[svn] Applied Christian Fraenkel's patch "custom certificate patch for wget-1.7+dev;

[wget] / src / gen_sslfunc.c

diff --git a/src/gen_sslfunc.c b/src/gen_sslfunc.c
index 6fc0de1514b3e7f62dd983067cc886bc72b6add0..c19cc66fe08d0af64e9e272b143a5d55ce1df66f 100644 (file)
--- a/src/gen_sslfunc.c
+++ b/src/gen_sslfunc.c
@@ -18,73 +18,118 @@ along with this program; if not, write to the Free Software
 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.  */
 
 #include <config.h>
+
 #ifdef HAVE_SSL
+
+#include <assert.h>
+#include <sys/time.h>
+#include <errno.h>
+
 #include <openssl/bio.h>
 #include <openssl/crypto.h>
 #include <openssl/x509.h>
 #include <openssl/ssl.h>
 #include <openssl/err.h>
 #include <openssl/pem.h>
-#include <assert.h>
-#define SSL_ERR_CTX_CREATION -2
-#include <sys/time.h>
+
 #include "wget.h"
 #include "connect.h"
-int verify_callback(int ok, X509_STORE_CTX *ctx);
+
+#ifndef errno
+extern int errno;
+#endif
+
+static int verify_callback PARAMS ((int, X509_STORE_CTX *));
 
 /* Creates a SSL Context and sets some defaults for it */
-int init_ssl(SSL_CTX **ctx)
+uerr_t
+init_ssl (SSL_CTX **ctx)
 {
-SSL_METHOD *meth=NULL;
-int verify=SSL_VERIFY_NONE;
-  SSL_library_init();
-  SSL_load_error_strings();
-  SSLeay_add_all_algorithms();
-  SSLeay_add_ssl_algorithms();
-  meth = SSLv23_client_method();
-  *ctx = SSL_CTX_new(meth);
-  SSL_CTX_set_verify(*ctx,verify,verify_callback);
-  if (*ctx==NULL) return SSL_ERR_CTX_CREATION;
-return 0; /* Succeded */
+  SSL_METHOD *meth = NULL;
+  int verify = SSL_VERIFY_NONE;
+  SSL_library_init ();
+  SSL_load_error_strings ();
+  SSLeay_add_all_algorithms ();
+  SSLeay_add_ssl_algorithms ();
+  meth = SSLv23_client_method ();
+  *ctx = SSL_CTX_new (meth);
+  SSL_CTX_set_verify (*ctx, verify, verify_callback);
+  if (*ctx == NULL) return SSLERRCTXCREATE;
+  if (opt.sslcertfile)
+    {
+      if (SSL_CTX_use_certificate_file (*ctx, opt.sslcertfile,
+                                       SSL_FILETYPE_PEM) <= 0)
+       return SSLERRCERTFILE;
+      if (opt.sslcertkey == NULL) 
+       opt.sslcertkey=opt.sslcertfile;
+      if (SSL_CTX_use_PrivateKey_file (*ctx, opt.sslcertkey,
+                                      SSL_FILETYPE_PEM) <= 0)
+       return SSLERRCERTKEY;
+  }
+  return 0; /* Succeded */
 }
 
 /* Sets up a SSL structure and performs the handshake on fd 
    Returns 0 if everything went right
-       Returns 1 if something went wrong ----- TODO: More exit codes
+   Returns 1 if something went wrong ----- TODO: More exit codes
 */
-int connect_ssl (SSL **con, SSL_CTX *ctx, int fd) 
+int
+connect_ssl (SSL **con, SSL_CTX *ctx, int fd) 
 {
-  *con=(SSL *)SSL_new(ctx);
-  SSL_set_fd(*con,fd);
-  SSL_set_connect_state(*con); 
-  SSL_connect(*con);  
-  if ((*con)->state !=SSL_ST_OK)
+  *con = (SSL *)SSL_new (ctx);
+  SSL_set_fd (*con, fd);
+  SSL_set_connect_state (*con); 
+  SSL_connect (*con);  
+  if ((*con)->state != SSL_ST_OK)
     return 1;
-return 0;
+  return 0;
 }
 
-void shutdown_ssl (SSL* con)
+void
+shutdown_ssl (SSL* con)
 {
-  SSL_shutdown(con);
-  if (con != NULL) SSL_free(con);
+  SSL_shutdown (con);
+  if (con != NULL)
+    SSL_free (con);
 }
 
-void free_ssl_ctx (SSL_CTX * ctx) {
-  SSL_CTX_free(ctx);
+void
+free_ssl_ctx (SSL_CTX * ctx)
+{
+  SSL_CTX_free (ctx);
 }
 
-int verify_callback(int ok, X509_STORE_CTX *ctx){
-char *s,buf[256];
-  s=X509_NAME_oneline(X509_get_subject_name(ctx->current_cert),buf,256);
+int
+verify_callback (int ok, X509_STORE_CTX *ctx)
+{
+  char *s, buf[256];
+  s = X509_NAME_oneline (X509_get_subject_name (ctx->current_cert), buf, 256);
   if (ok == 0) {
     switch (ctx->error) {
-       case X509_V_ERR_CERT_NOT_YET_VALID:
-       case X509_V_ERR_CERT_HAS_EXPIRED:
-       case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
-               ok=1;
+    case X509_V_ERR_CERT_NOT_YET_VALID:
+    case X509_V_ERR_CERT_HAS_EXPIRED:
+    case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
+      ok = 1;
     }
   }
-  return(ok);
+  return ok;
+}
+
+/* pass all ssl errors to DEBUGP
+   returns the number of printed errors */
+int
+ssl_printerrors (void) 
+{
+  int ocerr = 0;
+  unsigned long curerr = 0;
+  char errbuff[1024];
+  memset(errbuff, 0, sizeof(errbuff));
+  for (curerr = ERR_get_error (); curerr; curerr = ERR_get_error ())
+    {
+      DEBUGP (("OpenSSL: %s\n", ERR_error_string (curerr, errbuff)));
+      ++ocerr;
+    }
+  return ocerr;
 }
 
 /* SSL version of iread. Only exchanged read for SSL_read 
@@ -98,7 +143,7 @@ ssl_iread (SSL *con, char *buf, int len)
 {
   int res;
   int fd;
-  BIO_get_fd(con->rbio,&fd);
+  BIO_get_fd (con->rbio, &fd);
   do
     {
 #ifdef HAVE_SELECT
@@ -138,7 +183,7 @@ ssl_iwrite (SSL *con, char *buf, int len)
 {
   int res = 0;
   int fd;
-  BIO_get_fd(con->rbio,&fd);
+  BIO_get_fd (con->rbio, &fd);
   /* `write' may write less than LEN bytes, thus the outward loop
      keeps trying it until all was written, or an error occurred.  The
      inner loop is reserved for the usual EINTR f*kage, and the