Changeset 57613 – Oracle VirtualBox

trunk/include/iprt/crypto/store.h

-              r57584
+              r57613
 #include <iprt/crypto/x509.h>
 #include <iprt/crypto/taf.h>
+#include <iprt/sha.h>
 …
 /** Pointer to a certificate store search. */
 typedef RTCRSTORECERTSEARCH *PRTCRSTORECERTSEARCH;
+/**
+ * Info about a wanted certificate.
+ *
+ * All the search criteria are optional, but for a safe and efficient search
+ * it's recommended to specify all possible ones.  If none are given, the search
+ * function will fail.
+ *
+ * For use with RTCrStoreCertAddFromFishingExpedition and others.
+ */
+typedef struct RTCRCERTWANTED
+{
+    /** The certificate subject name, optional.
+     * The format is: "C=US, ST=California, L=Redwood Shores, O=Oracle Corporation" */
+    const char *pszSubject;
+    /** The size of the DER (ASN.1) encoded certificate, optional (0). */
+    uint16_t    cbEncoded;
+    /** Set if abSha1 contains a valid SHA-1 fingerprint. */
+    bool        fSha1Fingerprint;
+    /** Set if abSha512 contains a valid SHA-512 fingerprint. */
+    bool        fSha512Fingerprint;
+    /** The SHA-1 fingerprint (of the encoded data).   */
+    uint8_t     abSha1[RTSHA1_HASH_SIZE];
+    /** The SHA-512 fingerprint (of the encoded data).   */
+    uint8_t     abSha512[RTSHA512_HASH_SIZE];
+    /** User pointer for directly associating other data with the entry.
+     * Subclassing the structure isn't possible because it's passed as an array. */
+    void const *pvUser;
+} RTCRCERTWANTED;
+/** Pointer to a const certificat wanted structure. */
+typedef RTCRCERTWANTED const *PCRTCRCERTWANTED;
 …
                                     PCRTSTRTUPLE paSuffixes, size_t cSuffixes, PRTERRINFO pErrInfo);
+RTDECL(int) RTCrStoreCertAddWantedFromDir(RTCRSTORE hStore, uint32_t fFlags,
+                                          const char *pszDir, PCRTSTRTUPLE paSuffixes, size_t cSuffixes,
+                                          PCRTCRCERTWANTED paWanted, size_t cWanted, bool *pafFound, PRTERRINFO pErrInfo);
 /**
  * Adds certificates from the specified file.
 …
 RTDECL(int) RTCrStoreCertAddFromFile(RTCRSTORE hStore, uint32_t fFlags, const char *pszFilename, PRTERRINFO pErrInfo);
+RTDECL(int) RTCrStoreCertAddWantedFromFile(RTCRSTORE hStore, uint32_t fFlags, const char *pszFilename,
+                                           PCRTCRCERTWANTED paWanted, size_t cWanted, bool *pafFound, PRTERRINFO pErrInfo);
 /**
  * Adds certificates from the specified java key store file.
 …
  */
 RTDECL(int) RTCrStoreCertAddFromStore(RTCRSTORE hStore, uint32_t fFlags, RTCRSTORE hStoreSrc);
+RTDECL(int) RTCrStoreCertAddWantedFromStore(RTCRSTORE hStore, uint32_t fFlags, RTCRSTORE hSrcStore,
+                                            PCRTCRCERTWANTED paWanted, size_t cWanted, bool *pafFound);
+RTDECL(int) RTCrStoreCertCheckWanted(RTCRSTORE hStore, PCRTCRCERTWANTED paWanted, size_t cWanted, bool *pafFound);
+RTDECL(int) RTCrStoreCertAddWantedFromFishingExpedition(RTCRSTORE hStore, uint32_t fFlags,
+                                                        PCRTCRCERTWANTED paWanted, size_t cWanted,
+                                                        bool *pafFound, PRTERRINFO pErrInfo);
 /**
 …
  */
 RTDECL(int) RTCrStoreCertExportAsPem(RTCRSTORE hStore, uint32_t fFlags, const char *pszFilename);
+/**
+ * Counts the number of certificates in the store.
+ *
+ * @returns Certificate count on success, UINT32_MAX on failure.
+ * @param   hStore              The store which certificates should be counted.
+ */
+RTDECL(uint32_t) RTCrStoreCertCount(RTCRSTORE hStore);
 RTDECL(int) RTCrStoreCertFindAll(RTCRSTORE hStore, PRTCRSTORECERTSEARCH pSearch);

trunk/include/iprt/dir.h

r56291	r57613
236	236	*
237	237	* This is the RTFS_TYPE_MASK stuff shifted down 12 bits and
238		* identical to the BSD/LINUX ABI.
	238	* identical to the BSD/LINUX ABI. See RTFS_TYPE_DIRENTRYTYPE_SHIFT.
239	239	*/
240	240	typedef enum RTDIRENTRYTYPE

trunk/include/iprt/err.h

-              r57516
+              r57613
 /** @name RTCrDigest status codes.
  * @{ */
 /** OpenSSL failed to initialize the digest algorithm contextn. */
+/** OpenSSL failed to initialize the digest algorithm context. */
 #define VERR_CR_DIGEST_OSSL_DIGEST_INIT_ERROR       (-24200)
 /** OpenSSL failed to clone the digest algorithm context. */
 …
 /** @} */
+/** @name RTPath  status codes.
+ * @{ */
+/** Unknown glob variable.  */
+#define VERR_PATH_MATCH_UNKNOWN_VARIABLE            (-24400)
+/** The specified glob variable must be first in the pattern. */
+#define VERR_PATH_MATCH_VARIABLE_MUST_BE_FIRST      (-24401)
+/** Hit unimplemented glob pattern matching feature.  */
+#define VERR_PATH_MATCH_FEATURE_NOT_IMPLEMENTED     (-24402)
+/** Unknown character class in glob pattern.   */
+#define VERR_PATH_GLOB_UNKNOWN_CHAR_CLASS           (-24403)
+/** @} */
 /* SED-END */

trunk/include/iprt/file.h

-              r57004
+              r57613
 RTDECL(int) RTFileCreateTempSecure(char *pszTemplate);
+/**
+ * Opens a new file with a unique name in the temp directory.
+ *
+ * @returns iprt status code.
+ * @param   pszTemplate     The file name template on input. The actual file
+ *                          name on success. Empty string on failure.
+ * @param   fMode           The mode to create the file with.  Use 0600 unless
+ *                          you have reason not to.
+ *
+ * @remarks If actual control over the filename or location is required, we'll
+ *          create an extended edition of this API.
+ */
+RTDECL(int) RTFileOpenTemp(PRTFILE pFile, char *pszFilename, size_t cbFilename, uint64_t fOpen);
 /** @page   pg_rt_filelock      RT File locking API description

trunk/include/iprt/fs.h

-              r56291
+              r57613
 /** Type mask (S_IFMT). */
 #define RTFS_TYPE_MASK              0170000U
+/** The shift count to convert between RTFS_TYPE_MASK and DIRENTRYTYPE. */
+#define RTFS_TYPE_DIRENTRYTYPE_SHIFT    12
 /** Unix attribute mask. */
 …
 RTR3DECL(int) RTFsQueryProperties(const char *pszFsPath, PRTFSPROPERTIES pProperties);
+/**
+ * Checks if the given volume is case sensitive or not.
+ *
+ * This may be misleading in some cases as we lack the necessary APIs to query
+ * the information on some system (or choose not to use them) and are instead
+ * returning the general position on case sensitive file name of the system.
+ *
+ * @returns @c true if case sensitive, @c false if not.
+ * @param   pszFsPath       Path within the mounted file system.
+ */
+RTR3DECL(bool) RTFsIsCaseSensitive(const char *pszFsPath);
 /**

trunk/include/iprt/http.h

-              r57577
+              r57613
 /* $Id$ */
 /** @file
  * IPRT - Simple HTTP Communication API.
+ * IPRT - Simple HTTP/HTTPS Client API.
  */
 …
 RT_C_DECLS_BEGIN
 /** @defgroup grp_rt_http   RTHttp - Simple HTTP API
+/** @defgroup grp_rt_http   RTHttp - Simple HTTP/HTTPS Client API
  * @ingroup grp_rt
  * @{
 …
 /** @todo the following three definitions may move the iprt/types.h later. */
 /** RTHTTP interface handle. */
+/** HTTP/HTTPS client handle. */
 typedef R3PTRTYPE(struct RTHTTPINTERNAL *)      RTHTTP;
 /** Pointer to a RTHTTP interface handle. */
 typedef RTHTTP                                  *PRTHTTP;
 /** Nil RTHTTP interface handle. */
+/** Pointer to a HTTP/HTTPS client handle. */
+typedef RTHTTP                                 *PRTHTTP;
+/** Nil HTTP/HTTPS client handle. */
 #define NIL_RTHTTP                              ((RTHTTP)0)
 /**
  * Creates a HTTP interface handle.
+ * Creates a HTTP client instance.
+ *
  * @returns iprt status code.
 …
 /**
  * Destroys a HTTP interface handle.
+ * Destroys a HTTP client instance.
+ *
  * @param   hHttp       Handle to the HTTP interface.
 …
  * @returns iprt status code.
+ *
  * @param   hHttp           HTTP interface handle.
  * @param   pcszUrl         URL.
+ * @param   hHttp           The HTTP client instance.
+ * @param   pszUrl          URL.
  * @param   ppszNotUtf8     Where to return the poitner to the HTTP response.
  *                          The string is of course zero terminated.  Use
 …
  *          containing embedded zero's, use RTHttpGetBinary instead.
  */
 RTR3DECL(int) RTHttpGetText(RTHTTP hHttp, const char *pcszUrl, char **ppszNotUtf8);
+RTR3DECL(int) RTHttpGetText(RTHTTP hHttp, const char *pszUrl, char **ppszNotUtf8);
 /**
 …
  * @returns iprt status code.
+ *
  * @param   hHttp           HTTP interface handle.
  * @param   pcszUrl         The URL.
+ * @param   hHttp           The HTTP client instance.
+ * @param   pszUrl          The URL.
  * @param   ppvResponse     Where to store the HTTP response data.  Use
  *                          RTHttpFreeResponse to free.
  * @param   pcb             Size of the returned buffer.
  */
 RTR3DECL(int) RTHttpGetBinary(RTHTTP hHttp, const char *pcszUrl, void **ppvResponse, size_t *pcb);
+RTR3DECL(int) RTHttpGetBinary(RTHTTP hHttp, const char *pszUrl, void **ppvResponse, size_t *pcb);
 /**
 …
  * @returns iprt status code.
+ *
  * @param   hHttp           HTTP interface handle.
+ * @param   hHttp           The HTTP client instance.
  * @param   pszUrl          The URL.
  * @param   pszDstFile      The destination file name.
 …
  * @returns iprt status code.
+ *
  * @param   hHttp           HTTP interface handle.
+ * @param   hHttp           The HTTP client instance.
  */
 RTR3DECL(int) RTHttpAbort(RTHTTP hHttp);
 …
+ *
  * @returns iprt status code.
  * @param   hHttp           HTTP interface handle.
+ * @param   hHttp           The HTTP client instance.
  */
 RTR3DECL(int) RTHttpUseSystemProxySettings(RTHTTP hHttp);
 …
  * @returns iprt status code.
+ *
  * @param   hHttp           HTTP interface handle.
  * @param   pcszProxy       URL of the proxy.
+ * @param   hHttp           The HTTP client instance.
+ * @param   pszProxy        URL of the proxy.
  * @param   uPort           port number of the proxy, use 0 for not specifying a port.
  * @param   pcszUser        Username, pass NULL for no authentication.
  * @param   pcszPwd         Password, pass NULL for no authentication.
  */
 RTR3DECL(int) RTHttpSetProxy(RTHTTP hHttp, const char *pcszProxyUrl, uint32_t uPort,
                              const char *pcszProxyUser, const char *pcszProxyPwd);
+ * @param   pszProxyUser    Username, pass NULL for no authentication.
+ * @param   pszProxyPwd     Password, pass NULL for no authentication.
+ */
+RTR3DECL(int) RTHttpSetProxy(RTHTTP hHttp, const char *pszProxyUrl, uint32_t uPort,
+                             const char *pszProxyUser, const char *pszProxyPwd);
 /**
 …
  * @returns iprt status code.
+ *
  * @param   hHttp           HTTP interface handle.
+ * @param   hHttp           The HTTP client instance.
  * @param   cHeaders        Number of custom headers.
  * @param   pcszHeaders     Array of headers in form "foo: bar".
+ * @param   papszHeaders    Array of headers in form "foo: bar".
  */
 RTR3DECL(int) RTHttpSetHeaders(RTHTTP hHttp, size_t cHeaders, const char * const *papszHeaders);
 /**
+ * Tells the HTTP client instance to gather system CA certificates into a
+ * temporary file and use it for HTTPS connections.
+ *
+ * This will be called automatically if a 'https' URL is presented and
+ * RTHttpSetCaFile hasn't been called yet.
+ *
+ * @returns IPRT status code.
+ * @param   hHttp           The HTTP client instance.
+ * @param   pErrInfo        Where to store additional error/warning information.
+ *                          Optional.
+ */
+RTR3DECL(int) RTHttpUseTemporaryCaFile(RTHTTP hHttp, PRTERRINFO pErrInfo);
+/**
  * Set a custom certification authority file, containing root certificates.
+ *
  * @returns iprt status code.
+ *
+ * @param   hHttp           HTTP interface handle.
+ * @param   pcszCAFile      File name containing root certificates.
+ */
+RTR3DECL(int) RTHttpSetCAFile(RTHTTP hHttp, const char *pcszCAFile);
+ * @param   hHttp           The HTTP client instance.
+ * @param   pszCAFile       File name containing root certificates.
+ *
+ * @remarks For portable HTTPS support, use RTHttpGatherCaCertsInFile and pass
+ */
+RTR3DECL(int) RTHttpSetCAFile(RTHTTP hHttp, const char *pszCAFile);
+/**
+ * Gathers certificates into a cryptographic (certificate) store
+ *
+ * This is a just a combination of RTHttpGatherCaCertsInStore and
+ * RTCrStoreCertExportAsPem.
+ *
+ * @returns IPRT status code.
+ * @param   hStore          The certificate store to gather the certificates
+ *                          in.
+ * @param   fFlags          RTHTTPGATHERCACERT_F_XXX.
+ * @param   pErrInfo        Where to store additional error/warning information.
+ *                          Optional.
+ */
+RTR3DECL(int) RTHttpGatherCaCertsInStore(RTCRSTORE hStore, uint32_t fFlags, PRTERRINFO pErrInfo);
+/**
+ * Gathers certificates into a file that can be used with RTHttpSetCAFile.
+ *
+ * This is a just a combination of RTHttpGatherCaCertsInStore and
+ * RTCrStoreCertExportAsPem.
+ *
+ * @returns IPRT status code.
+ * @param   pszCaFile       The output file.
+ * @param   fFlags          RTHTTPGATHERCACERT_F_XXX.
+ * @param   pErrInfo        Where to store additional error/warning information.
+ *                          Optional.
+ */
+RTR3DECL(int) RTHttpGatherCaCertsInFile(const char *pszCaFile, uint32_t fFlags, PRTERRINFO pErrInfo);
 /** @} */

trunk/include/iprt/mangling.h

-              r57584
+              r57613
 # define RTFileOpenF                                    RT_MANGLER(RTFileOpenF)
 # define RTFileOpenV                                    RT_MANGLER(RTFileOpenV)
+# define RTFileOpenTemp                                 RT_MANGLER(RTFileOpenTemp)
 # define RTFileQueryFsSizes                             RT_MANGLER(RTFileQueryFsSizes)
 # define RTFileQueryInfo                                RT_MANGLER(RTFileQueryInfo)
 …
 # define RTFileWriteAt                                  RT_MANGLER(RTFileWriteAt)
 # define RTFilesystemVfsFromFile                        RT_MANGLER(RTFilesystemVfsFromFile)
+# define RTFsIsCaseSensitive                            RT_MANGLER(RTFsIsCaseSensitive)
 # define RTFsQueryProperties                            RT_MANGLER(RTFsQueryProperties)
 # define RTFsQuerySerial                                RT_MANGLER(RTFsQuerySerial)
 …
 # define RTPathGetCurrentOnDrive                        RT_MANGLER(RTPathGetCurrentOnDrive)
 # define RTPathGetMode                                  RT_MANGLER(RTPathGetMode)
+# define RTPathGlob                                     RT_MANGLER(RTPathGlob)
+# define RTPathGlobFree                                 RT_MANGLER(RTPathGlobFree)
 # define RTPathHasSuffix                                RT_MANGLER(RTPathHasSuffix)
 # define RTPathHasPath                                  RT_MANGLER(RTPathHasPath)
 …
 # define RTCrStoreCertAddEncoded                        RT_MANGLER(RTCrStoreCertAddEncoded)
 # define RTCrStoreCertByIssuerAndSerialNo               RT_MANGLER(RTCrStoreCertByIssuerAndSerialNo)
+# define RTCrStoreCertCount                             RT_MANGLER(RTCrStoreCertCount)
 # define RTCrStoreCertFindAll                           RT_MANGLER(RTCrStoreCertFindAll)
 # define RTCrStoreCertFindBySubjectOrAltSubjectByRfc5280 RT_MANGLER(RTCrStoreCertFindBySubjectOrAltSubjectByRfc5280)
 …
 # define RTCrStoreCertAddFromJavaKeyStoreInMem          RT_MANGLER(RTCrStoreCertAddFromJavaKeyStoreInMem)
 # define RTCrStoreCertAddFromStore                      RT_MANGLER(RTCrStoreCertAddFromStore)
+# define RTCrStoreCertAddWantedFromDir                  RT_MANGLER(RTCrStoreCertAddWantedFromDir)
+# define RTCrStoreCertAddWantedFromFile                 RT_MANGLER(RTCrStoreCertAddWantedFromFile)
+# define RTCrStoreCertAddWantedFromStore                RT_MANGLER(RTCrStoreCertAddWantedFromStore)
+# define RTCrStoreCertAddWantedFromFishingExpedition    RT_MANGLER(RTCrStoreCertAddWantedFromFishingExpedition)
+# define RTCrStoreCertCheckWanted                       RT_MANGLER(RTCrStoreCertCheckWanted)
 # define RTCrStoreCertExportAsPem                       RT_MANGLER(RTCrStoreCertExportAsPem)
 # define RTErrInfoAdd                                   RT_MANGLER(RTErrInfoAdd)

