Fossil SCM

Add the test-trust-store command for debugging TLS problems.

drh 2024-11-04 11:22 trunk
Commit 28ea88e77039030fe7cd5d8a381a12f4c8613269dd925ccdda30b4bc4fa6923b
Parent 6bb5ff4aeab1b81…
1 file changed +20 -2
~ src/http_ssl.c
M src/http_ssl.c
+20 -2
--- src/http_ssl.c
+++ src/http_ssl.c
@@ -247,11 +247,11 @@
247247
248248
 /*
249249
 ** Call this routine once before any other use of the SSL interface.
250250
 ** This routine does initial configuration of the SSL module.
251251
 */
252
-static void ssl_global_init_client(void){
252
+static void ssl_global_init_client(int bDebug){
253253
 const char *identityFile;
254254
255255
 if( sslIsInit==0 ){
256256
 const char *zFile;
257257
 const char *zCaFile = 0;
@@ -302,10 +302,14 @@
302302
 zCaDirectory = 0;
303303
 break;
304304
 }
305305
 }
306306
 }
307
+ if( bDebug ){
308
+ fossil_print("zCaFile = %s\n"
309
+ "zCaDirectory = %s\n", zCaFile, zCaDirectory);
310
+ }
307311
 if( zFile==0 ){
308312
 /* fossil_fatal("Cannot find a trust store"); */
309313
 }else if( SSL_CTX_load_verify_locations(sslCtx, zCaFile, zCaDirectory)==0 ){
310314
 fossil_fatal("Cannot load CA root certificates from %s", zFile);
311315
 }
@@ -332,10 +336,13 @@
332336
 if( g.zSSLIdentity!=0 ){
333337
 identityFile = g.zSSLIdentity;
334338
 }else{
335339
 identityFile = db_get("ssl-identity", 0);
336340
 }
341
+ if( bDebug ){
342
+ fossil_print("identifyFile = %s\n", identityFile);
343
+ }
337344
 if( identityFile!=0 && identityFile[0]!='\0' ){
338345
 if( SSL_CTX_use_certificate_chain_file(sslCtx,identityFile)!=1
339346
 || SSL_CTX_use_PrivateKey_file(sslCtx,identityFile,SSL_FILETYPE_PEM)!=1
340347
 ){
341348
 fossil_fatal("Could not load SSL identity from %s", identityFile);
@@ -359,10 +366,21 @@
359366
 SSL_CTX_free(sslCtx);
360367
 ssl_clear_errmsg();
361368
 sslIsInit = 0;
362369
 }
363370
 }
371
+
372
+/*
373
+** COMMAND: test-trust-store
374
+**
375
+** Show the trust store that is used by OpenSSL.
376
+*/
377
+void test_openssl_trust_store(void){
378
+ ssl_global_init_client(1);
379
+ ssl_global_shutdown();
380
+}
381
+
364382
365383
 /*
366384
 ** Close the currently open client SSL connection. If no connection is open,
367385
 ** this routine is a no-op.
368386
 */
@@ -446,11 +464,11 @@
446464
 */
447465
 int ssl_open_client(UrlData *pUrlData){
448466
 X509 *cert;
449467
 const char *zRemoteHost;
450468
451
- ssl_global_init_client();
469
+ ssl_global_init_client(0);
452470
 if( pUrlData->useProxy ){
453471
 int rc;
454472
 char *connStr = mprintf("%s:%d", g.url.name, pUrlData->port);
455473
 BIO *sBio = BIO_new_connect(connStr);
456474
 free(connStr);
457475
--- src/http_ssl.c
+++ src/http_ssl.c
@@ -247,11 +247,11 @@
247
248 /*
249 ** Call this routine once before any other use of the SSL interface.
250 ** This routine does initial configuration of the SSL module.
251 */
252 static void ssl_global_init_client(void){
253 const char *identityFile;
254
255 if( sslIsInit==0 ){
256 const char *zFile;
257 const char *zCaFile = 0;
@@ -302,10 +302,14 @@
302 zCaDirectory = 0;
303 break;
304 }
305 }
306 }
 
 
 
 
307 if( zFile==0 ){
308 /* fossil_fatal("Cannot find a trust store"); */
309 }else if( SSL_CTX_load_verify_locations(sslCtx, zCaFile, zCaDirectory)==0 ){
310 fossil_fatal("Cannot load CA root certificates from %s", zFile);
311 }
@@ -332,10 +336,13 @@
332 if( g.zSSLIdentity!=0 ){
333 identityFile = g.zSSLIdentity;
334 }else{
335 identityFile = db_get("ssl-identity", 0);
336 }
 
