Hello community, here is the log from the commit of package libserf for openSUSE:Factory checked in at 2012-06-10 23:19:15 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/libserf (Old) and /work/SRC/openSUSE:Factory/.libserf.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "libserf", Maintainer is "" Changes: -------- --- /work/SRC/openSUSE:Factory/libserf/libserf.changes 2012-03-23 15:11:39.000000000 +0100 +++ /work/SRC/openSUSE:Factory/.libserf.new/libserf.changes 2012-06-10 23:19:16.000000000 +0200 @@ -1,0 +2,7 @@ +Thu Jun 7 20:54:34 UTC 2012 - [email protected] + +- update to upstream Serf 1.1.0 + New: serf_bucket_request_set_CL() for C-L based, non-chunked requests + New: serf_ssl_server_cert_chain_callback_set() for full-chain validation + +------------------------------------------------------------------- Old: ---- serf-1.0.3.tar.bz2 New: ---- serf-1.1.0.tar.bz2 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ libserf.spec ++++++ --- /var/tmp/diff_new_pack.Agd103/_old 2012-06-10 23:19:17.000000000 +0200 +++ /var/tmp/diff_new_pack.Agd103/_new 2012-06-10 23:19:17.000000000 +0200 @@ -16,22 +16,30 @@ # - Name: libserf %define soname 0 %define major 1 -Version: 1.0.3 -Release: 1 +Version: 1.1.0 +Release: 0 Summary: High-Performance Asynchronous HTTP Client Library +License: Apache-2.0 +Group: System/Libraries Source: https://serf.googlecode.com/files/serf-%{version}.tar.bz2 Url: https://serf.googlecode.com -Group: System/Libraries -License: Apache-2.0 BuildRoot: %{_tmppath}/%{name}-%{version}-build -BuildRequires: libapr-util1-devel libapr1-devel openldap2-devel zlib-devel -BuildRequires: libexpat-devel libopenssl-devel -BuildRequires: gcc glibc-devel make pkgconfig -BuildRequires: autoconf automake libtool +BuildRequires: autoconf +BuildRequires: automake +BuildRequires: gcc +BuildRequires: glibc-devel +BuildRequires: libapr-util1-devel +BuildRequires: libapr1-devel +BuildRequires: libexpat-devel +BuildRequires: libopenssl-devel +BuildRequires: libtool +BuildRequires: make +BuildRequires: openldap2-devel +BuildRequires: pkgconfig +BuildRequires: zlib-devel %description The serf library is a C-based HTTP client library built upon the Apache @@ -71,9 +79,13 @@ Summary: High-Performance Asynchronous HTTP Client Library Group: Development/Libraries/C and C++ +Requires: libapr-util1-devel +Requires: libapr1-devel +Requires: libexpat-devel +Requires: libopenssl-devel Requires: libserf-1-0 = %{version} -Requires: libapr1-devel libapr-util1-devel openldap2-devel zlib-devel -Requires: libopenssl-devel libexpat-devel +Requires: openldap2-devel +Requires: zlib-devel %description -n libserf-devel The serf library is a C-based HTTP client library built upon the Apache ++++++ serf-1.0.3.tar.bz2 -> serf-1.1.0.tar.bz2 ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/serf-1.0.3/CHANGES new/serf-1.1.0/CHANGES --- old/serf-1.0.3/CHANGES 2012-03-20 20:39:31.000000000 +0100 +++ new/serf-1.1.0/CHANGES 2012-06-07 22:12:29.000000000 +0200 @@ -1,14 +1,22 @@ -Serf 1.0.3 [2012-03-20, r1586] +Serf 