trunk/include/iprt/path.h

-              r57572
+              r57613
  * The first component is the root, volume or UNC specifier, if present.  Use
  * RTPATH_PROP_HAS_ROOT_SPEC() on RTPATHPARSED::fProps to determine its
  * precense.
+ * presence.
+ *
  * Other than the root component, no component will include directory separators
 …
 RTDECL(int) RTPathTemp(char *pszPath, size_t cchPath);
+/**
+ * RTPathGlobl result entry.
+ */
+typedef struct RTPATHGLOBENTRY
+{
+    /** List entry. */
+    struct RTPATHGLOBENTRY *pNext;
+    /** RTDIRENTRYTYPE value. */
+    uint8_t                 uType;
+    /** Unused explicit padding. */
+    uint8_t                 bUnused;
+    /** The length of the path. */
+    uint16_t                cchPath;
+    /** The path to the file (variable length). */
+    char                    szPath[1];
+} RTPATHGLOBENTRY;
+/** Pointer to a GLOB result entry. */
+typedef RTPATHGLOBENTRY *PRTPATHGLOBENTRY;
+/** Pointer to a const GLOB result entry. */
+typedef RTPATHGLOBENTRY const *PCRTPATHGLOBENTRY;
+/** Pointer to a GLOB result entry pointer. */
+typedef PCRTPATHGLOBENTRY *PPCRTPATHGLOBENTRY;
+/**
+ * Performs wildcard expansion on a path pattern.
+ *
+ * @returns IPRT status code.
+ *
+ * @param   pszPattern      The pattern to expand.
+ * @param   fFlags          RTPATHGLOB_F_XXX.
+ * @param   ppHead          Where to return the head of the result list.  This
+ *                          is always set to NULL on failure.
+ * @param   pcResults       Where to return the number of the result. Optional.
+ */
+RTDECL(int) RTPathGlob(const char *pszPattern, uint32_t fFlags, PPCRTPATHGLOBENTRY ppHead, uint32_t *pcResults);
+/** @name RTPATHGLOB_F_XXX - RTPathGlob flags
+ *  @{ */
+/** Case insensitive. */
+#define RTPATHGLOB_F_IGNORE_CASE        RT_BIT_32(0)
+/** Do not expand \${EnvOrSpecialVariable} in the pattern. */
+#define RTPATHGLOB_F_NO_VARIABLES       RT_BIT_32(1)
+/** Do not interpret a leading tilde as a home directory reference. */
+#define RTPATHGLOB_F_NO_TILDE           RT_BIT_32(2)
+/** Only return the first match. */
+#define RTPATHGLOB_F_FIRST_ONLY         RT_BIT_32(3)
+/** Only match directories (implied if pattern ends with slash). */
+#define RTPATHGLOB_F_ONLY_DIRS          RT_BIT_32(4)
+/** Do not match directories.  (Can't be used with RTPATHGLOB_F_ONLY_DIRS or
+ * patterns containing a trailing slash.) */
+#define RTPATHGLOB_F_NO_DIRS            RT_BIT_32(5)
+/** Disables the '**' wildcard pattern for matching zero or more subdirs. */
+#define RTPATHGLOB_F_NO_STARSTAR        RT_BIT_32(6)
+/** Mask of valid flags. */
+#define RTPATHGLOB_F_MASK               UINT32_C(0x0000007f)
+/** @} */
+/**
+ * Frees the results produced by RTPathGlob.
+ *
+ * @param   pHead           What RTPathGlob returned.  NULL ignored.
+ */
+RTDECL(void) RTPathGlobFree(PCRTPATHGLOBENTRY pHead);
 /**
  * Query information about a file system object.

