2 Copyright (C) 2000 Free Software Foundation, Inc.
3 Contributed by Christian Fraenkel.
5 This file is part of GNU Wget.
7 GNU Wget is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 2 of the License, or
10 (at your option) any later version.
12 GNU Wget is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with Wget; if not, write to the Free Software
19 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
28 #include <openssl/bio.h>
29 #include <openssl/crypto.h>
30 #include <openssl/x509.h>
31 #include <openssl/ssl.h>
32 #include <openssl/err.h>
33 #include <openssl/pem.h>
42 static int verify_callback PARAMS ((int, X509_STORE_CTX *));
44 /* Creates a SSL Context and sets some defaults for it */
46 init_ssl (SSL_CTX **ctx)
48 SSL_METHOD *meth = NULL;
49 int verify = SSL_VERIFY_NONE;
51 SSL_load_error_strings ();
52 SSLeay_add_all_algorithms ();
53 SSLeay_add_ssl_algorithms ();
54 meth = SSLv23_client_method ();
55 *ctx = SSL_CTX_new (meth);
56 SSL_CTX_set_verify (*ctx, verify, verify_callback);
57 if (*ctx == NULL) return SSLERRCTXCREATE;
60 if (SSL_CTX_use_certificate_file (*ctx, opt.sslcertfile,
61 SSL_FILETYPE_PEM) <= 0)
62 return SSLERRCERTFILE;
63 if (opt.sslcertkey == NULL)
64 opt.sslcertkey=opt.sslcertfile;
65 if (SSL_CTX_use_PrivateKey_file (*ctx, opt.sslcertkey,
66 SSL_FILETYPE_PEM) <= 0)
69 return 0; /* Succeded */
72 /* Sets up a SSL structure and performs the handshake on fd
73 Returns 0 if everything went right
74 Returns 1 if something went wrong ----- TODO: More exit codes
77 connect_ssl (SSL **con, SSL_CTX *ctx, int fd)
79 *con = (SSL *)SSL_new (ctx);
80 SSL_set_fd (*con, fd);
81 SSL_set_connect_state (*con);
83 if ((*con)->state != SSL_ST_OK)
89 shutdown_ssl (SSL* con)
97 free_ssl_ctx (SSL_CTX * ctx)
103 verify_callback (int ok, X509_STORE_CTX *ctx)
106 s = X509_NAME_oneline (X509_get_subject_name (ctx->current_cert), buf, 256);
108 switch (ctx->error) {
109 case X509_V_ERR_CERT_NOT_YET_VALID:
110 case X509_V_ERR_CERT_HAS_EXPIRED:
111 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
118 /* pass all ssl errors to DEBUGP
119 returns the number of printed errors */
121 ssl_printerrors (void)
124 unsigned long curerr = 0;
126 memset(errbuff, 0, sizeof(errbuff));
127 for (curerr = ERR_get_error (); curerr; curerr = ERR_get_error ())
129 DEBUGP (("OpenSSL: %s\n", ERR_error_string (curerr, errbuff)));
135 /* SSL version of iread. Only exchanged read for SSL_read
136 Read at most LEN bytes from FD, storing them to BUF. This is
137 virtually the same as read(), but takes care of EINTR braindamage
138 and uses select() to timeout the stale connections (a connection is
139 stale if more than OPT.TIMEOUT time is spent in select() or
142 ssl_iread (SSL *con, char *buf, int len)
146 BIO_get_fd (con->rbio, &fd);
155 res = select_fd (fd, opt.timeout, 0);
157 while (res == -1 && errno == EINTR);
160 /* Set errno to ETIMEDOUT on timeout. */
162 /* #### Potentially evil! */
168 res = SSL_read (con, buf, len);
170 while (res == -1 && errno == EINTR);
175 /* SSL version of iwrite. Only exchanged write for SSL_write
176 Write LEN bytes from BUF to FD. This is similar to iread(), but
177 doesn't bother with select(). Unlike iread(), it makes sure that
178 all of BUF is actually written to FD, so callers needn't bother
179 with checking that the return value equals to LEN. Instead, you
180 should simply check for -1. */
182 ssl_iwrite (SSL *con, char *buf, int len)
186 BIO_get_fd (con->rbio, &fd);
187 /* `write' may write less than LEN bytes, thus the outward loop
188 keeps trying it until all was written, or an error occurred. The
189 inner loop is reserved for the usual EINTR f*kage, and the
190 innermost loop deals with the same during select(). */
200 res = select_fd (fd, opt.timeout, 1);
202 while (res == -1 && errno == EINTR);
205 /* Set errno to ETIMEDOUT on timeout. */
207 /* #### Potentially evil! */
213 res = SSL_write (con, buf, len);
215 while (res == -1 && errno == EINTR);
223 #endif /* HAVE_SSL */