Only in dump/curl-7.21.6/docs/examples: certstore.c diff -ur downloads-a/curl-7.21.6/docs/libcurl/curl_easy_setopt.3 dump/curl-7.21.6/docs/libcurl/curl_easy_setopt.3 --- downloads-a/curl-7.21.6/docs/libcurl/curl_easy_setopt.3 2011-04-21 01:48:28.000000000 +0530 +++ dump/curl-7.21.6/docs/libcurl/curl_easy_setopt.3 2011-05-10 05:35:14.168290500 +0530 @@ -1986,6 +1986,16 @@ limitation in openssl. This option is OpenSSL-specific and does nothing if libcurl is built to use GnuTLS. NSS-powered libcurl provides the option only for backward compatibility. +.IP CURLOPT_CACERTSTORE +Pass a pointer to a X509_STORE that you have loaded with valid root +certificates. An example function can be found in certstore.c. The store +contains multiple CA certificates to verify the peer with. +This makes sense only when used in combination with the +\fICURLOPT_SSL_VERIFYPEER\fP option. This option is OpenSSL-specific and +does nothing if libcurl is built to use GnuTLS. +This option is useful if you want to load the root certificates from a trusted +signed file. It is also useful if you want to parse the root certificates +once and use it again and again. .IP CURLOPT_CRLFILE Pass a char * to a zero terminated string naming a file with the concatenation of CRL (in PEM format) to use in the certificate validation that occurs during diff -ur downloads-a/curl-7.21.6/include/curl/curl.h dump/curl-7.21.6/include/curl/curl.h --- downloads-a/curl-7.21.6/include/curl/curl.h 2011-04-22 22:31:50.000000000 +0530 +++ dump/curl-7.21.6/include/curl/curl.h 2011-05-10 02:26:11.819052000 +0530 @@ -1475,6 +1475,7 @@ */ CINIT(TRANSFER_ENCODING, LONG, 207), + CINIT(CACERTSTORE, OBJECTPOINT, 208), CURLOPT_LASTENTRY /* the last unused */ } CURLoption; diff -ur downloads-a/curl-7.21.6/include/curl/typecheck-gcc.h dump/curl-7.21.6/include/curl/typecheck-gcc.h --- downloads-a/curl-7.21.6/include/curl/typecheck-gcc.h 2011-04-19 01:17:32.000000000 +0530 +++ dump/curl-7.21.6/include/curl/typecheck-gcc.h 2011-05-10 02:26:29.950704000 +0530 @@ -244,6 +244,7 @@ (option) == CURLOPT_SSLENGINE || \ (option) == CURLOPT_CAINFO || \ (option) == CURLOPT_CAPATH || \ + (option) == CURLOPT_CACERTSTORE || \ (option) == CURLOPT_RANDOM_FILE || \ (option) == CURLOPT_EGDSOCKET || \ (option) == CURLOPT_SSL_CIPHER_LIST || \ diff -ur downloads-a/curl-7.21.6/lib/getenv.c dump/curl-7.21.6/lib/getenv.c --- downloads-a/curl-7.21.6/lib/getenv.c 2011-03-19 20:46:08.000000000 +0530 +++ dump/curl-7.21.6/lib/getenv.c 2011-05-10 02:27:23.319358500 +0530 @@ -46,7 +46,7 @@ char *temp = getenv(variable); env[0] = '\0'; if(temp != NULL) - ExpandEnvironmentStrings(temp, env, sizeof(env)); + ExpandEnvironmentStringsA(temp, env, sizeof(env)); return (env[0] != '\0')?strdup(env):NULL; #else char *env = getenv(variable); diff -ur downloads-a/curl-7.21.6/lib/sslgen.c dump/curl-7.21.6/lib/sslgen.c --- downloads-a/curl-7.21.6/lib/sslgen.c 2011-04-21 02:15:08.000000000 +0530 +++ dump/curl-7.21.6/lib/sslgen.c 2011-05-10 02:26:11.750697000 +0530 @@ -85,6 +85,7 @@ if((data->version == needle->version) && (data->verifypeer == needle->verifypeer) && (data->verifyhost == needle->verifyhost) && + safe_strequal(data->cert_store, needle->cert_store) && safe_strequal(data->CApath, needle->CApath) && safe_strequal(data->CAfile, needle->CAfile) && safe_strequal(data->random_file, needle->random_file) && @@ -100,6 +101,7 @@ struct ssl_config_data *dest) { dest->sessionid = source->sessionid; + dest->cert_store = source->cert_store; dest->verifyhost = source->verifyhost; dest->verifypeer = source->verifypeer; dest->version = source->version; diff -ur downloads-a/curl-7.21.6/lib/ssluse.c dump/curl-7.21.6/lib/ssluse.c --- downloads-a/curl-7.21.6/lib/ssluse.c 2011-04-22 22:31:50.000000000 +0530 +++ dump/curl-7.21.6/lib/ssluse.c 2011-05-10 02:26:11.526102000 +0530 @@ -841,6 +841,10 @@ connssl->handle = NULL; } if(connssl->ctx) { + if( connssl->m_prevcertstore ){ + connssl->ctx->cert_store = connssl->m_prevcertstore; + connssl->m_prevcertstore = 0; + } SSL_CTX_free (connssl->ctx); connssl->ctx = NULL; } @@ -1475,9 +1479,15 @@ break; } - if(connssl->ctx) + if(connssl->ctx){ + if( connssl->m_prevcertstore ){ + connssl->ctx->cert_store = connssl->m_prevcertstore; + connssl->m_prevcertstore = 0; + } SSL_CTX_free(connssl->ctx); + } connssl->ctx = SSL_CTX_new(req_method); + connssl->m_prevcertstore = 0; if(!connssl->ctx) { failf(data, "SSL: couldn't create a context: %s", @@ -1586,6 +1596,10 @@ } } #endif + if(data->set.cert_store && data->set.cert_store!