trunk/src/VBox/Frontends/VirtualBox/src/net/UINetworkReply.cpp

-              r57581
+              r57613
 private:
+    /** @name Helpers - HTTP stuff
+     * @{ */
+    int applyProxyRules();
+    int applyHttpsCertificates();
+    int applyRawHeaders();
+    int performMainRequest();
+    /** @} */
+    /* Helper: Main thread runner: */
+    void run();
     /** Info about wanted certificate. */
     typedef struct CERTINFO
+    {
-        /** The certificate subject name. */
-        const char *pszSubject;
-        /** The size of the DER (ASN.1) encoded certificate. */
-        uint16_t    cbEncoded;
         /** Gives the s_aCerts index this certificate is an alternative edition of,
          * UINT8_MAX if no alternative.  This is a complication caused by VeriSign
 …
         /** Set if mandatory. */
         bool        fMandatory;
-        /** The SHA-1 fingerprint (of the encoded data).   */
-        uint8_t     abSha1[RTSHA1_HASH_SIZE];
-        /** The SHA-512 fingerprint (of the encoded data).   */
-        uint8_t     abSha512[RTSHA512_HASH_SIZE];
         /** Filename in the zip file we download (PEM). */
         const char *pszZipFile;
 …
     } CERTINFO;
-    /** @name Helpers - HTTP stuff
-     * @{ */
-    int applyProxyRules();
-    int applyHttpsCertificates();
-    int applyRawHeaders();
-    int performMainRequest();
-    /** @} */
-    /* Helper: Main thread runner: */
-    void run();
     /** @name Static helpers for HTTP and Certificates handling.
      * @{ */
 …
     static int applyProxyRules(RTHTTP hHttp, const QString &strHostName, int iPort);
     static int applyRawHeaders(RTHTTP hHttp, const QList<QByteArray> &headers, const QNetworkRequest &request);
     static bool allCertsFound(uint64_t fFoundCerts, bool fOnlyMandatory);
     static uint64_t certEntryFoundMask(uint32_t iCert);
     static bool checkCertificatesInFile(const char *pszCaCertFile);
     static bool checkCertificatesInStore(RTCRSTORE hStore, unsigned *pcCertificates = NULL);
     static int downloadCertificates(RTHTTP hHttp, const char *pszCaCertFile);
+    static unsigned countCertsFound(bool const *pafFoundCerts);
+    static bool areAllCertsFound(bool const *pafFoundCerts, bool fOnlyMandatory);
+    static void refreshCertificates(RTHTTP hHttp, RTCRSTORE hOldStore, bool *pafFoundCerts, const char *pszCaCertFile);
+    static void downloadMissingCertificates(RTCRSTORE hNewStore, bool *pafNewFoundCerts, RTHTTP hHttp,
+                                            PRTERRINFOSTATIC pStaticErrInfo);
     static int convertVerifyAndAddPemCertificateToStore(RTCRSTORE hStore, void const *pvResponse,
+                                                        size_t cbResponse, const CERTINFO *pCertInfo);
+    static int retrieveCertificatesFromSystem(const char *pszCaCertFile);
+                                                        size_t cbResponse, PCRTCRCERTWANTED pWantedCert);
     /** @} */
 …
     static const QString s_strCertificateFileName;
+    static const CERTINFO s_aCerts[3];
+    static const RTCRCERTWANTED s_aCerts[3];
+    static const CERTINFO s_CertInfoPcaCls3Gen1Md2;
+    static const CERTINFO s_CertInfoPcaCls3Gen1Sha1;
+    static const CERTINFO s_CertInfoPcaCls3Gen5;
+};
+/*static*/ const UINetworkReplyPrivateThread::CERTINFO UINetworkReplyPrivateThread::s_CertInfoPcaCls3Gen1Sha1 =
+{
+    /*.iAlternativeTo =*/   1,
+    /*.fMandatory     =*/   false,
+    /*.pszZipFile     =*/
+    "VeriSign Root Certificates/Generation 1 (G1) PCAs/Class 3 Public Primary Certification Authority.pem",
+    /*.apszUrls[3]    =*/
+    {
+        "http://www.symantec.com/content/en/us/enterprise/verisign/roots/Class-3-Public-Primary-Certification-Authority.pem",
+        "http://www.verisign.com/repository/roots/root-certificates/PCA-3.pem", /* dead */
+        NULL,
+        "http://update.virtualbox.org/cacerts-symantec-PCA-3-pem-has-gone-missing-again" /* attention getter */
+    }
+};
+/*static*/ const UINetworkReplyPrivateThread::CERTINFO UINetworkReplyPrivateThread::s_CertInfoPcaCls3Gen1Md2 =
+{
+    /*.iAlternativeTo =*/   0,
+    /*.fMandatory     =*/   false,
+    /*.pszZipFile     =*/   NULL,
+    /*.apszUrls[3]    =*/   { NULL, NULL, NULL },
+};
+/*static*/ const UINetworkReplyPrivateThread::CERTINFO UINetworkReplyPrivateThread::s_CertInfoPcaCls3Gen5 =
+{
+    /*.iAlternativeTo =*/   UINT8_MAX,
+    /*.fMandatory     =*/   true,
+    /*.pszZipFile     =*/
+    "VeriSign Root Certificates/Generation 5 (G5) PCA/VeriSign Class 3 Public Primary Certification Authority - G5.pem",
+    /*.apszUrls[3]    =*/
+    {
+        "http://www.symantec.com/content/en/us/enterprise/verisign/roots/VeriSign-Class%203-Public-Primary-Certification-Authority-G5.pem",
+        "http://www.symantec.com/content/en/us/enterprise/verisign/roots/VeriSign-Class-3-Public-Primary-Certification-Authority-G5.pem", /* (in case they correct above typo) */
+        "http://www.verisign.com/repository/roots/root-certificates/PCA-3G5.pem", /* dead */
+        "http://update.virtualbox.org/cacerts-symantec-PCA-3G5-pem-has-gone-missing-again" /* attention getter */
+    }
 };
 …
 /**
  * Details on the certificates we are after.
+ * The pvUser member points to a UINetworkReplyPrivateThread::CERTINFO.
  */
 /* static */ const UINetworkReplyPrivateThread::CERTINFO UINetworkReplyPrivateThread::s_aCerts[3] =
+/* static */ const RTCRCERTWANTED UINetworkReplyPrivateThread::s_aCerts[3] =
+{
     /*[0] =*/   /* The reissued version with the SHA-1 signature. */
 /** @todo r=bird: Why do we need this certificate? Neither update.virtualbox.org nor www.virtualbox.org uses it...  ElCapitan doesn't ship this. */
+    {
+        /*.pszSubject =*/
+        "C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority",
+        /*.cbEncoded      =*/   0x240,
+        /*.iAlternativeTo =*/   1,
+        /*.fMandatory     =*/   false,
+        /*.abSha1         =*/
+        /*.pszSubject        =*/    "C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority",
+        /*.cbEncoded         =*/    0x240,
+        /*.Sha1Fingerprint   =*/    true,
+        /*.Sha512Fingerprint =*/    true,
+        /*.abSha1            =*/
+        {
 xa1, 0xdb, 0x63, 0x93, 0x91, 0x6f, 0x17, 0xe4, 0x18, 0x55,
 x09, 0x40, 0x04, 0x15, 0xc7, 0x02, 0x40, 0xb0, 0xae, 0x6b
         },
         /*.abSha512       =*/
+        /*.abSha512          =*/
+        {
 xbb, 0xf7, 0x8a, 0x19, 0x9f, 0x37, 0xee, 0xa2,
 …
 x0a, 0x67, 0x83, 0x87, 0xc5, 0x45, 0xc4, 0x99
         },
+        /*.pszZipFile     =*/
+        "VeriSign Root Certificates/Generation 1 (G1) PCAs/Class 3 Public Primary Certification Authority.pem",
+        /*.apszUrls[3]    =*/
+        {
+            "http://www.symantec.com/content/en/us/enterprise/verisign/roots/Class-3-Public-Primary-Certification-Authority.pem",
+            "http://www.verisign.com/repository/roots/root-certificates/PCA-3.pem", /* dead */
+            NULL,
+            "http://update.virtualbox.org/cacerts-symantec-PCA-3-pem-has-gone-missing-again" /* attention getter */
+        },
+        /*.pvUser */ &UINetworkReplyPrivateThread::s_CertInfoPcaCls3Gen1Sha1
     },
     /*[1] =*/   /* The original version with the MD2 signature. */
+    {
+        /*.pszSubject     =*/
+        "C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority",
+        /*.cbEncoded      =*/   0x240,
+        /*.iAlternativeTo =*/   0,
+        /*.fMandatory     =*/   false,
+        /*.abSha1         =*/
+        /*.pszSubject        =*/    "C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority",
+        /*.cbEncoded         =*/    0x240,
+        /*.Sha1Fingerprint   =*/    true,
+        /*.Sha512Fingerprint =*/    true,
+        /*.abSha1            =*/
+        {
 x74, 0x2c, 0x31, 0x92, 0xe6, 0x07, 0xe4, 0x24, 0xeb, 0x45,
 x49, 0x54, 0x2b, 0xe1, 0xbb, 0xc5, 0x3e, 0x61, 0x74, 0xe2
         },
         /*.abSha512       =*/
+        /*.abSha512          =*/
+        {
 x7c, 0x2f, 0x94, 0x22, 0x5f, 0x67, 0x98, 0x89,
 …
 xc8, 0x0c, 0x5a, 0xe7, 0x8b, 0x33, 0xf2, 0xaa
         },
+        /*.pszZipFile     =*/ NULL,
+        /*.apszUrls[3]    =*/ { NULL, NULL, NULL },
+        /*.pvUser */ &UINetworkReplyPrivateThread::s_CertInfoPcaCls3Gen1Md2
     },
     /*[2] =*/
+    {
         /*.pszSubject =*/
+        /*.pszSubject        =*/
         "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. - For authorized use only, "
         "CN=VeriSign Class 3 Public Primary Certification Authority - G5",
         /*.cbEncoded      =*/   0x4d7,
         /*.iAlternativeTo =*/   UINT8_MAX,
         /*.fMandatory     =*/   true,
         /*.abSha1         =*/
+        /*.cbEncoded         =*/    0x4d7,
+        /*.Sha1Fingerprint   =*/    true,
+        /*.Sha512Fingerprint =*/    true,
+        /*.abSha1            =*/
+        {
 x4e, 0xb6, 0xd5, 0x78, 0x49, 0x9b, 0x1c, 0xcf, 0x5f, 0x58,
 x1e, 0xad, 0x56, 0xbe, 0x3d, 0x9b, 0x67, 0x44, 0xa5, 0xe5
         },
         /*.abSha512   =*/
+        /*.abSha512          =*/
+        {
 xd4, 0xf8, 0x10, 0x54, 0x72, 0x77, 0x0a, 0x2d,
 …
 xd2, 0x6b, 0xa8, 0x9a, 0xf0, 0xb3, 0x6a, 0x01
         },
+        /*.pszZipFile     =*/
+        "VeriSign Root Certificates/Generation 5 (G5) PCA/VeriSign Class 3 Public Primary Certification Authority - G5.pem",
+        /*.apszUrls[3]    =*/
+        {
+            "http://www.symantec.com/content/en/us/enterprise/verisign/roots/VeriSign-Class%203-Public-Primary-Certification-Authority-G5.pem",
+            "http://www.symantec.com/content/en/us/enterprise/verisign/roots/VeriSign-Class-3-Public-Primary-Certification-Authority-G5.pem", /* (in case they correct above typo) */
+            "http://www.verisign.com/repository/roots/root-certificates/PCA-3G5.pem", /* dead */
+            "http://update.virtualbox.org/cacerts-symantec-PCA-3G5-pem-has-gone-missing-again" /* attention getter */
+        },
+        /*.pvUser */ &UINetworkReplyPrivateThread::s_CertInfoPcaCls3Gen5
     },
 };
 …
     /*
+     * Check that the certificate file is recent and contains the necessary certificates.
+     * Check the state of our CA certificate file, it's one of the following:
+     *      - Missing, recreate from scratch (= refresh).
+     *      - Everything is there and it is less than 28 days old, do nothing.
+     *      - Everything is there but it's older than 28 days, refresh.
+     *      - Missing certificates and is older than 1 min, refresh.
+     *
+     * Start by creating a store for loading the current state into, as we'll
+     * be need that for the refresh.
      */
+    int rc;
+    if (checkCertificatesInFile(pszCaCertFile))
+        rc = RTHttpSetCAFile(m_hHttp, pszCaCertFile);
+    else
+    {
+    RTCRSTORE hCurStore = NIL_RTCRSTORE;
+    int rc = RTCrStoreCreateInMem(&hCurStore, 256);
+    if (RT_SUCCESS(rc))
+    {
+        bool fRefresh    = true;
+        bool afCertsFound[RT_ELEMENTS(s_aCerts)];
+        RT_ZERO(afCertsFound);
         /*
+         * Need to create/update the CA certificate file.  Try see if the necessary
+         * certificates are to be found somewhere on the local system, then fall back
+         * to downloading them.
+         * Load the file if it exists.
+         *
+         * To effect regular updates, we need the modification date of the file,
+         * so we use RTPathQueryInfoEx here and not RTFileExists.
          */
+        rc = retrieveCertificatesFromSystem(pszCaCertFile);
+        if (RT_FAILURE(rc))
+            rc = downloadCertificates(m_hHttp, pszCaCertFile);
+        RTFSOBJINFO Info;
+        int rc = RTPathQueryInfoEx(pszCaCertFile, &Info, RTFSOBJATTRADD_NOTHING, RTPATH_F_FOLLOW_LINK);
+        if (   RT_SUCCESS(rc)
+            && RTFS_IS_FILE(Info.Attr.fMode))
+        {
+            RTERRINFOSTATIC StaticErrInfo;
+            rc = RTCrStoreCertAddFromFile(hCurStore, RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR, pszCaCertFile,
+                                          RTErrInfoInitStatic(&StaticErrInfo));
+            if (RTErrInfoIsSet(&StaticErrInfo.Core))
+                LogRel(("checkCertificates: %s\n", StaticErrInfo.Core.pszMsg));
+            else
+                AssertRC(rc);
+            /*
+             * Scan the store the for certificates we need, then see what we
+             * need to do wrt file age.
+             */
+            rc = RTCrStoreCertCheckWanted(hCurStore, s_aCerts, RT_ELEMENTS(s_aCerts), afCertsFound);
+            AssertRC(rc);
+            RTTIMESPEC RefreshAge;
+            uint32_t   cSecRefresh = rc == VINF_SUCCESS  ? 28 * RT_SEC_1DAY /* all found */ : 60 /* stuff missing */;
+            fRefresh = RTTimeSpecCompare(&Info.ModificationTime, RTTimeSpecSubSeconds(RTTimeNow(&RefreshAge), cSecRefresh)) <= 0;
+        }
+        /*
+         * Refresh the file if necessary.
+         */
+        if (fRefresh)
+            refreshCertificates(m_hHttp, hCurStore, afCertsFound, pszCaCertFile);
+        RTCrStoreRelease(hCurStore);
+        /*
+         * Final verdict.
+         */
+        if (areAllCertsFound(afCertsFound, true /*fOnlyMandatory*/))
+            rc = VINF_SUCCESS;
+        else
+            rc = VERR_NOT_FOUND; /** @todo r=bird: Why not try and let RTHttpGet* bitch if the necessary certs are missing? */
+        /*
+         * Set our custom CA file.
+         */
         if (RT_SUCCESS(rc))
             rc = RTHttpSetCAFile(m_hHttp, pszCaCertFile);
+    }
     return rc;
+}
 …
 /**
+ * Checks if the certificates we desire are all present in the given file, and
+ * that the file is recent enough (not for downloaded certs).
+ * Counts the number of certificates found in a search result array.
+ *
+ * @returns true if fine, false if not.
+ * @param   pszCaCertFile   The path to the certificate file.
+ * @returns Number of wanted certifcates we've found.
+ * @param   pafFoundCerts       Array parallel to s_aCerts with the status of
+ *                              each wanted certificate.
  */
+/*static*/ bool
+UINetworkReplyPrivateThread::checkCertificatesInFile(const char *pszCaCertFile)
+{
+    bool fFoundCerts = false;
+    /*
+     * Check whether the file exists.
+     */
+    RTFSOBJINFO Info;
+    int rc = RTPathQueryInfoEx(pszCaCertFile, &Info, RTFSOBJATTRADD_NOTHING, RTPATH_F_FOLLOW_LINK);
+    if (   RT_SUCCESS(rc)
+        && RTFS_IS_FILE(Info.Attr.fMode))
+    {
+        /*
+         * Load the CA certificate file into a store and use
+         * checkCertificatesInStore to do the real work.
+         */
+        RTCRSTORE hStore;
+        int rc = RTCrStoreCreateInMem(&hStore, 256);
+        if (RT_SUCCESS(rc))
+        {
+            RTERRINFOSTATIC StaticErrInfo;
+            rc = RTCrStoreCertAddFromFile(hStore, RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR, pszCaCertFile,
+                                          RTErrInfoInitStatic(&StaticErrInfo));
+            if (RTErrInfoIsSet(&StaticErrInfo.Core))
+                LogRel(("checkCertificates: %s\n", StaticErrInfo.Core.pszMsg));
+            else
+                AssertRC(rc);
+            unsigned cCertificates = 0;
+            fFoundCerts = checkCertificatesInStore(hStore, &cCertificates);
+            RTCrStoreRelease(hStore);
+            /*
+             * If there are more than two certificates in the database, we're looking
+             * at a mirror of the system CA stores.  Refresh our snapshot once every 28 days.
+             */
+            RTTIMESPEC MaxAge;
+            if (   fFoundCerts
+                && cCertificates > 2
+                && RTTimeSpecCompare(&Info.ModificationTime, RTTimeSpecSubSeconds(RTTimeNow(&MaxAge), 28 *24*3600)) < 0)
+                fFoundCerts = false;
+        }
+    }
+    return fFoundCerts;
+/*static*/ unsigned
+UINetworkReplyPrivateThread::countCertsFound(bool const *pafFoundCerts)
+{
+    unsigned cFound = 0;
+    for (uint32_t i = 0; i < RT_ELEMENTS(s_aCerts); i++)
+        cFound += pafFoundCerts[i];
+    return cFound;
+}
 …
+ *
  * @returns true if we have, false if we haven't.
  * @param   fFoundCerts         The mask of found certificates (see
  *                              certEntryFoundMask).
+ * @param   pafFoundCerts       Array parallel to s_aCerts with the status of
+ *                              each wanted certificate.
  * @param   fOnlyMandatory      Only require mandatory certificates to be
  *                              present.  If false, all certificates must be
 …
  */
 /*static*/ bool
+UINetworkReplyPrivateThread::allCertsFound(uint64_t fFoundCerts, bool fOnlyMandatory)
+{
+    AssertCompile(RT_ELEMENTS(s_aCerts) < 64);
+    /* Add non-mandatory flags before comparing. */
+    if (   fOnlyMandatory
+        && fFoundCerts != RT_BIT_64(RT_ELEMENTS(s_aCerts)) - UINT64_C(1))
+UINetworkReplyPrivateThread::areAllCertsFound(bool const *pafFoundCerts, bool fOnlyMandatory)
+{
+    if (fOnlyMandatory)
+    {
         for (uint32_t i = 0; i < RT_ELEMENTS(s_aCerts); i++)
+            if (!s_aCerts[i].fMandatory)
+                fFoundCerts |= RT_BIT_64(i);
+    return fFoundCerts == RT_BIT_64(RT_ELEMENTS(s_aCerts)) - UINT64_C(1);
+}
+/**
+ * Calculates the 64-bit 'found' mask for a certificate entry.
+ *
+ * @returns 64-bit mask.
+ * @param   iCert               The certificate entry.
+ */
+/*static*/ uint64_t
+UINetworkReplyPrivateThread::certEntryFoundMask(uint32_t iCert)
+{
+    Assert(iCert < RT_ELEMENTS(s_aCerts));
+    uint64_t fMask = RT_BIT_64(iCert);
+            if (   !pafFoundCerts[i]
+                && ((const CERTINFO *)s_aCerts[i].pvUser)->fMandatory)
+                return false;
+    }
+    else
+        for (uint32_t i = 0; i < RT_ELEMENTS(s_aCerts); i++)
+            if (!pafFoundCerts[i])
+                return false;
+    return true;
+}
+/*static*/ void
+UINetworkReplyPrivateThread::refreshCertificates(RTHTTP hHttp, RTCRSTORE hOldStore, bool *pafOldFoundCerts,
+                                                 const char *pszCaCertFile)
+{
     /*
+     * Tedium: Also mark certificates that this is an alternative to, we only need
+     *         the public key once.
+     * Collect the standard assortment of SSL certificates.
      */
+    uint8_t iAlt = s_aCerts[iCert].iAlternativeTo;
+    if (iAlt != UINT8_MAX)
+    {
+        unsigned cMax = 10;
+        do
+        {
+            Assert(iAlt < RT_ELEMENTS(s_aCerts));
+            Assert(cMax > 1);
+            Assert(strcmp(s_aCerts[iAlt].pszSubject, s_aCerts[iCert].pszSubject) == 0);
+            fMask |= RT_BIT_64(iAlt);
+            iAlt = s_aCerts[iAlt].iAlternativeTo;
+        } while (iAlt != iCert && cMax-- > 0);
+    }
+    return fMask;
+}
+/**
+ * Checks if the certificates we desire are all present in the given store.
+ *
+ * @returns true if present, false if not.
+ * @param   hStore              The store to examine.
+ * @param   pcCertificates      Where to return the number of certificates in
+ *                              the store. Optional.
+ */
+/* static */ bool
+UINetworkReplyPrivateThread::checkCertificatesInStore(RTCRSTORE hStore, unsigned *pcCertificates /* = NULL*/)
+{
+    if (pcCertificates)
+        *pcCertificates = 0;
+    /*
+     * Enumerate the store, checking for the certificates we need.
+     */
+    RTCRSTORECERTSEARCH Search;
+    int rc = RTCrStoreCertFindAll(hStore, &Search);
+    uint32_t  cHint = RTCrStoreCertCount(hOldStore);
+    RTCRSTORE hNewStore;
+    int rc = RTCrStoreCreateInMem(&hNewStore, cHint > 32 && cHint < _32K ? cHint + 16 : 256);
     if (RT_SUCCESS(rc))
+    {
+        uint64_t      fFoundCerts   = 0;
+        unsigned      cCertificates = 0;
+        PCRTCRCERTCTX pCertCtx;
+        while ((pCertCtx = RTCrStoreCertSearchNext(hStore, &Search)) != NULL)
+        {
+            if (   (pCertCtx->fFlags & RTCRCERTCTX_F_ENC_MASK) == RTCRCERTCTX_F_ENC_X509_DER
+                && pCertCtx->cbEncoded > 0
+                && pCertCtx->pCert)
+        RTERRINFOSTATIC StaticErrInfo;
+        rc = RTHttpGatherCaCertsInStore(hNewStore, 0 /*fFlags*/, RTErrInfoInitStatic(&StaticErrInfo));
+        if (RTErrInfoIsSet(&StaticErrInfo.Core))
+            LogRel(("refreshCertificates/#1: %s\n", StaticErrInfo.Core.pszMsg));
+        else
+            AssertLogRelRC(rc);
+        if (RT_SUCCESS(rc))
+        {
+            /*
+             * Check and see what we've got.  If we haven't got all we desire,
+             * try add it from the previous store.
+             */
+            bool afNewFoundCerts[RT_ELEMENTS(s_aCerts)];
+            RT_ZERO(afNewFoundCerts); /* paranoia */
+            rc = RTCrStoreCertCheckWanted(hNewStore, s_aCerts, RT_ELEMENTS(s_aCerts), afNewFoundCerts);
+            AssertLogRelRC(rc);
+            Assert(rc != VINF_SUCCESS || areAllCertsFound(afNewFoundCerts, false /*fOnlyMandatory*/));
+            if (rc != VINF_SUCCESS)
+            {
+                cCertificates++;
+                /*
+                 * It is a X.509 certificate.  Check if it matches any of those we're looking for.
+                 */
+                for (uint32_t i = 0; i < RT_ELEMENTS(s_aCerts); i++)
+                    if (   pCertCtx->cbEncoded == s_aCerts[i].cbEncoded
+                        && RTCrX509Name_MatchWithString(&pCertCtx->pCert->TbsCertificate.Subject, s_aCerts[i].pszSubject))
+                    {
+                        if (RTSha1Check(pCertCtx->pabEncoded, pCertCtx->cbEncoded, s_aCerts[i].abSha1))
+                        {
+                            if (RTSha512Check(pCertCtx->pabEncoded, pCertCtx->cbEncoded, s_aCerts[i].abSha512))
+                            {
+                                fFoundCerts |= certEntryFoundMask(i);
+                                break;
+                            }
+                        }
+                    }
+                rc = RTCrStoreCertAddWantedFromStore(hNewStore,
+                                                     RTCRCERTCTX_F_ADD_IF_NOT_FOUND | RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR,
+                                                     hOldStore, s_aCerts, RT_ELEMENTS(s_aCerts), afNewFoundCerts);
+                AssertLogRelRC(rc);
+                Assert(rc != VINF_SUCCESS || areAllCertsFound(afNewFoundCerts, false /*fOnlyMandatory*/));
+            }
+            RTCrCertCtxRelease(pCertCtx);
+            /*
+             * If that didn't help, seek out certificates in more obscure places,
+             * like java, mozilla and mutt.
+             */
+            if (rc != VINF_SUCCESS)
+            {
+                rc = RTCrStoreCertAddWantedFromFishingExpedition(hNewStore,
+                                                                 RTCRCERTCTX_F_ADD_IF_NOT_FOUND
+                                                                 | RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR,
+                                                                 s_aCerts, RT_ELEMENTS(s_aCerts), afNewFoundCerts,
+                                                                 RTErrInfoInitStatic(&StaticErrInfo));
+                if (RTErrInfoIsSet(&StaticErrInfo.Core))
+                    LogRel(("refreshCertificates/#2: %s\n", StaticErrInfo.Core.pszMsg));
+                Assert(rc != VINF_SUCCESS || areAllCertsFound(afNewFoundCerts, false /*fOnlyMandatory*/));
+            }
+            /*
+             * If that didn't help, try download the certificates.
+             */
+            if (rc != VINF_SUCCESS)
+                downloadMissingCertificates(hNewStore, afNewFoundCerts, hHttp, &StaticErrInfo);
+            /*
+             * If we've got the same or better hit rate than the old store,
+             * replace the CA certs file.
+             */
+            if (   areAllCertsFound(afNewFoundCerts, false /*fOnlyMandatory*/)
+                || (   countCertsFound(afNewFoundCerts) >= countCertsFound(pafOldFoundCerts)
+                    &&    areAllCertsFound(afNewFoundCerts, true /*fOnlyMandatory*/)
+                       >= areAllCertsFound(pafOldFoundCerts, true /*fOnlyMandatory*/) ) )
+            {
+                rc = RTCrStoreCertExportAsPem(hNewStore, 0 /*fFlags*/, pszCaCertFile);
+                if (RT_SUCCESS(rc))
+                    memcpy(pafOldFoundCerts, afNewFoundCerts, sizeof(afNewFoundCerts));
+                else
+                    RT_ZERO(pafOldFoundCerts);
+            }
+        }
+        int rc2 = RTCrStoreCertSearchDestroy(hStore, &Search); AssertRC(rc2);
+        /*
+         * Set the certificate count.
+         */
+        if (pcCertificates)
+            *pcCertificates = cCertificates;
+        /*
+         * Did we locate all of them?
+         */
+        if (allCertsFound(fFoundCerts, true /* fOnlyMandatory */)) /** @todo combine the two certificate retrieval approaches */
+            return true;
+    }
+    AssertRC(rc);
+    return false;
+}
+/*static*/ int
+UINetworkReplyPrivateThread::downloadCertificates(RTHTTP hHttp, const char *pszCaCertFile)
+{
+    /*
+     * Prepare temporary certificate store.
+     */
+    RTCRSTORE hStore;
+    int rc = RTCrStoreCreateInMem(&hStore, RT_ELEMENTS(s_aCerts));
+    AssertRCReturn(rc, rc);
+    /*
+     * Accounts for certificates we've downloaded, verified and added to the store.
+     */
+    uint64_t fFoundCerts = 0;
+    AssertCompile(RT_ELEMENTS(s_aCerts) < 64);
+        RTCrStoreRelease(hNewStore);
+    }
+}
+/*static*/ void
+UINetworkReplyPrivateThread::downloadMissingCertificates(RTCRSTORE hNewStore, bool *pafNewFoundCerts, RTHTTP hHttp,
+                                                         PRTERRINFOSTATIC pStaticErrInfo)
+{
+    int rc;
     /*
 …
+        {
             for (uint32_t i = 0; i < RT_ELEMENTS(s_aCerts); i++)
                 if (s_aCerts[i].pszZipFile)
+                if (!pafNewFoundCerts[i])
+                {
+                    void  *pvFile;
+                    size_t cbFile;
+                    rc = RTZipPkzipMemDecompress(&pvFile, &cbFile, pvRootsZip, cbRootsZip, s_aCerts[i].pszZipFile);
+                    if (RT_SUCCESS(rc))
+                    CERTINFO const *pInfo = (CERTINFO const *)s_aCerts[i].pvUser;
+                    if (pInfo->pszZipFile)
+                    {
+                        rc = convertVerifyAndAddPemCertificateToStore(hStore, pvFile, cbFile, &s_aCerts[i]);
+                        RTMemFree(pvFile);
+                        void  *pvFile;
+                        size_t cbFile;
+                        rc = RTZipPkzipMemDecompress(&pvFile, &cbFile, pvRootsZip, cbRootsZip, pInfo->pszZipFile);
                         if (RT_SUCCESS(rc))
+                            fFoundCerts |= certEntryFoundMask(i);
+                        {
+                            rc = convertVerifyAndAddPemCertificateToStore(hNewStore, pvFile, cbFile, &s_aCerts[i]);
+                            RTMemFree(pvFile);
+                            if (RT_SUCCESS(rc))
+                            {
+                                /*
+                                 * Successfully added. Mark it as found and return if we've got them all.
+                                 */
+                                pafNewFoundCerts[i] = true;
+                                if (areAllCertsFound(pafNewFoundCerts, false /* fOnlyMandatory */))
+                                {
+                                    RTHttpFreeResponse(pvRootsZip);
+                                    return;
+                                }
+                            }
+                        }
+                    }
+                }
             RTHttpFreeResponse(pvRootsZip);
-            if (allCertsFound(fFoundCerts, false /* fOnlyMandatory */))
-                break;
+        }
+    }
     /*
      * Fallback: Try download certificates separately.
+     * Try download certificates separately.
      */
+    if (allCertsFound(fFoundCerts, false /* fOnlyMandatory */))
+        for (uint32_t i = 0; i < RT_ELEMENTS(s_aCerts); i++)
+            if (!(fFoundCerts & RT_BIT_64(i)))
+                for (uint32_t iUrl = 0; iUrl < RT_ELEMENTS(s_aCerts[i].apszUrls); i++)
+                    if (s_aCerts[i].apszUrls[iUrl])
+    for (uint32_t i = 0; i < RT_ELEMENTS(s_aCerts); i++)
+        if (!pafNewFoundCerts[i])
+        {
+            CERTINFO const *pInfo = (CERTINFO const *)s_aCerts[i].pvUser;
+            for (uint32_t iUrl = 0; iUrl < RT_ELEMENTS(pInfo->apszUrls); i++)
+                if (pInfo->apszUrls[iUrl])
+                {
+                    void  *pvResponse;
+                    size_t cbResponse;
+                    rc = RTHttpGetBinary(hHttp, pInfo->apszUrls[iUrl], &pvResponse, &cbResponse);
+                    if (RT_SUCCESS(rc))
+                    {
+                        void  *pvResponse;
+                        size_t cbResponse;
+                        rc = RTHttpGetBinary(hHttp, s_aCerts[i].apszUrls[iUrl], &pvResponse, &cbResponse);
+                        rc = convertVerifyAndAddPemCertificateToStore(hNewStore, pvResponse, cbResponse, &s_aCerts[i]);
+                        RTHttpFreeResponse(pvResponse);
                         if (RT_SUCCESS(rc))
+                        {
+                            rc = convertVerifyAndAddPemCertificateToStore(hStore, pvResponse, cbResponse, &s_aCerts[i]);
+                            RTHttpFreeResponse(pvResponse);
+                            if (RT_SUCCESS(rc))
+                            {
+                                fFoundCerts |= certEntryFoundMask(i);
+                                break;
+                            }
+                            pafNewFoundCerts[i] = true;
+                            break;
+                        }
+                    }
+    /*
+     * See if we've got the certificates we want, save it we do.
+     */
+    if (allCertsFound(fFoundCerts, true /*fOnlyMandatory*/))
+        rc = RTCrStoreCertExportAsPem(hStore, 0 /*fFlags*/, pszCaCertFile);
+    else if (RT_SUCCESS(rc))
+        rc = VERR_NOT_FOUND;
+    RTCrStoreRelease(hStore);
+    return rc;
+                }
+        }
+}
 …
  * @param   pvResponse          The raw PEM certificate file bytes.
  * @param   cbResponse          The number of bytes.
  * @param   pCertInfo           The certificate info (we use hashes and encoded
+ * @param   pWantedCert         The certificate info (we use hashes and encoded
  *                              size).
  */
 …
 UINetworkReplyPrivateThread::convertVerifyAndAddPemCertificateToStore(RTCRSTORE hStore,
                                                                       void const *pvResponse, size_t cbResponse,
                                                                       const CERTINFO *pCertInfo)
+                                                                      PCRTCRCERTWANTED pWantedCert)
+{
     /*
 …
         rc = VERR_NOT_FOUND;
         for (PCRTCRPEMSECTION pCur = pSectionHead; pCur; pCur = pCur->pNext)
             if (pCur->cbData == pCertInfo->cbEncoded)
+            if (pCur->cbData == pWantedCert->cbEncoded)
+            {
                 if (   RTSha1Check(pCur->pbData, pCur->cbData, pCertInfo->abSha1)
                     && RTSha512Check(pCur->pbData, pCur->cbData, pCertInfo->abSha512))
+                if (   RTSha1Check(pCur->pbData, pCur->cbData, pWantedCert->abSha1)
+                    && RTSha512Check(pCur->pbData, pCur->cbData, pWantedCert->abSha512))
+                {
                     /*
 …
             else
                 LogRel(("convertVerifyAndAddPemCertificateToStore: cbData=%#zx expected %#zx\n",
                         pCur->cbData, pCertInfo->cbEncoded));
+                        pCur->cbData, pWantedCert->cbEncoded));
         RTCrPemFreeSections(pSectionHead);
 …
     return rc;
+}
-/**
- * Tries to retrieve an up to date list of certificates from the system that
- * includes the necessary certs.
+ *
- * @returns IPRT status code, success indicating that we've found what we need.
- * @param   pszCaCertFile           Where to store the certificates.
- */
-/*static*/ int
-UINetworkReplyPrivateThread::retrieveCertificatesFromSystem(const char *pszCaCertFile)
+{
-    /*
-     * Duplicate the user and system stores.
-     */
-    RTERRINFOSTATIC StaticErrInfo;
-    RTCRSTORE hUserStore;
-    int rc = RTCrStoreCreateSnapshotById(&hUserStore, RTCRSTOREID_USER_TRUSTED_CAS_AND_CERTIFICATES,
-                                         RTErrInfoInitStatic(&StaticErrInfo));
-    if (RT_FAILURE(rc))
-        hUserStore = NIL_RTCRSTORE;
-    if (RTErrInfoIsSet(&StaticErrInfo.Core))
-        LogRel(("retrieveCertificatesFromSystem/#1: %s\n", StaticErrInfo.Core.pszMsg));
-    RTCRSTORE hSystemStore;
-    rc = RTCrStoreCreateSnapshotById(&hSystemStore, RTCRSTOREID_SYSTEM_TRUSTED_CAS_AND_CERTIFICATES,
-                                     RTErrInfoInitStatic(&StaticErrInfo));
-    if (RT_FAILURE(rc))
-        hUserStore = NIL_RTCRSTORE;
-    if (RTErrInfoIsSet(&StaticErrInfo.Core))
-        LogRel(("retrieveCertificatesFromSystem/#2: %s\n", StaticErrInfo.Core.pszMsg));
-    /*
-     * Merge the two.
-     */
-    int rc2 = RTCrStoreCertAddFromStore(hUserStore, RTCRCERTCTX_F_ADD_IF_NOT_FOUND | RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR,
-                                        hSystemStore);
-    AssertRC(rc2);
-    RTCrStoreRelease(hSystemStore);
-    hSystemStore = NIL_RTCRSTORE;
-    /*
-     * See if we've got the certificates we want, save it we do.
-     */
-    if (checkCertificatesInStore(hUserStore))
-        rc = RTCrStoreCertExportAsPem(hUserStore, 0 /*fFlags*/, pszCaCertFile);
-    else
-        rc = VERR_NOT_FOUND;
-    RTCrStoreRelease(hUserStore);
-    return rc;
+}