1.1.0 [2012-06-07, from /tags/1.1.0] + New: serf_bucket_request_set_CL() for C-L based, non-chunked requests + New: serf_ssl_server_cert_chain_callback_set() for full-chain validation + + +Serf 1.0.3 [2012-03-20, from /tags/1.0.3, r1586] Map more OpenSSL errors into SERF_SSL_CERT_UNKNOWNCA (r1573) + Serf 1.0.2 Not released. -Serf 1.0.1 [2012-02-15, r1569] + +Serf 1.0.1 [2012-02-15, from /tags/1.0.1, r1569] FreeBSD fixes in the test suite (r1560, r1565) Minor build fixes -Serf 1.0.0 [2011-07-15, r1540] + +Serf 1.0.0 [2011-07-15, from /tags/1.0.0, r1540] Fixed issue 38: enable builds using non-GNU make Fixed issue 49: support SSL tunnels for HTTPS via a proxy Fixed issue 56: allow Subject Alternative Name, and enable SNI @@ -29,17 +37,17 @@ Various memory leak fixes -Serf 0.7.2 [2011-03-12, r1452] +Serf 0.7.2 [2011-03-12, from /tags/0.7.2, r1452] Actually disable Nagle when creating a connection (r1441) Return error when app asks for HTTPS over proxy connection (r1433) -Serf 0.7.1 [2011-01-25, r1432] +Serf 0.7.1 [2011-01-25, from /tags/0.7.1, r1432] Fix memory leak when using SSL (r1408, r1416) Fix build for blank apr-util directory (r1421) -Serf 0.7.0 [2010-08-25, r1407] +Serf 0.7.0 [2010-08-25, from /tags/0.7.0, r1407] Fix double free abort when destroying request buckets Fix test server in unit test framework to avoid random test failures Allow older Serf programs which don't use the new authn framework to still @@ -49,12 +57,12 @@ Fix HTTP header parsing to allow for empty header values -Serf 0.6.1 [2010-05-14, r1370] +Serf 0.6.1 [2010-05-14, from /tags/0.6.1, r1370] Generally: this release fixes problems with the 0.4.0 packaging Small compilation fix in outgoing.c for Windows builds -Serf 0.6.0 [2010-05-14, r1363] +Serf 0.6.0 Not released. @@ -62,8 +70,8 @@ Not released. -Serf 0.4.0 [2010-05-13, r1353] - [NOTE: this release misstated itself as 0.5.0; use a later release instead] +Serf 0.4.0 + WITHDRAWN: this release misstated itself as 0.5.0; use a later release Provide authn framework, supporting Basic, Digest, Kerberos (SSPI, GSS), along with proxy authn using Basic or Digest @@ -80,14 +88,14 @@ Added serf_lib_version() for runtime version tests -Serf 0.3.1 [2010-02-14, r1321] +Serf 0.3.1 [2010-02-14, from /tags/0.3.1, r1322] Fix loss of error on request->setup() callback. (Issue 47) Support APR 2.x. (Issue 48) Fixed slowdown in aggregate bucket with millions of child buckets Avoid hang in apr_pollset_poll() by unclosed connections after fork() -Serf 0.3.0 [2009-01-26, r1217] +Serf 0.3.0 [2009-01-26, from /tags/0.3.0, r1217] Support LTFLAGS override as a config-time env. variable (Issue 44) Fix CUTest test harness compilation on Solaris (Issue 43) Fix small race condition in OpenSSL initialization (Issue 39) @@ -102,7 +110,7 @@ Build with bundled OpenSSL builds -Serf 0.2.0 [2008-06-06, r1189] +Serf 0.2.0 [2008-06-06, from /tags/0.2.0, r1189] Enable use of external event loop: serf_create_context_ex Enable adding new requests at the beginning of the request queue Handle 