Skip to content

Commit d2ef625

Browse files
vszakatsvszakats
committed
cmake: sync CA bundle/path detection with autotools
- skip the entire CA logic if no selected TLS backend support CA certs/bundles. Follow-up to 082bb41 #2545 - sync bundle path detection logic with `./configure`. - fix to not auto-detect CA bundle/path on Windows. - fix to reflect that BearSSL has CA bundle support. - show the detected bundle path (as with the cert bundle). - tidy up CMake syntax, fix typos in comments. Closes #14182
1 parent d3595c7 commit d2ef625

File tree

1 file changed

+70
-72
lines changed

1 file changed

+70
-72
lines changed

‎CMakeLists.txt‎

Lines changed: 70 additions & 72 deletions
Original file line numberDiff line numberDiff line change
@@ -487,6 +487,7 @@ if(CURL_USE_OPENSSL)
487487
if(CURL_DEFAULT_SSL_BACKEND AND CURL_DEFAULT_SSL_BACKEND STREQUAL "openssl")
488488
set(valid_default_ssl_backend TRUE)
489489
endif()
490+
set(curl_ca_bundle_supported TRUE)
490491

491492
set(CMAKE_REQUIRED_INCLUDES ${OPENSSL_INCLUDE_DIR})
492493
if(NOT DEFINED HAVE_BORINGSSL)
@@ -508,6 +509,7 @@ if(CURL_USE_MBEDTLS)
508509
if(CURL_DEFAULT_SSL_BACKEND AND CURL_DEFAULT_SSL_BACKEND STREQUAL "mbedtls")
509510
set(valid_default_ssl_backend TRUE)
510511
endif()
512+
set(curl_ca_bundle_supported TRUE)
511513
endif()
512514

513515
if(CURL_USE_BEARSSL)
@@ -520,6 +522,7 @@ if(CURL_USE_BEARSSL)
520522
if(CURL_DEFAULT_SSL_BACKEND AND CURL_DEFAULT_SSL_BACKEND STREQUAL "bearssl")
521523
set(valid_default_ssl_backend TRUE)
522524
endif()
525+
set(curl_ca_bundle_supported TRUE)
523526
endif()
524527

525528
if(CURL_USE_WOLFSSL)
@@ -533,6 +536,7 @@ if(CURL_USE_WOLFSSL)
533536
if(CURL_DEFAULT_SSL_BACKEND AND CURL_DEFAULT_SSL_BACKEND STREQUAL "wolfssl")
534537
set(valid_default_ssl_backend TRUE)
535538
endif()
539+
set(curl_ca_bundle_supported TRUE)
536540
endif()
537541

538542
if(CURL_USE_GNUTLS)
@@ -546,6 +550,7 @@ if(CURL_USE_GNUTLS)
546550
if(CURL_DEFAULT_SSL_BACKEND AND CURL_DEFAULT_SSL_BACKEND STREQUAL "gnutls")
547551
set(valid_default_ssl_backend TRUE)
548552
endif()
553+
set(curl_ca_bundle_supported TRUE)
549554

550555
if(NOT DEFINED HAVE_GNUTLS_SRP AND NOT CURL_DISABLE_SRP)
551556
cmake_push_check_state()
@@ -1102,88 +1107,81 @@ else()
11021107
unset(USE_UNIX_SOCKETS CACHE)
11031108
endif()
11041109

