Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
#include <config.h>
+
#ifdef HAVE_SSL
+
+#include <assert.h>
+#include <sys/time.h>
+#include <errno.h>
+
#include <openssl/bio.h>
#include <openssl/crypto.h>
#include <openssl/x509.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/pem.h>
-#include <assert.h>
-#define SSL_ERR_CTX_CREATION -2
-#include <sys/time.h>
+
#include "wget.h"
#include "connect.h"
-/* #### Shouldn't this be static? --hniksic */
-int verify_callback PARAMS ((int, X509_STORE_CTX *));
+#ifndef errno
+extern int errno;
+#endif
+
+static int verify_callback PARAMS ((int, X509_STORE_CTX *));
/* Creates a SSL Context and sets some defaults for it */
-int
+uerr_t
init_ssl (SSL_CTX **ctx)
{
SSL_METHOD *meth = NULL;
meth = SSLv23_client_method ();
*ctx = SSL_CTX_new (meth);
SSL_CTX_set_verify (*ctx, verify, verify_callback);
- if (*ctx == NULL) return SSL_ERR_CTX_CREATION;
+ if (*ctx == NULL) return SSLERRCTXCREATE;
+ if (opt.sslcertfile)
+ {
+ if (SSL_CTX_use_certificate_file (*ctx, opt.sslcertfile,
+ SSL_FILETYPE_PEM) <= 0)
+ return SSLERRCERTFILE;
+ if (opt.sslcertkey == NULL)
+ opt.sslcertkey=opt.sslcertfile;
+ if (SSL_CTX_use_PrivateKey_file (*ctx, opt.sslcertkey,
+ SSL_FILETYPE_PEM) <= 0)
+ return SSLERRCERTKEY;
+ }
return 0; /* Succeded */
}
return ok;
}
+/* pass all ssl errors to DEBUGP
+ returns the number of printed errors */
+int
+ssl_printerrors (void)
+{
+ int ocerr = 0;
+ unsigned long curerr = 0;
+ char errbuff[1024];
+ memset(errbuff, 0, sizeof(errbuff));
+ for (curerr = ERR_get_error (); curerr; curerr = ERR_get_error ())
+ {
+ DEBUGP (("OpenSSL: %s\n", ERR_error_string (curerr, errbuff)));
+ ++ocerr;
+ }
+ return ocerr;
+}
+
/* SSL version of iread. Only exchanged read for SSL_read
Read at most LEN bytes from FD, storing them to BUF. This is
virtually the same as read(), but takes care of EINTR braindamage