/***************************************************************************
- * _ _ ____ _
- * Project ___| | | | _ \| |
- * / __| | | | |_) | |
- * | (__| |_| | _ <| |___
+ * _ _ ____ _
+ * Project ___| | | | _ \| |
+ * / __| | | | |_) | |
+ * | (__| |_| | _ <| |___
* \___|\___/|_| \_\_____|
*
* Copyright (C) 1998 - 2004, Daniel Stenberg, <daniel@haxx.se>, et al.
* This software is licensed as described in the file COPYING, which
* you should have received as part of this distribution. The terms
* are also available at http://curl.haxx.se/docs/copyright.html.
- *
+ *
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
* copies of the Software, and permit persons to whom the Software is
* furnished to do so, under the terms of the COPYING file.
strcpy(buf, global_passwd);
return (int)strlen(buf);
}
- }
+ }
return 0;
}
-static
-bool seed_enough(int nread)
-{
-#ifdef HAVE_RAND_STATUS
- nread = 0; /* to prevent compiler warnings */
+/*
+ * rand_enough() is a function that returns TRUE if we have seeded the random
+ * engine properly. We use some preprocessor magic to provide a seed_enough()
+ * macro to use, just to prevent a compiler warning on this function if we
+ * pass in an argument that is never used.
+ */
- /* only available in OpenSSL 0.9.5a and later */
- if(RAND_status())
- return TRUE;
+#ifdef HAVE_RAND_STATUS
+#define seed_enough(x) rand_enough()
+static bool rand_enough(void)
+{
+ return RAND_status()?TRUE:FALSE;
+}
#else
- if(nread > 500)
- /* this is a very silly decision to make */
- return TRUE;
-#endif
- return FALSE; /* not enough */
+#define seed_enough(x) rand_enough(x)
+static bool rand_enough(int nread)
+{
+ /* this is a very silly decision to make */
+ return (nread > 500)?TRUE:FALSE;
}
+#endif
static
int random_the_seed(struct SessionHandle *data)
* being dependent upon the algorithm used by Curl_FormBoundary(): N bytes
* of a 7-bit ascii set. -- Richard Gorton, March 11 2003.
*/
-
+
do {
area = Curl_FormBoundary();
if(!area)
return 3; /* out of memory */
-
+
len = (int)strlen(area);
RAND_add(area, len, (len >> 1));
/* If we are using DSA, we can copy the parameters from
* the private key */
-
-
+
+
/* Now we know that a key and cert have been set against
* the SSL context */
if(!SSL_CTX_check_private_key(ctx)) {
failf(data, "Private key does not match the certificate public key");
return(0);
}
-#ifndef HAVE_USERDATA_IN_PWD_CALLBACK
+#ifndef HAVE_USERDATA_IN_PWD_CALLBACK
/* erase it now */
memset(global_passwd, 0, sizeof(global_passwd));
#endif
/* Free the SSL error strings */
ERR_free_strings();
-
+
/* EVP_cleanup() removes all ciphers and digests from the
table. */
EVP_cleanup();
for(i=0; i<2; i++) {
struct ssl_connect_data *connssl = &conn->ssl[i];
-
+
if(connssl->handle) {
(void)SSL_shutdown(connssl->handle);
SSL_set_connect_state(connssl->handle);
-
+
SSL_free (connssl->handle);
connssl->handle = NULL;
}
{
int i;
- if(data->state.session) {
+ if(data->state.session) {
for(i=0; i< data->set.ssl.numsessions; i++)
/* the single-killer function handles empty table slots */
Kill_Single_Session(&data->state.session[i]);
-
+
/* free the cache data */
free(data->state.session);
}
/* SSL_get1_session() will increment the reference
count and the session will stay in memory until explicitly freed with
- SSL_SESSION_free(3), regardless of its state.
+ SSL_SESSION_free(3), regardless of its state.
This function was introduced in openssl 0.9.5a. */
#else
ssl_sessionid = SSL_get_session(ssl->handle);
This is an inferior option because the session can be flushed
at any time by openssl. It is included only so curl compiles
under versions of openssl < 0.9.5a.
-
+
WARNING: How curl behaves if it's session is flushed is
- untested.
+ untested.
