Khaganat-NeL/khanat-opennel-code
2
0
Fork 0
Code Issues 21 Pull requests Projects Releases 1 Packages Wiki Activity

Changed: Make sslCtxFunction private and don't include curl.h in header

Browse source 
--HG--
branch : develop
This commit is contained in:
kervala 2018-08-07 18:40:48 +02:00
parent df032e220e
commit d9e6d34fcc
4 changed files with 54 additions and 46 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
code/nel/include/nel/gui/curl_certificates.h
View file

@ -19,7 +19,8 @@
#include "nel/misc/types_nl.h"
#include <curl/curl.h>
// forward declaration to avoid curl.h inclusion everywhere
typedef void CURL;
namespace NLGUI
{
@ -32,8 +33,8 @@ namespace NLGUI
// allow to use custom PEM certificates
static void addCertificateFile(const std::string &cert);
// cURL SSL certificate loading
static CURLcode sslCtxFunction(CURL *curl, void *sslctx, void *parm);
// set all CURL options to use custom SSL context function
static void useCertificates(CURL *curl);
};
} // namespace

55
code/nel/src/gui/curl_certificates.cpp
View file

@ -23,6 +23,8 @@
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <curl/curl.h>
using namespace std;
using namespace NLMISC;
@ -201,23 +203,8 @@ namespace NLGUI
/// this will be initialized on startup and cleared on exit
static SX509Certificates x509CertListManager;
// ***************************************************************************
// static
void CCurlCertificates::init(CURL *curl)
{
x509CertListManager.init(curl);
}
// ***************************************************************************
// static
void CCurlCertificates::addCertificateFile(const std::string &cert)
{
x509CertListManager.addCertificatesFromFile(cert);
}
// ***************************************************************************
// static
CURLcode CCurlCertificates::sslCtxFunction(CURL *curl, void *sslctx, void *parm)
// cURL SSL certificate loading
static CURLcode sslCtxFunction(CURL *curl, void *sslctx, void *parm)
{
CURLcode res = CURLE_OK;
@ -282,5 +269,39 @@ namespace NLGUI
return res;
}
// ***************************************************************************
// static
void CCurlCertificates::init(CURL *curl)
{
x509CertListManager.init(curl);
}
// ***************************************************************************
// static
void CCurlCertificates::addCertificateFile(const std::string &cert)
{
x509CertListManager.addCertificatesFromFile(cert);
}
// ***************************************************************************
// static
void CCurlCertificates::useCertificates(CURL *curl)
{
// CURL must be valid, using OpenSSL backend and certificates must be loaded, else return
if (!curl || !isUsingOpenSSLBackend || x509CertListManager.CertList.empty()) return;
curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM");
// would allow to provide the CA in memory instead of using CURLOPT_CAINFO, but needs to include and link OpenSSL
if (curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, &sslCtxFunction) != CURLE_OK)
{
nlwarning("Unable to support CURLOPT_SSL_CTX_FUNCTION, curl not compiled with OpenSSL ?");
}
// set both CURLOPT_CAINFO and CURLOPT_CAPATH to NULL to be sure we won't use default values (these files can be missing and generate errors)
curl_easy_setopt(curl, CURLOPT_CAINFO, NULL);
curl_easy_setopt(curl, CURLOPT_CAPATH, NULL);
}
}// namespace

27
code/nel/src/gui/group_html.cpp
View file

@ -404,15 +404,8 @@ namespace NLGUI
// specify custom CA certs
CCurlCertificates::addCertificateFile(options.curlCABundle);
// would allow to provide the CA in memory instead of using CURLOPT_CAINFO, but needs to include and link OpenSSL
if (curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, &CCurlCertificates::sslCtxFunction) != CURLE_OK)
{
nlwarning("Unable to support CURLOPT_SSL_CTX_FUNCTION, curl not compiled with OpenSSL ?");
}
// set both CURLOPT_CAINFO and CURLOPT_CAPATH to NULL to be sure we won't use default values (these files can be missing and generate errors)
curl_easy_setopt(curl, CURLOPT_CAINFO, NULL);
curl_easy_setopt(curl, CURLOPT_CAPATH, NULL);
// if supported, use custom SSL context function to load certificates
CCurlCertificates::useCertificates(curl);
}
download.data = new CCurlWWWData(curl, download.url);
@ -5350,14 +5343,14 @@ namespace NLGUI
// https://
if (toLower(url.substr(0, 8)) == "https://")
{
#if defined(NL_OS_WINDOWS)
curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, &CCurlCertificates::sslCtxFunction);
#else
if (!options.curlCABundle.empty())
{
curl_easy_setopt(curl, CURLOPT_CAINFO, options.curlCABundle.c_str());
}
#endif
// check if compiled with OpenSSL backend
CCurlCertificates::init(curl);
// specify custom CA certs
CCurlCertificates::addCertificateFile(options.curlCABundle);
// if supported, use custom SSL context function to load certificates
CCurlCertificates::useCertificates(curl);
}
// do not follow redirects, we have own handler

11
code/ryzom/client/src/http_client_curl.cpp
View file

@ -70,7 +70,6 @@ bool CCurlHttpClient::verifyServer(bool verify)
{
curl_easy_setopt(_Curl, CURLOPT_SSL_VERIFYHOST, verify ? 2 : 0);
curl_easy_setopt(_Curl, CURLOPT_SSL_VERIFYPEER, verify ? 1 : 0);
curl_easy_setopt(_Curl, CURLOPT_SSLCERTTYPE, "PEM");
// check if compiled with OpenSSL backend
NLGUI::CCurlCertificates::init(_Curl);
@ -78,15 +77,9 @@ bool CCurlHttpClient::verifyServer(bool verify)
// specify custom CA certs
NLGUI::CCurlCertificates::addCertificateFile(CAFilename);
// would allow to provide the CA in memory instead of using CURLOPT_CAINFO, but needs to include and link OpenSSL
if (curl_easy_setopt(_Curl, CURLOPT_SSL_CTX_FUNCTION, &NLGUI::CCurlCertificates::sslCtxFunction) != CURLE_OK)
{
nlwarning("Unable to support CURLOPT_SSL_CTX_FUNCTION, curl not compiled with OpenSSL ?");
}
// if supported, use custom SSL context function to load certificates
NLGUI::CCurlCertificates::useCertificates(_Curl);
// set both CURLOPT_CAINFO and CURLOPT_CAPATH to NULL to be sure we won't use default values (these files can be missing and generate errors)
curl_easy_setopt(_Curl, CURLOPT_CAINFO, NULL);
curl_easy_setopt(_Curl, CURLOPT_CAPATH, NULL);
return true;
}