From 24a07a0bbfe98924b339f4ffeeaef093e74f73fb Mon Sep 17 00:00:00 2001 From: eunhhu Date: Sun, 27 Sep 2026 08:12:23 +0100 Subject: Deliver to https receivers, verifying their certificates (083) A wire to an https:// URL speaks TLS 1.2 or later through OpenSSL: the receiver's certificate must chain to the system's CAs (or to the file --send-ca names) and name its host (SNI and SSL_set1_host, or the IP address). An untrusted receiver gets nothing: the send stays in the outbox, the wire logs it and tries again every 10 s. pure-serve now links libssl and libcrypto. --- prototypes/connections/deliver.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'prototypes/connections/deliver.h') diff --git a/prototypes/connections/deliver.h b/prototypes/connections/deliver.h index f720296..13048fc 100644 --- a/prototypes/connections/deliver.h +++ b/prototypes/connections/deliver.h @@ -15,8 +15,11 @@ * once, so a send delivered twice (its answer lost) is harmless. */ typedef struct PureWire PureWire; -/* A wire for the output named output of m to url (http://host[:port]/path), - * as source; NULL with why in error when it cannot be. */ +/* A wire for the output named output of m to url (http[s]://host[:port]/path), + * as source; NULL with why in error when it cannot be. An https receiver's + * certificate must be trusted (the system's CAs, or the file given to + * pure_wire_trust before the first https wire) and name its host. */ +void pure_wire_trust(const char *ca_file); PureWire *pure_wire_open(const PureModule *m, const char *output, const char *url, const char *source, char *error, size_t size); uint32_t pure_wire_output(const PureWire *); -- cgit v1.2.3