Deliver to https receivers, verifying their certificates (083)

A wire to an https:// URL speaks TLS 1.2 or later through OpenSSL: the
receiver's certificate must chain to the system's CAs (or to the file
--send-ca names) and name its host (SNI and SSL_set1_host, or the IP
address). An untrusted receiver gets nothing: the send stays in the
outbox, the wire logs it and tries again every 10 s. pure-serve now
links libssl and libcrypto.

1 files changed, 5 insertions, 2 deletions

diff --git a/prototypes/connections/deliver.h b/prototypes/connections/deliver.h
index f720296..13048fc 100644
--- a/prototypes/connections/deliver.h
+++ b/prototypes/connections/deliver.h
@@ -15,8 +15,11 @@
  * once, so a send delivered twice (its answer lost) is harmless. */
 typedef struct PureWire PureWire;
 
-/* A wire for the output named output of m to url (http://host[:port]/path),
- * as source; NULL with why in error when it cannot be. */
+/* A wire for the output named output of m to url (http[s]://host[:port]/path),
+ * as source; NULL with why in error when it cannot be. An https receiver's
+ * certificate must be trusted (the system's CAs, or the file given to
+ * pure_wire_trust before the first https wire) and name its host. */
+void pure_wire_trust(const char *ca_file);
 PureWire *pure_wire_open(const PureModule *m, const char *output, const char *url, const char *source,
                          char *error, size_t size);
 uint32_t pure_wire_output(const PureWire *);