Fossil

** is written into that second file instead of being written on standard
** output.  Use the "--out OUTPUT" option to specify an output file for
** a GET request where there is no PAYLOAD.
**
** Options:
**     --compress                 Use ZLIB compression on the payload
**     --mimetype TYPE            Mimetype of the payload
**     --no-cert-verify           Disable TLS cert verification
**     --out FILE                 Store the reply in FILE
**     -v                         Verbose output
**     --xfer                     PAYLOAD in a Fossil xfer protocol message
*/
void test_httpmsg_command(void){
  const char *zMimetype;
  const char *zInFile;
  const char *zOutFile;
  Blob in, out;
  unsigned int mHttpFlags = HTTP_GENERIC|HTTP_NOCOMPRESS;

  zMimetype = find_option("mimetype",0,1);
  zOutFile = find_option("out","o",1);
  if( find_option("verbose","v",0)!=0 ) mHttpFlags |= HTTP_VERBOSE;
  if( find_option("compress",0,0)!=0 ) mHttpFlags &= ~HTTP_NOCOMPRESS;
  if( find_option("no-cert-verify",0,0)!=0 ){
    ssl_disable_cert_verification();
  }
  if( find_option("xfer",0,0)!=0 ){
    mHttpFlags |= HTTP_USE_LOGIN;
    mHttpFlags &= ~HTTP_GENERIC;
  }
  verify_all_options();
  if( g.argc<3 || g.argc>5 ){
    usage("URL ?PAYLOAD? ?OUTPUT?");

  }
}

/*
** Call this routine once before any other use of the SSL interface.
** This routine does initial configuration of the SSL module.
*/
static void ssl_global_init_client(int bDebug){
  const char *identityFile;

  if( sslIsInit==0 ){
    const char *zFile;
    const char *zCaFile = 0;
    const char *zCaDirectory = 0;
    int i;

        }
        case 2: { /* file */
          zCaFile = zFile;
          zCaDirectory = 0;
          break;
        }
      }
      if( zFile ) break;
    }
    if( bDebug ){
      fossil_print("case-0:  X509_get_default_cert_file_env = %s\n",
                   X509_get_default_cert_file_env());
      fossil_print("case-1:  X509_get_default_cert_dir_env = %s\n",
                   X509_get_default_cert_dir_env());
      fossil_print("case-2:  ssl-ca-location = %s\n",
             g.repositoryOpen ? db_get("ssl-ca-location","(none)") : "(none)");
      fossil_print("case-3:  X509_get_default_cert_file = %s\n",
                   X509_get_default_cert_file());
      fossil_print("case-4:  X509_get_default_cert_dir = %s\n",
                   X509_get_default_cert_dir());
      if( i>=5 ){
        fossil_print("No trust store found.\n");
      }else{
        fossil_print("case-used    = %d\n"
                     "zCaFile      = %s\n"
                     "zCaDirectory = %s\n", i, zCaFile, zCaDirectory);
      }
    }
    if( zFile==0 ){
      /* fossil_fatal("Cannot find a trust store"); */
    }else if( SSL_CTX_load_verify_locations(sslCtx, zCaFile, zCaDirectory)==0 ){
      fossil_fatal("Cannot load CA root certificates from %s", zFile);
    }

    ** command line */
    if( g.zSSLIdentity!=0 ){
      identityFile = g.zSSLIdentity;
    }else{
      identityFile = db_get("ssl-identity", 0);
    }
    if( identityFile!=0 && identityFile[0]!='\0' ){
      if( bDebug ){
        fossil_print("identifyFile = %s\n", identityFile);
      }
      if( SSL_CTX_use_certificate_chain_file(sslCtx,identityFile)!=1
       || SSL_CTX_use_PrivateKey_file(sslCtx,identityFile,SSL_FILETYPE_PEM)!=1
      ){
        fossil_fatal("Could not load SSL identity from %s", identityFile);
      }
    }else{
      if( bDebug ){
        fossil_print("No identify file found.\n");
      }
    }
    /* Register a callback to tell the user what to do when the server asks
    ** for a cert */
    SSL_CTX_set_client_cert_cb(sslCtx, ssl_client_cert_callback);

    sslIsInit = 1;
  }else{

void ssl_global_shutdown(void){
  if( sslIsInit ){
    SSL_CTX_free(sslCtx);
    ssl_clear_errmsg();
    sslIsInit = 0;
  }
}

/*
** COMMAND: test-trust-store
**
** Show the trust store that is used by OpenSSL. 
*/
void test_openssl_trust_store(void){
  ssl_global_init_client(1);
  ssl_global_shutdown();
}


/*
** Close the currently open client SSL connection.  If no connection is open,
** this routine is a no-op.
*/
void ssl_close_client(void){
  if( iBio!=NULL ){

**
** Return the number of errors.
*/
int ssl_open_client(UrlData *pUrlData){
  X509 *cert;
  const char *zRemoteHost;

  ssl_global_init_client(0);
  if( pUrlData->useProxy ){
    int rc;
    char *connStr = mprintf("%s:%d", g.url.name, pUrlData->port);
    BIO *sBio = BIO_new_connect(connStr);
    free(connStr);
    if( BIO_do_connect(sBio)<=0 ){
      ssl_set_errmsg("SSL: cannot connect to proxy %s:%d (%s)",