trunk/src/VBox/Runtime/Makefile.kmk

-              r57586
+              r57613
         common/crypto/store.cpp \
         common/crypto/store-inmem.cpp \
+        common/crypto/RTCrStoreCertAddFromFile.cpp \
+        common/crypto/RTCrStoreCertAddFromDir.cpp \
+        common/crypto/RTCrStoreCertAddFromStore.cpp \
+        common/crypto/store-cert-add-basic.cpp \
         common/crypto/RTCrStoreCertAddFromJavaKeyStore.cpp \
+        common/crypto/RTCrStoreCertAddWantedFromFishingExpedition.cpp \
         common/crypto/RTCrStoreCertExportAsPem.cpp \
         common/dbg/dbg.cpp \
 …
         common/path/RTPathExt.cpp \
         common/path/RTPathFilename.cpp \
+        common/path/RTPathGlob.cpp \
         common/path/RTPathHasExt.cpp \
         common/path/RTPathHasPath.cpp \

trunk/src/VBox/Runtime/common/crypto/store-cert-add-basic.cpp

-              r57607
+              r57613
 #include <iprt/assert.h>
+#include <iprt/crypto/pem.h>
 #include <iprt/dir.h>
 #include <iprt/err.h>
+#include <iprt/file.h>
+#include <iprt/mem.h>
 #include <iprt/path.h>
+#include <iprt/sha.h>
 #include <iprt/string.h>
+#include "x509-internal.h"
+/*********************************************************************************************************************************
+*   Global Variables                                                                                                             *
+*********************************************************************************************************************************/
+/** BEGIN CERTIFICATE / END CERTIFICATE. */
+static RTCRPEMMARKERWORD const g_aWords_Certificate[] =
+{
+    { RT_STR_TUPLE("CERTIFICATE") }
+};
+/** BEGIN TRUSTED CERTIFICATE / END TRUSTED CERTIFICATE. */
+static RTCRPEMMARKERWORD const g_aWords_TrustedCertificate[] =
+{
+    { RT_STR_TUPLE("TRUSTED") },
+    { RT_STR_TUPLE("CERTIFICATE") }
+};
+/** BEGIN X509 CERTIFICATE / END X509 CERTIFICATE. (old) */
+static RTCRPEMMARKERWORD const g_aWords_X509Certificate[] =
+{
+    { RT_STR_TUPLE("X509") },
+    { RT_STR_TUPLE("CERTIFICATE") }
+};
+/**
+ * X509 Certificate markers.
+ *
+ * @remark See crypto/pem/pem.h in OpenSSL for a matching list.
+ */
+RTCRPEMMARKER const g_aX509CertificateMarkers[3] =
+{
+    { g_aWords_Certificate,         RT_ELEMENTS(g_aWords_Certificate) },
+    { g_aWords_TrustedCertificate,  RT_ELEMENTS(g_aWords_TrustedCertificate) },
+    { g_aWords_X509Certificate,     RT_ELEMENTS(g_aWords_X509Certificate) }
+};
+/**
+ * Checks if we've found all the certificates already.
+ *
+ * @returns true if all found, false if not.
+ * @param   afFound             Indicator array.
+ * @param   cWanted             Number of wanted certificates.
+ */
+DECLINLINE(bool) rtCrStoreAllDone(bool const *afFound, size_t cWanted)
+{
+    while (cWanted-- > 0)
+        if (!afFound[cWanted])
+            return false;
+    return true;
+}
+/**
+ * Checks if the given certificate specs matches the given wanted poster.
+ *
+ * @returns true if match, false if not.
+ * @param   pWanted     The certificate wanted poster.
+ * @param   cbEncoded   The candidate certificate encoded size.
+ * @param   paSha1      The candidate certificate SHA-1 fingerprint.
+ * @param   paSha512    The candidate certificate SHA-512 fingerprint.
+ * @param   pCert       The decoded candidate certificate, optional.  If not
+ *                      given the result will be uncertain.
+ */
+DECLINLINE(bool) rtCrStoreIsCertEqualToWanted(PCRTCRCERTWANTED pWanted,
+                                              size_t cbEncoded,
+                                              uint8_t const pabSha1[RTSHA1_HASH_SIZE],
+                                              uint8_t const pabSha512[RTSHA512_HASH_SIZE],
+                                              PCRTCRX509CERTIFICATE pCert)
+{
+    if (   pWanted->cbEncoded != cbEncoded
+        && pWanted->cbEncoded != 0)
+        return false;
+    if (   pWanted->fSha1Fingerprint
+        && memcmp(pWanted->abSha1, pabSha1, RTSHA1_HASH_SIZE) != 0)
+        return false;
+    if (   pWanted->fSha512Fingerprint
+        && memcmp(pWanted->abSha512, pabSha512, RTSHA512_HASH_SIZE) != 0)
+        return false;
+    if (   pWanted->pszSubject
+        && pCert
+        && !RTCrX509Name_MatchWithString(&pCert->TbsCertificate.Subject, pWanted->pszSubject))
+        return false;
+    return true;
+}
+/**
+ * Checks if a certificate is wanted.
+ *
+ * @returns true if match, false if not.
+ * @param   paWanted    The certificate wanted posters.
+ * @param   cWanted     The number of wanted posters.
+ * @param   apfFound    Found initicators running paralell to @a paWanted.
+ * @param   cbEncoded   The candidate certificate encoded size.
+ * @param   paSha1      The candidate certificate SHA-1 fingerprint.
+ * @param   paSha512    The candidate certificate SHA-512 fingerprint.
+ * @param   pCert       The decoded candidate certificate, optional.  If not
+ *                      given the result will be uncertain.
+ */
+DECLINLINE(bool) rtCrStoreIsCertWanted(PCRTCRCERTWANTED paWanted, size_t cWanted, bool const *pafFound, size_t cbEncoded,
+                                       uint8_t const pabSha1[RTSHA1_HASH_SIZE], uint8_t const pabSha512[RTSHA512_HASH_SIZE],
+                                       PCRTCRX509CERTIFICATE pCert)
+{
+    for (size_t iCert = 0; iCert < cWanted; iCert++)
+        if (!pafFound[iCert])
+            if (rtCrStoreIsCertEqualToWanted(&paWanted[iCert], cbEncoded, pabSha1, pabSha512, pCert))
+                return true;
+    return false;
+}
+/**
+ * Marks a certificate as found after it has been added to the store.
+ *
+ * May actually mark several certificates as found if there are duplicates or
+ * ambiguities in the wanted list.
+ *
+ * @returns true if all have been found, false if more to search for.
+ *
+ * @param   apfFound    Found initicators running paralell to @a paWanted.
+ *                      This is what this function updates.
+ * @param   paWanted    The certificate wanted posters.
+ * @param   cWanted     The number of wanted posters.
+ * @param   cbEncoded   The candidate certificate encoded size.
+ * @param   paSha1      The candidate certificate SHA-1 fingerprint.
+ * @param   paSha512    The candidate certificate SHA-512 fingerprint.
+ * @param   pCert       The decoded candidate certificate, optional.  If not
+ *                      given the result will be uncertain.
+ */
+static bool rtCrStoreMarkCertFound(bool *pafFound, PCRTCRCERTWANTED paWanted, size_t cWanted, size_t cbEncoded,
+                                   uint8_t const pabSha1[RTSHA1_HASH_SIZE], uint8_t const pabSha512[RTSHA512_HASH_SIZE],
+                                   PCRTCRX509CERTIFICATE pCert)
+{
+    size_t cFound = 0;
+    for (size_t iCert = 0; iCert < cWanted; iCert++)
+        if (pafFound[iCert])
+            cFound++;
+        else if (rtCrStoreIsCertEqualToWanted(&paWanted[iCert], cbEncoded, pabSha1, pabSha512, pCert))
+        {
+            pafFound[iCert] = true;
+            cFound++;
+        }
+    return cFound == cWanted;
+}
+RTDECL(int) RTCrStoreCertAddFromStore(RTCRSTORE hStore, uint32_t fFlags, RTCRSTORE hStoreSrc)
+{
+    /*
+     * Validate input.
+     */
+    AssertReturn(!(fFlags & ~(RTCRCERTCTX_F_ADD_IF_NOT_FOUND | RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR)), VERR_INVALID_FLAGS);
+    /*
+     * Enumerate all the certificates in the source store, adding them to the destination.
+     */
+    RTCRSTORECERTSEARCH Search;
+    int rc = RTCrStoreCertFindAll(hStoreSrc, &Search);
+    if (RT_SUCCESS(rc))
+    {
+        PCRTCRCERTCTX pCertCtx;
+        while ((pCertCtx = RTCrStoreCertSearchNext(hStoreSrc, &Search)) != NULL)
+        {
+            int rc2 = RTCrStoreCertAddEncoded(hStore, pCertCtx->fFlags | (fFlags & RTCRCERTCTX_F_ADD_IF_NOT_FOUND),
+                                              pCertCtx->pabEncoded, pCertCtx->cbEncoded, NULL);
+            if (RT_FAILURE(rc2))
+            {
+                rc = rc2;
+                if (!(fFlags & RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR))
+                    break;
+            }
+            RTCrCertCtxRelease(pCertCtx);
+        }
+        int rc2 = RTCrStoreCertSearchDestroy(hStoreSrc, &Search); AssertRC(rc2);
+    }
+    return rc;
+}
+RT_EXPORT_SYMBOL(RTCrStoreCertAddFromStore);
+RTDECL(int) RTCrStoreCertAddWantedFromStore(RTCRSTORE hStore, uint32_t fFlags, RTCRSTORE hSrcStore,
+                                            PCRTCRCERTWANTED paWanted, size_t cWanted, bool *pafFound)
+{
+    /*
+     * Validate input a little.
+     */
+    AssertReturn(!(fFlags & ~(RTCRCERTCTX_F_ADD_IF_NOT_FOUND | RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR)), VERR_INVALID_FLAGS);
+    fFlags |= RTCRCERTCTX_F_ADD_IF_NOT_FOUND; /* forced */
+    AssertReturn(cWanted, VERR_NOT_FOUND);
+    for (uint32_t i = 0; i < cWanted; i++)
+    {
+        AssertReturn(!paWanted[i].pszSubject || *paWanted[i].pszSubject, VERR_INVALID_PARAMETER);
+        AssertReturn(   paWanted[i].pszSubject
+                     || paWanted[i].fSha1Fingerprint
+                     || paWanted[i].fSha512Fingerprint,
+                     VERR_INVALID_PARAMETER);
+    }
+    /*
+     * Make sure we've got a result array.
+     */
+    bool *pafFoundFree = NULL;
+    if (!pafFound)
+    {
+        pafFound = pafFoundFree = (bool *)RTMemTmpAllocZ(sizeof(bool) * cWanted);
+        AssertReturn(pafFound, VERR_NO_TMP_MEMORY);
+    }
+    /*
+     * Enumerate the store entries.
+     */
+    RTCRSTORECERTSEARCH Search;
+    int rc = RTCrStoreCertFindAll(hSrcStore, &Search);
+    if (RT_SUCCESS(rc))
+    {
+        rc = VWRN_NOT_FOUND;
+        PCRTCRCERTCTX pCertCtx;
+        while ((pCertCtx = RTCrStoreCertSearchNext(hSrcStore, &Search)) != NULL)
+        {
+            if (   (pCertCtx->fFlags & RTCRCERTCTX_F_ENC_MASK) == RTCRCERTCTX_F_ENC_X509_DER
+                && pCertCtx->cbEncoded > 0
+                && pCertCtx->pCert)
+            {
+                /*
+                 * If the certificate is wanted, try add it to the store.
+                 */
+                uint8_t abSha1[RTSHA1_HASH_SIZE];
+                RTSha1(pCertCtx->pabEncoded, pCertCtx->cbEncoded, abSha1);
+                uint8_t abSha512[RTSHA512_HASH_SIZE];
+                RTSha1(pCertCtx->pabEncoded, pCertCtx->cbEncoded, abSha512);
+                if (rtCrStoreIsCertWanted(paWanted, cWanted, pafFound, pCertCtx->cbEncoded, abSha1, abSha512, pCertCtx->pCert))
+                {
+                    int rc2 = RTCrStoreCertAddEncoded(hStore,
+                                                      RTCRCERTCTX_F_ENC_X509_DER | (fFlags & RTCRCERTCTX_F_ADD_IF_NOT_FOUND),
+                                                      pCertCtx->pabEncoded, pCertCtx->cbEncoded, NULL /*pErrInfo*/);
+                    if (RT_SUCCESS(rc2))
+                    {
+                        /*
+                         * Mark it as found, stop if we've found all.
+                         */
+                        if (rtCrStoreMarkCertFound(pafFound, paWanted, cWanted,
+                                                   pCertCtx->cbEncoded, abSha1, abSha512, pCertCtx->pCert))
+                        {
+                            if (RT_SUCCESS(rc))
+                                rc = VINF_SUCCESS;
+                            RTCrCertCtxRelease(pCertCtx);
+                            break;
+                        }
+                    }
+                    else
+                    {
+                        /*
+                         * Some error adding the certificate.  Since it cannot be anything with
+                         * the encoding, it must be something with the store or resources, so
+                         * always return the error status.
+                         */
+                        rc = rc2;
+                        if (!(fFlags & RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR))
+                        {
+                            RTCrCertCtxRelease(pCertCtx);
+                            break;
+                        }
+                    }
+                }
+            }
+            RTCrCertCtxRelease(pCertCtx);
+        }
+        int rc2 = RTCrStoreCertSearchDestroy(hSrcStore, &Search);
+        AssertRC(rc2);
+    }
+    if (pafFoundFree)
+        RTMemTmpFree(pafFoundFree);
+    return rc;
+}
+RT_EXPORT_SYMBOL(RTCrStoreCertAddWantedFromStore);
+RTDECL(int) RTCrStoreCertCheckWanted(RTCRSTORE hStore, PCRTCRCERTWANTED paWanted, size_t cWanted, bool *pafFound)
+{
+    /*
+     * Validate input a little.
+     */
+    AssertReturn(cWanted, VERR_NOT_FOUND);
+    for (uint32_t i = 0; i < cWanted; i++)
+    {
+        AssertReturn(!paWanted[i].pszSubject || *paWanted[i].pszSubject, VERR_INVALID_PARAMETER);
+        AssertReturn(   paWanted[i].pszSubject
+                     || paWanted[i].fSha1Fingerprint
+                     || paWanted[i].fSha512Fingerprint,
+                     VERR_INVALID_PARAMETER);
+    }
+    AssertPtrReturn(pafFound, VERR_INVALID_POINTER);
+    /*
+     * Clear the found array.
+     */
+    for (uint32_t iCert = 0; iCert < cWanted; iCert++)
+        pafFound[iCert] = false;
+    /*
+     * Enumerate the store entries.
+     */
+    RTCRSTORECERTSEARCH Search;
+    int rc = RTCrStoreCertFindAll(hStore, &Search);
+    if (RT_SUCCESS(rc))
+    {
+        rc = VWRN_NOT_FOUND;
+        PCRTCRCERTCTX pCertCtx;
+        while ((pCertCtx = RTCrStoreCertSearchNext(hStore, &Search)) != NULL)
+        {
+            if (   (pCertCtx->fFlags & RTCRCERTCTX_F_ENC_MASK) == RTCRCERTCTX_F_ENC_X509_DER
+                && pCertCtx->cbEncoded > 0
+                && pCertCtx->pCert)
+            {
+                /*
+                 * Hash it and check if it's wanted.  Stop when we've found all.
+                 */
+                uint8_t abSha1[RTSHA1_HASH_SIZE];
+                RTSha1(pCertCtx->pabEncoded, pCertCtx->cbEncoded, abSha1);
+                uint8_t abSha512[RTSHA512_HASH_SIZE];
+                RTSha1(pCertCtx->pabEncoded, pCertCtx->cbEncoded, abSha512);
+                if (rtCrStoreMarkCertFound(pafFound, paWanted, cWanted, pCertCtx->cbEncoded, abSha1, abSha512, pCertCtx->pCert))
+                {
+                    rc = VINF_SUCCESS;
+                    RTCrCertCtxRelease(pCertCtx);
+                    break;
+                }
+            }
+            RTCrCertCtxRelease(pCertCtx);
+        }
+        int rc2 = RTCrStoreCertSearchDestroy(hStore, &Search);
+        AssertRC(rc2);
+    }
+    return rc;
+}
+RT_EXPORT_SYMBOL(RTCrStoreCertAddWantedFromStore);
+RTDECL(int) RTCrStoreCertAddFromFile(RTCRSTORE hStore, uint32_t fFlags, const char *pszFilename, PRTERRINFO pErrInfo)
+{
+    AssertReturn(!(fFlags & ~(RTCRCERTCTX_F_ADD_IF_NOT_FOUND | RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR)), VERR_INVALID_FLAGS);
+    size_t      cbContent;
+    void        *pvContent;
+    int rc = RTFileReadAllEx(pszFilename, 0, 64U*_1M, RTFILE_RDALL_O_DENY_WRITE, &pvContent, &cbContent);
+    if (RT_SUCCESS(rc))
+    {
+        /*
+         * Is it a java key store file?
+         */
+        if (   cbContent > 32
+            && ((uint32_t const *)pvContent)[0] == RT_H2BE_U32_C(UINT32_C(0xfeedfeed)) /* magic */
+            && ((uint32_t const *)pvContent)[1] == RT_H2BE_U32_C(UINT32_C(0x00000002)) /* version */ )
+            rc = RTCrStoreCertAddFromJavaKeyStoreInMem(hStore, fFlags, pvContent, cbContent, pszFilename, pErrInfo);
+        /*
+         * No assume PEM or DER encoded binary certificate.
+         */
+        else
+        {
+            PCRTCRPEMSECTION pSectionHead;
+            rc = RTCrPemParseContent(pvContent, cbContent,
+                                     (fFlags & RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR)
+                                     ? RTCRPEMREADFILE_F_CONTINUE_ON_ENCODING_ERROR : 0,
+                                     g_aX509CertificateMarkers, RT_ELEMENTS(g_aX509CertificateMarkers),
+                                     &pSectionHead, pErrInfo);
+            if (RT_SUCCESS(rc))
+            {
+                PCRTCRPEMSECTION pCurSec = pSectionHead;
+                while (pCurSec)
+                {
+                    int rc2 = RTCrStoreCertAddEncoded(hStore,
+                                                      RTCRCERTCTX_F_ENC_X509_DER | (fFlags & RTCRCERTCTX_F_ADD_IF_NOT_FOUND),
+                                                      pCurSec->pbData, pCurSec->cbData,
+                                                      !RTErrInfoIsSet(pErrInfo) ? pErrInfo : NULL);
+                    if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
+                    {
+                        rc = rc2;
+                        if (!(fFlags & RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR))
+                            break;
+                    }
+                    pCurSec = pCurSec->pNext;
+                }
+                RTCrPemFreeSections(pSectionHead);
+            }
+        }
+        RTFileReadAllFree(pvContent, cbContent);
+    }
+    else
+        rc = RTErrInfoSetF(pErrInfo, rc, "RTFileReadAllEx failed with %Rrc on '%s'", rc, pszFilename);
+    return rc;
+}
+RT_EXPORT_SYMBOL(RTCrStoreCertAddFromFile);
+RTDECL(int) RTCrStoreCertAddWantedFromFile(RTCRSTORE hStore, uint32_t fFlags, const char *pszFilename,
+                                           PCRTCRCERTWANTED paWanted, size_t cWanted, bool *pafFound, PRTERRINFO pErrInfo)
+{
+    /*
+     * Validate input a little.
+     */
+    AssertReturn(!(fFlags & ~(RTCRCERTCTX_F_ADD_IF_NOT_FOUND | RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR)), VERR_INVALID_FLAGS);
+    fFlags |= RTCRCERTCTX_F_ADD_IF_NOT_FOUND; /* forced */
+    AssertReturn(cWanted, VERR_NOT_FOUND);
+    for (uint32_t i = 0; i < cWanted; i++)
+    {
+        AssertReturn(!paWanted[i].pszSubject || *paWanted[i].pszSubject, VERR_INVALID_PARAMETER);
+        AssertReturn(   paWanted[i].pszSubject
+                     || paWanted[i].fSha1Fingerprint
+                     || paWanted[i].fSha512Fingerprint,
+                     VERR_INVALID_PARAMETER);
+    }
+    /*
+     * Make sure we've got a result array.
+     */
+    bool *pafFoundFree = NULL;
+    if (!pafFound)
+    {
+        pafFound = pafFoundFree = (bool *)RTMemTmpAllocZ(sizeof(bool) * cWanted);
+        AssertReturn(pafFound, VERR_NO_TMP_MEMORY);
+    }
+    size_t cbContent;
+    void  *pvContent;
+    int rc = RTFileReadAllEx(pszFilename, 0, 64U*_1M, RTFILE_RDALL_O_DENY_WRITE, &pvContent, &cbContent);
+    if (RT_SUCCESS(rc))
+    {
+        /*
+         * Is it a java key store file?   If so, load it into a tmp store
+         * which we can search.  Don't want to duplicate the JKS reader code.
+         */
+        if (   cbContent > 32
+            && ((uint32_t const *)pvContent)[0] == RT_H2BE_U32_C(UINT32_C(0xfeedfeed)) /* magic */
+            && ((uint32_t const *)pvContent)[1] == RT_H2BE_U32_C(UINT32_C(0x00000002)) /* version */ )
+        {
+            RTCRSTORE hTmpStore;
+            rc = RTCrStoreCreateInMem(&hTmpStore, 64);
+            if (RT_SUCCESS(rc))
+            {
+                rc = RTCrStoreCertAddFromJavaKeyStoreInMem(hStore, fFlags, pvContent, cbContent, pszFilename, pErrInfo);
+                if (RT_SUCCESS(rc))
+                    rc = RTCrStoreCertAddWantedFromStore(hStore, fFlags, hTmpStore, paWanted, cWanted, pafFound);
+                RTCrStoreRelease(hTmpStore);
+            }
+            else
+                rc = RTErrInfoSet(pErrInfo, rc, "Error creating temporary crypto store");
+        }
+        /*
+         * No assume PEM or DER encoded binary certificate.  Inspect them one by one.
+         */
+        else
+        {
+            PCRTCRPEMSECTION pSectionHead;
+            rc = RTCrPemParseContent(pvContent, cbContent,
+                                     (fFlags & RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR)
+                                     ? RTCRPEMREADFILE_F_CONTINUE_ON_ENCODING_ERROR : 0,
+                                     g_aX509CertificateMarkers, RT_ELEMENTS(g_aX509CertificateMarkers),
+                                     &pSectionHead, pErrInfo);
+            if (RT_SUCCESS(rc))
+            {
+                rc = VWRN_NOT_FOUND;
+                for (PCRTCRPEMSECTION pCurSec = pSectionHead; pCurSec; pCurSec = pCurSec->pNext)
+                {
+                    if (!pCurSec->cbData)
+                        continue;
+                    /*
+                     * See if this is a binary blob we might be interested in.
+                     */
+                    uint8_t abSha1[RTSHA1_HASH_SIZE];
+                    RTSha1(pCurSec->pbData, pCurSec->cbData, abSha1);
+                    uint8_t abSha512[RTSHA512_HASH_SIZE];
+                    RTSha1(pCurSec->pbData, pCurSec->cbData, abSha512);
+                    if (!rtCrStoreIsCertWanted(paWanted, cWanted, pafFound, pCurSec->cbData, abSha1, abSha512, NULL))
+                        continue;
+                    /*
+                     * Decode the certificate so we can match the subject string.
+                     */
+                    RTASN1CURSORPRIMARY Cursor;
+                    RTAsn1CursorInitPrimary(&Cursor, pCurSec->pbData, (uint32_t)pCurSec->cbData,
+                                            !RTErrInfoIsSet(pErrInfo) ? pErrInfo : NULL,
+                                            &g_RTAsn1DefaultAllocator, RTASN1CURSOR_FLAGS_DER, "InMem");
+                    RTCRX509CERTIFICATE X509Cert;
+                    int rc2 = RTCrX509Certificate_DecodeAsn1(&Cursor.Cursor, 0, &X509Cert, "Cert");
+                    if (RT_SUCCESS(rc2))
+                    {
+                        rc2 = RTCrX509Certificate_CheckSanity(&X509Cert, 0, !RTErrInfoIsSet(pErrInfo) ? pErrInfo : NULL, "Cert");
+                        if (RT_SUCCESS(rc2))
+                        {
+                            if (rtCrStoreIsCertWanted(paWanted, cWanted, pafFound, pCurSec->cbData, abSha1, abSha512, &X509Cert))
+                            {
+                                /*
+                                 * The certificate is wanted, now add it to the store.
+                                 */
+                                rc2 = RTCrStoreCertAddEncoded(hStore,
+                                                              RTCRCERTCTX_F_ENC_X509_DER
+                                                              | (fFlags & RTCRCERTCTX_F_ADD_IF_NOT_FOUND),
+                                                              pCurSec->pbData, pCurSec->cbData,
+                                                              !RTErrInfoIsSet(pErrInfo) ? pErrInfo : NULL);
+                                if (RT_SUCCESS(rc2))
+                                {
+                                    /*
+                                     * Mark it as found, stop if we've found all.
+                                     */
+                                    if (rtCrStoreMarkCertFound(pafFound, paWanted, cWanted,
+                                                               pCurSec->cbData, abSha1, abSha512, &X509Cert))
+                                    {
+                                        RTAsn1VtDelete(&X509Cert.SeqCore.Asn1Core);
+                                        rc = VINF_SUCCESS;
+                                        break;
+                                    }
+                                }
+                            }
+                        }
+                        else
+                            Assert(!pErrInfo || RTErrInfoIsSet(pErrInfo));
+                        RTAsn1VtDelete(&X509Cert.SeqCore.Asn1Core);
+                    }
+                    else if (!RTErrInfoIsSet(pErrInfo))
+                        RTErrInfoSetF(pErrInfo, rc2, "RTCrX509Certificate_DecodeAsn1 failed");
+                    /*
+                     * Stop on error, if requested.  Otherwise, let pErrInfo keep it.
+                     */
+                    if (RT_FAILURE(rc2) && !(fFlags & RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR))
+                    {
+                        rc = rc2;
+                        break;
+                    }
+                } /* For each PEM section. */
+                RTCrPemFreeSections(pSectionHead);
+            }
+        }
+        RTFileReadAllFree(pvContent, cbContent);
+    }
+    else
+        rc = RTErrInfoSetF(pErrInfo, rc, "RTFileReadAllEx failed with %Rrc on '%s'", rc, pszFilename);
+    if (pafFoundFree)
+        RTMemTmpFree(pafFoundFree);
+    return rc;
+}
+RT_EXPORT_SYMBOL(RTCrStoreCertAddWantedFromFile);
 …
         if (cchPath > 0)
+        {
             size_t const cbFilename = sizeof(szPath) - cchPath;
+            size_t const cbMaxFilename = sizeof(szPath) - cchPath;
             /*
 …
                     if (RT_SUCCESS(rc2))
+                    {
+                        if (   !RTDirEntryIsStdDotLink(&u.DirEntry)
+                        if (   (   u.DirEntry.enmType == RTDIRENTRYTYPE_FILE
+                                || u.DirEntry.enmType == RTDIRENTRYTYPE_SYMLINK
+                                || (   u.DirEntry.enmType == RTDIRENTRYTYPE_UNKNOWN
+                                    && !RTDirEntryIsStdDotLink(&u.DirEntry)) )
                             && rtCrStoreIsSuffixMatch(&u.DirEntry, paSuffixes, cSuffixes) )
+                        {
                             if (u.DirEntry.cbName < cbFilename)
+                            if (u.DirEntry.cbName < cbMaxFilename)
+                            {
                                 memcpy(&szPath[cchPath], u.DirEntry.szName, u.DirEntry.cbName + 1);
 …
+                                }
+                            }
+                            else if (   u.DirEntry.enmType == RTDIRENTRYTYPE_FILE
+                                     || u.DirEntry.enmType == RTDIRENTRYTYPE_SYMLINK
+                                     || u.DirEntry.enmType == RTDIRENTRYTYPE_UNKNOWN)
+                            else
+                            {
                                 rc = RTErrInfoAddF(pErrInfo, VERR_FILENAME_TOO_LONG,
 …
     return rc;
+}
+RT_EXPORT_SYMBOL(RTCrStoreCertAddFromDir);
+RTDECL(int) RTCrStoreCertAddWantedFromDir(RTCRSTORE hStore, uint32_t fFlags,
+                                          const char *pszDir, PCRTSTRTUPLE paSuffixes, size_t cSuffixes,
+                                          PCRTCRCERTWANTED paWanted, size_t cWanted, bool *pafFound, PRTERRINFO pErrInfo)
+{
+    /*
+     * Validate input a little.
+     */
+    AssertReturn(*pszDir, VERR_PATH_ZERO_LENGTH);
+    AssertReturn(!(fFlags & ~(RTCRCERTCTX_F_ADD_IF_NOT_FOUND | RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR)), VERR_INVALID_FLAGS);
+    fFlags |= RTCRCERTCTX_F_ADD_IF_NOT_FOUND; /* forced */
+    AssertReturn(cWanted, VERR_NOT_FOUND);
+    for (uint32_t i = 0; i < cWanted; i++)
+    {
+        AssertReturn(!paWanted[i].pszSubject || *paWanted[i].pszSubject, VERR_INVALID_PARAMETER);
+        AssertReturn(   paWanted[i].pszSubject
+                     || paWanted[i].fSha1Fingerprint
+                     || paWanted[i].fSha512Fingerprint,
+                     VERR_INVALID_PARAMETER);
+    }
+    /*
+     * Prepare for constructing path to the files in the directory, so that we
+     * can open them.
+     */
+    char szPath[RTPATH_MAX];
+    int rc = RTStrCopy(szPath, sizeof(szPath), pszDir);
+    if (RT_SUCCESS(rc))
+    {
+        size_t cchPath = RTPathEnsureTrailingSeparator(szPath, sizeof(szPath));
+        if (cchPath > 0)
+        {
+            size_t const cbMaxFilename = sizeof(szPath) - cchPath;
+            /*
+             * Enumerate the directory.
+             */
+            PRTDIR hDir;
+            rc = RTDirOpen(&hDir, pszDir);
+            if (RT_SUCCESS(rc))
+            {
+                rc = VWRN_NOT_FOUND;
+                for (;;)
+                {
+                    /* Read the next entry. */
+                    union
+                    {
+                        RTDIRENTRY  DirEntry;
+                        uint8_t     abPadding[RT_OFFSETOF(RTDIRENTRY, szName) + RTPATH_MAX];
+                    } u;
+                    size_t cbEntry = sizeof(u);
+                    int rc2 = RTDirRead(hDir, &u.DirEntry, &cbEntry);
+                    if (RT_SUCCESS(rc2))
+                    {
+                        if (   (   u.DirEntry.enmType == RTDIRENTRYTYPE_FILE
+                                || u.DirEntry.enmType == RTDIRENTRYTYPE_SYMLINK
+                                || (   u.DirEntry.enmType == RTDIRENTRYTYPE_UNKNOWN
+                                    && !RTDirEntryIsStdDotLink(&u.DirEntry)) )
+                            && rtCrStoreIsSuffixMatch(&u.DirEntry, paSuffixes, cSuffixes) )
+                        {
+                            if (u.DirEntry.cbName < cbMaxFilename)
+                            {
+                                memcpy(&szPath[cchPath], u.DirEntry.szName, u.DirEntry.cbName);
+                                szPath[cchPath + u.DirEntry.cbName] = '\0';
+                                if (u.DirEntry.enmType != RTDIRENTRYTYPE_FILE)
+                                    RTDirQueryUnknownType(szPath, true /*fFollowSymlinks*/, &u.DirEntry.enmType);
+                                if (u.DirEntry.enmType == RTDIRENTRYTYPE_FILE)
+                                {
+                                    rc2 = RTCrStoreCertAddWantedFromFile(hStore, fFlags, szPath,
+                                                                         paWanted, cWanted, pafFound, pErrInfo);
+                                    if (rc2 == VINF_SUCCESS)
+                                    {
+                                        Assert(rtCrStoreAllDone(pafFound, cWanted));
+                                        if (RT_SUCCESS(rc))
+                                            rc = VINF_SUCCESS;
+                                        break;
+                                    }
+                                    if (RT_FAILURE(rc2) && !(fFlags & RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR))
+                                    {
+                                        rc = rc2;
+                                        break;
+                                    }
+                                }
+                            }
+                            else
+                            {
+                                /*
+                                 * pErrInfo keeps the status code unless it's fatal.
+                                 */
+                                RTErrInfoAddF(pErrInfo, VERR_FILENAME_TOO_LONG,
+                                              "  Too long filename (%u bytes)", u.DirEntry.cbName);
+                                if (!(fFlags & RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR))
+                                {
+                                    rc = VERR_FILENAME_TOO_LONG;
+                                    break;
+                                }
+                            }
+                        }
+                    }
+                    else
+                    {
+                        if (rc2 != VERR_NO_MORE_FILES)
+                        {
+                            RTErrInfoAddF(pErrInfo, rc2, "RTDirRead failed: %Rrc", rc2);
+                            if (!(fFlags & RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR))
+                                rc = rc2;
+                        }
+                        break;
+                    }
+                }
+                RTDirClose(hDir);
+            }
+        }
+        else
+            rc = VERR_FILENAME_TOO_LONG;
+    }
+    return rc;
+}
+RT_EXPORT_SYMBOL(RTCrStoreCertAddWantedFromDir);

