uclient-fetch: load CA certificates

[project/uclient.git] / uclient-fetch.c

diff --git a/uclient-fetch.c b/uclient-fetch.c
index 881b4ea..37cc214 100644 (file)
--- a/uclient-fetch.c
+++ b/uclient-fetch.c
@@ -22,6 +22,7 @@
 #include <dlfcn.h>
 #include <getopt.h>
 #include <fcntl.h>
+#include <glob.h>
 
 #include <libubox/blobmsg.h>
 
@@ -38,6 +39,7 @@ static struct ustream_ssl_ctx *ssl_ctx;
 static const struct ustream_ssl_ops *ssl_ops;
 static int quiet = false;
 static bool verify = true;
+static bool default_certs = false;
 static const char *output_file;
 static int output_fd = -1;
 static int error_ret;
@@ -149,13 +151,27 @@ static void msg_connecting(struct uclient *cl)
        fprintf(stderr, "Connecting to %s:%d\n", addr, port);
 }
 
-static void init_request(struct uclient *cl)
+static int init_request(struct uclient *cl)
 {
+       int rc;
+
        out_bytes = 0;
-       uclient_connect(cl);
+
+       rc = uclient_connect(cl);
+       if (rc)
+               return rc;
+
        msg_connecting(cl);
-       uclient_http_set_request_type(cl, "GET");
-       uclient_request(cl);
+
+       rc = uclient_http_set_request_type(cl, "GET");
+       if (rc)
+               return rc;
+
+       rc = uclient_request(cl);
+       if (rc)
+               return rc;
+
+       return 0;
 }
 
 static void eof_cb(struct uclient *cl)
@@ -180,6 +196,10 @@ static void handle_uclient_error(struct uclient *cl, int code)
                type = "Connection failed";
                error_ret = 4;
                break;
+       case UCLIENT_ERROR_TIMEDOUT:
+               type = "Connection timed out";
+               error_ret = 4;
+               break;
        case UCLIENT_ERROR_SSL_INVALID_CERT:
                type = "Invalid SSL certificate";
                ignore = !verify;
@@ -226,6 +246,15 @@ static int usage(const char *progname)
        return 1;
 }
 
+static void init_ca_cert(void)
+{
+       glob_t gl;
+       int i;
+
+       glob("/etc/ssl/certs/*.crt", 0, NULL, &gl);
+       for (i = 0; i < gl.gl_pathc; i++)
+               ssl_ops->context_add_ca_crt_file(ssl_ctx, gl.gl_pathv[i]);
+}
 
 static void init_ustream_ssl(void)
 {
@@ -269,6 +298,8 @@ int main(int argc, char **argv)
        struct uclient *cl;
        int ch;
        int longopt_idx = 0;
+       bool has_cert = false;
+       int rc;
 
        init_ustream_ssl();
 
@@ -280,6 +311,7 @@ int main(int argc, char **argv)
                                verify = false;
                                break;
                        case L_CA_CERTIFICATE:
+                               has_cert = true;
                                if (ssl_ctx)
                                        ssl_ops->context_add_ca_crt_file(ssl_ctx, optarg);
                                break;
@@ -313,6 +345,9 @@ int main(int argc, char **argv)
        argv += optind;
        argc -= optind;
 
+       if (verify && !has_cert)
+               default_certs = true;
+
        if (argc != 1)
                return usage(progname);
 
@@ -337,11 +372,20 @@ int main(int argc, char **argv)
                return 1;
        }
 
-       if (ssl_ctx)
+       if (ssl_ctx) {
+               init_ca_cert();
                uclient_http_set_ssl_ctx(cl, ssl_ops, ssl_ctx, verify);
+       }
+
+       rc = init_request(cl);
+       if (!rc) {
+               /* no error received, we can enter main loop */
+               uloop_run();
+       } else {
+               fprintf(stderr, "Failed to establish connection\n");
+               error_ret = 4;
+       }
 
-       init_request(cl);
-       uloop_run();
        uloop_done();
 
        uclient_free(cl);