Fix heap overflow in HTTP protocol handling (CVE-2017-13090)

* src/retr.c (fd_read_body): Stop processing on negative chunk size

Reported-by: Antti Levomäki, Christian Jalio, Joonas Pihlaja from Forcepoint
Reported-by: Juhani Eronen from Finnish National Cyber Security Centre

.gitlab-ci.yml

@@ -0,0 +1,124 @@
+variables:
+  BUILD_IMAGES_PROJECT: gnuwget/build-images
+  DEBIAN_BUILD: buildenv-debian-stretch
+  FEDORA_BUILD: buildenv-f25
+  CENTOS7_BUILD: buildenv-centos7
+  GET_SOURCES_ATTEMPTS: "3"
+
+# In this build we combine
+#  * syntax-check
+#  * abi-check
+#  * build/valgrind-check
+#  * build/asan-check
+#  * build w/Werror and ubsan-check
+Debian GNU/Linux build:
+  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_BUILD
+  script:
+  - echo "127.0.0.1 wgettestingserver" >>/etc/hosts
+  - cat /etc/hosts
+  - touch .manywarnings
+  - alias make="make -j$(nproc)"
+  - ./bootstrap
+  - ./configure -C
+  - make syntax-check
+  - make check
+#  - make abi-check
+  - make distcheck
+  - make check-valgrind
+  - ./configure -C --with-ssl=openssl
+  - make clean
+  - make check
+#  - ./configure -C --enable-fsanitize-asan
+#  - make clean
+#  - make check
+#  - ./configure -C --enable-fsanitize-ubsan
+#  - make clean
+#  - make check
+#  - ./configure -C --enable-fsanitize-msan
+#  - make clean
+#  - make check
+  tags:
+  - shared
+  artifacts:
+    expire_in: 2 weeks
+    when: on_failure
+    paths:
+      - tests/*.log
+#      - compat_reports/
+
+#Centos7 build:
+#  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$CENTOS7_BUILD
+#  script:
+#  - sed -i 's/AM_GNU_GETTEXT_VERSION(0.19.3)/AM_GNU_GETTEXT_VERSION(0.18.2)/g' configure.ac
+#  - ./bootstrap && ./configure --enable-gcc-warnings --disable-doc && make -j$(nproc) check
+#  tags:
+#  - shared
+#  artifacts:
+#    expire_in: 2 weeks
+#    when: on_failure
+#    paths:
+#      - tests/*.log
+#      - compat_reports/
+
+#clang-analyzer/Fedora:
+#  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
+#  script:
+#  - ./bootstrap
+#  - scan-build ./configure --disable-doc --enable-gcc-warnings
+#  - make -j$(nproc) -C gl
+#  - scan-build --status-bugs -o scan-build-lib make -j$(nproc) -C lib
+#  tags:
+#  - shared
+#  except:
+#  - tags
+#  artifacts:
+#    expire_in: 2 weeks
+#    when: on_failure
+#    paths:
+#      - scan-build-lib/*
+
+#pages:
+#  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$DEBIAN_BUILD
+#  script:
+#  - ./bootstrap
+#  - CFLAGS="-g -O0" ./configure --enable-gtk-doc --enable-code-coverage --disable-gcc-warnings
+#  - make -j$(nproc) check
+#  - make local-code-coverage-output
+#  - mkdir -p public
+#  - rm -rf public/coverage
+#  - mv libidn2-*-coverage public/coverage
+#  - rm -rf public/reference
+#  - mv doc/reference/html public/reference
+#  - make -C doc manual
+#  - rm -rf public/manual
+#  - mv doc/manual public/manual
+#  tags:
+#  - shared
+#  artifacts:
+#    when: on_success
+#    paths:
+#      - public
+#  only:
+#    - master
+
+#MinGW64:
+#  image: $CI_REGISTRY/$BUILD_IMAGES_PROJECT:$FEDORA_BUILD
+#  before_script:
+#  - mount -t binfmt_misc binfmt_misc /proc/sys/fs/binfmt_misc &&
+#    echo ':DOSWin:M::MZ::/usr/bin/wine64:' > /proc/sys/fs/binfmt_misc/register
+#  script:
+#  - ./bootstrap
+#  - mingw64-configure --disable-valgrind-tests --disable-doc
+#  - mingw64-make -j$(nproc)
+#  - mingw64-make -j$(nproc) check
+#  tags:
+#  - shared
+#  - docker
+#  except:
+#  - tags
+#  artifacts:
+#    expire_in: 2 weeks
+#    when: on_failure
+#    paths:
+#      - ./*.log
+#      - tests/*.log

.travis.yml

@@ -1,4 +1,5 @@
 sudo: no
+dist: trusty
 
 language: c
 

NEWS

@@ -5,6 +5,36 @@ See the end for copying conditions.
 
 Please send GNU Wget bug reports to <bug-wget@gnu.org>.
 
+* Changes in Wget 1.19.2
+
+* Fix CVE-2017-13089 (Stack overflow in HTTP protocol handling)
+
+* Fix CVE-2017-13090 (Heap overflow in HTTP protocol handling)
+
+* New option --compression for gzip Content-Encoding
+
+* New option --[no]-netrc to control .netrc parsing
+
+* Added GNU extensions to .netrc parsing
+
+* Improved IDNA 2003 compatibility
+
+* Fix VPATH issues
+
+* Improved and extended the test suite
+
+* Support Wayback Machine's X-Archive-Orig-last-modified
+
+* Several bug fixes
+
+
+* Changes in Wget 1.19.1
+
+* Fix bugs, a regression, portability/build issues
+
+* Add new option --retry-on-http-error
+
+
 * Changes in Wget 1.19
 
 * New option --use-askpass=COMMAND. Fetch user/password by calling
@@ -691,7 +721,7 @@ addresses when accessing the first one fails.
 non-standard port.
 
 ** Wget now supports the robots.txt directives specified in
-<http://www.robotstxt.org/wc/norobots-rfc.txt>.
+<http://www.robotstxt.org/norobots-rfc.txt>.
 
 ** URL parser has been fixed, especially the infamous overzealous
 quoting.  Wget no longer dequotes reserved characters, e.g. `%3F' is

README.checkout

@@ -104,6 +104,10 @@ Compiling From Repository Sources
        The command line options --dns-servers and --bind-dns-address are
        only available when configured with --with-cares.
 
+     * [49]Gpef is required by some gnulib modules, most notably "unicase". You
+	   need the application installed on the machine to compile Wget from git.
+
+
    For those who might be confused as to what to do once they check out
    the source code, considering configure and Makefile do not yet exist at
    that point, a shell script called bootstrap has been provided. After
@@ -116,7 +120,7 @@ Compiling From Repository Sources
  $  cd wget        # assumes you've cloned a repository to "./wget"
     2. Generate all the automatically-generated files required prior to
        configuring the package:
- $  ./bootstrap
+ $  ./bootstrap (or: bash ./bootstrap)
     3. Configure the package and compile it:
  $  ./configure --enable-assert [some_parameters]
  $  make
@@ -212,3 +216,4 @@ References
   46. https://launchpad.net/libmetalink
   47. https://www.gnupg.org
   48. https://c-ares.haxx.se/
+  49. https://www.gnu.org/software/gperf/

bootstrap.conf

@@ -53,6 +53,7 @@ gettext
 gitlog-to-changelog
 git-version-gen
 gnupload
+group-member
 hostent
 ioctl
 iconv
@@ -111,11 +112,12 @@ unlink
 unlocked-io
 update-copyright
 libunistring-optional
-unistr/base
-unicase/tolower
+unistr/u8-strlen
+unicase/u8-tolower
 utimens
 vasprintf
 vsnprintf
+wcwidth
 write
 xmemdup0
 xstrndup
@@ -145,4 +147,21 @@ rsync      -
 tar        -
 xz         -
 flex       -
+gperf      -
 "
+
+bootstrap_post_import_hook ()
+{
+  # We need to patch unicase/special-casing-table.h for gperf < 3.1
+  GPERF_VER=$(gperf --version | {
+    IFS=' .' read x y major minor bugfix _
+    printf "%d%02d%02d" $major $minor $bugfix
+  })
+
+  if [ $GPERF_VER -lt 30100 ]; then
+    echo "Creating lib/unicase/special-casing-table.h for gperf < 3.1"
+     gperf -m 10 lib/unicase/special-casing-table.gperf | \
+       sed -e "s/gl_unicase_special_lookup.*/gl_unicase_special_lookup\ \(const char \*str, size_t len\)/g" \
+         > lib/unicase/special-casing-table.h
+  fi
+}

cfg.mk

@@ -1,4 +1,7 @@
-export VC_LIST_EXCEPT_DEFAULT=^(lib/.*|m4/.*|md5/.*|build-aux/.*|src/gettext\.h|.*ChangeLog)$$
+# Explicit syntax-check exceptions.
+exclude_file_name_regexp--sc_trailing_blank = ^doc/annou.*$$
+
+export VC_LIST_EXCEPT_DEFAULT=^(lib/.*|m4/.*|md5/.*|build-aux/.*|src/gettext\.h|.*ChangeLog|tests/certs/.*)$$
 
 local-checks-to-skip = \
     sc_const_long_option \
@@ -21,9 +24,10 @@ local-checks-to-skip = \
     sc_program_name \
     sc_makefile_at_at_check \
     sc_cast_of_argument_to_free \
+    sc_prohibit_undesirable_word_seq
 
