/* SSL support.
- Copyright (C) 2000 Christian Fraenkel.
+ Copyright (C) 2000 Free Software Foundation, Inc.
+ Contributed by Christian Fraenkel.
-This file is part of Wget.
+This file is part of GNU Wget.
-This program is free software; you can redistribute it and/or modify
+GNU Wget is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
-This program is distributed in the hope that it will be useful,
+GNU Wget is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
-along with this program; if not, write to the Free Software
+along with Wget; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
#include <config.h>
+
#ifdef HAVE_SSL
+
+#include <assert.h>
+#include <errno.h>
+#ifdef HAVE_UNISTD_H
+# include <unistd.h>
+#endif
+#ifdef HAVE_STRING_H
+# include <string.h>
+#else
+# include <strings.h>
+#endif
+
#include <openssl/bio.h>
#include <openssl/crypto.h>
#include <openssl/x509.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/pem.h>
-#include <assert.h>
-#define SSL_ERR_CTX_CREATION -2
-#include <sys/time.h>
+#include <openssl/rand.h>
+
#include "wget.h"
+#include "utils.h"
#include "connect.h"
+#include "url.h"
+
+#ifndef errno
+extern int errno;
+#endif
-/* #### Shouldn't this be static? --hniksic */
-int verify_callback PARAMS ((int, X509_STORE_CTX *));
+static int verify_callback PARAMS ((int, X509_STORE_CTX *));
+
+void
+ssl_init_prng (void)
+{
+ /* It is likely that older versions of OpenSSL will fail on
+ non-Linux machines because this code is unable to seed the PRNG
+ on older versions of the library. */
+
+#if SSLEAY_VERSION_NUMBER >= 0x00905100
+ char rand_file[256];
+ int maxrand = 500;
+
+ /* First, seed from a file specified by the user. This will be
+ $RANDFILE, if set, or ~/.rnd. */
+ RAND_file_name (rand_file, sizeof (rand_file));
+ if (rand_file)
+ /* Seed at most 16k (value borrowed from curl) from random file. */
+ RAND_load_file (rand_file, 16384);
+
+ if (RAND_status ())
+ return;
+
+ /* Get random data from EGD if opt.sslegdsock was set. */
+ if (opt.sslegdsock && *opt.sslegdsock)
+ RAND_egd (opt.sslegdsock);
+
+ if (RAND_status ())
+ return;
+
+#ifdef WINDOWS
+ /* Under Windows, we can try to seed the PRNG using screen content.
+ This may or may not work, depending on whether we'll calling Wget
+ interactively. */
+
+ RAND_screen ();
+ if (RAND_status ())
+ return;
+#endif
+
+ /* Still not enough randomness, presumably because neither random
+ file nor EGD have been available. Use the stupidest possible
+ method -- seed OpenSSL's PRNG with the system's PRNG. This is
+ insecure in the cryptographic sense, but people who care about
+ security will use /dev/random or their own source of randomness
+ anyway. */
+
+ while (RAND_status () == 0 && maxrand-- > 0)
+ {
+ unsigned char rnd = random_number (256);
+ RAND_seed (&rnd, sizeof (rnd));
+ }
+
+ if (RAND_status () == 0)
+ {
+ logprintf (LOG_NOTQUIET,
+ _("Could not seed OpenSSL PRNG; disabling SSL.\n"));
+ scheme_disable (SCHEME_HTTPS);
+ }
+#endif /* SSLEAY_VERSION_NUMBER >= 0x00905100 */
+}
/* Creates a SSL Context and sets some defaults for it */
-int
+uerr_t
init_ssl (SSL_CTX **ctx)
{
SSL_METHOD *meth = NULL;
meth = SSLv23_client_method ();
*ctx = SSL_CTX_new (meth);
SSL_CTX_set_verify (*ctx, verify, verify_callback);
- if (*ctx == NULL) return SSL_ERR_CTX_CREATION;
+ if (*ctx == NULL)
+ return SSLERRCTXCREATE;
+ if (opt.sslcertfile)
+ {
+ if (SSL_CTX_use_certificate_file (*ctx, opt.sslcertfile,
+ SSL_FILETYPE_PEM) <= 0)
+ return SSLERRCERTFILE;
+ if (opt.sslcertkey == NULL)
+ opt.sslcertkey=opt.sslcertfile;
+ if (SSL_CTX_use_PrivateKey_file (*ctx, opt.sslcertkey,
+ SSL_FILETYPE_PEM) <= 0)
+ return SSLERRCERTKEY;
+ }
return 0; /* Succeded */
}
SSL_connect (*con);
if ((*con)->state != SSL_ST_OK)
return 1;
+ /*while((SSLerror=ERR_get_error())!=0)
+ printf("%s\n", ERR_error_string(SSLerror,NULL));*/
+
return 0;
}
return ok;
}
+/* pass all ssl errors to DEBUGP
+ returns the number of printed errors */
+int
+ssl_printerrors (void)
+{
+ int ocerr = 0;
+ unsigned long curerr = 0;
+ char errbuff[1024];
+ memset(errbuff, 0, sizeof(errbuff));
+ for (curerr = ERR_get_error (); curerr; curerr = ERR_get_error ())
+ {
+ DEBUGP (("OpenSSL: %s\n", ERR_error_string (curerr, errbuff)));
+ ++ocerr;
+ }
+ return ocerr;
+}
+
/* SSL version of iread. Only exchanged read for SSL_read
Read at most LEN bytes from FD, storing them to BUF. This is
virtually the same as read(), but takes care of EINTR braindamage
do
{
#ifdef HAVE_SELECT
- if (opt.timeout)
+ if (opt.timeout && !SSL_pending (con))
{
-
do
{
res = select_fd (fd, opt.timeout, 0);
projects / wget / blobdiff