ssl native_ca_store: always reinit#21902
Closed
icing wants to merge 3 commits into
Closed
Conversation
Add bit `native_ca_store_opt` to keep the setting of CURLOPT_(PROXY_)SSL_OPTIONS and use that to calculate every easy transfer if a native CA store shall be used or not. This avoids `native_ca_store` getting stuck on TRUE after being set once.
stage. Common function for main and proxy. Use CURLSSLOPT_AUTO_CLIENT_CERT only for matching origin, do not set CURLSSLOPT_AUTO_CLIENT_CERT for DoH transfers.
bagder
approved these changes
Jun 8, 2026
There was a problem hiding this comment.
Pull request overview
This PR adjusts how SSL option bitmasks are applied by deferring evaluation from setopt time to the Curl_ssl_easy_config_complete() stage, so per-transfer SSL-derived flags (notably native_ca_store) are consistently reinitialized and don’t persist incorrectly across transfers. It also limits CURLSSLOPT_AUTO_CLIENT_CERT usage to the initial origin and explicitly disables it for DoH internal transfers.
Changes:
- Move evaluation of
CURLOPT_(PROXY_)SSL_OPTIONS-derived flags out ofsetoptand intoCurl_ssl_easy_config_complete(). - Stop populating per-flag fields in
setopt; only store thessl_optionsbitmask. - Mask out
CURLSSLOPT_AUTO_CLIENT_CERTwhen configuring the internal DoH easy handle.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
lib/vtls/vtls_config.c |
Adds centralized SSL-options completion logic and applies it during easy-config completion for main and proxy SSL configs. |
lib/setopt.c |
Simplifies SSL options handling to only store the options bitmask (defers derived-flag evaluation). |
lib/doh.c |
Prevents AUTO_CLIENT_CERT from being applied to DoH internal transfers by masking the option bit. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Move SSL options evaluation from setopt to ssl_config_complete stage. Common function for main and proxy.
Use CURLSSLOPT_AUTO_CLIENT_CERT only for matching origin, do not set CURLSSLOPT_AUTO_CLIENT_CERT for DoH transfers.
This avoids
native_ca_storegetting stuck on TRUE after being set once.