Ryzom
/
ryzom-core
1
1
Fork 0
Code Issues 38 Pull Requests Projects 1 Releases 1 Activity

Merge with develop

Browse Source 
--HG--
branch : compatibility-develop
hg/compatibility-develop
kervala 6 years ago
parent c3e95b7a74 6966bc1a12
commit 4545b43160
4 changed files with 64 additions and 47 deletions
Show Stats Download Patch File Download Diff File

7
code/nel/include/nel/gui/curl_certificates.h
Unescape Escape View File

@ -19,7 +19,8 @@
#include "nel/misc/types_nl.h"
#include <curl/curl.h>
// forward declaration to avoid curl.h inclusion everywhere
typedef void CURL;
namespace NLGUI
{
@ -32,8 +33,8 @@ namespace NLGUI
// allow to use custom PEM certificates
static void addCertificateFile(const std::string &cert);
// cURL SSL certificate loading
static CURLcode sslCtxFunction(CURL *curl, void *sslctx, void *parm);
// set all CURL options to use custom SSL context function
static void useCertificates(CURL *curl);
};
} // namespace

66
code/nel/src/gui/curl_certificates.cpp
Unescape Escape View File

@ -23,6 +23,8 @@
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <curl/curl.h>
using namespace std;
using namespace NLMISC;
@ -67,7 +69,16 @@ namespace NLGUI
// get more information on CURL session
curl_tlssessioninfo *sessionInfo;
CURLcode res = curl_easy_getinfo(curl, CURLINFO_TLS_SSL_PTR, &sessionInfo);
CURLINFO info;
#if CURL_AT_LEAST_VERSION(7, 48, 0)
info = CURLINFO_TLS_SSL_PTR;
#else
info = CURLINFO_TLS_SESSION;
#endif
CURLcode res = curl_easy_getinfo(curl, info, &sessionInfo);
// only use OpenSSL callback if not using Windows SSPI and using OpenSSL backend
if (!res && sessionInfo && sessionInfo->backend == CURLSSLBACKEND_OPENSSL && !(data && data->features & CURL_VERSION_SSPI))
@ -201,23 +212,8 @@ namespace NLGUI
/// this will be initialized on startup and cleared on exit
static SX509Certificates x509CertListManager;
// ***************************************************************************
// static
void CCurlCertificates::init(CURL *curl)
{
x509CertListManager.init(curl);
}
// ***************************************************************************
// static
void CCurlCertificates::addCertificateFile(const std::string &cert)
{
x509CertListManager.addCertificatesFromFile(cert);
}
// ***************************************************************************
// static
CURLcode CCurlCertificates::sslCtxFunction(CURL *curl, void *sslctx, void *parm)
// cURL SSL certificate loading
static CURLcode sslCtxFunction(CURL *curl, void *sslctx, void *parm)
{
CURLcode res = CURLE_OK;
@ -282,5 +278,39 @@ namespace NLGUI
return res;
}
// ***************************************************************************
// static
void CCurlCertificates::init(CURL *curl)
{
x509CertListManager.init(curl);
}
// ***************************************************************************
// static
void CCurlCertificates::addCertificateFile(const std::string &cert)
{
x509CertListManager.addCertificatesFromFile(cert);
}
// ***************************************************************************
// static
void CCurlCertificates::useCertificates(CURL *curl)
{
// CURL must be valid, using OpenSSL backend and certificates must be loaded, else return
if (!curl || !isUsingOpenSSLBackend || x509CertListManager.CertList.empty()) return;
curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "PEM");
// would allow to provide the CA in memory instead of using CURLOPT_CAINFO, but needs to include and link OpenSSL
if (curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, &sslCtxFunction) != CURLE_OK)
{
nlwarning("Unable to support CURLOPT_SSL_CTX_FUNCTION, curl not compiled with OpenSSL ?");
}
// set both CURLOPT_CAINFO and CURLOPT_CAPATH to NULL to be sure we won't use default values (these files can be missing and generate errors)
curl_easy_setopt(curl, CURLOPT_CAINFO, NULL);
curl_easy_setopt(curl, CURLOPT_CAPATH, NULL);
}
}// namespace

27
code/nel/src/gui/group_html.cpp
Unescape Escape View File

@ -404,15 +404,8 @@ namespace NLGUI
// specify custom CA certs
CCurlCertificates::addCertificateFile(options.curlCABundle);
// would allow to provide the CA in memory instead of using CURLOPT_CAINFO, but needs to include and link OpenSSL
if (curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, &CCurlCertificates::sslCtxFunction) != CURLE_OK)
{
nlwarning("Unable to support CURLOPT_SSL_CTX_FUNCTION, curl not compiled with OpenSSL ?");
}
// set both CURLOPT_CAINFO and CURLOPT_CAPATH to NULL to be sure we won't use default values (these files can be missing and generate errors)
curl_easy_setopt(curl, CURLOPT_CAINFO, NULL);
curl_easy_setopt(curl, CURLOPT_CAPATH, NULL);
// if supported, use custom SSL context function to load certificates
CCurlCertificates::useCertificates(curl);
}
download.data = new CCurlWWWData(curl, download.url);
@ -5352,14 +5345,14 @@ namespace NLGUI
// https://
if (toLower(url.substr(0, 8)) == "https://")
{
#if defined(NL_OS_WINDOWS)
curl_easy_setopt(curl, CURLOPT_SSL_CTX_FUNCTION, &CCurlCertificates::sslCtxFunction);
#else
if (!options.curlCABundle.empty())
{
curl_easy_setopt(curl, CURLOPT_CAINFO, options.curlCABundle.c_str());
}
#endif
// check if compiled with OpenSSL backend
CCurlCertificates::init(curl);
// specify custom CA certs
CCurlCertificates::addCertificateFile(options.curlCABundle);
// if supported, use custom SSL context function to load certificates
CCurlCertificates::useCertificates(curl);
}
// do not follow redirects, we have own handler

11
code/ryzom/client/src/http_client_curl.cpp
Unescape Escape View File

@ -70,7 +70,6 @@ bool CCurlHttpClient::verifyServer(bool verify)
{
curl_easy_setopt(_Curl, CURLOPT_SSL_VERIFYHOST, verify ? 2 : 0);
curl_easy_setopt(_Curl, CURLOPT_SSL_VERIFYPEER, verify ? 1 : 0);
curl_easy_setopt(_Curl, CURLOPT_SSLCERTTYPE, "PEM");
// check if compiled with OpenSSL backend
NLGUI::CCurlCertificates::init(_Curl);
@ -78,15 +77,9 @@ bool CCurlHttpClient::verifyServer(bool verify)
// specify custom CA certs
NLGUI::CCurlCertificates::addCertificateFile(CAFilename);
// would allow to provide the CA in memory instead of using CURLOPT_CAINFO, but needs to include and link OpenSSL
if (curl_easy_setopt(_Curl, CURLOPT_SSL_CTX_FUNCTION, &NLGUI::CCurlCertificates::sslCtxFunction) != CURLE_OK)
{
nlwarning("Unable to support CURLOPT_SSL_CTX_FUNCTION, curl not compiled with OpenSSL ?");
}
// if supported, use custom SSL context function to load certificates
NLGUI::CCurlCertificates::useCertificates(_Curl);
// set both CURLOPT_CAINFO and CURLOPT_CAPATH to NULL to be sure we won't use default values (these files can be missing and generate errors)
curl_easy_setopt(_Curl, CURLOPT_CAINFO, NULL);
curl_easy_setopt(_Curl, CURLOPT_CAPATH, NULL);
return true;
}

Write Preview
Loading…
Cancel
Save