1414#include < curl/curl.h>
1515#include < cstdio>
1616#include < iostream>
17- #include < vector>
1817#include < string>
1918#include " ../src/Network.hpp"
2019#include " ../src/Path.hpp"
21- #include < boost/asio.hpp>
22- #include < boost/asio/ssl.hpp>
23-
24- namespace ssl = boost::asio::ssl;
25- using tcp = boost::asio::ip::tcp;
26-
27- std::string get_ssl_certificate (const std::string& host) {
28- bool status = true ;
29- std::string cert_buffer;
30- boost::asio::io_context io_context;
31-
32- // Use SSLv23 context (it's compatible with all versions of SSL/TLS)
33- ssl::context ssl_context (ssl::context::sslv23);
34-
35- // Restrict supported protocol to TLSv1.3
36- ssl_context.set_options (ssl::context::no_sslv2 | ssl::context::no_sslv3);
37- ssl_context.set_options (ssl::context::no_tlsv1 | ssl::context::no_tlsv1_1);
38- ssl_context.set_options (ssl::context::no_tlsv1_2);
39-
40- // Resolver for HTTPS (default port 443)
41- tcp::resolver resolver (io_context);
42- tcp::resolver::results_type endpoints = resolver.resolve (host, " 443" );
43-
44- ssl::stream<tcp::socket> stream (io_context, ssl_context);
45- SSL_set_tlsext_host_name (stream.native_handle (), host.c_str ());
46-
47- try {
48- boost::asio::connect (stream.lowest_layer (), endpoints);
49- stream.handshake (ssl::stream_base::client);
50- } catch (const boost::system::system_error& e) {
51- std::cerr << " SSL handshake failed: " << e.what () << std::endl;
52- status = false ;
53- }
54-
55- if (status) {
56- // Get certificate
57- X509* cert = SSL_get_peer_certificate (stream.native_handle ());
58- if (!cert) {
59- std::cerr << " No certificate found." << std::endl;
60- status = false ;
61- }
62- if (status) {
63- // Verify the certificate matches the host
64- if (X509_check_host (
65- cert, host.c_str (), host.length (), 0 , nullptr ) != 1 ) {
66- std::cerr << " Hostname verification failed." << std::endl;
67- status = false ;
68- }
69- if (status) {
70- BIO* bio = BIO_new (BIO_s_mem ());
71- PEM_write_bio_X509 (bio, cert);
72- char * cert_str = nullptr ;
73- qint64 cert_len = BIO_get_mem_data (bio, &cert_str);
74- cert_buffer = std::string (cert_str, cert_len);
75- BIO_free (bio);
76- }
77- }
78- X509_free (cert);
79- }
80- return cert_buffer;
81- }
8220
8321void Downloader::setUrl (QUrl url) {
8422 m_url = url;
@@ -134,20 +72,6 @@ void Downloader::runConnect(QFile *file, const std::string& url) {
13472 const std::string trle_domain = " https://www.trle.net" ;
13573 const std::string trcustoms_domain = " https://trcustoms.org" ;
13674
137- // Securely determine which domain is being accessed
138- if (url.compare (0 , trle_domain.size (), trle_domain) == 0 ) {
139- std::string cert_buffer = get_ssl_certificate (" www.trle.net" );
140- std::vector<char >
141- cert_buffer_vec (cert_buffer.begin (), cert_buffer.end ());
142-
143- curl_blob blob;
144- blob.data = cert_buffer_vec.data ();
145- blob.len = cert_buffer_vec.size ();
146- blob.flags = CURL_BLOB_COPY;
147-
148- status = curl_easy_setopt (curl, CURLOPT_CAINFO_BLOB, &blob);
149- }
150-
15175 // Set the URL securely
15276 if (status == CURLE_OK) {
15377 status = curl_easy_setopt (curl, CURLOPT_URL, url.c_str ());
@@ -158,6 +82,12 @@ void Downloader::runConnect(QFile *file, const std::string& url) {
15882 status = curl_easy_setopt (curl, CURLOPT_SSL_VERIFYPEER, 1L );
15983 }
16084
85+ // Set TLS v1.3 version
86+ if (status == CURLE_OK) {
87+ status = curl_easy_setopt (curl, CURLOPT_SSLVERSION,
88+ CURL_SSLVERSION_TLSv1_3);
89+ }
90+
16191 // Secure Public Key Pinning
16292 if (status == CURLE_OK) {
16393 if (url.compare (0 , trle_domain.size (), trle_domain) == 0 ) {
0 commit comments