Fossil

}

/*
** Call this routine once before any other use of the SSL interface.
** This routine does initial configuration of the SSL module.
*/
static void ssl_global_init_client(void){
  const char *zCaSetting = 0;
  const char *identityFile;

  if( sslIsInit==0 ){
    SSL_library_init();
    SSL_load_error_strings();
    OpenSSL_add_all_algorithms();
    sslCtx = SSL_CTX_new(SSLv23_client_method());
    /* Disable SSLv2 and SSLv3 */
    SSL_CTX_set_options(sslCtx, SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3);

    /* Set up acceptable CA root certificates */
    zCaSetting = db_get("ssl-ca-location", 0);
    if( zCaSetting==0 || zCaSetting[0]=='\0' ){
      /* CA location not specified, use platform's default certificate store */
      X509_STORE_set_default_paths(SSL_CTX_get_cert_store(sslCtx));
    }else{
      /* User has specified a CA location, make sure it exists and use it */
      const char *zCaFile = 0;
      const char *zCaDirectory = 0;
      switch( file_isdir(zCaSetting, ExtFILE) ){
        case 0: { /* doesn't exist */
          fossil_fatal("ssl-ca-location is set to '%s', "
              "but is not a file or directory", zCaSetting);
          break;
        }
        case 1: { /* directory */

    return -SSL_get_error(pServer->ssl, n);
  }else{
    return n;
  }
}

#endif /* FOSSIL_ENABLE_SSL */

/*
** zPath is a name that might be a file or directory containing a trust
** store.  *pzStore is the name of the trust store to actually use.
**
** If *pzStore is not NULL (meaning no trust store has been found yet)
** and if zPath exists, then set *pzStore to point to zPath.
*/
static void trust_location_usable(const char *zPath, const char **pzStore){
  if( *pzStore!=0 ) return;
  if( file_isdir(zPath, ExtFILE)>0 ) *pzStore = zPath;
}

/*
** COMMAND: tls-config*
** COMMAND: ssl-config
**
** Usage: %fossil ssl-config [SUBCOMMAND] [OPTIONS...] [ARGS...]
**

**   show ?-v?                   Show the TLS configuration. Add -v to see
**                               additional explaination
*/
void test_tlsconfig_info(void){
  const char *zCmd;
  size_t nCmd;
  int nHit = 0;

  db_find_and_open_repository(OPEN_OK_NOT_FOUND|OPEN_SUBSTITUTE,0);
  db_open_config(1,0);
  if( g.argc==2 || (g.argc>=3 && g.argv[2][0]=='-') ){
    zCmd = "show";
    nCmd = 4;
  }else{
    zCmd = g.argv[2];

      "PRAGMA secure_delete=ON;"
      "DELETE FROM config WHERE name GLOB 'ssl-*';"
    );
    db_protect_pop();
  }else
  if( strncmp("show",zCmd,nCmd)==0 ){
    const char *zName, *zValue;
    const char *zUsed = 0;       /* Trust store location actually used */
    size_t nName;
    Stmt q;
    int verbose = find_option("verbose","v",0)!=0;
    verify_all_options();

#if !defined(FOSSIL_ENABLE_SSL)
    fossil_print("OpenSSL-version:      (none)\n");
    if( verbose ){
      fossil_print("\n"
         "  The OpenSSL library is not used by this build of Fossil\n\n"
      );
    }
#else
    fossil_print("OpenSSL-version:      %s  (0x%09x)\n",
         SSLeay_version(SSLEAY_VERSION), OPENSSL_VERSION_NUMBER);
    if( verbose ){
      fossil_print("\n"
         "  The version of the OpenSSL library being used\n"
         "  by this instance of Fossil.  Version 3.0.0 or\n"
         "  later is recommended.\n\n"
      );
    }

    fossil_print("Trust store location\n");
    zValue = db_get("ssl-ca-location","");
    trust_location_usable(zValue, &zUsed);
    fossil_print("  ssl-ca-location:    %s\n", zValue);
    if( verbose ){
      fossil_print("\n"
         "    This setting is the name of a file or directory that contains\n"
         "    the complete set of root certificates used by Fossil when it\n"


