` into `ssl_primary_config` so `match_ssl_primary_config()` compares it. Or add an explicit check in `Curl_ssl_conn_config_match()`. ## Impact A transfer expecting SecTrust verification silently inherits an OpenSSL-only verified connection (or vice versa). Certificates trusted by one policy but not the other pass without re-verification.

Source code

lib/vtls/vtls_config.c@curl-8_21_0lines 144–180 · definition of match_ssl_primary_config as in release curl-8_21_0; differs from master; commits that changed it since: 7be1e70cb6 vtls: move 'native_ca_store' ssl_config_data => ssl_primary_config | 69ac867f98 TLS: drop support for TLS-SRP
144static bool match_ssl_primary_config(struct Curl_easy *data,
C1: match_ssl_primary_config in release curl-8_21_0 does not compare native_ca_store (lines 149-176)
C1: ssl_primary_config struct in release lacks native_ca_store field
C4: match_ssl_primary_config lacks native_ca_store comparison
145 struct ssl_primary_config *c1,
146 struct ssl_primary_config *c2)
147{
148 (void)data;
149 if((c1->version == c2->version) &&
150 (c1->version_max == c2->version_max) &&
151 (c1->ssl_options == c2->ssl_options) &&
152 (c1->verifypeer == c2->verifypeer) &&
153 (c1->verifyhost == c2->verifyhost) &&
154 (c1->verifystatus == c2->verifystatus) &&
155 blobcmp(c1->cert_blob, c2->cert_blob) &&
156 blobcmp(c1->ca_info_blob, c2->ca_info_blob) &&
157 blobcmp(c1->issuercert_blob, c2->issuercert_blob) &&
158 blobcmp(c1->key_blob, c2->key_blob) &&
159 Curl_safecmp(c1->CApath, c2->CApath) &&
160 Curl_safecmp(c1->CAfile, c2->CAfile) &&
161 Curl_safecmp(c1->issuercert, c2->issuercert) &&
162 Curl_safecmp(c1->clientcert, c2->clientcert) &&
163#ifdef USE_TLS_SRP
164 !Curl_timestrcmp(c1->username, c2->username) &&
165 !Curl_timestrcmp(c1->password, c2->password) &&
166#endif
167 curl_strequal(c1->cipher_list, c2->cipher_list) &&
168 curl_strequal(c1->cipher_list13, c2->cipher_list13) &&
169 curl_strequal(c1->curves, c2->curves) &&
170 curl_strequal(c1->signature_algorithms, c2->signature_algorithms) &&
171 Curl_safecmp(c1->CRLfile, c2->CRLfile) &&
172 Curl_safecmp(c1->pinned_key, c2->pinned_key) &&
173 curl_strequal(c1->cert_type, c2->cert_type) &&
174 Curl_safecmp(c1->key, c2->key) &&
175 curl_strequal(c1->key_type, c2->key_type) &&
176 !Curl_timestrcmp(c1->key_passwd, c2->key_passwd))
177 return TRUE;
178
179 return FALSE;
180}
lib/vtls/vtls_config.c@curl-8_21_0lines 256–380 · definition of Curl_ssl_easy_config_complete as in release curl-8_21_0; differs from master; commits that changed it since: 7be1e70cb6 vtls: move 'native_ca_store' ssl_config_data => ssl_primary_config | c8df3defd9 lib: new easy option string storage | 69ac867f98 TLS: drop support for TLS-SRP
256CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data,
257 struct Curl_peer *origin)
258{
259 struct ssl_config_data *sslc = &data->set.ssl;
C2: struct ssl_config_data *sslc = &data->set.ssl;
260#if defined(CURL_CA_PATH) || defined(CURL_CA_BUNDLE)
C2: sslc is struct ssl_config_data*; line 270 sets sslc->native_ca_store = TRUE
261 struct UserDefined *set = &data->set;
262 CURLcode result;
263#endif
264
