[svn] Merge of fix for bugs 20341 and 20410.

[wget] / src / openssl.c

diff --git a/src/openssl.c b/src/openssl.c
index 14454027c60f8f151b61d7bb6f3613f71f6cb7b3..df4a938d8be488c6f6014efd8d7891586e1c8ff2 100644 (file)
--- a/src/openssl.c
+++ b/src/openssl.c
@@ -1,12 +1,12 @@
 /* SSL support via OpenSSL library.
 /* SSL support via OpenSSL library.

-   Copyright (C) 2000-2005 Free Software Foundation, Inc.
+   Copyright (C) 2000-2006 Free Software Foundation, Inc.

    Originally contributed by Christian Fraenkel.
 
 This file is part of GNU Wget.
 
 GNU Wget is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
    Originally contributed by Christian Fraenkel.
 
 This file is part of GNU Wget.
 
 GNU Wget is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by

-the Free Software Foundation; either version 2 of the License, or
+the Free Software Foundation; either version 3 of the License, or

 (at your option) any later version.
 
 GNU Wget is distributed in the hope that it will be useful,
 (at your option) any later version.
 
 GNU Wget is distributed in the hope that it will be useful,


@@ -15,8 +15,7 @@ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 
 You should have received a copy of the GNU General Public License
 GNU General Public License for more details.
 
 You should have received a copy of the GNU General Public License

-along with Wget; if not, write to the Free Software Foundation, Inc.,
-51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+along with Wget.  If not, see <http://www.gnu.org/licenses/>.

 
 In addition, as a special exception, the Free Software Foundation
 gives permission to link the code of its release of Wget with the
 
 In addition, as a special exception, the Free Software Foundation
 gives permission to link the code of its release of Wget with the


@@ -225,6 +224,10 @@ ssl_init ()
      handles them correctly), allow them in OpenSSL.  */
   SSL_CTX_set_mode (ssl_ctx, SSL_MODE_ENABLE_PARTIAL_WRITE);
 
      handles them correctly), allow them in OpenSSL.  */
   SSL_CTX_set_mode (ssl_ctx, SSL_MODE_ENABLE_PARTIAL_WRITE);
 

+  /* The OpenSSL library can handle renegotiations automatically, so
+     tell it to do so.  */
+  SSL_CTX_set_mode (ssl_ctx, SSL_MODE_AUTO_RETRY);
+

   return true;
 
  error:
   return true;
 
  error:


@@ -509,19 +512,34 @@ ssl_check_certificate (int fd, const char *host)
   vresult = SSL_get_verify_result (conn);
   if (vresult != X509_V_OK)
     {
   vresult = SSL_get_verify_result (conn);
   if (vresult != X509_V_OK)
     {

-      /* #### We might want to print saner (and translatable) error
-        messages for several frequently encountered errors.  The
-        candidates would include
-        X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY,
-        X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN,
-        X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT,
-        X509_V_ERR_CERT_NOT_YET_VALID, X509_V_ERR_CERT_HAS_EXPIRED,
-        and possibly others.  The current approach would still be
-        used for the less frequent failure cases.  */
+      char *issuer = X509_NAME_oneline (X509_get_issuer_name (cert), 0, 0);

       logprintf (LOG_NOTQUIET,
       logprintf (LOG_NOTQUIET,

-                _("%s: Certificate verification error for %s: %s\n"),
-                severity, escnonprint (host),
-                X509_verify_cert_error_string (vresult));
+                _("%s: cannot verify %s's certificate, issued by `%s':\n"),
+                severity, escnonprint (host), escnonprint (issuer));
+      /* Try to print more user-friendly (and translated) messages for
+        the frequent verification errors.  */
+      switch (vresult)
+       {
+       case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
+         logprintf (LOG_NOTQUIET,
+                    _("  Unable to locally verify the issuer's authority.\n"));
+         break;
+       case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
+       case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
+         logprintf (LOG_NOTQUIET, _("  Self-signed certificate encountered.\n"));
+         break;
+       case X509_V_ERR_CERT_NOT_YET_VALID:
+         logprintf (LOG_NOTQUIET, _("  Issued certificate not yet valid.\n"));
+         break;
+       case X509_V_ERR_CERT_HAS_EXPIRED:
+         logprintf (LOG_NOTQUIET, _("  Issued certificate has expired.\n"));
+         break;
+       default:
+         /* For the less frequent error strings, simply provide the
+            OpenSSL error message.  */
+         logprintf (LOG_NOTQUIET, "  %s\n",
+                    X509_verify_cert_error_string (vresult));
+       }

       success = false;
       /* Fall through, so that the user is warned about *all* issues
         with the cert (important with --no-check-certificate.)  */
       success = false;
       /* Fall through, so that the user is warned about *all* issues
         with the cert (important with --no-check-certificate.)  */