         "    is acting as a SSL client. If defined, this setting takes\n"

         "    priority over built-in paths and environment variables\n\n"
      );
    }

    zName = X509_get_default_cert_file_env();
    zValue = fossil_getenv(zName);
    if( zValue==0 ) zValue = "";
    trust_location_usable(zValue, &zUsed);
    nName = strlen(zName);
    fossil_print("  %s:%*s%s\n", zName, 19-nName, "", zValue);
    zName = X509_get_default_cert_dir_env();
    zValue = fossil_getenv(zName);
    if( zValue==0 ) zValue = "";
    trust_location_usable(zValue, &zUsed);
    nName = strlen(zName);
    fossil_print("  %s:%*s%s\n", zName, 19-nName, "", zValue);
    if( verbose ){
      fossil_print("\n"
        "    Environment variables that determine alternative locations for\n"
        "    the root certificates used by Fossil when it is acting as a SSL\n"
        "    client. If specified, these alternative locations override\n"
        "    the built-in locations.\n\n"
      );
    }


    zValue = X509_get_default_cert_file();
    trust_location_usable(zValue, &zUsed);
    fossil_print("  OpenSSL-cert-file:  %s\n", zValue);
    zValue = X509_get_default_cert_dir();
    trust_location_usable(zValue, &zUsed);
    fossil_print("  OpenSSL-cert-dir:   %s\n", X509_get_default_cert_dir());
    if( verbose ){
      fossil_print("\n"

         "    The default locations for the set of root certificates\n"
         "    used by the \"fossil sync\" and similar commands to verify\n"
         "    the identity of servers for \"https:\" URLs. These values\n"
         "    come into play when Fossil is used as a TLS client.  These\n"
         "    values are built into your OpenSSL library.\n\n"
      );
    }

    if( zUsed==0 ) zUsed = "";
    fossil_print("  Trust store used:   %s\n", zUsed);
    if( verbose ){
      fossil_print("\n"
         "    The location that is actually used for the root certificates\n"
         "    used to verify the identity of servers for \"https:\" URLs.\n"
         "    This will be one of the first of the five locations listed\n"
         "    above that actually exists.\n\n"
      );
    }


#endif /* FOSSIL_ENABLE_SSL */


    fossil_print("ssl-identity:        %s\n", db_get("ssl-identity",""));
    if( verbose ){
      fossil_print("\n"
        "  This setting is the name of a file that contains the PEM-format\n"
        "  certificate and private-key used by Fossil clients to authenticate\n"
        "  with servers. Few servers actually require this, so this setting\n"
        "  is usually blank.\n\n"
      );
    }

    db_prepare(&q,
       "SELECT name, '', value FROM global_config"
       " WHERE name GLOB 'cert:*'"
       "UNION ALL "
       "SELECT name, date(mtime,'unixepoch'), value FROM config"
       " WHERE name GLOB 'cert:*'"
       " ORDER BY name"
    );
    nHit = 0;
    while( db_step(&q)==SQLITE_ROW ){
                /*  123456789 123456789 123456789 */
      if( verbose ){
        fossil_print("exception:            %-40s %s\n"
                     "     hash:            %.57s\n",
             db_column_text(&q,0)+5, db_column_text(&q,1),
             db_column_text(&q,2));
      }else{
        fossil_print("exception:            %-40s %s\n",
             db_column_text(&q,0)+5, db_column_text(&q,1));
      }
      nHit++;
    }
    db_finalize(&q);
    if( nHit && verbose ){
      fossil_print("\n"
         "  The exceptions are server certificates that the Fossil client\n"
         "  is unable to verify using root certificates, but which should be\n"