trunk/src/VBox/Runtime/common/crypto/store.cpp

-              r57572
+              r57613
+RTDECL(uint32_t) RTCrStoreCertCount(RTCRSTORE hStore)
+{
+    PRTCRSTOREINT pThis = (PRTCRSTOREINT)hStore;
+    AssertPtrReturn(pThis, UINT32_MAX);
+    AssertReturn(pThis->u32Magic == RTCRSTOREINT_MAGIC, UINT32_MAX);
+    RTCRSTORECERTSEARCH Search;
+    int rc = pThis->pProvider->pfnCertFindAll(pThis->pvProvider, &Search);
+    AssertRCReturn(rc, UINT32_MAX);
+    uint32_t cCerts = 0;
+    PCRTCRCERTCTX pCur;
+    while ((pCur = pThis->pProvider->pfnCertSearchNext(pThis->pvProvider, &Search)) != NULL)
+    {
+        RTCrCertCtxRelease(pCur);
+        cCerts++;
+    }
+    return cCerts;
+}
 #ifdef IPRT_WITH_OPENSSL
 /*

trunk/src/VBox/Runtime/common/crypto/x509-internal.h

-              r56290
+              r57613
 #define ___common_crypto_x509_internal_h
+#include <iprt/crypto/pem.h>
+extern RTCRPEMMARKER const g_aX509CertificateMarkers[3];
 #define RTASN1TMPL_TEMPLATE_FILE "../common/crypto/x509-template.h"
 #include <iprt/asn1-generator-internal-header.h>