'Connection:close' headers @@ -123,7 +131,7 @@ Do not issue double close on skt w/second one being close(-1) (Issue 33) -Serf 0.1.2 [2007-06-18, r1115] +Serf 0.1.2 [2007-06-18, from /tags/0.1.2, r1115] Enable thread-safety with OpenSSL (Issue 19) Teach serfmake to install headers into include/serf-0 Be more tolerant when servers close the connection without telling us @@ -133,7 +141,7 @@ Fix uninitialized branch in serf_spider (Issue 15) -Serf 0.1.1 [2007-05-12, r1105] +Serf 0.1.1 [2007-05-12, from /tags/0.1.1, r1105] Add SSL client certificate support Implement optimized iovec reads for header buckets Fix up 'make clean' and 'make distclean' (Issues 9, 10) @@ -141,5 +149,5 @@ Remove abort() calls (Issue 13) -Serf 0.1.0 [2006-12-14, r1087] +Serf 0.1.0 [2006-12-14, from /tags/0.1.0, r1087] Initial packaged release diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/serf-1.0.3/buckets/request_buckets.c new/serf-1.1.0/buckets/request_buckets.c --- old/serf-1.0.3/buckets/request_buckets.c 2011-06-24 04:03:57.000000000 +0200 +++ new/serf-1.1.0/buckets/request_buckets.c 2012-03-19 22:31:55.000000000 +0100 @@ -25,11 +25,15 @@ const char *uri; serf_bucket_t *headers; serf_bucket_t *body; + apr_int64_t len; } request_context_t; +#define LENGTH_UNKNOWN ((apr_int64_t)-1) + + serf_bucket_t *serf_bucket_request_create( const char *method, - const char *uri, + const char *URI, serf_bucket_t *body, serf_bucket_alloc_t *allocator) { @@ -37,13 +41,23 @@ ctx = serf_bucket_mem_alloc(allocator, sizeof(*ctx)); ctx->method = method; - ctx->uri = uri; + ctx->uri = URI; ctx->headers = serf_bucket_headers_create(allocator); ctx->body = body; + ctx->len = LENGTH_UNKNOWN; return serf_bucket_create(&serf_bucket_type_request, allocator, ctx); } +void serf_bucket_request_set_CL( + serf_bucket_t *bucket, + apr_int64_t len) +{ + request_context_t *ctx = (request_context_t *)bucket->data; + + ctx->len = len; +} + serf_bucket_t *serf_bucket_request_get_headers( serf_bucket_t *bucket) { @@ -111,9 +125,19 @@ /* Insert the two buckets. */ serf_bucket_aggregate_append(bucket, new_bucket); serf_bucket_aggregate_append(bucket, ctx->headers); - if (ctx->body != NULL) { + + /* If we know the length, then use C-L and the raw body. Otherwise, + use chunked encoding for the request. */ + if (ctx->len != LENGTH_UNKNOWN) { + char buf[30]; + sprintf(buf, "%" APR_INT64_T_FMT, ctx->len); + serf_bucket_headers_set(ctx->headers, "Content-Length", buf); + if (ctx->body != NULL) + serf_bucket_aggregate_append(bucket, ctx->body); + } + else if (ctx->body != NULL) { /* Morph the body bucket to a chunked encoding bucket for now. */ - serf_bucket_headers_set(ctx->headers, "Transfer-Encoding", "chunked"); + serf_bucket_headers_setn(ctx->headers, "Transfer-Encoding", "chunked"); ctx->body = serf_bucket_chunk_create(ctx->body, bucket->allocator); serf_bucket_aggregate_append(bucket, ctx->body); } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/serf-1.0.3/buckets/ssl_buckets.c new/serf-1.1.0/buckets/ssl_buckets.c --- old/serf-1.0.3/buckets/ssl_buckets.c 