Commit f6c335d6 authored by Patrick Monnerat's avatar Patrick Monnerat
Browse files

NSS: support for CERTINFO feature

parent 2bd72fa6

docs/libcurl/curl_easy_getinfo.3

+3 −3
Original line number Diff line number Diff line
@@ -5,7 +5,7 @@ 
.\" *                            | (__| |_| |  _ <| |___

.\" *                             \___|\___/|_| \_\_____|

.\" *

.\" * Copyright (C) 1998 - 2012, Daniel Stenberg, <daniel@haxx.se>, et al.

.\" * Copyright (C) 1998 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al.

.\" *

.\" * This software is licensed as described in the file COPYING, which

.\" * you should have received as part of this distribution. The terms
@@ -219,8 +219,8 @@ done. The struct reports how many certs it found and then you can extract info 
for each of those certs by following the linked lists. The info chain is

provided in a series of data in the format "name:content" where the content is

for the specific named data. See also the certinfo.c example. NOTE: this

option is only available in libcurl built with OpenSSL support. (Added in

7.19.1)

option is only available in libcurl built with OpenSSL, NSS, GSKit or QsoSSL

support. (Added in 7.19.1)

.IP CURLINFO_CONDITION_UNMET

Pass a pointer to a long to receive the number 1 if the condition provided in

the previous request didn't match (see \fICURLOPT_TIMECONDITION\fP). Alas, if

docs/libcurl/curl_easy_setopt.3

+3 −2
Original line number Diff line number Diff line
@@ -2549,9 +2549,10 @@ is ignored. 


.IP CURLOPT_CERTINFO

Pass a long set to 1 to enable libcurl's certificate chain info gatherer. With

this enabled, libcurl (if built with OpenSSL) will extract lots of information

this enabled, libcurl (if built with OpenSSL, NSS, GSKit or QsoSSL) will

extract lots of information

and data about the certificates in the certificate chain used in the SSL

connection. This data is then possible to extract after a transfer using

connection. This data may then be retrieved after a transfer using

\fIcurl_easy_getinfo(3)\fP and its option \fICURLINFO_CERTINFO\fP. (Added in

7.19.1)

.IP CURLOPT_RANDOM_FILE

lib/hostcheck.c

+2 −2
Original line number Diff line number Diff line
@@ -23,7 +23,7 @@ 
#include "curl_setup.h"



#if defined(USE_SSLEAY) || defined(USE_AXTLS) || defined(USE_QSOSSL) || \

    defined(USE_GSKIT)

    defined(USE_GSKIT) || defined(USE_NSS)

/* these backends use functions from this file */



#include "hostcheck.h"
@@ -94,4 +94,4 @@ int Curl_cert_hostcheck(const char *match_pattern, const char *hostname) 
  return 0;

}



#endif /* SSLEAY or AXTLS or QSOSSL or GSKIT */
 
#endif /* SSLEAY or AXTLS or QSOSSL or GSKIT or NSS */

lib/nss.c

+42 −4
Original line number Diff line number Diff line
@@ -653,6 +653,10 @@ static void display_conn_info(struct connectdata *conn, PRFileDesc *sock) 
  SSLChannelInfo channel;

  SSLCipherSuiteInfo suite;

  CERTCertificate *cert;

  CERTCertificate *cert2;

  CERTCertificate *cert3;

  PRTime now;

  int i;



  if(SSL_GetChannelInfo(sock, &channel, sizeof channel) ==

     SECSuccess && channel.length == sizeof channel &&
@@ -663,11 +667,45 @@ static void display_conn_info(struct connectdata *conn, PRFileDesc *sock) 
    }

  }



  cert = SSL_PeerCertificate(sock);



  if(cert) {

    infof(conn->data, "Server certificate:\n");



  cert = SSL_PeerCertificate(sock);

    if(!conn->data->set.ssl.certinfo) {

      display_cert_info(conn->data, cert);

      CERT_DestroyCertificate(cert);

    }

    else {

      /* Count certificates in chain. */

      now = PR_Now();

      i = 1;

      if(!cert->isRoot) {

        cert2 = CERT_FindCertIssuer(cert, now, certUsageSSLCA);

        while(cert2) {

          i++;

          if(cert2->isRoot) {

            CERT_DestroyCertificate(cert2);

            break;

          }

          cert3 = CERT_FindCertIssuer(cert2, now, certUsageSSLCA);

          CERT_DestroyCertificate(cert2);

          cert2 = cert3;

        }

      }

      Curl_ssl_init_certinfo(conn->data, i);

      for(i = 0; cert; cert = cert2) {

        Curl_extract_certinfo(conn, i++, cert->derCert.data,

                              cert->derCert.data + cert->derCert.len);

        if(cert->isRoot) {

          CERT_DestroyCertificate(cert);

          break;

        }

        cert2 = CERT_FindCertIssuer(cert, now, certUsageSSLCA);

        CERT_DestroyCertificate(cert);

      }

    }

  }



  return;

}

lib/url.c

+2 −1
Original line number Diff line number Diff line
@@ -1926,7 +1926,8 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option, 
    data->set.ssl.fsslctxp = va_arg(param, void *);

    break;

#endif

#if defined(USE_SSLEAY) || defined(USE_QSOSSL) || defined(USE_GSKIT)

#if defined(USE_SSLEAY) || defined(USE_QSOSSL) || defined(USE_GSKIT) || \

    defined(USE_NSS)

  case CURLOPT_CERTINFO:

    data->set.ssl.certinfo = (0 != va_arg(param, long))?TRUE:FALSE;

    break;