trunk/src/VBox/Runtime/common/misc/http.cpp

-              r57577
+              r57613
 #include "internal/iprt.h"
+#include <iprt/asm.h>
 #include <iprt/assert.h>
+#include <iprt/crypto/store.h>
 #include <iprt/env.h>
 #include <iprt/err.h>
+#include <iprt/file.h>
 #include <iprt/mem.h>
+#include <iprt/path.h>
+#include <iprt/stream.h>
 #include <iprt/string.h>
+#include <iprt/file.h>
 #include <iprt/stream.h>
+#include "internal/magics.h"
 #include <curl/curl.h>
-#include "internal/magics.h"
 …
 *   Structures and Typedefs                                                                                                      *
 *********************************************************************************************************************************/
+/**
+ * Internal HTTP client instance.
+ */
 typedef struct RTHTTPINTERNAL
+{
 …
     uint32_t            u32Magic;
     /** cURL handle. */
     CURL                *pCurl;
+    CURL               *pCurl;
     /** The last response code. */
     long                lLastResp;
+    /** custom headers */
+    struct curl_slist   *pHeaders;
+    /** CA certificate for HTTPS authentication check. */
+    char                *pcszCAFile;
+    /** Custom headers/ */
+    struct curl_slist  *pHeaders;
+    /** CA certificate file for HTTPS authentication. */
+    char               *pszCaFile;
+    /** Whether to delete the CA on destruction. */
+    bool                fDeleteCaFile;
     /** Abort the current HTTP request if true. */
+    bool                fAbort;
+    bool volatile       fAbort;
+    /** Set if someone is preforming an HTTP operation. */
+    bool volatile       fBusy;
     /** The location field for 301 responses. */
+    char                *pszRedirLocation;
+    char               *pszRedirLocation;
+    /** Output callback data. */
+    union
+    {
+        /** For file destination.  */
+        RTFILE          hFile;
+        /** For memory destination. */
+        struct
+        {
+            /** The current size (sans terminator char). */
+            size_t      cb;
+            /** The currently allocated size. */
+            size_t      cbAllocated;
+            /** Pointer to the buffer. */
+            uint8_t    *pb;
+        } Mem;
+    } Output;
+    /** Output callback status. */
+    int                 rcOutput;
+    /** Download size hint set by the progress callback. */
+    uint64_t            cbDownloadHint;
 } RTHTTPINTERNAL;
+/** Pointer to an internal HTTP client instance. */
 typedef RTHTTPINTERNAL *PRTHTTPINTERNAL;
-typedef struct RTHTTPMEMCHUNK
+{
-    uint8_t    *pu8Mem;
-    size_t      cb;
-} RTHTTPMEMCHUNK;
-typedef RTHTTPMEMCHUNK *PRTHTTPMEMCHUNK;
 …
 *   Defined Constants And Macros                                                                                                 *
 *********************************************************************************************************************************/
+#define CURL_FAILED(rcCurl) (RT_UNLIKELY(rcCurl != CURLE_OK))
+/** @def RTHTTP_MAX_MEM_DOWNLOAD
+ * The max size we are allowed to download to a memory buffer.
+ *
+ * @remarks The minus 1 is for the trailing zero terminator we always add.
+ */
+#if ARCH_BITS == 64
+# define RTHTTP_MAX_MEM_DOWNLOAD_SIZE       (UINT32_C(64)*_1M - 1)
+#else
+# define RTHTTP_MAX_MEM_DOWNLOAD_SIZE       (UINT32_C(32)*_1M - 1)
+#endif
+/** Checks whether a cURL return code indicates success. */
+#define CURL_SUCCESS(rcCurl)    RT_LIKELY(rcCurl == CURLE_OK)
+/** Checks whether a cURL return code indicates failure. */
+#define CURL_FAILURE(rcCurl)    RT_UNLIKELY(rcCurl != CURLE_OK)
 /** Validates a handle and returns VERR_INVALID_HANDLE if not valid. */
 …
+/*********************************************************************************************************************************
+*   Internal Functions                                                                                                           *
+*********************************************************************************************************************************/
+static void rtHttpUnsetCaFile(PRTHTTPINTERNAL pThis);
 RTR3DECL(int) RTHttpCreate(PRTHTTP phHttp)
+{
     AssertPtrReturn(phHttp, VERR_INVALID_PARAMETER);
+    /** @todo r=bird: rainy day: curl_global_init is not thread safe, only a
+     *        problem if multiple threads get here at the same time. */
+    int rc = VERR_HTTP_INIT_FAILED;
     CURLcode rcCurl = curl_global_init(CURL_GLOBAL_ALL);
+    if (CURL_FAILED(rcCurl))
+        return VERR_HTTP_INIT_FAILED;
+    CURL *pCurl = curl_easy_init();
+    if (!pCurl)
+        return VERR_HTTP_INIT_FAILED;
+    PRTHTTPINTERNAL pHttpInt = (PRTHTTPINTERNAL)RTMemAllocZ(sizeof(RTHTTPINTERNAL));
+    if (!pHttpInt)
+        return VERR_NO_MEMORY;
+    pHttpInt->u32Magic = RTHTTP_MAGIC;
+    pHttpInt->pCurl = pCurl;
+    *phHttp = (RTHTTP)pHttpInt;
+    if (!CURL_FAILURE(rcCurl))
+    {
+        CURL *pCurl = curl_easy_init();
+        if (pCurl)
+        {
+            PRTHTTPINTERNAL pThis = (PRTHTTPINTERNAL)RTMemAllocZ(sizeof(RTHTTPINTERNAL));
+            if (pThis)
+            {
+                pThis->u32Magic = RTHTTP_MAGIC;
+                pThis->pCurl    = pCurl;
+                *phHttp = (RTHTTP)pThis;
+                return VINF_SUCCESS;
+            }
+            rc = VERR_NO_MEMORY;
+        }
+        else
+            rc = VERR_HTTP_INIT_FAILED;
+    }
+    curl_global_cleanup();
+    return rc;
+}
+RTR3DECL(void) RTHttpDestroy(RTHTTP hHttp)
+{
+    if (hHttp == NIL_RTHTTP)
+        return;
+    PRTHTTPINTERNAL pThis = hHttp;
+    RTHTTP_VALID_RETURN_VOID(pThis);
+    Assert(!pThis->fBusy);
+    pThis->u32Magic = RTHTTP_MAGIC_DEAD;
+    curl_easy_cleanup(pThis->pCurl);
+    pThis->pCurl = NULL;
+    if (pThis->pHeaders)
+        curl_slist_free_all(pThis->pHeaders);
+    rtHttpUnsetCaFile(pThis);
+    Assert(!pThis->pszCaFile);
+    if (pThis->pszRedirLocation)
+        RTStrFree(pThis->pszRedirLocation);
+    RTMemFree(pThis);
+    curl_global_cleanup();
+}
+RTR3DECL(int) RTHttpAbort(RTHTTP hHttp)
+{
+    PRTHTTPINTERNAL pThis = hHttp;
+    RTHTTP_VALID_RETURN(pThis);
+    pThis->fAbort = true;
     return VINF_SUCCESS;
 …
-RTR3DECL(void) RTHttpDestroy(RTHTTP hHttp)
+{
-    if (!hHttp)
-        return;
-    PRTHTTPINTERNAL pHttpInt = hHttp;
-    RTHTTP_VALID_RETURN_VOID(pHttpInt);
-    pHttpInt->u32Magic = RTHTTP_MAGIC_DEAD;
-    curl_easy_cleanup(pHttpInt->pCurl);
-    if (pHttpInt->pHeaders)
-        curl_slist_free_all(pHttpInt->pHeaders);
-    if (pHttpInt->pcszCAFile)
-        RTStrFree(pHttpInt->pcszCAFile);
-    if (pHttpInt->pszRedirLocation)
-        RTStrFree(pHttpInt->pszRedirLocation);
-    RTMemFree(pHttpInt);
-    curl_global_cleanup();
+}
-static DECLCALLBACK(size_t) rtHttpWriteData(void *pvBuf, size_t cb, size_t n, void *pvUser)
+{
-    PRTHTTPMEMCHUNK pMem = (PRTHTTPMEMCHUNK)pvUser;
-    size_t cbAll = cb * n;
-    pMem->pu8Mem = (uint8_t*)RTMemRealloc(pMem->pu8Mem, pMem->cb + cbAll + 1);
-    if (pMem->pu8Mem)
+    {
-        memcpy(&pMem->pu8Mem[pMem->cb], pvBuf, cbAll);
-        pMem->cb += cbAll;
-        pMem->pu8Mem[pMem->cb] = '\0';
+    }
-    return cbAll;
+}
-static DECLCALLBACK(int) rtHttpProgress(void *pData, double DlTotal, double DlNow, double UlTotal, double UlNow)
+{
-    PRTHTTPINTERNAL pHttpInt = (PRTHTTPINTERNAL)pData;
-    AssertReturn(pHttpInt->u32Magic == RTHTTP_MAGIC, 1);
-    return pHttpInt->fAbort ? 1 : 0;
+}
-RTR3DECL(int) RTHttpAbort(RTHTTP hHttp)
+{
-    PRTHTTPINTERNAL pHttpInt = hHttp;
-    RTHTTP_VALID_RETURN(pHttpInt);
-    pHttpInt->fAbort = true;
-    return VINF_SUCCESS;
+}
 RTR3DECL(int) RTHttpGetRedirLocation(RTHTTP hHttp, char **ppszRedirLocation)
+{
+    PRTHTTPINTERNAL pHttpInt = hHttp;
+    RTHTTP_VALID_RETURN(pHttpInt);
+    if (!pHttpInt->pszRedirLocation)
+    PRTHTTPINTERNAL pThis = hHttp;
+    RTHTTP_VALID_RETURN(pThis);
+    Assert(!pThis->fBusy);
+    if (!pThis->pszRedirLocation)
         return VERR_HTTP_NOT_FOUND;
+    *ppszRedirLocation = RTStrDup(pHttpInt->pszRedirLocation);
+    return VINF_SUCCESS;
+    return RTStrDupEx(ppszRedirLocation, pThis->pszRedirLocation);
+}
 …
 RTR3DECL(int) RTHttpUseSystemProxySettings(RTHTTP hHttp)
+{
     PRTHTTPINTERNAL pHttpInt = hHttp;
     RTHTTP_VALID_RETURN(pHttpInt);
+    PRTHTTPINTERNAL pThis = hHttp;
+    RTHTTP_VALID_RETURN(pThis);
     /*
 …
         if (!strncmp(szProxy, RT_STR_TUPLE("http://")))
+        {
             rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_PROXY, &szProxy[sizeof("http://") - 1]);
             if (CURL_FAILED(rcCurl))
+            rcCurl = curl_easy_setopt(pThis->pCurl, CURLOPT_PROXY, &szProxy[sizeof("http://") - 1]);
+            if (CURL_FAILURE(rcCurl))
                 return VERR_INVALID_PARAMETER;
             rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_PROXYPORT, 80);
             if (CURL_FAILED(rcCurl))
+            rcCurl = curl_easy_setopt(pThis->pCurl, CURLOPT_PROXYPORT, 80);
+            if (CURL_FAILURE(rcCurl))
                 return VERR_INVALID_PARAMETER;
+        }
         else
+        {
             rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_PROXY, &szProxy[sizeof("http://") - 1]);
             if (CURL_FAILED(rcCurl))
+            rcCurl = curl_easy_setopt(pThis->pCurl, CURLOPT_PROXY, &szProxy[sizeof("http://") - 1]);
+            if (CURL_FAILURE(rcCurl))
                 return VERR_INVALID_PARAMETER;
+        }
 …
                              const char *pcszProxyUser, const char *pcszProxyPwd)
+{
     PRTHTTPINTERNAL pHttpInt = hHttp;
     RTHTTP_VALID_RETURN(pHttpInt);
+    PRTHTTPINTERNAL pThis = hHttp;
+    RTHTTP_VALID_RETURN(pThis);
     AssertPtrReturn(pcszProxy, VERR_INVALID_PARAMETER);
     int rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_PROXY, pcszProxy);
     if (CURL_FAILED(rcCurl))
+    int rcCurl = curl_easy_setopt(pThis->pCurl, CURLOPT_PROXY, pcszProxy);
+    if (CURL_FAILURE(rcCurl))
         return VERR_INVALID_PARAMETER;
     if (uPort != 0)
+    {
         rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_PROXYPORT, (long)uPort);
         if (CURL_FAILED(rcCurl))
+        rcCurl = curl_easy_setopt(pThis->pCurl, CURLOPT_PROXYPORT, (long)uPort);
+        if (CURL_FAILURE(rcCurl))
             return VERR_INVALID_PARAMETER;
+    }
 …
     if (pcszProxyUser && pcszProxyPwd)
+    {
         rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_PROXYUSERNAME, pcszProxyUser);
         if (CURL_FAILED(rcCurl))
+        rcCurl = curl_easy_setopt(pThis->pCurl, CURLOPT_PROXYUSERNAME, pcszProxyUser);
+        if (CURL_FAILURE(rcCurl))
             return VERR_INVALID_PARAMETER;
         rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_PROXYPASSWORD, pcszProxyPwd);
         if (CURL_FAILED(rcCurl))
+        rcCurl = curl_easy_setopt(pThis->pCurl, CURLOPT_PROXYPASSWORD, pcszProxyPwd);
+        if (CURL_FAILURE(rcCurl))
             return VERR_INVALID_PARAMETER;
+    }
 …
 RTR3DECL(int) RTHttpSetHeaders(RTHTTP hHttp, size_t cHeaders, const char * const *papszHeaders)
+{
     PRTHTTPINTERNAL pHttpInt = hHttp;
     RTHTTP_VALID_RETURN(pHttpInt);
+    PRTHTTPINTERNAL pThis = hHttp;
+    RTHTTP_VALID_RETURN(pThis);
     if (!cHeaders)
+    {
         if (pHttpInt->pHeaders)
             curl_slist_free_all(pHttpInt->pHeaders);
         pHttpInt->pHeaders = 0;
+        if (pThis->pHeaders)
+            curl_slist_free_all(pThis->pHeaders);
+        pThis->pHeaders = 0;
         return VINF_SUCCESS;
+    }
 …
         pHeaders = curl_slist_append(pHeaders, papszHeaders[i]);
     pHttpInt->pHeaders = pHeaders;
     int rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_HTTPHEADER, pHeaders);
     if (CURL_FAILED(rcCurl))
+    pThis->pHeaders = pHeaders;
+    int rcCurl = curl_easy_setopt(pThis->pCurl, CURLOPT_HTTPHEADER, pHeaders);
+    if (CURL_FAILURE(rcCurl))
         return VERR_INVALID_PARAMETER;
 …
+RTR3DECL(int) RTHttpSetCAFile(RTHTTP hHttp, const char *pcszCAFile)
+{
+    PRTHTTPINTERNAL pHttpInt = hHttp;
+    RTHTTP_VALID_RETURN(pHttpInt);
+    if (pHttpInt->pcszCAFile)
+        RTStrFree(pHttpInt->pcszCAFile);
+    pHttpInt->pcszCAFile = RTStrDup(pcszCAFile);
+    if (!pHttpInt->pcszCAFile)
+        return VERR_NO_MEMORY;
+/**
+ * Set the CA file to NULL, deleting any temporary file if necessary.
+ *
+ * @param   pThis           The HTTP/HTTPS client instance.
+ */
+static void rtHttpUnsetCaFile(PRTHTTPINTERNAL pThis)
+{
+    if (pThis->pszCaFile)
+    {
+        if (pThis->fDeleteCaFile)
+        {
+            int rc2 = RTFileDelete(pThis->pszCaFile);
+            AssertMsg(RT_SUCCESS(rc2) || !RTFileExists(pThis->pszCaFile), ("rc=%Rrc '%s'\n", rc2, pThis->pszCaFile));
+        }
+        RTStrFree(pThis->pszCaFile);
+        pThis->pszCaFile = NULL;
+    }
+}
+RTR3DECL(int) RTHttpSetCAFile(RTHTTP hHttp, const char *pszCaFile)
+{
+    PRTHTTPINTERNAL pThis = hHttp;
+    RTHTTP_VALID_RETURN(pThis);
+    rtHttpUnsetCaFile(pThis);
+    pThis->fDeleteCaFile = false;
+    if (pszCaFile)
+        return RTStrDupEx(&pThis->pszCaFile, pszCaFile);
     return VINF_SUCCESS;
+}
+RTR3DECL(int) RTHttpUseTemporaryCaFile(RTHTTP hHttp, PRTERRINFO pErrInfo)
+{
+    PRTHTTPINTERNAL pThis = hHttp;
+    RTHTTP_VALID_RETURN(pThis);
+    /*
+     * Create a temporary file.
+     */
+    int rc = VERR_NO_STR_MEMORY;
+    char *pszCaFile = RTStrAlloc(RTPATH_MAX);
+    if (pszCaFile)
+    {
+        RTFILE hFile;
+        rc = RTFileOpenTemp(&hFile, pszCaFile, RTPATH_MAX,
+                            RTFILE_O_CREATE | RTFILE_O_WRITE | RTFILE_O_DENY_NONE | (0600 << RTFILE_O_CREATE_MODE_SHIFT));
+        if (RT_SUCCESS(rc))
+        {
+            /*
+             * Gather certificates into a temporary store and export them to the temporary file.
+             */
+            RTCRSTORE hStore;
+            rc = RTCrStoreCreateInMem(&hStore, 256);
+            if (RT_SUCCESS(rc))
+            {
+                rc = RTHttpGatherCaCertsInStore(hStore, 0 /*fFlags*/, pErrInfo);
+                if (RT_SUCCESS(rc))
+                    /** @todo Consider adding an API for exporting to a RTFILE... */
+                    rc = RTCrStoreCertExportAsPem(hStore, 0 /*fFlags*/, pszCaFile);
+                RTCrStoreRelease(hStore);
+            }
+            RTFileClose(hFile);
+            if (RT_SUCCESS(rc))
+            {
+                /*
+                 * Set the CA file for the instance.
+                 */
+                rtHttpUnsetCaFile(pThis);
+                pThis->fDeleteCaFile = true;
+                pThis->pszCaFile = pszCaFile;
+                return VINF_SUCCESS;
+            }
+            int rc2 = RTFileDelete(pszCaFile);
+            AssertRC(rc2);
+        }
+        else
+            RTErrInfoAddF(pErrInfo, rc, "Error creating temorary file: %Rrc", rc);
+        RTStrFree(pszCaFile);
+    }
+    return rc;
+}
+RTR3DECL(int) RTHttpGatherCaCertsInStore(RTCRSTORE hStore, uint32_t fFlags, PRTERRINFO pErrInfo)
+{
+    uint32_t const cBefore = RTCrStoreCertCount(hStore);
+    AssertReturn(cBefore != UINT32_MAX, VERR_INVALID_HANDLE);
+    /*
+     * Add the user store, quitely ignoring any errors.
+     */
+    RTCRSTORE hSrcStore;
+    int rcUser = RTCrStoreCreateSnapshotById(&hSrcStore, RTCRSTOREID_USER_TRUSTED_CAS_AND_CERTIFICATES, pErrInfo);
+    if (RT_SUCCESS(rcUser))
+    {
+        rcUser = RTCrStoreCertAddFromStore(hStore, RTCRCERTCTX_F_ADD_IF_NOT_FOUND | RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR,
+                                           hSrcStore);
+        RTCrStoreRelease(hSrcStore);
+    }
+    /*
+     * Ditto for the system store.
+     */
+    int rcSystem = RTCrStoreCreateSnapshotById(&hSrcStore, RTCRSTOREID_USER_TRUSTED_CAS_AND_CERTIFICATES, pErrInfo);
+    if (RT_SUCCESS(rcSystem))
+    {
+        rcSystem = RTCrStoreCertAddFromStore(hStore, RTCRCERTCTX_F_ADD_IF_NOT_FOUND | RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR,
+                                             hSrcStore);
+        RTCrStoreRelease(hSrcStore);
+    }
+    /*
+     * If the number of certificates increased, we consider it a success.
+     */
+    if (RTCrStoreCertCount(hStore) > cBefore)
+    {
+        if (RT_FAILURE(rcSystem))
+            return -rcSystem;
+        if (RT_FAILURE(rcUser))
+            return -rcUser;
+        return rcSystem != VINF_SUCCESS ? rcSystem : rcUser;
+    }
+    if (RT_FAILURE(rcSystem))