265 ssl_easy_config_compl_options(origin, data->state.initial_origin, sslc);
266
267 if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
268#if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
269 if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
C3: if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob) sslc->native_ca_store = TRUE;
C5: Auto-set of native_ca_store=TRUE guarded by USE_APPLE_SECTRUST || CURL_CA_NATIVE
270 sslc->native_ca_store = TRUE;
271#endif
272#ifdef CURL_CA_PATH
273 if(!sslc->custom_capath && !set->str[STRING_SSL_CAPATH]) {
274 result = Curl_setstropt(&set->str[STRING_SSL_CAPATH], CURL_CA_PATH);
275 if(result)
276 return result;
277 }
278#endif
279#ifdef CURL_CA_BUNDLE
C3: #ifdef CURL_CA_BUNDLE block sets STRING_SSL_CAFILE to CURL_CA_BUNDLE when !sslc->custom_cafile
C5: CURL_CA_BUNDLE auto-fill sets primary.CAfile
280 if(!sslc->custom_cafile && !set->str[STRING_SSL_CAFILE]) {
281 result = Curl_setstropt(&set->str[STRING_SSL_CAFILE], CURL_CA_BUNDLE);
282 if(result)
283 return result;
284 }
285#endif
286 }
287 sslc->primary.CAfile = data->set.str[STRING_SSL_CAFILE];
C3: sslc->primary.CAfile = ssl_easy_steal(data, STRING_SSL_CAFILE_PROXY);
288 sslc->primary.CRLfile = data->set.str[STRING_SSL_CRLFILE];
289 sslc->primary.CApath = data->set.str[STRING_SSL_CAPATH];
290 sslc->primary.cipher_list = data->set.str[STRING_SSL_CIPHER_LIST];
291 sslc->primary.cipher_list13 = data->set.str[STRING_SSL_CIPHER13_LIST];
292 sslc->primary.signature_algorithms =
293 data->set.str[STRING_SSL_SIGNATURE_ALGORITHMS];
294 sslc->primary.ca_info_blob = data->set.blobs[BLOB_CAINFO];
295 sslc->primary.curves = data->set.str[STRING_SSL_EC_CURVES];
296 /* Maybe these should not be used for another origin. But for
297 * backwards compatibility, keep them in. */
298 sslc->primary.issuercert = data->set.str[STRING_SSL_ISSUERCERT];
299 sslc->primary.issuercert_blob = data->set.blobs[BLOB_SSL_ISSUERCERT];
300
301 if(Curl_peer_equal(data->state.initial_origin, origin)) {
302 sslc->primary.pinned_key = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
303 sslc->primary.cert_blob = data->set.blobs[BLOB_CERT];
304 sslc->primary.cert_type = data->set.str[STRING_CERT_TYPE];
305 sslc->primary.key = data->set.str[STRING_KEY];
306 sslc->primary.key_type = data->set.str[STRING_KEY_TYPE];
307 sslc->primary.key_passwd = data->set.str[STRING_KEY_PASSWD];
308 sslc->primary.clientcert = data->set.str[STRING_CERT];
309 sslc->primary.key_blob = data->set.blobs[BLOB_KEY];
310#ifdef USE_TLS_SRP
311 sslc->primary.username = data->set.str[STRING_TLSAUTH_USERNAME];
312 sslc->primary.password = data->set.str[STRING_TLSAUTH_PASSWORD];
313#endif
314 }
315 else {
316 sslc->primary.pinned_key = NULL;
317 sslc->primary.cert_blob = NULL;
318 sslc->primary.cert_type = NULL;
319 sslc->primary.key = NULL;
320 sslc->primary.key_type = NULL;
321 sslc->primary.key_passwd = NULL;
322 sslc->primary.clientcert = NULL;
323 sslc->primary.key_blob = NULL;
324#ifdef USE_TLS_SRP
325 sslc->primary.username = NULL;
326 sslc->primary.password = NULL;
327#endif
328 }
329
330#ifndef CURL_DISABLE_PROXY
331 sslc = &data->set.proxy_ssl;
332 /* no initial origin for proxy, it is not changed for redirects */
333 ssl_easy_config_compl_options(NULL, NULL, sslc);
334
335 if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
336#if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
337 if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
338 sslc->native_ca_store = TRUE;
339#endif
340#ifdef CURL_CA_PATH
341 if(!sslc->custom_capath && !set->str[STRING_SSL_CAPATH_PROXY]) {
342 result = Curl_setstropt(&set->str[STRING_SSL_CAPATH_PROXY],
343 CURL_CA_PATH);
344 if(result)
345 return result;
346 }
347#endif
348#ifdef CURL_CA_BUNDLE
349 if(!sslc->custom_cafile && !set->str[STRING_SSL_CAFILE_PROXY]) {
350 result = Curl_setstropt(&set->str[STRING_SSL_CAFILE_PROXY],
351 CURL_CA_BUNDLE);
352 if(result)
353 return result;
354 }
355#endif
356 }
357 sslc->primary.CAfile = data->set.str[STRING_SSL_CAFILE_PROXY];
358 sslc->primary.CApath = data->set.str[STRING_SSL_CAPATH_PROXY];
359 sslc->primary.cipher_list = data->set.str[STRING_SSL_CIPHER_LIST_PROXY];
360 sslc->primary.cipher_list13 = data->set.str[STRING_SSL_CIPHER13_LIST_PROXY];
361 sslc->primary.pinned_key = data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY];
362 sslc->primary.cert_blob = data->set.blobs[BLOB_CERT_PROXY];
363 sslc->primary.ca_info_blob = data->set.blobs[BLOB_CAINFO_PROXY];
364 sslc->primary.issuercert = data->set.str[STRING_SSL_ISSUERCERT_PROXY];
365 sslc->primary.issuercert_blob = data->set.blobs[BLOB_SSL_ISSUERCERT_PROXY];
366 sslc->primary.CRLfile = data->set.str[STRING_SSL_CRLFILE_PROXY];
367 sslc->primary.cert_type = data->set.str[STRING_CERT_TYPE_PROXY];
368 sslc->primary.key = data->set.str[STRING_KEY_PROXY];
369 sslc->primary.key_type = data->set.str[STRING_KEY_TYPE_PROXY];
370 sslc->primary.key_passwd = data->set.str[STRING_KEY_PASSWD_PROXY];
371 sslc->primary.clientcert = data->set.str[STRING_CERT_PROXY];
372 sslc->primary.key_blob = data->set.blobs[BLOB_KEY_PROXY];
373#ifdef USE_TLS_SRP
374 sslc->primary.username = data->set.str[STRING_TLSAUTH_USERNAME_PROXY];
375 sslc->primary.password = data->set.str[STRING_TLSAUTH_PASSWORD_PROXY];
376#endif
377#endif /* CURL_DISABLE_PROXY */
378
379 return CURLE_OK;
380}
lib/vtls/vtls_config.clines 171–184 · definition of Curl_ssl_conn_config_match
171bool Curl_ssl_conn_config_match(struct Curl_easy *data,
C4: Curl_ssl_conn_config_match calls match_ssl_primary_config
172 struct connectdata *candidate,
173 bool proxy)
174{
175#ifndef CURL_DISABLE_PROXY
176 if(proxy)
177 return match_ssl_primary_config(data, &data->set.proxy_ssl.primary,
178 &candidate->proxy_ssl_config);
179#else
180 (void)proxy;
181#endif
182 return match_ssl_primary_config(data, &data->set.ssl.primary,
183 &candidate->ssl_config);
184}
lib/vtls/vtls_config.clines 136–169 · definition of match_ssl_primary_config
Show 34 lines (not cited by the judge)
136static bool match_ssl_primary_config(struct Curl_easy *data,
137 struct ssl_primary_config *c1,
138 struct ssl_primary_config *c2)
139{
140 (void)data;
141 if((c1->version == c2->version) &&
142 (c1->version_max == c2->version_max) &&
143 (c1->ssl_options == c2->ssl_options) &&
144 (c1->native_ca_store == c2->native_ca_store) &&
145 (c1->verifypeer == c2->verifypeer) &&
146 (c1->verifyhost == c2->verifyhost) &&
147 (c1->verifystatus == c2->verifystatus) &&
148 blobcmp(c1->cert_blob, c2->cert_blob) &&
149 blobcmp(c1->ca_info_blob, c2->ca_info_blob) &&
150 blobcmp(c1->issuercert_blob, c2->issuercert_blob) &&
151 blobcmp(c1->key_blob, c2->key_blob) &&
152 Curl_safecmp(c1->CApath, c2->CApath) &&
153 Curl_safecmp(c1->CAfile, c2->CAfile) &&
154 Curl_safecmp(c1->issuercert, c2->issuercert) &&
155 Curl_safecmp(c1->clientcert, c2->clientcert) &&
156 curl_strequal(c1->cipher_list, c2->cipher_list) &&
157 curl_strequal(c1->cipher_list13, c2->cipher_list13) &&
158 curl_strequal(c1->curves, c2->curves) &&
159 curl_strequal(c1->signature_algorithms, c2->signature_algorithms) &&
160 Curl_safecmp(c1->CRLfile, c2->CRLfile) &&
161 Curl_safecmp(c1->pinned_key, c2->pinned_key) &&
162 curl_strequal(c1->cert_type, c2->cert_type) &&
163 Curl_safecmp(c1->key, c2->key) &&
164 curl_strequal(c1->key_type, c2->key_type) &&
165 !Curl_timestrcmp(c1->key_passwd, c2->key_passwd))
166 return TRUE;
167
168 return FALSE;
169}
lib/vtls/vtls_config.clines 248–363 · definition of Curl_ssl_easy_config_complete
Show 116 lines (not cited by the judge)
248CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data,
249 struct Curl_peer *origin)
250{
251 struct ssl_config_data *sslc = &data->set.ssl;
252#if defined(CURL_CA_PATH) || defined(CURL_CA_BUNDLE)
253 CURLcode result;
254#endif
255
256 ssl_easy_config_compl_options(origin, data->state.initial_origin, sslc);
257
258 if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
259#if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
260 if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
261 sslc->primary.native_ca_store = TRUE;
262#endif
263#ifdef CURL_CA_PATH
264 if(!sslc->custom_capath && !CURL_EASY_STR(data, STRING_SSL_CAPATH)) {
265 result = Curl_setstropt(data, STRING_SSL_CAPATH, CURL_CA_PATH);
266 if(result)
267 return result;
268 }
269#endif
270#ifdef CURL_CA_BUNDLE
271 if(!sslc->custom_cafile && !CURL_EASY_STR(data, STRING_SSL_CAFILE)) {
272 result = Curl_setstropt(data, STRING_SSL_CAFILE, CURL_CA_BUNDLE);
273 if(result)
274 return result;
275 }
276#endif
277 }
278 sslc->primary.CAfile = ssl_easy_steal(data, STRING_SSL_CAFILE);
279 sslc->primary.CRLfile = ssl_easy_steal(data, STRING_SSL_CRLFILE);
280 sslc->primary.CApath = ssl_easy_steal(data, STRING_SSL_CAPATH);
281 sslc->primary.cipher_list = ssl_easy_steal(data, STRING_SSL_CIPHER_LIST);
282 sslc->primary.cipher_list13 = ssl_easy_steal(data, STRING_SSL_CIPHER13_LIST);
283 sslc->primary.signature_algorithms =
284 ssl_easy_steal(data, STRING_SSL_SIGNATURE_ALGORITHMS);
285 sslc->primary.ca_info_blob = data->set.blobs[BLOB_CAINFO];
286 sslc->primary.curves = ssl_easy_steal(data, STRING_SSL_EC_CURVES);
287 /* Maybe these should not be used for another origin. But for
288 * backwards compatibility, keep them in. */
289 sslc->primary.issuercert = ssl_easy_steal(data, STRING_SSL_ISSUERCERT);
290 sslc->primary.issuercert_blob = data->set.blobs[BLOB_SSL_ISSUERCERT];
291
292 if(Curl_peer_equal(data->state.initial_origin, origin)) {
293 sslc->primary.pinned_key =
