[svn] Merge of fix for bugs 20341 and 20410.

[wget] / src / openssl.c

diff --git a/src/openssl.c b/src/openssl.c
index 14454027c60f8f151b61d7bb6f3613f71f6cb7b3..df4a938d8be488c6f6014efd8d7891586e1c8ff2 100644 (file)
--- a/src/openssl.c
+++ b/src/openssl.c
@@ -1,12 +1,12 @@
 /* SSL support via OpenSSL library.
-   Copyright (C) 2000-2005 Free Software Foundation, Inc.
+   Copyright (C) 2000-2006 Free Software Foundation, Inc.
    Originally contributed by Christian Fraenkel.
 
 This file is part of GNU Wget.
 
 GNU Wget is free software; you can redistribute it and/or modify
 it under the terms of the GNU General Public License as published by
-the Free Software Foundation; either version 2 of the License, or
+the Free Software Foundation; either version 3 of the License, or
 (at your option) any later version.
 
 GNU Wget is distributed in the hope that it will be useful,
@@ -15,8 +15,7 @@ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 GNU General Public License for more details.
 
 You should have received a copy of the GNU General Public License
-along with Wget; if not, write to the Free Software Foundation, Inc.,
-51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+along with Wget.  If not, see <http://www.gnu.org/licenses/>.
 
 In addition, as a special exception, the Free Software Foundation
 gives permission to link the code of its release of Wget with the
@@ -225,6 +224,10 @@ ssl_init ()
      handles them correctly), allow them in OpenSSL.  */
   SSL_CTX_set_mode (ssl_ctx, SSL_MODE_ENABLE_PARTIAL_WRITE);
 
+  /* The OpenSSL library can handle renegotiations automatically, so
+     tell it to do so.  */
+  SSL_CTX_set_mode (ssl_ctx, SSL_MODE_AUTO_RETRY);
+
   return true;
 
  error:
@@ -509,19 +512,34 @@ ssl_check_certificate (int fd, const char *host)
   vresult = SSL_get_verify_result (conn);
   if (vresult != X509_V_OK)
     {
-      /* #### We might want to print saner (and translatable) error
-        messages for several frequently encountered errors.  The
-        candidates would include
-        X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY,
-        X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN,
-        X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT,
-        X509_V_ERR_CERT_NOT_YET_VALID, X509_V_ERR_CERT_HAS_EXPIRED,
-        and possibly others.  The current approach would still be
-        used for the less frequent failure cases.  */
+      char *issuer = X509_NAME_oneline (X509_get_issuer_name (cert), 0, 0);
       logprintf (LOG_NOTQUIET,
-                _("%s: Certificate verification error for %s: %s\n"),
-                severity, escnonprint (host),
-                X509_verify_cert_error_string (vresult));
+                _("%s: cannot verify %s's certificate, issued by `%s':\n"),
+                severity, escnonprint (host), escnonprint (issuer));
+      /* Try to print more user-friendly (and translated) messages for
+        the frequent verification errors.  */
+      switch (vresult)
+       {
+       case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
+         logprintf (LOG_NOTQUIET,
+                    _("  Unable to locally verify the issuer's authority.\n"));
+         break;
+       case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
+       case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
+         logprintf (LOG_NOTQUIET, _("  Self-signed certificate encountered.\n"));
+         break;
+       case X509_V_ERR_CERT_NOT_YET_VALID:
+         logprintf (LOG_NOTQUIET, _("  Issued certificate not yet valid.\n"));
+         break;
+       case X509_V_ERR_CERT_HAS_EXPIRED:
+         logprintf (LOG_NOTQUIET, _("  Issued certificate has expired.\n"));
+         break;
+       default:
+         /* For the less frequent error strings, simply provide the
+            OpenSSL error message.  */
+         logprintf (LOG_NOTQUIET, "  %s\n",
+                    X509_verify_cert_error_string (vresult));
+       }
       success = false;
       /* Fall through, so that the user is warned about *all* issues
         with the cert (important with --no-check-certificate.)  */