+        return rcSystem;
+    if (RT_FAILURE(rcUser))
+        return rcSystem;
+    return VERR_NOT_FOUND;
+}
+RTR3DECL(int) RTHttpGatherCaCertsInFile(const char *pszCaFile, uint32_t fFlags, PRTERRINFO pErrInfo)
+{
+    RTCRSTORE hStore;
+    int rc = RTCrStoreCreateInMem(&hStore, 256);
+    if (RT_SUCCESS(rc))
+    {
+        rc = RTHttpGatherCaCertsInStore(hStore, fFlags, pErrInfo);
+        if (RT_SUCCESS(rc))
+            rc = RTCrStoreCertExportAsPem(hStore, 0 /*fFlags*/, pszCaFile);
+        RTCrStoreRelease(hStore);
+    }
+    return rc;
+}
 …
+ *
  * @returns IPRT status code.
  * @param   pHttpInt            HTTP instance.
  * @param   rcCurl              What curl returned.
  */
 static int rtHttpGetCalcStatus(PRTHTTPINTERNAL pHttpInt, int rcCurl)
+ * @param   pThis           The HTTP/HTTPS client instance.
+ * @param   rcCurl          What curl returned.
+ */
+static int rtHttpGetCalcStatus(PRTHTTPINTERNAL pThis, int rcCurl)
+{
     int rc = VERR_INTERNAL_ERROR;
     if (pHttpInt->pszRedirLocation)
+    {
         RTStrFree(pHttpInt->pszRedirLocation);
         pHttpInt->pszRedirLocation = NULL;
+    if (pThis->pszRedirLocation)
+    {
+        RTStrFree(pThis->pszRedirLocation);
+        pThis->pszRedirLocation = NULL;
+    }
     if (rcCurl == CURLE_OK)
+    {
         curl_easy_getinfo(pHttpInt->pCurl, CURLINFO_RESPONSE_CODE, &pHttpInt->lLastResp);
         switch (pHttpInt->lLastResp)
+        curl_easy_getinfo(pThis->pCurl, CURLINFO_RESPONSE_CODE, &pThis->lLastResp);
+        switch (pThis->lLastResp)
+        {
             case 200:
 …
+            {
                 const char *pszRedirect;
                 curl_easy_getinfo(pHttpInt->pCurl, CURLINFO_REDIRECT_URL, &pszRedirect);
+                curl_easy_getinfo(pThis->pCurl, CURLINFO_REDIRECT_URL, &pszRedirect);
                 size_t cb = strlen(pszRedirect);
                 if (cb > 0 && cb < 2048)
                     pHttpInt->pszRedirLocation = RTStrDup(pszRedirect);
+                    pThis->pszRedirLocation = RTStrDup(pszRedirect);
                 rc = VERR_HTTP_REDIRECTED;
                 break;
 …
 /**
+ * cURL callback for reporting progress, we use it for checking for abort.
+ */
+static int rtHttpProgress(void *pData, double rdTotalDownload, double rdDownloaded, double rdTotalUpload, double rdUploaded)
+{
+    PRTHTTPINTERNAL pThis = (PRTHTTPINTERNAL)pData;
+    AssertReturn(pThis->u32Magic == RTHTTP_MAGIC, 1);
+    pThis->cbDownloadHint = (uint64_t)rdTotalDownload;
+    return pThis->fAbort ? 1 : 0;
+}
+/**
+ * Whether we're likely to need SSL to handle the give URL.
+ *
+ * @returns true if we need, false if we probably don't.
+ * @param   pszUrl              The URL.
+ */
+static bool rtHttpNeedSsl(const char *pszUrl)
+{
+    return RTStrNICmp(pszUrl, RT_STR_TUPLE("https:")) == 0;
+}
+/**
+ * Applies recoded settings to the cURL instance before doing work.
+ *
+ * @returns IPRT status code.
+ * @param   pThis           The HTTP/HTTPS client instance.
+ * @param   pszUrl          The URL.
+ */
+static int rtHttpApplySettings(PRTHTTPINTERNAL pThis, const char *pszUrl)
+{
+    /*
+     * The URL.
+     */
+    int rcCurl = curl_easy_setopt(pThis->pCurl, CURLOPT_URL, pszUrl);
+    if (CURL_FAILURE(rcCurl))
+        return VERR_INVALID_PARAMETER;
+    /*
+     * Setup SSL.  Can be a bit of work.
+     */
+    rcCurl = curl_easy_setopt(pThis->pCurl, CURLOPT_SSLVERSION, (long)CURL_SSLVERSION_TLSv1);
+    if (CURL_FAILURE(rcCurl))
+        return VERR_INVALID_PARAMETER;
+    const char *pszCaFile = pThis->pszCaFile;
+    if (   !pszCaFile
+        && rtHttpNeedSsl(pszUrl))
+    {
+        int rc = RTHttpUseTemporaryCaFile(pThis, NULL);
+        if (RT_SUCCESS(rc))
+            pszCaFile = pThis->pszCaFile;
+        else
+            return rc; /* Non-portable alternative: pszCaFile = "/etc/ssl/certs/ca-certificates.crt"; */
+    }
+    if (pszCaFile)
+    {
+        rcCurl = curl_easy_setopt(pThis->pCurl, CURLOPT_CAINFO, pszCaFile);
+        if (CURL_FAILURE(rcCurl))
+            return VERR_INTERNAL_ERROR;
+    }
+    /*
+     * Progress/abort.
+     */
+    rcCurl = curl_easy_setopt(pThis->pCurl, CURLOPT_PROGRESSFUNCTION, &rtHttpProgress);
+    if (CURL_FAILURE(rcCurl))
+        return VERR_INTERNAL_ERROR;
+    rcCurl = curl_easy_setopt(pThis->pCurl, CURLOPT_PROGRESSDATA, (void *)pThis);
+    if (CURL_FAILURE(rcCurl))
+        return VERR_INTERNAL_ERROR;
+    rcCurl = curl_easy_setopt(pThis->pCurl, CURLOPT_NOPROGRESS, (long)0);
+    if (CURL_FAILURE(rcCurl))
+        return VERR_INTERNAL_ERROR;
+    return VINF_SUCCESS;
+}
+/**
+ * cURL callback for writing data.
+ */
+static size_t rtHttpWriteData(void *pvBuf, size_t cbUnit, size_t cUnits, void *pvUser)
+{
+    PRTHTTPINTERNAL pThis = (PRTHTTPINTERNAL)pvUser;
+    /*
+     * Do max size and overflow checks.
+     */
+    size_t const cbToAppend = cbUnit * cUnits;
+    size_t const cbCurSize  = pThis->Output.Mem.cb;
+    size_t const cbNewSize  = cbCurSize + cbToAppend;
+    if (   cbToAppend < RTHTTP_MAX_MEM_DOWNLOAD_SIZE
+        && cbNewSize  < RTHTTP_MAX_MEM_DOWNLOAD_SIZE)
+    {
+        if (cbNewSize + 1 <= pThis->Output.Mem.cbAllocated)
+        {
+            memcpy(&pThis->Output.Mem.pb[cbCurSize], pvBuf, cbToAppend);
+            pThis->Output.Mem.cb = cbNewSize;
+            pThis->Output.Mem.pb[cbNewSize] = '\0';
+            return VINF_SUCCESS;
+        }
+        /*
+         * We need to reallocate the output buffer.
+         */
+        /** @todo this could do with a better strategy wrt growth. */
+        size_t cbAlloc = RT_ALIGN_Z(cbNewSize + 1, 64);
+        if (   cbAlloc <= pThis->cbDownloadHint
+            && pThis->cbDownloadHint < RTHTTP_MAX_MEM_DOWNLOAD_SIZE)
+            cbAlloc = RT_ALIGN_Z(pThis->cbDownloadHint + 1, 64);
+        uint8_t *pbNew = (uint8_t *)RTMemRealloc(pThis->Output.Mem.pb, cbAlloc);
+        if (pbNew)
+        {
+            memcpy(&pbNew[cbCurSize], pvBuf, cbToAppend);
+            pbNew[cbNewSize] = '\0';
+            pThis->Output.Mem.cbAllocated = cbAlloc;
+            pThis->Output.Mem.pb = pbNew;
+            pThis->Output.Mem.cb = cbNewSize;
+            return VINF_SUCCESS;
+        }
+        pThis->rcOutput = VERR_NO_MEMORY;
+    }
+    else
+        pThis->rcOutput      = VERR_TOO_MUCH_DATA;
+    /*
+     * Failure - abort.
+     */
+    RTMemFree(pThis->Output.Mem.pb);
+    pThis->Output.Mem.pb = NULL;
+    pThis->Output.Mem.cb = RTHTTP_MAX_MEM_DOWNLOAD_SIZE;
+    pThis->fAbort        = true;
+    return 0;
+}
+/**
  * Internal worker that performs a HTTP GET.
+ *
  * @returns IPRT status code.
  * @param   hHttp               The HTTP instance.
  * @param   pcszUrl             The URL.
+ * @param   hHttp               The HTTP/HTTPS client instance.
+ * @param   pszUrl              The URL.
  * @param   ppvResponse         Where to return the pointer to the allocated
  *                              response data (RTMemFree).  There will always be
 …
  *                              is not part of the size returned via @a pcb.
  * @param   pcb                 The size of the response data.
+ */
+RTR3DECL(int) rtHttpGet(RTHTTP hHttp, const char *pcszUrl, uint8_t **ppvResponse, size_t *pcb)
+{
+    PRTHTTPINTERNAL pHttpInt = hHttp;
+    RTHTTP_VALID_RETURN(pHttpInt);
+    pHttpInt->fAbort = false;
+    int rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_URL, pcszUrl);
+    if (CURL_FAILED(rcCurl))
+        return VERR_INVALID_PARAMETER;
+#if 0
+    rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_VERBOSE, 1);
+    if (CURL_FAILED(rcCurl))
+        return VERR_INVALID_PARAMETER;
+#endif
+    const char *pcszCAFile = "/etc/ssl/certs/ca-certificates.crt";
+    if (pHttpInt->pcszCAFile)
+        pcszCAFile = pHttpInt->pcszCAFile;
+    if (RTFileExists(pcszCAFile))
+    {
+        rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_CAINFO, pcszCAFile);
+        if (CURL_FAILED(rcCurl))
+            return VERR_INTERNAL_ERROR;
+    }
+    RTHTTPMEMCHUNK Chunk = { NULL, 0 };
+    rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_WRITEFUNCTION, &rtHttpWriteData);
+    if (CURL_FAILED(rcCurl))
+        return VERR_INTERNAL_ERROR;
+    rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_WRITEDATA, (void *)&Chunk);
+    if (CURL_FAILED(rcCurl))
+        return VERR_INTERNAL_ERROR;
+    rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_PROGRESSFUNCTION, &rtHttpProgress);
+    if (CURL_FAILED(rcCurl))
+        return VERR_INTERNAL_ERROR;
+    rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_PROGRESSDATA, (void *)pHttpInt);
+    if (CURL_FAILED(rcCurl))
+        return VERR_INTERNAL_ERROR;
+    rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_NOPROGRESS, (long)0);
+    if (CURL_FAILED(rcCurl))
+        return VERR_INTERNAL_ERROR;
+    rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_SSLVERSION, (long)CURL_SSLVERSION_TLSv1);
+    if (CURL_FAILED(rcCurl))
+        return VERR_INVALID_PARAMETER;
+    rcCurl = curl_easy_perform(pHttpInt->pCurl);
+    int rc = rtHttpGetCalcStatus(pHttpInt, rcCurl);
+ *
+ * @remarks We ASSUME the API user doesn't do concurrent GETs in different
+ *          threads, because that will probably blow up!
+ */
+static int rtHttpGetToMem(RTHTTP hHttp, const char *pszUrl, uint8_t **ppvResponse, size_t *pcb)
+{
+    PRTHTTPINTERNAL pThis = hHttp;
+    RTHTTP_VALID_RETURN(pThis);
+    /*
+     * Reset the return values in case of more "GUI programming" on the client
+     * side (i.e. a programming style not bothering checking return codes).
+     */
+    *ppvResponse = NULL;
+    *pcb         = 0;
+    /*
+     * Set the busy flag (paranoia).
+     */
+    bool fBusy = ASMAtomicXchgBool(&pThis->fBusy, true);
+    AssertReturn(fBusy, VERR_WRONG_ORDER);
+    /*
+     * Reset the state and apply settings.
+     */
+    pThis->fAbort = false;
+    pThis->rcOutput = VINF_SUCCESS;
+    pThis->cbDownloadHint = 0;
+    int rc = rtHttpApplySettings(hHttp, pszUrl);
     if (RT_SUCCESS(rc))
+    {
+        *ppvResponse = Chunk.pu8Mem;
+        *pcb         = Chunk.cb;
+    }
+    else
+    {
+        if (Chunk.pu8Mem)
+            RTMemFree(Chunk.pu8Mem);
+        *ppvResponse = NULL;
+        *pcb         = 0;
+    }
+        RT_ZERO(pThis->Output.Mem);
+        int rcCurl = curl_easy_setopt(pThis->pCurl, CURLOPT_WRITEFUNCTION, &rtHttpWriteData);
+        if (!CURL_FAILURE(rcCurl))
+            rcCurl = curl_easy_setopt(pThis->pCurl, CURLOPT_WRITEDATA, (void *)pThis);
+        if (!CURL_FAILURE(rcCurl))
+        {
+            /*
+             * Perform the HTTP operation.
+             */
+            rcCurl = curl_easy_perform(pThis->pCurl);
+            rc = rtHttpGetCalcStatus(pThis, rcCurl);
+            if (RT_SUCCESS(rc))
+                rc = pThis->rcOutput;
+            if (RT_SUCCESS(rc))
+            {
+                *ppvResponse = pThis->Output.Mem.pb;
+                *pcb         = pThis->Output.Mem.cb;
+            }
+            else if (pThis->Output.Mem.pb)
+                RTMemFree(pThis->Output.Mem.pb);
+            RT_ZERO(pThis->Output.Mem);
+        }
+        else
+            rc = VERR_INTERNAL_ERROR_3;
+    }
+    ASMAtomicWriteBool(&pThis->fBusy, false);
     return rc;
+}
 RTR3DECL(int) RTHttpGetText(RTHTTP hHttp, const char *pcszUrl, char **ppszNotUtf8)
+RTR3DECL(int) RTHttpGetText(RTHTTP hHttp, const char *pszUrl, char **ppszNotUtf8)
+{
     uint8_t *pv;
     size_t   cb;
     int rc = rtHttpGet(hHttp, pcszUrl, &pv, &cb);
+    int rc = rtHttpGetToMem(hHttp, pszUrl, &pv, &cb);
     if (RT_SUCCESS(rc))
+    {
 …
 RTR3DECL(int) RTHttpGetBinary(RTHTTP hHttp, const char *pcszUrl, void **ppvResponse, size_t *pcb)
+{
     return rtHttpGet(hHttp, pcszUrl, (uint8_t **)ppvResponse, pcb);
+RTR3DECL(int) RTHttpGetBinary(RTHTTP hHttp, const char *pszUrl, void **ppvResponse, size_t *pcb)
+{
+    return rtHttpGetToMem(hHttp, pszUrl, (uint8_t **)ppvResponse, pcb);
+}
 …
+static size_t rtHttpWriteDataToFile(void *pvBuf, size_t cb, size_t n, void *pvUser)
+{
+    size_t cbAll = cb * n;
+    RTFILE hFile = (RTFILE)(intptr_t)pvUser;
+/**
+ * cURL callback for writing data to a file.
+ */
+static size_t rtHttpWriteDataToFile(void *pvBuf, size_t cbUnit, size_t cUnits, void *pvUser)
+{
+    PRTHTTPINTERNAL pThis = (PRTHTTPINTERNAL)pvUser;
     size_t cbWritten = 0;
     int rc = RTFileWrite(hFile, pvBuf, cbAll, &cbWritten);
+    int rc = RTFileWrite(pThis->Output.hFile, pvBuf, cbUnit * cUnits, &cbWritten);
     if (RT_SUCCESS(rc))
         return cbWritten;
+    pThis->rcOutput = rc;
     return 0;
+}
 …
 RTR3DECL(int) RTHttpGetFile(RTHTTP hHttp, const char *pszUrl, const char *pszDstFile)
+{
+    PRTHTTPINTERNAL pHttpInt = hHttp;
+    RTHTTP_VALID_RETURN(pHttpInt);
+    /*
+     * Set up the request.
+     */
+    pHttpInt->fAbort = false;
+    int rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_URL, pszUrl);
+    if (CURL_FAILED(rcCurl))
+        return VERR_INVALID_PARAMETER;
+#if 0
+    rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_VERBOSE, 1);
+    if (CURL_FAILED(rcCurl))
+        return VERR_INVALID_PARAMETER;
+#endif
+    const char *pcszCAFile = "/etc/ssl/certs/ca-certificates.crt";
+    if (pHttpInt->pcszCAFile)
+        pcszCAFile = pHttpInt->pcszCAFile;
+    if (RTFileExists(pcszCAFile))
+    {
+        rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_CAINFO, pcszCAFile);
+        if (CURL_FAILED(rcCurl))
+            return VERR_INTERNAL_ERROR;
+    }
+    rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_WRITEFUNCTION, &rtHttpWriteDataToFile);
+    if (CURL_FAILED(rcCurl))
+        return VERR_INTERNAL_ERROR;
+    rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_PROGRESSFUNCTION, &rtHttpProgress);
+    if (CURL_FAILED(rcCurl))
+        return VERR_INTERNAL_ERROR;
+    rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_PROGRESSDATA, (void *)pHttpInt);
+    if (CURL_FAILED(rcCurl))
+        return VERR_INTERNAL_ERROR;
+    rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_NOPROGRESS, (long)0);
+    if (CURL_FAILED(rcCurl))
+        return VERR_INTERNAL_ERROR;
+    /*
+     * Open the output file.
+     */
+    RTFILE hFile;
+    int rc = RTFileOpen(&hFile, pszDstFile, RTFILE_O_WRITE | RTFILE_O_CREATE_REPLACE | RTFILE_O_DENY_READWRITE);
+    PRTHTTPINTERNAL pThis = hHttp;
+    RTHTTP_VALID_RETURN(pThis);
+    /*
+     * Set the busy flag (paranoia).
+     */
+    bool fBusy = ASMAtomicXchgBool(&pThis->fBusy, true);
+    AssertReturn(fBusy, VERR_WRONG_ORDER);
+    /*
+     * Reset the state and apply settings.
+     */
+    pThis->fAbort = false;
+    pThis->rcOutput = VINF_SUCCESS;
+    pThis->cbDownloadHint = 0;
+    int rc = rtHttpApplySettings(hHttp, pszUrl);
     if (RT_SUCCESS(rc))
+    {
+        rcCurl = curl_easy_setopt(pHttpInt->pCurl, CURLOPT_WRITEDATA, (void *)(uintptr_t)hFile);
+        if (!CURL_FAILED(rcCurl))
+        pThis->Output.hFile = NIL_RTFILE;
+        int rcCurl = curl_easy_setopt(pThis->pCurl, CURLOPT_WRITEFUNCTION, &rtHttpWriteDataToFile);
+        if (!CURL_FAILURE(rcCurl))
+            rcCurl = curl_easy_setopt(pThis->pCurl, CURLOPT_WRITEDATA, (void *)pThis);
+        if (!CURL_FAILURE(rcCurl))
+        {
             /*
              * Perform the request.
+             * Open the output file.
              */
+            rcCurl = curl_easy_perform(pHttpInt->pCurl);
+            rc = rtHttpGetCalcStatus(pHttpInt, rcCurl);
+            rc = RTFileOpen(&pThis->Output.hFile, pszDstFile, RTFILE_O_CREATE_REPLACE | RTFILE_O_WRITE | RTFILE_O_DENY_READWRITE);
+            if (RT_SUCCESS(rc))
+            {
+                /*
+                 * Perform the HTTP operation.
+                 */
+                rcCurl = curl_easy_perform(pThis->pCurl);
+                rc = rtHttpGetCalcStatus(pThis, rcCurl);
+                if (RT_SUCCESS(rc))
+                     rc = pThis->rcOutput;
+                int rc2 = RTFileClose(pThis->Output.hFile);
+                if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
+                    rc = rc2;
+            }
+            pThis->Output.hFile = NIL_RTFILE;
+        }
         else
+            rc = VERR_INTERNAL_ERROR;
+        int rc2 = RTFileClose(hFile);
+        if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
+            rc = rc2;
+    }
+            rc = VERR_INTERNAL_ERROR_3;
+    }
+    ASMAtomicWriteBool(&pThis->fBusy, false);
     return rc;
+}