 #SHELL=bash -x
 show-vc-list-except:
 	@$(VC_LIST_EXCEPT)
 
-VC_LIST_ALWAYS_EXCLUDE_REGEX = ^ABOUT-NLS|((msdos|vms)/.*)|ChangeLog-2014-12-10|/.*.der$$
+VC_LIST_ALWAYS_EXCLUDE_REGEX = ^ABOUT-NLS|((msdos|vms)/.*)|ChangeLog-2014-12-10|/.*.der|^tests/certs/.*$$

configure.ac

@@ -641,10 +641,6 @@ AS_IF([test "X$iri" != "Xno"],[
       AC_MSG_NOTICE([disabling IRIs because libiconv wasn't found])
     fi
   fi
-],[  # else
-  # For some reason, this seems to be set even when we don't check.
-  # Explicitly unset.
-  LIBICONV=
 ])
 
 AC_ARG_WITH(libidn, AC_HELP_STRING([--with-libidn=[DIR]],
@@ -663,11 +659,6 @@ if test "X$iri" != "Xno"; then
 #    ])
   ])
 fi
-if test "X$iri" = "Xno"; then
-  # we don't need libunistring - clear settings from gnulib module
-  LIBUNISTRING=""
-  LTLIBUNISTRING=""
-fi
 
 dnl
 dnl Check for UUID
@@ -793,7 +784,8 @@ dnl Create output
 dnl
 AC_CONFIG_FILES([Makefile src/Makefile doc/Makefile util/Makefile
                  po/Makefile.in tests/Makefile
-                 lib/Makefile testenv/Makefile])
+                 lib/Makefile testenv/Makefile
+                 tests/certs/interca.conf tests/certs/rootca.conf])
 AC_CONFIG_HEADERS([src/config.h])
 AC_OUTPUT
 

contrib/check-hard

@@ -12,7 +12,8 @@ if [ $CORES -lt 1 ]; then CORES=1; fi
 echo "Running: make distclean"
 make distclean > /dev/null || true
 
-CFLAGS="-std=c89 -pedantic -O0 -g -Wall -Wextra -Wstrict-prototypes -Wold-style-definition -Wwrite-strings -Wshadow -Wformat -Wformat-security -Wunreachable-code -Wstrict-prototypes -Wmissing-prototypes -Wold-style-definition"
+#CFLAGS="-std=c89 -pedantic -O0 -g -Wall -Wextra -Wstrict-prototypes -Wold-style-definition -Wwrite-strings -Wshadow -Wformat -Wformat-security -Wunreachable-code -Wstrict-prototypes -Wmissing-prototypes -Wold-style-definition"
+CFLAGS="-Wall -Wextra -O2 -g"
 
 CACHEFILE=$PWD/config_check.cache
 
@@ -30,7 +31,7 @@ for CC in gcc clang; do
   # the compiler changed, so we have to remove the cache file here
   rm -f $CACHEFILE
 
-  for options in "" "--with-ssl=openssl"; do
+  for options in "" "--with-ssl=openssl" "--disable-iri"; do
     export DISTCHECK_CONFIGURE_FLAGS="-C --cache-file=$CACHEFILE $options"
     echo "  ./configure $DISTCHECK_CONFIGURE_FLAGS"
     ./configure $DISTCHECK_CONFIGURE_FLAGS CFLAGS="$CFLAGS" > /dev/null

contrib/release

@@ -0,0 +1,112 @@
+#!/bin/bash -e
+#
+# Written 2016 by Tim Ruehsen
+
+extensions="gz xz"
+app_name=$(grep "^PACKAGE_NAME='" configure|cut -d "'" -f2)
+app_ver=$(grep "^PACKAGE_VERSION='" configure|cut -d "'" -f2)
+
+echo "Current version of $app_name is $app_ver"
+echo
+echo -n "Enter Y if that is OK, else enter N and edit configure.ac: "
+read x
+[ "$x" != "y" -a "$x" != "Y" ] && exit 0
+
+echo
+grep -i "Changes in $app_name" NEWS|head -1
+echo -n "Did you edit the NEWS file ? [y/N] "
+read x
+[ "$x" != "y" -a "$x" != "Y" ] && exit 0
+
+echo
+
+export CFLAGS="-g -O2 -Wall"
+
+echo "* Bootstrap"
+./bootstrap >/dev/null
+
+echo "* Configure"
+./configure -q
+
+echo "* Make"
+make -s clean
+make -s
+
+echo "* Make distcheck"
+make -s distcheck >/dev/null
+
+echo "* Make dist"
+make -s dist >/dev/null
+make -s dist-xz >/dev/null
+
+while true; do
+  echo "Alpha or Regular release ? [r/A] "
+  read x
+  if test "$x" = "r" || test "$x" = "R"; then
+    directory="/incoming/ftp"
+    break
+  elif test "$x" = "a" || test "$x" = "A"; then
+    directory="/incoming/alpha"
+    break
+  fi
+done
+
+x=$(gpg --list-secret-keys 2>/dev/null|grep ^sec|awk '{ print $2 }')
+echo $x
+if [ "$x" = "" ]; then
+  echo No signing key found - please check with 'gpg --list-secret-keys'
+  exit 1
+fi
+
+# arrays just work in Bash
+keys=($x)
+if [ ${#keys[@]} -eq 1 ]; then
+  IFS='/' arr=($x)
+  signing_key=${arr[1]}
+else
+  for ((i=0; i < ${#keys[@]}; i++)); do
+    echo "$((i+1))) ${keys[i]}"
+  done
+  while true; do
+    echo -n "Enter 1-${#keys[@]}: "
+    read x
+
+    # check for digits only
+    if [ -n "${i//[0-9]/}" ]; then continue; fi
+
+    if test $x -ge 1 || test $x -le ${#keys[@]}; then
+      IFS='/' arr=(${keys[$((x-1))]})
+      signing_key=${arr[1]}
+      break
+    fi
+  done
+fi
+unset IFS
+echo $signing_key
+
+# fetch app_version again, just in case
+app_ver=$(grep "^PACKAGE_VERSION='" configure|cut -d "'" -f2)
+
+for ext in $extensions; do
+  app_tarball="${app_name}-${app_ver}.tar.$ext"
+  gpg --default-key $signing_key --yes -b $app_tarball
+
+  echo -e "version: 1.2\nfilename: ${app_tarball}\ndirectory: ${app_name}\n" >${app_tarball}.directive
+  gpg --default-key $signing_key --yes --clearsign ${app_tarball}.directive
+
+ftp -v -n -i -p ftp-upload.gnu.org <<EOF
+user anonymous
+cd $directory
+put ${app_tarball}
+put ${app_tarball}.sig
+put ${app_tarball}.directive.asc
+EOF
+
+done
+
+prev_tag=`git tag|tail -2|head -1`
+echo "Don't forget to mention the following contributors in the announcement:"
+(
+  git log ${prev_tag}.. --format="%aN" --reverse
+  git log ${prev_tag}.. --reverse|grep -i reported|cut -d':' -f2|cut -d'<' -f1|cut -d' ' -f2-|tr -d '"'
+) | sort -u