*/
#endif
Kill_Single_Session(store);
else
store = &data->state.session[i]; /* use this slot */
-
+
/* now init the session struct wisely */
store->sessionid = ssl_sessionid;
store->age = data->state.sessionage; /* set current age */
if((asn1_string[10] >= '0') && (asn1_string[10] <= '9') &&
(asn1_string[11] >= '0') && (asn1_string[11] <= '9'))
second= (asn1_string[10]-'0')*10+(asn1_string[11]-'0');
-
+
infof(data,
"%s%04d-%02d-%02d %02d:%02d:%02d %s\n",
prefix, year+1900, month, day, hour, minute, second, (gmt?"GMT":""));
return 0;
}
-#endif
+#endif
/* ====================================================== */
#ifdef USE_SSLEAY
{
char *tmp;
const char *certdomain;
-
+
if(!certname ||
strlen(certname)<3 ||
!hostname ||
if((certname[0] != '*') || (certdomain[0] != '.'))
return 0; /* not a wildcard certificate, check failed */
-
+
if(!strchr(certdomain+1, '.'))
return 0; /* the certificate must have at least another dot in its name */
#else
struct in_addr addr;
#endif
-
+
#ifdef ENABLE_IPV6
- if(conn->bits.ipv6_ip &&
+ if(conn->bits.ipv6_ip &&
Curl_inet_pton(AF_INET6, conn->host.name, &addr)) {
target = GEN_IPADD;
addrlen = sizeof(struct in6_addr);
target = GEN_IPADD;
addrlen = sizeof(struct in_addr);
}
-
+
/* get a "list" of alternative names */
altnames = X509_get_ext_d2i(server_cert, NID_subject_alt_name, NULL, NULL);
-
+
if(altnames) {
int hostlen = 0;
int domainlen = 0;
char *domain = NULL;
int numalts;
int i;
-
+
if(GEN_DNS == target) {
hostlen = (int)strlen(conn->host.name);
domain = strchr(conn->host.name, '.');
if((hostlen == altlen) &&
curl_strnequal(conn->host.name, altptr, hostlen))
matched = TRUE;
-
+
/* Is this a wildcard match? */
else if((altptr[0] == '*') &&
(domainlen == altlen-1) &&
curl_strnequal(domain, altptr+1, domainlen))
matched = TRUE;
break;
-
- case GEN_IPADD: /* IP address comparison */
+
+ case GEN_IPADD: /* IP address comparison */
/* compare alternative IP address if the data chunk is the same size
our server IP address is */
if((altlen == addrlen) && !memcmp(altptr, &addr, altlen))
}
GENERAL_NAMES_free(altnames);
}
-
+
if(matched)
/* an alternative name matched the server hostname */
infof(data, "\t subjectAltName: %s matched\n", conn->host.dispname);
int j,i=-1 ;
/* The following is done because of a bug in 0.9.6b */
-
+
unsigned char *nulstr = (unsigned char *)"";
unsigned char *peer_CN = nulstr;
- X509_NAME *name = X509_get_subject_name(server_cert) ;
- if (name)
- while ((j=X509_NAME_get_index_by_NID(name,NID_commonName,i))>=0)
- i=j;
+ X509_NAME *name = X509_get_subject_name(server_cert) ;
+ if (name)
+ while ((j=X509_NAME_get_index_by_NID(name,NID_commonName,i))>=0)
+ i=j;
/* we have the name entry and we will now convert this to a string
that we can use for comparison. Doing this we support BMPstring,
X509_NAME_ENTRY_get_data(
X509_NAME_get_entry(name,i)));
}
-
+
if (peer_CN == nulstr)
peer_CN = NULL;
infof(data, "\t common name: %s (matched)\n", peer_CN);
OPENSSL_free(peer_CN);
}
- }
+ }
return CURLE_OK;
}
#endif
req_method = SSLv3_client_method();
break;
}
-
+
connssl->ctx = SSL_CTX_new(req_method);
if(!connssl->ctx) {
*/
SSL_CTX_set_options(connssl->ctx, SSL_OP_ALL);
-
+
if(data->set.cert) {
if(!cert_stuff(conn,
connssl->ctx,
timeout_ms = data->set.timeout*1000;
else
timeout_ms = data->set.connecttimeout*1000;
-
+
/* subtract the passed time */
timeout_ms -= has_passed;
-
+
if(timeout_ms < 0) {
/* a precaution, no need to continue if time already is up */
failf(data, "SSL connection timeout");
Store_SSL_Session(conn, connssl);
}
-
+
/* Get server's certificate (note: beware of dynamic allocation) - opt */
/* major serious hack alert -- we should check certificates
* to authenticate the server; otherwise we risk man-in-the-middle
return CURLE_SSL_PEER_CERTIFICATE;
}
infof (data, "Server certificate:\n");
-
+
str = X509_NAME_oneline(X509_get_subject_name(connssl->server_cert),
NULL, 0);
if(!str) {
/* We could do all sorts of certificate verification stuff here before
deallocating the certificate. */
-
+
data->set.ssl.certverifyresult=SSL_get_verify_result(connssl->handle);
if(data->set.ssl.certverifyresult != X509_V_OK) {
if(data->set.ssl.verifypeer) {
projects / thirdparty / curl.git / commitdiff