trunk/src/VBox/Runtime/common/path/RTPathEnsureTrailingSeparator.cpp

-              r57572
+              r57613
         if (RTPATH_IS_SLASH(ch) || RTPATH_IS_VOLSEP(ch))
             return off;
+        if (off + 2 <= cbPath)
+        {
+            pszPath[off++] = RTPATH_SLASH;
+            pszPath[off]   = '\0';
+            return off;
+        }
+    }
+    if (off + 2 < cbPath)
+    else if (off + 3 <= cbPath)
+    {
         pszPath[off++] = '.';

trunk/src/VBox/Runtime/generic/RTCrStoreCreateSnapshotById-generic.cpp

r57572	r57613
146	146	}
147	147	else
148		RTErrInfo~~Set(pErrInfo, rc, "~~RTCrStoreCreateInMem failed");
	148	RTErrInfoAdd(pErrInfo, rc, " RTCrStoreCreateInMem failed");
149	149	return rc;
150	150	}

trunk/src/VBox/Runtime/generic/createtemp-generic.cpp

-              r57358
+              r57613
+}
 RT_EXPORT_SYMBOL(RTFileCreateTempSecure);
+RTDECL(int) RTFileOpenTemp(PRTFILE phFile, char *pszFilename, size_t cbFilename, uint64_t fOpen)
+{
+    AssertReturn((fOpen & RTFILE_O_ACTION_MASK) == RTFILE_O_CREATE, VERR_INVALID_FLAGS);
+    AssertReturn(fOpen & RTFILE_O_WRITE, VERR_INVALID_FLAGS);
+    /*
+     * Start by obtaining the path to the temporary directory.
+     */
+    int rc = RTPathTemp(pszFilename, cbFilename);
+    if (RT_SUCCESS(rc))
+    {
+        /*
+         * Add a filename pattern.
+         */
+        static char const s_szTemplate[] = "IPRT-XXXXXXXXXXXX.tmp";
+        rc = RTPathAppend(pszFilename, cbFilename, s_szTemplate);
+        if (RT_SUCCESS(rc))
+        {
+            char * const pszX = RTStrEnd(pszFilename, cbFilename) - (sizeof(s_szTemplate) - 1) + 5;
+            unsigned     cXes = sizeof(s_szTemplate) - 1 - 4 - 5;
+            Assert(pszX[0] == 'X'); Assert(pszX[-1] == '-'); Assert(pszX[cXes] == '.');
+            /*
+             * Try 10000 times with random names.
+             */
+            unsigned cTriesLeft = 10000;
+            while (cTriesLeft-- > 0)
+            {
+                rtCreateTempFillTemplate(pszX, cXes);
+                rc = RTFileOpen(phFile, pszFilename, fOpen);
+                if (RT_SUCCESS(rc))
+                    return rc;
+            }
+        }
+    }
+    if (cbFilename)
+        *pszFilename = '\0';
+    *phFile = NIL_RTFILE;
+    return rc;
+}
+RT_EXPORT_SYMBOL(RTFileOpenTemp);

trunk/src/VBox/Runtime/generic/fs-stubs-generic.cpp

-              r57358
+              r57613
+{
     pProperties->cbMaxComponent = 255;
+#if defined(RT_OS_OS2) || defined(RT_OS_WINDOWS) || defined(RT_OS_DARWIN)
+    pProperties->fCaseSensitive = false;
+#else
     pProperties->fCaseSensitive = true;
+#endif
     pProperties->fCompressed = false;
     pProperties->fFileCompression = false;
 …
+}
+RTR3DECL(bool) RTFsIsCaseSensitive(const char *pszFsPath)
+{
+#if defined(RT_OS_OS2) || defined(RT_OS_WINDOWS) || defined(RT_OS_DARWIN)
+    return false;
+#else
+    return true;
+#endif
+}

trunk/src/VBox/Runtime/r3/nt/fs-nt.cpp

-              r57358
+              r57613
+RTR3DECL(bool) RTFsIsCaseSensitive(const char *pszFsPath)
+{
+    return false;
+}
 RTR3DECL(int) RTFsQueryType(const char *pszFsPath, PRTFSTYPE penmType)

trunk/src/VBox/Runtime/r3/posix/fs-posix.cpp

-              r57358
+              r57613
              */
             pProperties->cbMaxComponent = StatVFS.f_namemax;
+#if defined(RT_OS_OS2) || defined(RT_OS_WINDOWS)
+            pProperties->fCaseSensitive = false;
+#else
             pProperties->fCaseSensitive = true;
+#endif
             pProperties->fCompressed = false;
             pProperties->fFileCompression = false;
 …
              pszFsPath, pszFsPath, pProperties, pProperties->cbMaxComponent, pProperties->fReadOnly, rc));
     return rc;
+}
+RTR3DECL(bool) RTFsIsCaseSensitive(const char *pszFsPath)
+{
+#if defined(RT_OS_OS2) || defined(RT_OS_WINDOWS)
+    return false;
+#else
+    return true;
+#endif
+}

trunk/src/VBox/Runtime/r3/win/fs-win.cpp

-              r57358
+              r57613
     RTUtf16Free(pwszFsRoot);
     return rc;
+}
+RTR3DECL(bool) RTFsIsCaseSensitive(const char *pszFsPath)
+{
+    return false;
+}

trunk/src/VBox/Runtime/testcase/Makefile.kmk

-              r57604
+              r57613
         tstOnce \
         tstRTPath \
+        tstRTPathGlob \
         tstRTPipe \
         tstRTPoll \
 …
 tstRTPath_SOURCES = tstRTPath.cpp
+tstRTPathGlob_TEMPLATE = VBOXR3TSTEXE
+tstRTPathGlob_SOURCES = tstRTPathGlob.cpp
 tstRTPipe_TEMPLATE = VBOXR3TSTEXE
 tstRTPipe_SOURCES = tstRTPipe.cpp

Changeset 57613 in vbox

Legend:

trunk/include/iprt/crypto/store.h

trunk/include/iprt/dir.h

trunk/include/iprt/err.h

trunk/include/iprt/file.h

trunk/include/iprt/fs.h

trunk/include/iprt/http.h

trunk/include/iprt/mangling.h

trunk/include/iprt/path.h

trunk/src/VBox/Frontends/VirtualBox/src/net/UINetworkReply.cpp

trunk/src/VBox/Runtime/Makefile.kmk

trunk/src/VBox/Runtime/common/crypto/store-cert-add-basic.cpp

trunk/src/VBox/Runtime/common/crypto/store.cpp

trunk/src/VBox/Runtime/common/crypto/x509-internal.h

trunk/src/VBox/Runtime/common/misc/http.cpp

trunk/src/VBox/Runtime/common/path/RTPathEnsureTrailingSeparator.cpp

trunk/src/VBox/Runtime/generic/RTCrStoreCreateSnapshotById-generic.cpp

trunk/src/VBox/Runtime/generic/createtemp-generic.cpp

trunk/src/VBox/Runtime/generic/fs-stubs-generic.cpp

trunk/src/VBox/Runtime/r3/nt/fs-nt.cpp

trunk/src/VBox/Runtime/r3/posix/fs-posix.cpp

trunk/src/VBox/Runtime/r3/win/fs-win.cpp

trunk/src/VBox/Runtime/testcase/Makefile.kmk

Download in other formats: