From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:59154) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Uc4xb-0003l2-Tm for qemu-devel@nongnu.org; Mon, 13 May 2013 22:27:30 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Uc4xY-0003VM-Pc for qemu-devel@nongnu.org; Mon, 13 May 2013 22:27:27 -0400 Received: from mx1.redhat.com ([209.132.183.28]:35967) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Uc4xY-0003VE-H4 for qemu-devel@nongnu.org; Mon, 13 May 2013 22:27:24 -0400 Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id r4E2RNGa004857 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK) for ; Mon, 13 May 2013 22:27:24 -0400 From: Fam Zheng Date: Tue, 14 May 2013 10:26:30 +0800 Message-Id: <1368498390-20738-12-git-send-email-famz@redhat.com> In-Reply-To: <1368498390-20738-1-git-send-email-famz@redhat.com> References: <1368498390-20738-1-git-send-email-famz@redhat.com> Subject: [Qemu-devel] [PATCH v2 11/11] curl: introduce ssl_no_cert runtime option. List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kwolf@redhat.com, jcody@redhat.com, Fam Zheng , stefanha@redhat.com Added an option to let curl disable ssl certificate check. Signed-off-by: Fam Zheng --- block/curl.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/block/curl.c b/block/curl.c index fa9960d..21a357b 100644 --- a/block/curl.c +++ b/block/curl.c @@ -96,6 +96,8 @@ typedef struct BDRVCURLState { int cache_quota; /* Whether http server accept range in header */ bool accept_range; + /* Whether certificated ssl only */ + bool ssl_no_cert; } BDRVCURLState; static void curl_clean_state(CURLState *s); @@ -337,6 +339,8 @@ static CURLState *curl_init_state(BDRVCURLState *s) curl_easy_setopt(state->curl, CURLOPT_NOSIGNAL, 1); curl_easy_setopt(state->curl, CURLOPT_ERRORBUFFER, state->errmsg); curl_easy_setopt(state->curl, CURLOPT_FAILONERROR, 1); + curl_easy_setopt(state->curl, CURLOPT_SSL_VERIFYPEER, + s->ssl_no_cert ? 0 : 1); /* Restrict supported protocols to avoid security issues in the more * obscure protocols. For example, do not allow POP3/SMTP/IMAP see @@ -427,7 +431,12 @@ static QemuOptsList runtime_opts = { .type = QEMU_OPT_SIZE, .help = "Readahead size", }, - { /* end of list */ } + { + .name = "ssl_no_cert", + .type = QEMU_OPT_BOOL, + .help = "SSL certificate check", + }, + { /* End of list */ } }, }; @@ -465,6 +474,7 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags) goto out_noclean; } + s->ssl_no_cert = qemu_opt_get_bool(opts, "ssl_no_cert", true); if (!inited) { curl_global_init(CURL_GLOBAL_ALL); inited = 1; -- 1.8.1.4