Reducing header overuse, non-inlining selected methods (CPPOST-35).

[shibboleth/cpp-xmltooling.git] / xmltooling / util / CurlURLInputStream.cpp

diff --git a/xmltooling/util/CurlURLInputStream.cpp b/xmltooling/util/CurlURLInputStream.cpp
index 7b84e91..f3b6dcd 100644 (file)
--- a/xmltooling/util/CurlURLInputStream.cpp
+++ b/xmltooling/util/CurlURLInputStream.cpp
@@ -26,6 +26,7 @@
 #include <xmltooling/util/CurlURLInputStream.h>
 #include <xmltooling/util/XMLHelper.h>
 
+#include <openssl/ssl.h>
 #include <xercesc/util/XercesDefs.hpp>
 #include <xercesc/util/XMLNetAccessor.hpp>
 #include <xercesc/util/XMLString.hpp>
@@ -47,6 +48,21 @@ namespace {
     static const XMLCh uri[] =              UNICODE_LITERAL_3(u,r,i);
     static const XMLCh url[] =              UNICODE_LITERAL_3(u,r,l);
     static const XMLCh verifyHost[] =       UNICODE_LITERAL_10(v,e,r,i,f,y,H,o,s,t);
+
+    // callback to invoke a caller-defined SSL callback
+    CURLcode ssl_ctx_callback(CURL* curl, SSL_CTX* ssl_ctx, void* userptr)
+    {
+        // Manually disable SSLv2 so we're not dependent on libcurl to do it.
+        // Also disable the ticket option where implemented, since this breaks a variety
+        // of servers. Newer libcurl also does this for us.
+#ifdef SSL_OP_NO_TICKET
+        SSL_CTX_set_options(ssl_ctx, SSL_OP_ALL|SSL_OP_NO_SSLv2|SSL_OP_NO_TICKET);
+#else
+        SSL_CTX_set_options(ssl_ctx, SSL_OP_ALL|SSL_OP_NO_SSLv2);
+#endif
+
+        return CURLE_OK;
+    }
 }
 
 CurlURLInputStream::CurlURLInputStream(const char* url)
@@ -149,8 +165,8 @@ void CurlURLInputStream::init(const DOMElement* e)
     curl_easy_setopt(fEasy, CURLOPT_MAXREDIRS, 6);
 
     // Default settings.
-    curl_easy_setopt(fEasy, CURLOPT_CONNECTTIMEOUT,15);
-    curl_easy_setopt(fEasy, CURLOPT_TIMEOUT,30);
+    curl_easy_setopt(fEasy, CURLOPT_CONNECTTIMEOUT,30);
+    curl_easy_setopt(fEasy, CURLOPT_TIMEOUT,60);
     curl_easy_setopt(fEasy, CURLOPT_HTTPAUTH,0);
     curl_easy_setopt(fEasy, CURLOPT_USERPWD,NULL);
     curl_easy_setopt(fEasy, CURLOPT_SSL_VERIFYHOST, 2);
@@ -160,6 +176,9 @@ void CurlURLInputStream::init(const DOMElement* e)
     curl_easy_setopt(fEasy, CURLOPT_NOSIGNAL, 1);
     curl_easy_setopt(fEasy, CURLOPT_FAILONERROR, 1);
 
+    // Install SSL callback.
+    curl_easy_setopt(fEasy, CURLOPT_SSL_CTX_FUNCTION, ssl_ctx_callback);
+
     fError[0] = 0;
     curl_easy_setopt(fEasy, CURLOPT_ERRORBUFFER, fError);
 
@@ -183,8 +202,13 @@ void CurlURLInputStream::init(const DOMElement* e)
 #ifdef CURLOPTTYPE_OFF_T
                     else if (opt < CURLOPTTYPE_OFF_T)
                         success = (curl_easy_setopt(fEasy, opt, value.get()) == CURLE_OK);
+# ifdef HAVE_CURL_OFF_T
                     else if (sizeof(curl_off_t) == sizeof(long))
                         success = (curl_easy_setopt(fEasy, opt, strtol(value.get(), NULL, 10)) == CURLE_OK);
+# else
+                    else if (sizeof(off_t) == sizeof(long))
+                        success = (curl_easy_setopt(fEasy, opt, strtol(value.get(), NULL, 10)) == CURLE_OK);
+# endif
                     else
                         success = false;
 #else