1105-
11061110
#
11071111
# CA handling
11081112
#
1109-
set(CURL_CA_BUNDLE "auto" CACHE STRING
1110-
"Path to the CA bundle. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
1111-
set(CURL_CA_FALLBACK OFF CACHE BOOL
1112-
"Set ON to use built-in CA store of TLS backend. Defaults to OFF")
1113-
set(CURL_CA_PATH "auto" CACHE STRING
1114-
"Location of default CA path. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
1115-
1116-
if("${CURL_CA_BUNDLE}" STREQUAL "")
1117-
message(FATAL_ERROR "Invalid value of CURL_CA_BUNDLE. Use 'none', 'auto' or file path.")
1118-
elseif("${CURL_CA_BUNDLE}" STREQUAL "none")
1119-
unset(CURL_CA_BUNDLE CACHE)
1120-
elseif("${CURL_CA_BUNDLE}" STREQUAL "auto")
1121-
unset(CURL_CA_BUNDLE CACHE)
1122-
if(NOT CMAKE_CROSSCOMPILING)
1123-
set(CURL_CA_BUNDLE_AUTODETECT TRUE)
1113+
if(curl_ca_bundle_supported)
1114+
set(CURL_CA_BUNDLE "auto" CACHE STRING
1115+
"Path to the CA bundle. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
1116+
set(CURL_CA_FALLBACK OFF CACHE BOOL
1117+
"Set ON to use built-in CA store of TLS backend. Defaults to OFF")
1118+
set(CURL_CA_PATH "auto" CACHE STRING
1119+
"Location of default CA path. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
1120+
1121+
if(CURL_CA_BUNDLE STREQUAL "")
1122+
message(FATAL_ERROR "Invalid value of CURL_CA_BUNDLE. Use 'none', 'auto' or file path.")
1123+
elseif(CURL_CA_BUNDLE STREQUAL "none")
1124+
unset(CURL_CA_BUNDLE CACHE)
1125+
elseif(CURL_CA_BUNDLE STREQUAL "auto")
1126+
unset(CURL_CA_BUNDLE CACHE)
1127+
if(NOT CMAKE_CROSSCOMPILING AND NOT WIN32)
1128+
set(CURL_CA_BUNDLE_AUTODETECT TRUE)
1129+
endif()
1130+
else()
1131+
set(CURL_CA_BUNDLE_SET TRUE)
11241132
endif()
1125-
else()
1126-
set(CURL_CA_BUNDLE_SET TRUE)
1127-
endif()
11281133

1129-
if("${CURL_CA_PATH}" STREQUAL "")
1130-
message(FATAL_ERROR "Invalid value of CURL_CA_PATH. Use 'none', 'auto' or directory path.")
1131-
elseif("${CURL_CA_PATH}" STREQUAL "none")
1132-
unset(CURL_CA_PATH CACHE)
1133-
elseif("${CURL_CA_PATH}" STREQUAL "auto")
1134-
unset(CURL_CA_PATH CACHE)
1135-
if(NOT CMAKE_CROSSCOMPILING)
1136-
set(CURL_CA_PATH_AUTODETECT TRUE)
1137-
endif()
1138-
else()
1139-
set(CURL_CA_PATH_SET TRUE)
1140-
endif()
1141-
1142-
if(CURL_CA_BUNDLE_SET AND CURL_CA_PATH_AUTODETECT)
1143-
# Skip autodetection of unset CA path because CA bundle is set explicitly
1144-
elseif(CURL_CA_PATH_SET AND CURL_CA_BUNDLE_AUTODETECT)
1145-
# Skip autodetection of unset CA bundle because CA path is set explicitly
1146-
elseif(CURL_CA_PATH_AUTODETECT OR CURL_CA_BUNDLE_AUTODETECT)
1147-
# first try autodetecting a CA bundle, then a CA path
1148-
1149-
if(CURL_CA_BUNDLE_AUTODETECT)
1150-
set(SEARCH_CA_BUNDLE_PATHS
1151-
/etc/ssl/certs/ca-certificates.crt
1152-
/etc/pki/tls/certs/ca-bundle.crt
1153-
/usr/share/ssl/certs/ca-bundle.crt
1154-
/usr/local/share/certs/ca-root-nss.crt
1155-
/etc/ssl/cert.pem)
1156-
1157-
foreach(SEARCH_CA_BUNDLE_PATH ${SEARCH_CA_BUNDLE_PATHS})
1158-
if(EXISTS "${SEARCH_CA_BUNDLE_PATH}")
1159-
message(STATUS "Found CA bundle: ${SEARCH_CA_BUNDLE_PATH}")
1160-
set(CURL_CA_BUNDLE "${SEARCH_CA_BUNDLE_PATH}" CACHE STRING
1161-
"Path to the CA bundle. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
1162-
set(CURL_CA_BUNDLE_SET TRUE CACHE BOOL "Path to the CA bundle has been set")
1163-
break()
1164-
endif()
1165-
endforeach()
1166-
endif()
1134+
if(CURL_CA_PATH STREQUAL "")
1135+
message(FATAL_ERROR "Invalid value of CURL_CA_PATH. Use 'none', 'auto' or directory path.")
1136+
elseif(CURL_CA_PATH STREQUAL "none")
1137+
unset(CURL_CA_PATH CACHE)
1138+
elseif(CURL_CA_PATH STREQUAL "auto")
1139+
unset(CURL_CA_PATH CACHE)
1140+
if(NOT CMAKE_CROSSCOMPILING AND NOT WIN32)
1141+
set(CURL_CA_PATH_AUTODETECT TRUE)
1142+
endif()
1143+
else()
1144+
set(CURL_CA_PATH_SET TRUE)
1145+
endif()
1146+
1147+
if(CURL_CA_BUNDLE_SET AND CURL_CA_PATH_AUTODETECT)
1148+
# Skip auto-detection of unset CA path because CA bundle is set explicitly
1149+
elseif(CURL_CA_PATH_SET AND CURL_CA_BUNDLE_AUTODETECT)
1150+
# Skip auto-detection of unset CA bundle because CA path is set explicitly
1151+
elseif(CURL_CA_BUNDLE_AUTODETECT OR CURL_CA_PATH_AUTODETECT)
1152+
# First try auto-detecting a CA bundle, then a CA path
1153+
1154+
if(CURL_CA_BUNDLE_AUTODETECT)
1155+
foreach(SEARCH_CA_BUNDLE_PATH IN ITEMS
1156+
"/etc/ssl/certs/ca-certificates.crt"
1157+
"/etc/pki/tls/certs/ca-bundle.crt"
1158+
"/usr/share/ssl/certs/ca-bundle.crt"
1159+
"/usr/local/share/certs/ca-root-nss.crt"
1160+
"/etc/ssl/cert.pem")
1161+
if(EXISTS "${SEARCH_CA_BUNDLE_PATH}")
1162+
message(STATUS "Found CA bundle: ${SEARCH_CA_BUNDLE_PATH}")
1163+
set(CURL_CA_BUNDLE "${SEARCH_CA_BUNDLE_PATH}" CACHE STRING
1164+
"Path to the CA bundle. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
1165+
set(CURL_CA_BUNDLE_SET TRUE CACHE BOOL "Path to the CA bundle has been set")
1166+
break()
1167+
endif()
1168+
endforeach()
1169+
endif()
11671170