doc/announcement_1.19.txt

@@ -0,0 +1,104 @@
+Hello,
+
+we are pleased to announce the new version of GNU wget 1.19.
+
+It comes with major improvements for Metalink, IDNA2008 for
+international domain names, an option to call external tools
+for fetching user/password, several bugfixes and improvements.
+
+Many thanks go to all the contributors and list activists !
+
+Contributors (from the git log):
+Ander Juaristi
+Dale R. Worley 
+Eli Zaretskii 
+Gisle Vanem 
+Giuseppe Scrivano
+Göran Uddeborg 
+Jann Horn 
+Jeffery To
+Jérémie Courrèges-Anglas 
+Liam R. Howlett
+losgrandes
+Matthew White
+Misra, Deapesh 
+Nikos Mavrogiannopoulos
+Noël Köthe
+Piotr Wajda
+Rahul Bedarkar
+Sean Burford
+Tim Rühsen
+Tobias Stoeckmann
+vijeth-aradhya
+
+
+The new version is available for download here:
+
+https://ftp.gnu.org/gnu/wget/wget-1.19.tar.gz
+https://ftp.gnu.org/gnu/wget/wget-1.19.tar.xz
+
+and the GPG detached signatures using the key 0x08302DB6A2670428:
+
+https://ftp.gnu.org/gnu/wget/wget-1.19.tar.gz.sig
+https://ftp.gnu.org/gnu/wget/wget-1.19.tar.xz.sig
+
+To reduce load on the main server, you can use this redirector service
+which automatically redirects you to a mirror:
+
+http://ftpmirror.gnu.org/wget/wget-1.19.tar.gz
+http://ftpmirror.gnu.org/wget/wget-1.19.tar.xz
+
+
+Noteworthy changes:
+
+* New option --use-askpass=COMMAND. Fetch user/password by calling
+  an external program.
+
+* Use IDNA2008 (+ TR46 if available) through libidn2
+
+* When processing a Metalink header, --metalink-index=<number> allows
+  to process the header's application/metalink4+xml files.
+
+* When processing a Metalink file, --trust-server-names enables the
+  use of the destination file names specified in the Metalink file,
+  otherwise a safe destination file name is computed.
+
+* When processing a Metalink file, enforce a safe destination path.
+  Remove any drive letter prefix under w32, i.e. 'C:D:file'.  Call
+  libmetalink's metalink_check_safe_path() to prevent absolute,
+  relative, or home paths:
+  https://tools.ietf.org/html/rfc5854#section-4.1.2.1
+  https://tools.ietf.org/html/rfc5854#section-4.2.8.3
+
+* When processing a Metalink file, --directory-prefix=<prefix> sets
+  the top of the retrieval tree to prefix for Metalink downloads.
+
+* When processing a Metalink file, reject downloaded files which don't
+  agree with their own metalink:size value:
+  https://tools.ietf.org/html/rfc5854#section-4.2.16
+
+* When processing a Metalink file, with --continue resume partially
+  downloaded files and keep fully downloaded files even if they fail
+  the verification.
+
+* When processing a Metalink file, create the parent directories of a
+  "path/file" destination file name:
+  https://tools.ietf.org/html/rfc5854#section-4.1.2.1
+  https://tools.ietf.org/html/rfc5854#section-4.2.8.3
+
+* On a recursive download, append a .tmp suffix to temporary files
+  that will be deleted after being parsed, and create them
+  readable/writable only by the owner.
+
+* New make target 'check-valgrind'
+
+* Fix several bugs
+
+* Fix compatibility issues
+
+
+Please report any problem you may experience to the bug-wget@gnu.org
+mailing list.
+
+For the maintainers of Wget,
+Tim

doc/wget.texi

@@ -193,6 +193,8 @@ options, or via the initialization file @file{.wgetrc} (@pxref{Startup
 File}).  Wget allows you to define @dfn{global} startup files
 (@file{/usr/local/etc/wgetrc} by default) for site settings. You can also
 specify the location of a startup file with the --config option.
+To disable the reading of config files, use --no-config.
+If both --config and --no-config are given, --no-config is ignored.
  
 
 @ignore
@@ -566,7 +568,10 @@ would be resolved to @samp{http://foo/baz/b.html}.
 
 @cindex specify config 
 @item --config=@var{FILE}
-Specify the location of a startup file you wish to use.
+Specify the location of a startup file you wish to use instead of the
+default one(s). Use --no-config to disable reading of config files.
+If both --config and --no-config are given, --no-config is ignored.
+
 
 @item --rejected-log=@var{logfile}
 Logs all URL rejections to @var{logfile} as comma separated values.  The values
@@ -703,6 +708,12 @@ Before (over)writing a file, back up an existing file by adding a
 files are rotated to @samp{.2}, @samp{.3}, and so on, up to
 @var{backups} (and lost beyond that).
 
+@cindex authentication credentials
+@item --no-netrc
+Do not try to obtain credentials from @file{.netrc} file. By default
+@file{.netrc} file is searched for credentials in case none have been
+passed on command line and authentication is required.
+
 @cindex continue retrieval
 @cindex incomplete downloads
 @cindex resume download
@@ -1335,6 +1346,11 @@ renamed from @samp{--html-extension}, to better reflect its new
 behavior. The old option name is still acceptable, but should now be
 considered deprecated.
 
+As of version 1.19.2, Wget will also ensure that any downloaded files with
+a @code{Content-Encoding} of @samp{br}, @samp{compress}, @samp{deflate}
+or @samp{gzip} end in the suffix @samp{.br}, @samp{.Z}, @samp{.zlib}
+and @samp{.gz} respectively.
+
 At some point in the future, this option may well be expanded to
 include suffixes for other types of content, including content types
 that are not parsed by Wget.
@@ -1519,6 +1535,20 @@ wget --header="Host: foo.bar" http://localhost/
 In versions of Wget prior to 1.10 such use of @samp{--header} caused
 sending of duplicate headers.
 
+@cindex Content-Encoding, choose
+@item --compression=@var{type}
+Choose the type of compression to be used.  Legal values are
+@samp{auto}, @samp{gzip} and @samp{none}.
+
+If @samp{auto} or @samp{gzip} are specified, Wget asks the server to
+compress the file using the gzip compression format. If the server
+compresses the file and responds with the @code{Content-Encoding}
+header field set appropriately, the file will be decompressed
+automatically. This is the default.
+
+If @samp{none} is specified, wget will not ask the server to compress
+the file and will not decompress any server responses.
+
 @cindex redirect
 @item --max-redirect=@var{number}
 Specifies the maximum number of redirections to follow for a resource.
@@ -1718,6 +1748,21 @@ some few obscure servers, which never send HTTP authentication
 challenges, but accept unsolicited auth info, say, in addition to
 form-based authentication.
 
+@item --retry-on-http-error=@var{code[,code,...]}
+Consider given HTTP response codes as non-fatal, transient errors.
+Supply a comma-separated list of 3-digit HTTP response codes as
+argument. Useful to work around special circumstances where retries
+are required, but the server responds with an error code normally not
+retried by Wget. Such errors might be 503 (Service Unavailable) and
+429 (Too Many Requests). Retries enabled by this option are performed
+subject to the normal retry timing and retry count limitations of
+Wget.
+
+Using this option is intended to support special use cases only and is
+generally not recommended, as it can force retries even in cases where
+the server is actually trying to decrease its load. Please use wisely
+and only if you know what you are doing.
+
 @end table
 
 @node HTTPS (SSL/TLS) Options, FTP Options, HTTP Options, Invoking
@@ -3337,10 +3382,16 @@ Turn globbing on/off---the same as @samp{--glob} and @samp{--no-glob}.
 Define a header for HTTP downloads, like using
 @samp{--header=@var{string}}.
 
+@item compression = @var{string}
+Choose the compression type to be used.  Legal values are @samp{auto}
+(the default), @samp{gzip}, and @samp{none}.  The same as
+@samp{--compression=@var{string}}.
+
 @item adjust_extension = on/off
 Add a @samp{.html} extension to @samp{text/html} or
-@samp{application/xhtml+xml} files that lack one, or a @samp{.css}
-extension to @samp{text/css} files that lack one, like
+@samp{application/xhtml+xml} files that lack one, a @samp{.css}
+extension to @samp{text/css} files that lack one, and a @samp{.br},
+@samp{.Z}, @samp{.zlib} or @samp{.gz} to compressed files like
 @samp{-E}. Previously named @samp{html_extension} (still acceptable,
 but deprecated).
 
@@ -4251,7 +4302,7 @@ server.
 
 Until version 1.8, Wget supported the first version of the standard,
 written by Martijn Koster in 1994 and available at
-@url{http://www.robotstxt.org/robotstxt.html}.  As of version 1.8,
+@url{http://www.robotstxt.org/orig.html}.  As of version 1.8,
 Wget has supported the additional directives specified in the internet
 draft @samp{<draft-koster-robots-00.txt>} titled ``A Method for Web
 Robots Control''.  The draft, which has as far as I know never made to
@@ -4270,7 +4321,7 @@ this:
 @end example
 
 This is explained in some detail at
-@url{http://www.robotstxt.org/wc/meta-user.html}.  Wget supports this
+@url{http://www.robotstxt.org/meta.html}.  Wget supports this
 method of robot exclusion in addition to the usual @file{/robots.txt}
 exclusion.
 