2012-03-20 20:22:54.000000000 +0100 +++ new/serf-1.1.0/buckets/ssl_buckets.c 2012-04-19 23:43:22.000000000 +0200 @@ -171,6 +171,7 @@ /* Server cert callbacks */ serf_ssl_need_server_cert_t server_cert_callback; + serf_ssl_server_cert_chain_cb_t server_cert_chain_callback; void *server_cert_userdata; const char *cert_path; @@ -460,6 +461,66 @@ apr_pool_destroy(subpool); } + if (ctx->server_cert_chain_callback + && (depth == 0 || failures)) { + apr_status_t status; + STACK_OF(X509) *chain; + const serf_ssl_certificate_t **certs; + int certs_len; + apr_pool_t *subpool; + + apr_pool_create(&subpool, ctx->pool); + + /* Borrow the chain to pass to the callback. */ + chain = X509_STORE_CTX_get_chain(store_ctx); + + /* If the chain can't be retrieved, just pass the current + certificate. */ + /* ### can this actually happen with _get_chain() ? */ + if (!chain) { + serf_ssl_certificate_t *cert = apr_palloc(subpool, sizeof(*cert)); + + cert->ssl_cert = server_cert; + cert->depth = depth; + + /* Room for the server_cert and a trailing NULL. */ + certs = apr_palloc(subpool, sizeof(*certs) * 2); + certs[0] = cert; + + certs_len = 1; + } else { + int i; + + certs_len = sk_X509_num(chain); + + /* Room for all the certs and a trailing NULL. */ + certs = apr_palloc(subpool, sizeof(*certs) * (certs_len + 1)); + for (i = 0; i < certs_len; ++i) { + serf_ssl_certificate_t *cert; + + cert = apr_palloc(subpool, sizeof(*cert)); + cert->ssl_cert = sk_X509_value(chain, i); + cert->depth = i; + + certs[i] = cert; + } + } + certs[certs_len] = NULL; + + /* Callback for further verification. */ + status = ctx->server_cert_chain_callback(ctx->server_cert_userdata, + failures, depth, + certs, certs_len); + if (status == APR_SUCCESS) { + cert_valid = 1; + } else { + /* Pass the error back to the caller through the context-run. */ + ctx->pending_err = status; + } + + apr_pool_destroy(subpool); + } + return cert_valid; } @@ -1012,6 +1073,17 @@ context->server_cert_userdata = data; } +void serf_ssl_server_cert_chain_callback_set( + serf_ssl_context_t *context, + serf_ssl_need_server_cert_t cert_callback, + serf_ssl_server_cert_chain_cb_t cert_chain_callback, + void *data) +{ + context->server_cert_callback = cert_callback; + context->server_cert_chain_callback = cert_chain_callback; + context->server_cert_userdata = data; +} + static serf_ssl_context_t *ssl_init_context(void) { serf_ssl_context_t *ssl_ctx; @@ -1036,6 +1108,11 @@ ssl_ctx->cached_cert_pw = 0; ssl_ctx->pending_err = APR_SUCCESS; + ssl_ctx->cert_callback = NULL; + ssl_ctx->cert_pw_callback = NULL; + ssl_ctx->server_cert_callback = NULL; + ssl_ctx->server_cert_chain_callback = NULL; + SSL_CTX_set_verify(ssl_ctx->ctx, SSL_VERIFY_PEER, validate_server_certificate); SSL_CTX_set_options(ssl_ctx->ctx, SSL_OP_ALL); @@ -1398,7 +1475,8 @@ switch (nm->type) { case GEN_DNS: - p = apr_pstrmemdup(pool, nm->d.ia5->data, nm->d.ia5->length); + p = apr_pstrmemdup(pool, (const char *)nm->d.ia5->data, + nm->d.ia5->length); break; default: /* Don't know what to do - skip. */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/serf-1.0.3/build/apr_common.m4 new/serf-1.1.0/build/apr_common.m4 --- old/serf-1.0.3/build/apr_common.m4 2012-03-20 20:45:51.000000000 +0100 +++ new/serf-1.1.0/build/apr_common.m4 2012-06-07 22:24:50.000000000 +0200 @@ -202,14 +202,18 @@ dnl for a user to override configure when it does something stupid. dnl AC_DEFUN([APR_RESTORE_THE_ENVIRONMENT], [ -if test "x$apr_ste_save_$1" = "x"; then +dnl Check whether $apr_ste_save_$1 is empty or +dnl only whitespace. The verbatim "X" is token number 1, +dnl the following whitespace will be ignored. +set X $apr_ste_save_$1 +if test ${#} -eq 1; then $2$1="$$1" $1= else if test "x$apr_ste_save_$1" = "x$$1"; then $2$1= else - $2$1=`echo $$1 | sed -e "s%${apr_ste_save_$1}%%"` + $2$1=`echo "$$1" | sed -e "s%${apr_ste_save_$1}%%"` $1="$apr_ste_save_$1" fi fi diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/serf-1.0.3/build/serf.def new/serf-1.1.0/build/serf.def --- old/serf-1.0.3/build/serf.def 2012-03-20 20:45:52.000000000 +0100 +++ new/serf-1.1.0/build/serf.def 2012-06-07 22:24:51.000000000 +0200 @@ -83,6 +83,7 @@ serf_ssl_client_cert_provider_set serf_ssl_client_cert_password_set serf_ssl_server_cert_callback_set +serf_ssl_server_cert_chain_callback_set serf_ssl_use_default_certificates serf_ssl_set_hostname serf_ssl_cert_depth diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/serf-1.0.3/configure new/serf-1.1.0/configure --- old/serf-1.0.3/configure 2012-03-20 20:45:52.000000000 +0100 +++ new/serf-1.1.0/configure 2012-06-07 22:24:51.000000000 +0200 @@ -4609,7 +4609,7 @@ else ac_cv_header_stdc=no fi -rm -f conftest* +rm -f -r conftest* fi @@ -4630,7 +4630,7 @@ else ac_cv_header_stdc=no fi -rm -f conftest* +rm -f -r conftest* fi @@ -5073,14 +5073,15 @@ -if test "x$apr_ste_save_CPPFLAGS" = "x"; then +set X $apr_ste_save_CPPFLAGS +if test ${#} -eq 1; then EXTRA_CPPFLAGS="$CPPFLAGS" CPPFLAGS= else if test "x$apr_ste_save_CPPFLAGS" = "x$CPPFLAGS"; then EXTRA_CPPFLAGS= else - EXTRA_CPPFLAGS=`echo $CPPFLAGS | sed -e "s%${apr_ste_save_CPPFLAGS}%%"` + EXTRA_CPPFLAGS=`echo "$CPPFLAGS" | sed -e "s%${apr_ste_save_CPPFLAGS}%%"` CPPFLAGS="$apr_ste_save_CPPFLAGS" fi fi @@ -5091,14 +5092,15 @@ -if test "x$apr_ste_save_CFLAGS" = "x"; then +set X $apr_ste_save_CFLAGS +if test ${#} -eq 1; then EXTRA_CFLAGS="$CFLAGS" CFLAGS= else if test "x$apr_ste_save_CFLAGS" = "x$CFLAGS"; then EXTRA_CFLAGS= else - EXTRA_CFLAGS=`echo $CFLAGS | sed -e "s%${apr_ste_save_CFLAGS}%%"` + EXTRA_CFLAGS=`echo "$CFLAGS" | sed -e "s%${apr_ste_save_CFLAGS}%%"` CFLAGS="$apr_ste_save_CFLAGS" fi fi @@ -5109,14 +5111,15 @@ -if test "x$apr_ste_save_CXXFLAGS" = "x"; then +set X $apr_ste_save_CXXFLAGS +if test ${#} -eq 1; then EXTRA_CXXFLAGS="$CXXFLAGS" CXXFLAGS= else if test "x$apr_ste_save_CXXFLAGS" = "x$CXXFLAGS"; then EXTRA_CXXFLAGS= else - EXTRA_CXXFLAGS=`echo $CXXFLAGS | sed -e "s%${apr_ste_save_CXXFLAGS}%%"` + EXTRA_CXXFLAGS=`echo "$CXXFLAGS" | sed -e "s%${apr_ste_save_CXXFLAGS}%%"` CXXFLAGS="$apr_ste_save_CXXFLAGS" fi fi @@ -5127,14 +5130,15 @@ -if test "x$apr_ste_save_LDFLAGS" = "x"; then +set X $apr_ste_save_LDFLAGS +if test ${#} -eq 1; then EXTRA_LDFLAGS="$LDFLAGS" LDFLAGS= else if test "x$apr_ste_save_LDFLAGS" = "x$LDFLAGS"; then EXTRA_LDFLAGS= else - EXTRA_LDFLAGS=`echo $LDFLAGS | sed -e "s%${apr_ste_save_LDFLAGS}%%"` + EXTRA_LDFLAGS=`echo "$LDFLAGS" | sed -e "s%${apr_ste_save_LDFLAGS}%%"` LDFLAGS="$apr_ste_save_LDFLAGS" fi fi @@ -5145,14 +5149,15 @@ -if test "x$apr_ste_save_LIBS" = "x"; then +set X $apr_ste_save_LIBS +if test ${#} -eq 1; then EXTRA_LIBS="$LIBS" LIBS= else if test "x$apr_ste_save_LIBS" = "x$LIBS"; then EXTRA_LIBS= else - EXTRA_LIBS=`echo $LIBS | sed -e "s%${apr_ste_save_LIBS}%%"` + EXTRA_LIBS=`echo "$LIBS" | sed -e "s%${apr_ste_save_LIBS}%%"` LIBS="$apr_ste_save_LIBS" fi fi @@ -5163,14 +5168,15 @@ -if test "x$apr_ste_save_INCLUDES" = "x"; then +set X $apr_ste_save_INCLUDES +if test ${#} -eq 1; then EXTRA_INCLUDES="$INCLUDES" INCLUDES= else if test "x$apr_ste_save_INCLUDES" = "x$INCLUDES"; then EXTRA_INCLUDES= else - EXTRA_INCLUDES=`echo $INCLUDES | sed -e "s%${apr_ste_save_INCLUDES}%%"` + EXTRA_INCLUDES=`echo "$INCLUDES" | sed -e "s%${apr_ste_save_INCLUDES}%%"` INCLUDES="$apr_ste_save_INCLUDES" fi fi diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/serf-1.0.3/serf.h new/serf-1.1.0/serf.h --- old/serf-1.0.3/serf.h 2012-03-20 20:36:27.000000000 +0100 +++ new/serf-1.1.0/serf.h 2012-03-20 20:42:49.000000000 +0100 @@ -1030,8 +1030,8 @@ /* Version info */ #define SERF_MAJOR_VERSION 1 -#define SERF_MINOR_VERSION 0 -#define SERF_PATCH_VERSION 3 +#define SERF_MINOR_VERSION 1 +#define SERF_PATCH_VERSION 0 /* Version number string */ #define SERF_VERSION_STRING APR_STRINGIFY(SERF_MAJOR_VERSION) "." \ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/serf-1.0.3/serf_bucket_types.h new/serf-1.1.0/serf_bucket_types.h --- old/serf-1.0.3/serf_bucket_types.h 2011-06-25 18:01:01.000000000 +0200 +++ new/serf-1.1.0/serf_bucket_types.h 2012-04-19 23:43:22.000000000 +0200 @@ -47,6 +47,12 @@ serf_bucket_t *body, serf_bucket_alloc_t *allocator); +/* Send a Content-Length header with @a len. The @a body bucket should + contain precisely that much data. */ +void serf_bucket_request_set_CL( + serf_bucket_t *bucket, + apr_int64_t len); + serf_bucket_t *serf_bucket_request_get_headers( serf_bucket_t *request); @@ -486,6 +492,13 @@ int failures, const serf_ssl_certificate_t *cert); +typedef apr_status_t (*serf_ssl_server_cert_chain_cb_t)( + void *data, + int failures, + int error_depth, + const serf_ssl_certificate_t * const * certs, + apr_size_t certs_len); + void serf_ssl_client_cert_provider_set( serf_ssl_context_t *context, serf_ssl_need_client_cert_t callback, @@ -508,6 +521,16 @@ void *data); /** + * Set callbacks to override the default SSL server certificate validation + * algorithm for the current certificate or the entire certificate chain. + */ +void serf_ssl_server_cert_chain_callback_set( + serf_ssl_context_t *context, + serf_ssl_need_server_cert_t cert_callback, + serf_ssl_server_cert_chain_cb_t