1168-
if(CURL_CA_PATH_AUTODETECT AND (NOT CURL_CA_PATH_SET))
1169-
if(EXISTS "/etc/ssl/certs")
1170-
set(CURL_CA_PATH "/etc/ssl/certs" CACHE STRING
1171-
"Location of default CA path. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
1172-
set(CURL_CA_PATH_SET TRUE CACHE BOOL "Path to the CA bundle has been set")
1171+
if(CURL_CA_PATH_AUTODETECT AND NOT CURL_CA_PATH_SET)
1172+
set(SEARCH_CA_PATH "/etc/ssl/certs")
1173+
file(GLOB curl_ca_files_found "${SEARCH_CA_PATH}/[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f].0")
1174+
if(curl_ca_files_found)
1175+
unset(curl_ca_files_found)
1176+
message(STATUS "Found CA path: ${SEARCH_CA_PATH}")
1177+
set(CURL_CA_PATH "${SEARCH_CA_PATH}" CACHE STRING
1178+
"Location of default CA path. Set 'none' to disable or 'auto' for auto-detection. Defaults to 'auto'.")
1179+
set(CURL_CA_PATH_SET TRUE CACHE BOOL "Path to the CA bundle has been set")
1180+
endif()
11731181
endif()
11741182
endif()
11751183
endif()
11761184

1177-
if(CURL_CA_PATH_SET AND
1178-
NOT USE_OPENSSL AND
1179-
NOT USE_WOLFSSL AND
1180-
NOT USE_GNUTLS AND
1181-
NOT USE_MBEDTLS)
1182-
message(STATUS
1183-
"CA path only supported by OpenSSL, wolfSSL, GnuTLS or mbedTLS. "
1184-
"Set CURL_CA_PATH=none or enable one of those TLS backends.")
1185-
endif()
1186-
11871185
# Check for header files
11881186
if(WIN32)
11891187
set(CURL_INCLUDES ${CURL_INCLUDES} "winsock2.h")

0 commit comments

Comments
 (0)