po/POTFILES.in

@@ -35,7 +35,6 @@ src/ptimer.c
 src/recur.c
 src/res.c
 src/retr.c
-src/spider.c
 src/url.c
 src/utils.c
 src/warc.c

src/Makefile.am

@@ -65,8 +65,8 @@ nodist_wget_SOURCES = version.c
 EXTRA_wget_SOURCES = iri.c
 LDADD = $(LIBOBJS) ../lib/libgnu.a $(GETADDRINFO_LIB) $(HOSTENT_LIB)\
  $(INET_NTOP_LIB) $(LIBSOCKET) $(LIB_CLOCK_GETTIME) $(LIB_CRYPTO)\
- $(LIB_NANOSLEEP) $(LIB_POSIX_SPAWN) $(LIB_SELECT) $(LTLIBICONV) $(LTLIBINTL)\
- $(LTLIBTHREAD) $(LTLIBUNISTRING) $(SERVENT_LIB)
+ $(LIB_NANOSLEEP) $(LIB_POSIX_SPAWN) $(LIB_SELECT) $(LIBICONV) $(LIBINTL)\
+ $(LIBTHREAD) $(LIBUNISTRING) $(SERVENT_LIB)
 AM_CPPFLAGS = -I$(top_builddir)/lib -I$(top_srcdir)/lib
 
 

src/connect.c

@@ -56,10 +56,6 @@ as that of the covered work.  */
 #include <string.h>
 #include <sys/time.h>
 
-#ifdef ENABLE_IRI
-#include <idn2.h>
-#endif
-
 #include "utils.h"
 #include "host.h"
 #include "connect.h"
@@ -280,11 +276,8 @@ connect_to_ip (const ip_address *ip, int port, const char *print)
 
           if (opt.enable_iri && (name = idn_decode ((char *) print)) != NULL)
             {
-              int len = strlen (print) + strlen (name) + 4;
-              str = xmalloc (len);
-              snprintf (str, len, "%s (%s)", name, print);
-              str[len-1] = '\0';
-              idn2_free (name);
+              str = aprintf ("%s (%s)", name, print);
+              xfree (name);
             }
 
           logprintf (LOG_VERBOSE, _("Connecting to %s|%s|:%d... "),

src/convert.c

@@ -1024,7 +1024,7 @@ convert_cleanup (void)
 
 /* This table should really be merged with dl_file_url_map and
    downloaded_html_files.  This was originally a list, but I changed
-   it to a hash table beause it was actually taking a lot of time to
+   it to a hash table because it was actually taking a lot of time to
    find things in it.  */
 
 static struct hash_table *downloaded_files_hash;

src/cookies.c

@@ -485,7 +485,7 @@ parse_set_cookie (const char *set_cookie, bool silent)
 /* Check whether ADDR matches <digits>.<digits>.<digits>.<digits>.
 
    We don't want to call network functions like inet_addr() because
-   all we need is a check, preferrably one that is small, fast, and
+   all we need is a check, preferably one that is small, fast, and
    well-defined.  */
 
 static bool
@@ -516,7 +516,7 @@ numeric_address_p (const char *addr)
    psl on our own, if libpsl is compiled without a public suffix list,
    fall back to using the original "tail matching" heuristic. Also if
    libpsl is unable to convert the domain to lowercase, which means that
-   it doesnt have any runtime conversion support, we again fall back to
+   it doesn't have any runtime conversion support, we again fall back to
    "tail matching" since libpsl states the results are unpredictable with
    upper case strings.
    */

src/ftp.c

@@ -1463,7 +1463,7 @@ Error in server response, closing control connection.\n"));
       else if (opt.noclobber || opt.always_rest || opt.timestamping || opt.dirstruct
                || opt.output_document || count > 0)
         {
-          if (opt.unlink && file_exists_p (con->target))
+          if (opt.unlink_requested && file_exists_p (con->target, NULL))
             {
               if (unlink (con->target) < 0)
                 {
@@ -1857,7 +1857,7 @@ ftp_loop_internal (struct url *u, struct url *original_url, struct fileinfo *f,
   /* If we receive .listing file it is necessary to determine system type of the ftp
      server even if opn.noclobber is given. Thus we must ignore opt.noclobber in
      order to establish connection with the server and get system type. */
-  if (opt.noclobber && !opt.output_document && file_exists_p (con->target)
+  if (opt.noclobber && !opt.output_document && file_exists_p (con->target, NULL)
       && !((con->cmd & DO_LIST) && !(con->cmd & DO_RETR)))
     {
       logprintf (LOG_VERBOSE,
@@ -2129,7 +2129,7 @@ Removing file due to --delete-after in ftp_loop_internal():\n"));
 }
 
 /* Return the directory listing in a reusable format.  The directory
-   is specifed in u->dir.  */
+   is specified in u->dir.  */
 static uerr_t
 ftp_get_listing (struct url *u, struct url *original_url, ccon *con,
                  struct fileinfo **f)
@@ -2413,7 +2413,7 @@ Already have correct symlink %s -> %s\n\n"),
               && !(f->type == FT_SYMLINK && !opt.retr_symlinks)
               && f->tstamp != -1
               && dlthis
-              && file_exists_p (con->target))
+              && file_exists_p (con->target, NULL))
             {
               touch (actual_target, f->tstamp);
             }

src/host.c

@@ -57,10 +57,6 @@ as that of the covered work.  */
 
 #include <errno.h>
 
-#ifdef ENABLE_IRI
-#include <idn2.h>
-#endif
-
 #include "utils.h"
 #include "host.h"
 #include "url.h"
@@ -846,11 +842,8 @@ lookup_host (const char *host, int flags)
 
       if (opt.enable_iri && (name = idn_decode ((char *) host)) != NULL)
         {
-          int len = strlen (host) + strlen (name) + 4;
-          str = xmalloc (len);
-          snprintf (str, len, "%s (%s)", name, host);
-          str[len-1] = '\0';
-          idn2_free (name);
+          str = aprintf ("%s (%s)", name, host);
+          xfree (name);
         }
 
       logprintf (LOG_VERBOSE, _("Resolving %s... "),

src/hsts.c

@@ -32,9 +32,9 @@ as that of the covered work.  */
 
 #ifdef HAVE_HSTS
 #include "hsts.h"
+#include "utils.h"
 #include "host.h" /* for is_valid_ip_address() */
 #include "init.h" /* for home_dir() */
-#include "utils.h"
 #include "hash.h"
 #include "c-ctype.h"
 #ifdef TESTING
@@ -443,7 +443,6 @@ hsts_store_entry (hsts_store_t store,
   enum hsts_kh_match match = NO_MATCH;
   struct hsts_kh *kh = xnew(struct hsts_kh);
   struct hsts_kh_info *entry = NULL;
-  time_t t = 0;
 
   if (hsts_is_host_eligible (scheme, host))
     {
@@ -458,17 +457,18 @@ hsts_store_entry (hsts_store_t store,
             }
           else if (max_age > 0)
             {
-              if (entry->max_age != max_age ||
-                  entry->include_subdomains != include_subdomains)
+              /* RFC 6797 states that 'max_age' is a TTL relative to the
+               * reception of the STS header so we have to update the
+               * 'created' field too. The RFC also states that we have to
+               * update the entry each time we see HSTS header.
+               * See also Section 11.2. */
+              time_t t = time (NULL);
+
+              if (t != -1 && t != entry->created)
                 {
-                  /* RFC 6797 states that 'max_age' is a TTL relative to the reception of the STS header
-                     so we have to update the 'created' field too */
-                  t = time (NULL);
-                  if (t != -1)
-                    entry->created = t;
+                  entry->created = t;
                   entry->max_age = max_age;
                   entry->include_subdomains = include_subdomains;
-
                   store->changed = true;
                 }
             }
@@ -500,18 +500,19 @@ hsts_store_t
 hsts_store_open (const char *filename)
 {
   hsts_store_t store = NULL;
+  file_stats_t fstats;
 
   store = xnew0 (struct hsts_store);
   store->table = hash_table_new (0, hsts_hash_func, hsts_cmp_func);
   store->last_mtime = 0;
   store->changed = false;
 
-  if (file_exists_p (filename))
+  if (file_exists_p (filename, &fstats))
     {
       if (hsts_file_access_valid (filename))
         {
           struct stat st;
-          FILE *fp = fopen (filename, "r");
+          FILE *fp = fopen_stat (filename, "r", &fstats);
 
           if (!fp || !hsts_read_database (store, fp, false))
             {

src/html-parse.c

@@ -176,8 +176,8 @@ struct pool {
   P->orig_size = P->size;                                       \
 } while (0)
 
-/* Grow the pool to accomodate at least SIZE new bytes.  If the pool
-   already has room to accomodate SIZE bytes of data, this is a no-op.  */
+/* Grow the pool to accommodate at least SIZE new bytes.  If the pool
+   already has room to accommodate SIZE bytes of data, this is a no-op.  */
 
 #define POOL_GROW(p, increase)                                  \
   GROW_ARRAY ((p)->contents, (p)->size, (p)->tail + (increase), \

src/http-ntlm.c

@@ -122,7 +122,7 @@ ntlm_input (struct ntlmdata *ntlm, const char *header)
 
       DEBUGP (("Received a type-2 NTLM message.\n"));
 
-      size = wget_base64_decode (header, buffer);
+      size = wget_base64_decode (header, buffer, strlen (header));
       if (size < 0)
         return false;           /* malformed base64 from server */
 

src/http.c

@@ -973,6 +973,9 @@ skip_short_body (int fd, wgint contlen, bool chunked)
               remaining_chunk_size = strtol (line, &endl, 16);
               xfree (line);
 
+              if (remaining_chunk_size < 0)
+                return false;
+
               if (remaining_chunk_size == 0)
                 {
                   line = fd_read_line (fd);
@@ -1539,6 +1542,16 @@ persistent_available_p (const char *host, int port, bool ssl,
   fd = -1;                                      \
 } while (0)
 
+typedef enum
+{
+  ENC_INVALID = -1,             /* invalid encoding */
+  ENC_NONE = 0,                 /* no special encoding */
+  ENC_GZIP,                     /* gzip compression */
+  ENC_DEFLATE,                  /* deflate compression */
+  ENC_COMPRESS,                 /* compress compression */
+  ENC_BROTLI                    /* brotli compression */
+} encoding_t;
+
 struct http_stat
 {
   wgint len;                    /* received length */
@@ -1569,6 +1582,10 @@ struct http_stat
 #ifdef HAVE_METALINK
   metalink_t *metalink;
 #endif
+
+  encoding_t local_encoding;    /* the encoding of the local file */
+  encoding_t remote_encoding;   /* the encoding of the remote file */
+
   bool temporary;               /* downloading a temporary file */
 };
 
@@ -1680,6 +1697,9 @@ read_response_body (struct http_stat *hs, int sock, FILE *fp, wgint contlen,
   if (chunked_transfer_encoding)
     flags |= rb_chunked_transfer_encoding;
 
+  if (hs->remote_encoding == ENC_GZIP)
+    flags |= rb_compressed_gzip;
+
   hs->len = hs->restval;
   hs->rd_size = 0;
   /* Download the response body and write it to fp.
@@ -1873,7 +1893,12 @@ initialize_request (const struct url *u, struct http_stat *hs, int *dt, struct u
                         rel_value);
   SET_USER_AGENT (req);
   request_set_header (req, "Accept", "*/*", rel_none);
-  request_set_header (req, "Accept-Encoding", "identity", rel_none);
+#ifdef HAVE_LIBZ
+  if (opt.compression != compression_none)
+    request_set_header (req, "Accept-Encoding", "gzip", rel_none);
+  else
+#endif
+    request_set_header (req, "Accept-Encoding", "identity", rel_none);
 
   /* Find the username with priority */
   if (u->user)
@@ -1900,7 +1925,7 @@ initialize_request (const struct url *u, struct http_stat *hs, int *dt, struct u
     *passwd = NULL;
 
   /* Check for ~/.netrc if none of the above match */
-  if (opt.netrc && (!user || !passwd))
+  if (opt.netrc && (!*user || !*passwd))
     search_netrc (u->host, (const char **) user, (const char **) passwd, 0);
 
   /* We only do "site-wide" authentication with "global" user/password
@@ -2290,7 +2315,7 @@ check_file_output (const struct url *u, struct http_stat *hs,
     }
 
   /* TODO: perform this check only once. */
-  if (!hs->existence_checked && file_exists_p (hs->local_file))
+  if (!hs->existence_checked && file_exists_p (hs->local_file, NULL))
     {
       if (opt.noclobber && !opt.output_document)
         {
@@ -2486,7 +2511,7 @@ open_output_stream (struct http_stat *hs, int count, FILE **fp)
         }
       else if (ALLOW_CLOBBER || count > 0)
         {
-          if (opt.unlink && file_exists_p (hs->local_file))
+          if (opt.unlink_requested && file_exists_p (hs->local_file, NULL))
             {
               if (unlink (hs->local_file) < 0)
                 {
@@ -2552,14 +2577,14 @@ set_content_type (int *dt, const char *type)
      of the multitude of broken CGI's that "forget" to generate the
      content-type.  */
   if (!type ||
-      0 == strncasecmp (type, TEXTHTML_S, strlen (TEXTHTML_S)) ||
-      0 == strncasecmp (type, TEXTXHTML_S, strlen (TEXTXHTML_S)))
+      0 == c_strcasecmp (type, TEXTHTML_S) ||
+      0 == c_strcasecmp (type, TEXTXHTML_S))
     *dt |= TEXTHTML;
   else
     *dt &= ~TEXTHTML;
 
   if (type &&
-      0 == strncasecmp (type, TEXTCSS_S, strlen (TEXTCSS_S)))
+      0 == c_strcasecmp (type, TEXTCSS_S))
     *dt |= TEXTCSS;
   else
     *dt &= ~TEXTCSS;
@@ -2998,7 +3023,7 @@ skip_content_type:
           char *bin_hash = alloca (dig_hash_str_len * 3 / 4 + 1);
           ssize_t hash_bin_len;
 
-          hash_bin_len = wget_base64_decode (dig_hash, bin_hash);
+          hash_bin_len = wget_base64_decode (dig_hash, bin_hash, dig_hash_str_len * 3 / 4 + 1);
 
           /* Detect malformed base64 input.  */
           if (hash_bin_len < 0)
@@ -3189,6 +3214,8 @@ gethttp (const struct url *u, struct url *original_url, struct http_stat *hs,
   xfree (hs->remote_time);
   hs->error = NULL;
   hs->message = NULL;
+  hs->local_encoding = ENC_NONE;
+  hs->remote_encoding = ENC_NONE;
 
   conn = u;
 
@@ -3476,7 +3503,7 @@ gethttp (const struct url *u, struct url *original_url, struct http_stat *hs,
 
 #ifdef HAVE_METALINK
   /* We need to check for the Metalink data in the very first response
-     we get from the server (before redirectionrs, authorization, etc.).  */
+     we get from the server (before redirections, authorization, etc.).  */
   if (metalink)
     {
       hs->metalink = metalink_from_http (resp, hs, u);
@@ -3496,7 +3523,7 @@ gethttp (const struct url *u, struct url *original_url, struct http_stat *hs,
       uerr_t auth_err = RETROK;
       bool retry;
       /* Normally we are not interested in the response body.
-         But if we are writing a WARC file we are: we like to keep everyting.  */
+         But if we are writing a WARC file we are: we like to keep everything.  */
       if (warc_enabled)
         {
           int _err;
@@ -3556,20 +3583,6 @@ gethttp (const struct url *u, struct url *original_url, struct http_stat *hs,
         pconn.authorized = true;
     }
 
-  if (statcode == HTTP_STATUS_GATEWAY_TIMEOUT)
-    {
-      hs->len = 0;
-      hs->res = 0;
-      hs->restval = 0;
-
-      CLOSE_FINISH (sock);
-      xfree (hs->message);
-
-      retval = GATEWAYTIMEOUT;
-      goto cleanup;
-    }
-
-
   {
     uerr_t ret = check_file_output (u, hs, resp, hdrval, sizeof hdrval);
     if (ret != RETROK)
@@ -3639,6 +3652,8 @@ gethttp (const struct url *u, struct url *original_url, struct http_stat *hs,
     }
   hs->newloc = resp_header_strdup (resp, "Location");
   hs->remote_time = resp_header_strdup (resp, "Last-Modified");
+  if (!hs->remote_time) // now look for the Wayback Machine's timestamp
+    hs->remote_time = resp_header_strdup (resp, "X-Archive-Orig-last-modified");
 
   if (resp_header_copy (resp, "Content-Range", hdrval, sizeof (hdrval)))
     {
@@ -3651,6 +3666,73 @@ gethttp (const struct url *u, struct url *original_url, struct http_stat *hs,
         }
     }
 
+  if (resp_header_copy (resp, "Content-Encoding", hdrval, sizeof (hdrval)))
+    {
+      hs->local_encoding = ENC_INVALID;
+
+      switch (hdrval[0])
+        {
+        case 'b': case 'B':
+          if (0 == c_strcasecmp(hdrval, "br"))
+            hs->local_encoding = ENC_BROTLI;
+          break;
+        case 'c': case 'C':
+          if (0 == c_strcasecmp(hdrval, "compress"))
+            hs->local_encoding = ENC_COMPRESS;
+          break;
+        case 'd': case 'D':
+          if (0 == c_strcasecmp(hdrval, "deflate"))
+            hs->local_encoding = ENC_DEFLATE;
+          break;
+        case 'g': case 'G':
+          if (0 == c_strcasecmp(hdrval, "gzip"))
+            hs->local_encoding = ENC_GZIP;
+          break;
+        case 'i': case 'I':
+          if (0 == c_strcasecmp(hdrval, "identity"))
+            hs->local_encoding = ENC_NONE;
+          break;
+        case 'x': case 'X':
+          if (0 == c_strcasecmp(hdrval, "x-compress"))
+            hs->local_encoding = ENC_COMPRESS;
+          else if (0 == c_strcasecmp(hdrval, "x-gzip"))
+            hs->local_encoding = ENC_GZIP;
+          break;
+        case '\0':
+          hs->local_encoding = ENC_NONE;
+        }
+
+      if (hs->local_encoding == ENC_INVALID)
+        {
+          DEBUGP (("Unrecognized Content-Encoding: %s\n", hdrval));
+          hs->local_encoding = ENC_NONE;
+        }
+#ifdef HAVE_LIBZ
+      else if (hs->local_encoding == ENC_GZIP
+               && opt.compression != compression_none)
+        {
+          /* Make sure the Content-Type is not gzip before decompressing */
+          const char * p = strchr (type, '/');
+          if (p == NULL)
+            {
+              hs->remote_encoding = ENC_GZIP;
+              hs->local_encoding = ENC_NONE;
+            }
+          else
+            {
+              p++;
+              if (c_tolower(p[0]) == 'x' && p[1] == '-')
+                p += 2;
+              if (0 != c_strcasecmp (p, "gzip"))
+                {
+                  hs->remote_encoding = ENC_GZIP;
+                  hs->local_encoding = ENC_NONE;
+                }
+            }
+        }
+#endif
+    }
+
   /* 20x responses are counted among successful by default.  */
   if (H_20X (statcode))
     *dt |= RETROKF;
@@ -3763,8 +3845,51 @@ gethttp (const struct url *u, struct url *original_url, struct http_stat *hs,
 
   set_content_type (dt, type);
 
+  if (cond_get)
+    {
+      if (statcode == HTTP_STATUS_NOT_MODIFIED)
+        {
+          logprintf (LOG_VERBOSE,
+                     _ ("File %s not modified on server. Omitting download.\n\n"),
+                     quote (hs->local_file));
+          *dt |= RETROKF;
+          CLOSE_FINISH (sock);
+          retval = RETRUNNEEDED;
+          goto cleanup;
+        }
+    }
+
   if (opt.adjust_extension)
     {
+      const char *encoding_ext = NULL;
+      switch (hs->local_encoding)
+        {
+        case ENC_INVALID:
+        case ENC_NONE:
+          break;
+        case ENC_BROTLI:
+          encoding_ext = ".br";
+          break;
+        case ENC_COMPRESS:
+          encoding_ext = ".Z";
+          break;
+        case ENC_DEFLATE:
+          encoding_ext = ".zlib";
+          break;
+        case ENC_GZIP:
+          encoding_ext = ".gz";
+          break;
+        default:
+          DEBUGP (("No extension found for encoding %d\n",
+                   hs->local_encoding));
+      }
+      if (encoding_ext != NULL)
+        {
+          char *file_ext = strrchr (hs->local_file, '.');
+          /* strip Content-Encoding extension (it will be re-added later) */
+          if (file_ext != NULL && 0 == strcasecmp (file_ext, encoding_ext))
+            *file_ext = '\0';
+        }
       if (*dt & TEXTHTML)
         /* -E / --adjust-extension / adjust_extension = on was specified,
            and this is a text/html file.  If some case-insensitive
@@ -3777,22 +3902,16 @@ gethttp (const struct url *u, struct url *original_url, struct http_stat *hs,
         {
           ensure_extension (hs, ".css", dt);
         }
+      if (encoding_ext != NULL)
+        {
+          ensure_extension (hs, encoding_ext, dt);
+        }
     }
 
   if (cond_get)
     {
-      if (statcode == HTTP_STATUS_NOT_MODIFIED)
-        {
-          logprintf (LOG_VERBOSE,
-                     _("File %s not modified on server. Omitting download.\n\n"),
-                     quote (hs->local_file));
-          *dt |= RETROKF;
-          CLOSE_FINISH (sock);
-          retval = RETRUNNEEDED;
-          goto cleanup;
-        }
       /* Handle the case when server ignores If-Modified-Since header.  */
-      else if (statcode == HTTP_STATUS_OK && hs->remote_time)
+      if (statcode == HTTP_STATUS_OK && hs->remote_time)
         {
           time_t tmr = http_atotm (hs->remote_time);
 
@@ -3814,6 +3933,16 @@ gethttp (const struct url *u, struct url *original_url, struct http_stat *hs,
         }
     }
 
+  if (statcode == HTTP_STATUS_RANGE_NOT_SATISFIABLE
+      && hs->restval < (contlen + contrange))
+    {
+      /* The file was not completely downloaded,
+         yet the server claims the range is invalid.
+         Bail out.  */
+      CLOSE_INVALIDATE (sock);
+      retval = RANGEERR;
+      goto cleanup;
+    }
   if (statcode == HTTP_STATUS_RANGE_NOT_SATISFIABLE
       || (!opt.timestamping && hs->restval > 0 && statcode == HTTP_STATUS_OK
           && contrange == 0 && contlen >= 0 && hs->restval >= contlen))
@@ -3848,6 +3977,9 @@ gethttp (const struct url *u, struct url *original_url, struct http_stat *hs,
     }
   if (contlen == -1)
     hs->contlen = -1;
+  /* If the response is gzipped, the uncompressed size is unknown. */
+  else if (hs->remote_encoding == ENC_GZIP)
+    hs->contlen = -1;
   else
     hs->contlen = contlen + contrange;
 
@@ -3910,8 +4042,8 @@ gethttp (const struct url *u, struct url *original_url, struct http_stat *hs,
               retval = _err;
               goto cleanup;
             }
-          else
-            CLOSE_FINISH (sock);
+
+          CLOSE_FINISH (sock);
         }
       else
         {
@@ -3934,7 +4066,11 @@ gethttp (const struct url *u, struct url *original_url, struct http_stat *hs,
             CLOSE_INVALIDATE (sock);
         }
 
-      retval = RETRFINISHED;
+      if (statcode == HTTP_STATUS_GATEWAY_TIMEOUT)
+        retval = GATEWAYTIMEOUT;
+      else
+        retval = RETRFINISHED;
+
       goto cleanup;
     }
 
@@ -3982,6 +4118,22 @@ gethttp (const struct url *u, struct url *original_url, struct http_stat *hs,
   return retval;
 }
 
+/* Check whether the supplied HTTP status code is among those
+   listed for the --retry-on-http-error option. */
+static bool
+check_retry_on_http_error (const int statcode)
+{
+  const char *tok = opt.retry_on_http_error;
+  while (tok && *tok)
+    {
+      if (atoi (tok) == statcode)
+        return true;
+      if ((tok = strchr (tok, ',')))
+        ++tok;
+    }
+  return false;
+}
+
 /* The genuine HTTP loop!  This is the part where the retrieval is
    retried, and retried, and retried, and...  */
 uerr_t
@@ -4044,7 +4196,7 @@ http_loop (const struct url *u, struct url *original_url, char **newloc,
       got_name = true;
     }
 
-  if (got_name && file_exists_p (hstat.local_file) && opt.noclobber && !opt.output_document)
+  if (got_name && file_exists_p (hstat.local_file, NULL) && opt.noclobber && !opt.output_document)
     {
       /* If opt.noclobber is turned on and file already exists, do not
          retrieve the file. But if the output_document was given, then this
@@ -4081,7 +4233,7 @@ http_loop (const struct url *u, struct url *original_url, char **newloc,
     {
       /* Use conditional get request if requested
        * and if timestamp is known at this moment.  */
-      if (opt.if_modified_since && !send_head_first && got_name && file_exists_p (hstat.local_file))
+      if (opt.if_modified_since && !send_head_first && got_name && file_exists_p (hstat.local_file, NULL))
         {
           *dt |= IF_MODIFIED_SINCE;
           {
@@ -4092,7 +4244,7 @@ http_loop (const struct url *u, struct url *original_url, char **newloc,
         }
         /* Send preliminary HEAD request if -N is given and we have existing
          * destination file or content disposition is enabled.  */
-      else if (opt.content_disposition || file_exists_p (hstat.local_file))
+      else if (opt.content_disposition || file_exists_p (hstat.local_file, NULL))
         send_head_first = true;
     }
 
@@ -4192,6 +4344,8 @@ http_loop (const struct url *u, struct url *original_url, char **newloc,
              bring them to "while" statement at the end, to judge
              whether the number of tries was exceeded.  */
           printwhat (count, opt.ntry);
+          xfree (hstat.message);
+          xfree (hstat.error);
           continue;
         case FWRITEERR: case FOPENERR:
           /* Another fatal error.  */
@@ -4319,6 +4473,11 @@ http_loop (const struct url *u, struct url *original_url, char **newloc,
               logprintf (LOG_NOTQUIET, _("\
 Remote file does not exist -- broken link!!!\n"));
             }
+          else if (check_retry_on_http_error (hstat.statcode))
+            {
+              printwhat (count, opt.ntry);
+              continue;
+            }
           else
             {
               logprintf (LOG_NOTQUIET, _("%s ERROR %d: %s.\n"),
@@ -5090,13 +5249,13 @@ ensure_extension (struct http_stat *hs, const char *ext, int *dt)
       strcpy (hs->local_file + local_filename_len, ext);
       /* If clobbering is not allowed and the file, as named,
          exists, tack on ".NUMBER.html" instead. */
-      if (!ALLOW_CLOBBER && file_exists_p (hs->local_file))
+      if (!ALLOW_CLOBBER && file_exists_p (hs->local_file, NULL))
         {
           int ext_num = 1;
           do
             sprintf (hs->local_file + local_filename_len,
                      ".%d%s", ext_num++, ext);
-          while (file_exists_p (hs->local_file));
+          while (file_exists_p (hs->local_file, NULL));
         }
       *dt |= ADDED_HTML_EXTENSION;
     }

src/init.c

@@ -99,6 +99,9 @@ CMD_DECLARE (cmd_vector);
 
 CMD_DECLARE (cmd_use_askpass);
 
+#ifdef HAVE_LIBZ
+CMD_DECLARE (cmd_spec_compression);
+#endif
 CMD_DECLARE (cmd_spec_dirstruct);
 CMD_DECLARE (cmd_spec_header);
 CMD_DECLARE (cmd_spec_warc_header);
@@ -161,6 +164,9 @@ static const struct {
   { "checkcertificate", &opt.check_cert,        cmd_check_cert },
 #endif
   { "chooseconfig",     &opt.choose_config,     cmd_file },
+#ifdef HAVE_LIBZ
+  { "compression",      &opt.compression,       cmd_spec_compression },
+#endif
   { "connecttimeout",   &opt.connect_timeout,   cmd_time },
   { "contentdisposition", &opt.content_disposition, cmd_boolean },
   { "contentonerror",   &opt.content_on_error,  cmd_boolean },
@@ -304,6 +310,7 @@ static const struct {
   { "restrictfilenames", NULL,                  cmd_spec_restrict_file_names },
   { "retrsymlinks",     &opt.retr_symlinks,     cmd_boolean },
   { "retryconnrefused", &opt.retry_connrefused, cmd_boolean },
+  { "retryonhttperror", &opt.retry_on_http_error, cmd_string },
   { "robots",           &opt.use_robots,        cmd_boolean },
   { "savecookies",      &opt.cookies_output,    cmd_file },
   { "saveheaders",      &opt.save_headers,      cmd_boolean },
@@ -321,7 +328,7 @@ static const struct {
   { "timestamping",     &opt.timestamping,      cmd_boolean },
   { "tries",            &opt.ntry,              cmd_number_inf },
   { "trustservernames", &opt.trustservernames,  cmd_boolean },
-  { "unlink",           &opt.unlink,            cmd_boolean },
+  { "unlink",           &opt.unlink_requested,  cmd_boolean },
   { "useaskpass" ,      &opt.use_askpass,       cmd_use_askpass },
   { "useproxy",         &opt.use_proxy,         cmd_boolean },
   { "user",             &opt.user,              cmd_string },
@@ -444,6 +451,10 @@ defaults (void)
   opt.ftps_clear_data_connection = false;
 #endif
 
+#ifdef HAVE_LIBZ
+  opt.compression = compression_auto;
+#endif
+
   /* The default for file name restriction defaults to the OS type. */
 #if defined(WINDOWS) || defined(MSDOS) || defined(__CYGWIN__)
   opt.restrict_files_os = restrict_windows;
@@ -565,10 +576,11 @@ wgetrc_env_file_name (void)
   char *env = getenv ("WGETRC");
   if (env && *env)
     {
-      if (!file_exists_p (env))
+      file_stats_t flstat;
+      if (!file_exists_p (env, &flstat))
         {
-          fprintf (stderr, _("%s: WGETRC points to %s, which doesn't exist.\n"),
-                   exec_name, env);
+          fprintf (stderr, _("%s: WGETRC points to %s, which couldn't be accessed because of error: %s.\n"),
+                   exec_name, env, strerror(flstat.access_err));
           exit (WGET_EXIT_GENERIC_ERROR);
         }
       return xstrdup (env);
@@ -576,7 +588,7 @@ wgetrc_env_file_name (void)
   return NULL;
 }
 
-/* Check for the existance of '$HOME/.wgetrc' and return its path
+/* Check for the existence of '$HOME/.wgetrc' and return its path
    if it exists and is set.  */
 char *
 wgetrc_user_file_name (void)
@@ -596,7 +608,7 @@ wgetrc_user_file_name (void)
 
   if (!file)
     return NULL;
-  if (!file_exists_p (file))
+  if (!file_exists_p (file, NULL))
     {
       xfree (file);
       return NULL;
@@ -629,7 +641,7 @@ wgetrc_file_name (void)
       if (home)
         {
           file = aprintf ("%s/wget.ini", home);
-          if (!file_exists_p (file))
+          if (!file_exists_p (file, NULL))
             {
               xfree (file);
             }
@@ -657,7 +669,7 @@ static bool setval_internal_tilde (int, const char *, const char *);
    there were errors in the file.  */
 
 bool
-run_wgetrc (const char *file)
+run_wgetrc (const char *file, file_stats_t *flstats)
 {
   FILE *fp;
   char *line = NULL;
@@ -665,7 +677,7 @@ run_wgetrc (const char *file)
   int ln;
   int errcnt = 0;
 
-  fp = fopen (file, "r");
+  fp = fopen_stat (file, "r", flstats);
   if (!fp)
     {
       fprintf (stderr, _("%s: Cannot read %s (%s).\n"), exec_name,
@@ -721,14 +733,16 @@ void
 initialize (void)
 {
   char *file, *env_sysrc;
+  file_stats_t flstats;
   bool ok = true;
 
+  memset(&flstats, 0, sizeof(flstats));
   /* Run a non-standard system rc file when the according environment
      variable has been set. For internal testing purposes only!  */
   env_sysrc = getenv ("SYSTEM_WGETRC");
-  if (env_sysrc && file_exists_p (env_sysrc))
+  if (env_sysrc && file_exists_p (env_sysrc, &flstats))
     {
-      ok &= run_wgetrc (env_sysrc);
+      ok &= run_wgetrc (env_sysrc, &flstats);
       /* If there are any problems parsing the system wgetrc file, tell
          the user and exit */
       if (! ok)
@@ -742,8 +756,8 @@ or specify a different file using --config.\n"), env_sysrc);
     }
   /* Otherwise, if SYSTEM_WGETRC is defined, use it.  */
 #ifdef SYSTEM_WGETRC
-  else if (file_exists_p (SYSTEM_WGETRC))
-    ok &= run_wgetrc (SYSTEM_WGETRC);
+  else if (file_exists_p (SYSTEM_WGETRC, &flstats))
+    ok &= run_wgetrc (SYSTEM_WGETRC, &flstats);
   /* If there are any problems parsing the system wgetrc file, tell
      the user and exit */
   if (! ok)
@@ -770,7 +784,8 @@ or specify a different file using --config.\n"), SYSTEM_WGETRC);
     }
   else
 #endif
-    ok &= run_wgetrc (file);
+	if (file_exists_p (file, &flstats))
+        ok &= run_wgetrc (file, &flstats);
 
   /* If there were errors processing either `.wgetrc', abort. */
   if (!ok)
@@ -1440,6 +1455,25 @@ cmd_cert_type (const char *com, const char *val, void *place)
 
 static bool check_user_specified_header (const char *);
 
+#ifdef HAVE_LIBZ
+static bool
+cmd_spec_compression (const char *com, const char *val, void *place)
+{
+  static const struct decode_item choices[] = {
+    { "auto", compression_auto },
+    { "gzip", compression_gzip },
+    { "none", compression_none },
+  };
+  int ok = decode_string (val, choices, countof (choices), place);
+  if (!ok)
+    {
+      fprintf (stderr, _("%s: %s: Invalid value %s.\n"), exec_name, com,
+               quote (val));
+    }
+  return ok;
+}
+#endif
+
 static bool
 cmd_spec_dirstruct (const char *com, const char *val, void *place_ignored _GL_UNUSED)
 {
@@ -1979,6 +2013,7 @@ cleanup (void)
   xfree (opt.body_file);
   xfree (opt.rejected_log);
   xfree (opt.use_askpass);
+  xfree (opt.retry_on_http_error);
 
 #ifdef HAVE_LIBCARES
 #include <ares.h>

src/init.h

@@ -41,6 +41,6 @@ void setoptval (const char *, const char *, const char *);
 char *home_dir (void);
 void cleanup (void);
 void defaults (void);
-bool run_wgetrc (const char *file);
+bool run_wgetrc (const char *file, file_stats_t *);
 
 #endif /* INIT_H */

src/iri.c

@@ -39,8 +39,10 @@ as that of the covered work.  */
 # include <iconv.h>
 #endif
 #include <idn2.h>
-#include <unicase.h>
-#include <unistr.h>
+#if IDN2_VERSION_NUMBER < 0x00140000
+# include <unicase.h>
+# include <unistr.h>
+#endif
 