cert_chain_callback, + void *data); + +/** * Use the default root CA certificates as included with the OpenSSL library. */ apr_status_t serf_ssl_use_default_certificates( diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/serf-1.0.3/test/serf_get.c new/serf-1.1.0/test/serf_get.c --- old/serf-1.0.3/test/serf_get.c 2011-06-25 18:01:01.000000000 +0200 +++ new/serf-1.1.0/test/serf_get.c 2012-04-19 23:43:22.000000000 +0200 @@ -42,10 +42,58 @@ } } +static void print_ssl_cert_errors(int failures) +{ + if (failures) { + fprintf(stderr, "INVALID CERTIFICATE:\n"); + if (failures & SERF_SSL_CERT_NOTYETVALID) + fprintf(stderr, "* The certificate is not yet valid.\n"); + if (failures & SERF_SSL_CERT_EXPIRED) + fprintf(stderr, "* The certificate expired.\n"); + if (failures & SERF_SSL_CERT_SELF_SIGNED) + fprintf(stderr, "* The certificate is self-signed.\n"); + if (failures & SERF_SSL_CERT_UNKNOWNCA) + fprintf(stderr, "* The CA is unknown.\n"); + if (failures & SERF_SSL_CERT_UNKNOWN_FAILURE) + fprintf(stderr, "* Unknown failure.\n"); + } +} + static apr_status_t ignore_all_cert_errors(void *data, int failures, const serf_ssl_certificate_t *cert) { - /* In a real application, you would normally would not want to do this */ + print_ssl_cert_errors(failures); + + /* In a real application, you would normally would not want to do this */ + return APR_SUCCESS; +} + +static apr_status_t print_certs(void *data, int failures, int error_depth, + const serf_ssl_certificate_t * const * certs, + apr_size_t certs_len) +{ + apr_pool_t *pool; + const serf_ssl_certificate_t *current; + + apr_pool_create(&pool, NULL); + + fprintf(stderr, "Received certificate chain with length %d\n", + (int)certs_len); + print_ssl_cert_errors(failures); + if (failures) + fprintf(stderr, "Error at depth=%d\n", error_depth); + else + fprintf(stderr, "Chain provided with depth=%d\n", error_depth); + + while ((current = *certs) != NULL) + { + fprintf(stderr, "\n-----BEGIN CERTIFICATE-----\n"); + fprintf(stderr, "%s\n", serf_ssl_cert_export(current, pool)); + fprintf(stderr, "-----END CERTIFICATE-----\n"); + ++certs; + } + + apr_pool_destroy(pool); return APR_SUCCESS; } @@ -64,7 +112,9 @@ if (!ctx->ssl_ctx) { ctx->ssl_ctx = serf_bucket_ssl_decrypt_context_get(c); } - serf_ssl_server_cert_callback_set(ctx->ssl_ctx, ignore_all_cert_errors, NULL); + serf_ssl_server_cert_chain_callback_set(ctx->ssl_ctx, + ignore_all_cert_errors, + print_certs, NULL); serf_ssl_set_hostname(ctx->ssl_ctx, ctx->hostinfo); *output_bkt = serf_bucket_ssl_encrypt_create(*output_bkt, ctx->ssl_ctx, diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/serf-1.0.3/test/test_ssl.c new/serf-1.1.0/test/test_ssl.c --- old/serf-1.0.3/test/test_ssl.c 2011-06-16 12:07:32.000000000 +0200 +++ new/serf-1.1.0/test/test_ssl.c 2012-04-19 23:43:22.000000000 +0200 @@ -16,6 +16,7 @@ #include <apr.h> #include <apr_pools.h> #include <apr_strings.h> +#include <apr_env.h> #include "serf.h" #include "serf_bucket_types.h" -- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