 
 
337 if( identityFile!=0 && identityFile[0]!='\0' ){
338 if( SSL_CTX_use_certificate_chain_file(sslCtx,identityFile)!=1
339 || SSL_CTX_use_PrivateKey_file(sslCtx,identityFile,SSL_FILETYPE_PEM)!=1
340 ){
341 fossil_fatal("Could not load SSL identity from %s", identityFile);
@@ -359,10 +366,21 @@
359 SSL_CTX_free(sslCtx);
360 ssl_clear_errmsg();
361 sslIsInit = 0;
362 }
363 }
 
 
 
 
 
 
 
 
 
 
 
364
365 /*
366 ** Close the currently open client SSL connection. If no connection is open,
367 ** this routine is a no-op.
368 */
@@ -446,11 +464,11 @@
446 */
447 int ssl_open_client(UrlData *pUrlData){
448 X509 *cert;
449 const char *zRemoteHost;
450
451 ssl_global_init_client();
452 if( pUrlData->useProxy ){
453 int rc;
454 char *connStr = mprintf("%s:%d", g.url.name, pUrlData->port);
455 BIO *sBio = BIO_new_connect(connStr);
456 free(connStr);
457
--- src/http_ssl.c
+++ src/http_ssl.c
@@ -247,11 +247,11 @@
247
248 /*
249 ** Call this routine once before any other use of the SSL interface.
250 ** This routine does initial configuration of the SSL module.
251 */
252 static void ssl_global_init_client(int bDebug){
253 const char *identityFile;
254
255 if( sslIsInit==0 ){
256 const char *zFile;
257 const char *zCaFile = 0;
@@ -302,10 +302,14 @@
302 zCaDirectory = 0;
303 break;
304 }
305 }
306 }
307 if( bDebug ){
308 fossil_print("zCaFile = %s\n"
309 "zCaDirectory = %s\n", zCaFile, zCaDirectory);
310 }
311 if( zFile==0 ){
312 /* fossil_fatal("Cannot find a trust store"); */
313 }else if( SSL_CTX_load_verify_locations(sslCtx, zCaFile, zCaDirectory)==0 ){
314 fossil_fatal("Cannot load CA root certificates from %s", zFile);
315 }
@@ -332,10 +336,13 @@
336 if( g.zSSLIdentity!=0 ){
337 identityFile = g.zSSLIdentity;
338 }else{
339 identityFile = db_get("ssl-identity", 0);
340 }
341 if( bDebug ){
342 fossil_print("identifyFile = %s\n", identityFile);
343 }
344 if( identityFile!=0 && identityFile[0]!='\0' ){
345 if( SSL_CTX_use_certificate_chain_file(sslCtx,identityFile)!=1
346 || SSL_CTX_use_PrivateKey_file(sslCtx,identityFile,SSL_FILETYPE_PEM)!=1
347 ){
348 fossil_fatal("Could not load SSL identity from %s", identityFile);
@@ -359,10 +366,21 @@
366 SSL_CTX_free(sslCtx);
367 ssl_clear_errmsg();
368 sslIsInit = 0;
369 }
370 }
371
372 /*
373 ** COMMAND: test-trust-store
374 **
375 ** Show the trust store that is used by OpenSSL.
376 */
377 void test_openssl_trust_store(void){
378 ssl_global_init_client(1);
379 ssl_global_shutdown();
380 }
381
382
383 /*
384 ** Close the currently open client SSL connection. If no connection is open,
385 ** this routine is a no-op.
386 */
@@ -446,11 +464,11 @@
464 */
465 int ssl_open_client(UrlData *pUrlData){
466 X509 *cert;
467 const char *zRemoteHost;
468
469 ssl_global_init_client(0);
470 if( pUrlData->useProxy ){
471 int rc;
472 char *connStr = mprintf("%s:%d", g.url.name, pUrlData->port);
473 BIO *sBio = BIO_new_connect(connStr);
474 free(connStr);
475

Keyboard Shortcuts

Open search /
Next entry (timeline) j
Previous entry (timeline) k
Open focused entry Enter
Show this help ?
Toggle theme Top nav button