294 ssl_easy_steal(data, STRING_SSL_PINNEDPUBLICKEY);
295 sslc->primary.cert_blob = data->set.blobs[BLOB_CERT];
296 sslc->primary.cert_type = ssl_easy_steal(data, STRING_CERT_TYPE);
297 sslc->primary.key = ssl_easy_steal(data, STRING_KEY);
298 sslc->primary.key_type = ssl_easy_steal(data, STRING_KEY_TYPE);
299 sslc->primary.key_passwd = ssl_easy_steal(data, STRING_KEY_PASSWD);
300 sslc->primary.clientcert = ssl_easy_steal(data, STRING_CERT);
301 sslc->primary.key_blob = data->set.blobs[BLOB_KEY];
302 }
303 else {
304 sslc->primary.pinned_key = NULL;
305 sslc->primary.cert_blob = NULL;
306 sslc->primary.cert_type = NULL;
307 sslc->primary.key = NULL;
308 sslc->primary.key_type = NULL;
309 sslc->primary.key_passwd = NULL;
310 sslc->primary.clientcert = NULL;
311 sslc->primary.key_blob = NULL;
312 }
313
314#ifndef CURL_DISABLE_PROXY
315 sslc = &data->set.proxy_ssl;
316 /* no initial origin for proxy, it is not changed for redirects */
317 ssl_easy_config_compl_options(NULL, NULL, sslc);
318
319 if(Curl_ssl_backend() != CURLSSLBACKEND_SCHANNEL) {
320#if defined(USE_APPLE_SECTRUST) || defined(CURL_CA_NATIVE)
321 if(!sslc->custom_capath && !sslc->custom_cafile && !sslc->custom_cablob)
322 sslc->primary.native_ca_store = TRUE;
323#endif
324#ifdef CURL_CA_PATH
325 if(!sslc->custom_capath &&
326 !CURL_EASY_STR(data, STRING_SSL_CAPATH_PROXY)) {
327 result = Curl_setstropt(data, STRING_SSL_CAPATH_PROXY, CURL_CA_PATH);
328 if(result)
329 return result;
330 }
331#endif
332#ifdef CURL_CA_BUNDLE
333 if(!sslc->custom_cafile &&
334 !CURL_EASY_STR(data, STRING_SSL_CAFILE_PROXY)) {
335 result = Curl_setstropt(data, STRING_SSL_CAFILE_PROXY, CURL_CA_BUNDLE);
336 if(result)
337 return result;
338 }
339#endif
340 }
341 sslc->primary.CAfile = ssl_easy_steal(data, STRING_SSL_CAFILE_PROXY);
342 sslc->primary.CApath = ssl_easy_steal(data, STRING_SSL_CAPATH_PROXY);
343 sslc->primary.cipher_list =
344 ssl_easy_steal(data, STRING_SSL_CIPHER_LIST_PROXY);
345 sslc->primary.cipher_list13 =
346 ssl_easy_steal(data, STRING_SSL_CIPHER13_LIST_PROXY);
347 sslc->primary.pinned_key =
348 ssl_easy_steal(data, STRING_SSL_PINNEDPUBLICKEY_PROXY);
349 sslc->primary.cert_blob = data->set.blobs[BLOB_CERT_PROXY];
350 sslc->primary.ca_info_blob = data->set.blobs[BLOB_CAINFO_PROXY];
351 sslc->primary.issuercert = ssl_easy_steal(data, STRING_SSL_ISSUERCERT_PROXY);
352 sslc->primary.issuercert_blob = data->set.blobs[BLOB_SSL_ISSUERCERT_PROXY];
353 sslc->primary.CRLfile = ssl_easy_steal(data, STRING_SSL_CRLFILE_PROXY);
354 sslc->primary.cert_type = ssl_easy_steal(data, STRING_CERT_TYPE_PROXY);
355 sslc->primary.key = ssl_easy_steal(data, STRING_KEY_PROXY);
356 sslc->primary.key_type = ssl_easy_steal(data, STRING_KEY_TYPE_PROXY);
357 sslc->primary.key_passwd = ssl_easy_steal(data, STRING_KEY_PASSWD_PROXY);
358 sslc->primary.clientcert = ssl_easy_steal(data, STRING_CERT_PROXY);
359 sslc->primary.key_blob = data->set.blobs[BLOB_KEY_PROXY];
360#endif /* CURL_DISABLE_PROXY */
361
362 return CURLE_OK;
363}
lib/config-os400.hlines 39–39 · definition of CURL_CA_BUNDLE
Show 1 lines (not cited by the judge)
39#define CURL_CA_BUNDLE "/QIBM/UserData/ICSS/Cert/Server/DEFAULT.KDB"