=(void*)connssl->ctx->cert_store) { + connssl->m_prevcertstore = connssl->ctx->cert_store; + connssl->ctx->cert_store = (X509_STORE*)data->set.cert_store; + } if(data->set.str[STRING_SSL_CAFILE] || data->set.str[STRING_SSL_CAPATH]) { /* tell SSL where to find CA certificates that are used to verify the servers certificate. */ diff -ur downloads-a/curl-7.21.6/lib/strerror.c dump/curl-7.21.6/lib/strerror.c --- downloads-a/curl-7.21.6/lib/strerror.c 2011-04-21 02:15:08.000000000 +0530 +++ dump/curl-7.21.6/lib/strerror.c 2011-05-10 02:27:23.351583000 +0530 @@ -630,7 +630,7 @@ strncpy(buf, strerror(err), max); else { if(!get_winsock_error(err, buf, max) && - !FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, NULL, err, + !FormatMessageA(FORMAT_MESSAGE_FROM_SYSTEM, NULL, err, LANG_NEUTRAL, buf, (DWORD)max, NULL)) snprintf(buf, max, "Unknown error %d (%#x)", err, err); } diff -ur downloads-a/curl-7.21.6/lib/telnet.c dump/curl-7.21.6/lib/telnet.c --- downloads-a/curl-7.21.6/lib/telnet.c 2011-04-22 22:31:50.000000000 +0530 +++ dump/curl-7.21.6/lib/telnet.c 2011-05-10 02:27:22.659244500 +0530 @@ -1241,7 +1241,7 @@ /* OK, so we have WinSock 2.0. We need to dynamically */ /* load ws2_32.dll and get the function pointers we need. */ - wsock2 = LoadLibrary("WS2_32.DLL"); + wsock2 = LoadLibraryA("WS2_32.DLL"); if(wsock2 == NULL) { failf(data,"failed to load WS2_32.DLL (%d)", ERRNO); return CURLE_FAILED_INIT; diff -ur downloads-a/curl-7.21.6/lib/url.c dump/curl-7.21.6/lib/url.c --- downloads-a/curl-7.21.6/lib/url.c 2011-04-21 02:15:08.000000000 +0530 +++ dump/curl-7.21.6/lib/url.c 2011-05-10 02:26:11.682342000 +0530 @@ -2032,6 +2032,9 @@ result = setstropt(&data->set.str[STRING_SSL_CAFILE], va_arg(param, char *)); break; + case CURLOPT_CACERTSTORE: + data->set.cert_store = va_arg(param, void *); + break; case CURLOPT_CAPATH: /* * Set CA path info for SSL connection. Specify directory name of the CA @@ -4899,6 +4902,7 @@ that will be freed as part of the SessionHandle struct, but all cloned copies will be separately allocated. */ + data->set.ssl.cert_store = data->set.cert_store; data->set.ssl.CApath = data->set.str[STRING_SSL_CAPATH]; data->set.ssl.CAfile = data->set.str[STRING_SSL_CAFILE]; data->set.ssl.CRLfile = data->set.str[STRING_SSL_CRLFILE]; diff -ur downloads-a/curl-7.21.6/lib/urldata.h dump/curl-7.21.6/lib/urldata.h --- downloads-a/curl-7.21.6/lib/urldata.h 2011-04-22 22:31:50.000000000 +0530 +++ dump/curl-7.21.6/lib/urldata.h 2011-05-10 02:26:30.023941500 +0530 @@ -246,6 +246,9 @@ bool use; ssl_connection_state state; #ifdef USE_SSLEAY + /* A place to preserve SSL_CTX_new allocated cert_store and then restore + it before SSL_CTX_free so user allocated cert store is not freed */ + void* m_prevcertstore; /* these ones requires specific SSL-types */ SSL_CTX* ctx; SSL* handle; @@ -299,6 +302,7 @@ long verifyhost; /* 0: no verify 1: check that CN exists 2: CN must match hostname */ + void *cert_store; /* user loaded & freed https certificate store*/ char *CApath; /* certificate dir (doesn't work on windows) */ char *CAfile; /* certificate to verify peer against */ const char *CRLfile; /* CRL to check certificate revocation */ @@ -1494,6 +1498,7 @@ long new_directory_perms; /* Permissions to use when creating remote dirs */ bool proxy_transfer_mode; /* set transfer mode (;type=) when doing FTP via an HTTP proxy */ + void *cert_store; /* user loaded+ userfreed https certificate store */ char *str[STRING_LAST]; /* array of strings, pointing to allocated memory */ unsigned int scope; /* address scope for IPv6 */ long allowed_protocols;