 #include "utils.h"
 #include "url.h"
@@ -119,6 +121,7 @@ check_encoding_name (const char *encoding)
   return true;
 }
 
+#ifdef HAVE_ICONV
 /* Do the conversion according to the passed conversion descriptor cd. *out
    will contain the transcoded string on success. *out content is
    unspecified otherwise. */
@@ -210,6 +213,15 @@ do_conversion (const char *tocode, const char *fromcode, char const *in_org, siz
     }
     return false;
 }
+#else
+static bool
+do_conversion (const char *tocode _GL_UNUSED, const char *fromcode _GL_UNUSED,
+               char const *in_org _GL_UNUSED, size_t inlen _GL_UNUSED, char **out)
+{
+  *out = NULL;
+  return false;
+}
+#endif
 
 /* Try converting string str from locale to UTF-8. Return a new string
    on success, or str on error or if conversion isn't needed. */
@@ -253,7 +265,7 @@ idn_encode (const struct iri *i, const char *host)
   if (!i->utf8_encode)
     {
       if (!remote_to_utf8 (i, host, &utf8_encoded))
-          return NULL;  /* Nothing to encode or an error occured */
+          return NULL;  /* Nothing to encode or an error occurred */
       src = utf8_encoded;
     }
   else
@@ -261,11 +273,14 @@ idn_encode (const struct iri *i, const char *host)
 
 #if IDN2_VERSION_NUMBER >= 0x00140000
   /* IDN2_TRANSITIONAL implies input NFC encoding */
-  if ((ret = idn2_lookup_u8 ((uint8_t *) src, (uint8_t **) &ascii_encoded, IDN2_NONTRANSITIONAL)) != IDN2_OK)
-    {
-      logprintf (LOG_VERBOSE, _("idn_encode failed (%d): %s\n"), ret,
-                 quote (idn2_strerror (ret)));
-    }
+  ret = idn2_lookup_u8 ((uint8_t *) src, (uint8_t **) &ascii_encoded, IDN2_NONTRANSITIONAL);
+  if (ret != IDN2_OK)
+    /* fall back to TR46 Transitional mode, max IDNA2003 compatibility */
+    ret = idn2_lookup_u8 ((uint8_t *) src, (uint8_t **) &ascii_encoded, IDN2_TRANSITIONAL);
+
+  if (ret != IDN2_OK)
+    logprintf (LOG_VERBOSE, _("idn_encode failed (%d): %s\n"), ret,
+               quote (idn2_strerror (ret)));
 #else
   /* we need a conversion to lowercase */
   lower = u8_tolower ((uint8_t *) src, u8_strlen ((uint8_t *) src) + 1, 0, UNINORM_NFKC, NULL, &len);
@@ -286,6 +301,15 @@ idn_encode (const struct iri *i, const char *host)
   xfree (lower);
 #endif
 
+  xfree (utf8_encoded);
+
+  if (ret == IDN2_OK && ascii_encoded)
+    {
+      char *tmp = xstrdup (ascii_encoded);
+      idn2_free (ascii_encoded);
+      ascii_encoded = tmp;
+    }
+
   return ret == IDN2_OK ? ascii_encoded : NULL;
 }
 

src/iri.h

@@ -40,8 +40,6 @@ struct iri {
 
 #ifdef ENABLE_IRI
 
-# include <idn2.h>
-
 char *parse_charset (const char *str);
 const char *find_locale (void);
 bool check_encoding_name (const char *encoding);

src/log.c

@@ -532,7 +532,7 @@ log_set_flush (bool flush)
     }
   else
     {
-      /* Reenable flushing.  If anything was printed in no-flush mode,
+      /* Re-enable flushing.  If anything was printed in no-flush mode,
          flush the log now.  */
       if (needs_flushing)
         logflush ();

src/main.c

@@ -275,6 +275,9 @@ static struct cmdline_option option_data[] =
     { IF_SSL ("certificate-type"), 0, OPT_VALUE, "certificatetype", -1 },
     { IF_SSL ("check-certificate"), 0, OPT_BOOLEAN, "checkcertificate", -1 },
     { "clobber", 0, OPT__CLOBBER, NULL, optional_argument },
+#ifdef HAVE_LIBZ
+    { "compression", 0, OPT_VALUE, "compression", -1 },
+#endif
     { "config", 0, OPT_VALUE, "chooseconfig", -1 },
     { "connect-timeout", 0, OPT_VALUE, "connecttimeout", -1 },
     { "continue", 'c', OPT_BOOLEAN, "continue", -1 },
@@ -359,6 +362,7 @@ static struct cmdline_option option_data[] =
 #endif
     { "method", 0, OPT_VALUE, "method", -1 },
     { "mirror", 'm', OPT_BOOLEAN, "mirror", -1 },
+    { "netrc", 0, OPT_BOOLEAN, "netrc", -1 },
     { "no", 'n', OPT__NO, NULL, required_argument },
     { "no-clobber", 0, OPT_BOOLEAN, "noclobber", -1 },
     { "no-config", 0, OPT_BOOLEAN, "noconfig", -1},
@@ -404,6 +408,7 @@ static struct cmdline_option option_data[] =
     { "restrict-file-names", 0, OPT_BOOLEAN, "restrictfilenames", -1 },
     { "retr-symlinks", 0, OPT_BOOLEAN, "retrsymlinks", -1 },
     { "retry-connrefused", 0, OPT_BOOLEAN, "retryconnrefused", -1 },
+    { "retry-on-http-error", 0, OPT_VALUE, "retryonhttperror", -1 },
     { "save-cookies", 0, OPT_VALUE, "savecookies", -1 },
     { "save-headers", 0, OPT_BOOLEAN, "saveheaders", -1 },
     { IF_SSL ("secure-protocol"), 0, OPT_VALUE, "secureprotocol", -1 },
@@ -423,7 +428,6 @@ static struct cmdline_option option_data[] =
     { "user", 0, OPT_VALUE, "user", -1 },
     { "user-agent", 'U', OPT_VALUE, "useragent", -1 },
     { "verbose", 'v', OPT_BOOLEAN, "verbose", -1 },
-    { "verbose", 0, OPT_BOOLEAN, "verbose", -1 },
     { "version", 'V', OPT_FUNCALL, (void *) print_version, no_argument },
     { "wait", 'w', OPT_VALUE, "wait", -1 },
     { "waitretry", 0, OPT_VALUE, "waitretry", -1 },
@@ -628,6 +632,8 @@ Download:\n"),
     N_("\
   -nc, --no-clobber                skip downloads that would download to\n\
                                      existing files (overwriting them)\n"),
+    N_("\
+       --no-netrc                  don't try to obtain credentials from .netrc\n"),
     N_("\
   -c,  --continue                  resume getting a partially-downloaded file\n"),
     N_("\
@@ -760,6 +766,10 @@ HTTP options:\n"),
        --ignore-length             ignore 'Content-Length' header field\n"),
     N_("\
        --header=STRING             insert STRING among the headers\n"),
+#ifdef HAVE_LIBZ
+    N_("\
+       --compression=TYPE          choose compression, one of auto, gzip and none\n"),
+#endif
     N_("\
        --max-redirect              maximum redirections allowed per page\n"),
     N_("\
@@ -808,7 +818,7 @@ HTTP options:\n"),
 HTTPS (SSL/TLS) options:\n"),
     N_("\
        --secure-protocol=PR        choose secure protocol, one of auto, SSLv2,\n\
-                                     SSLv3, TLSv1 and PFS\n"),
+                                     SSLv3, TLSv1, TLSv1_1, TLSv1_2 and PFS\n"),
     N_("\
        --https-only                only follow secure HTTPS links\n"),
     N_("\
@@ -1381,10 +1391,10 @@ main (int argc, char **argv)
             }
           else if (strcmp (config_opt->long_name, "config") == 0)
             {
-              bool userrc_ret = true;
-              userrc_ret &= run_wgetrc (optarg);
+              file_stats_t flstats;
               use_userconfig = true;
-              if (userrc_ret)
+              memset(&flstats, 0, sizeof(flstats));
+              if (file_exists_p(optarg, &flstats) && run_wgetrc (optarg, &flstats))
                 break;
               else
                 {
@@ -1620,7 +1630,7 @@ WARNING: timestamping does nothing in combination with -O. See the manual\n\
 for details.\n\n"));
           opt.timestamping = false;
         }
-      if (opt.noclobber && file_exists_p(opt.output_document))
+      if (opt.noclobber && file_exists_p(opt.output_document, NULL))
            {
               /* Check if output file exists; if it does, exit. */
               logprintf (LOG_VERBOSE,
@@ -1672,6 +1682,26 @@ for details.\n\n"));
         }
     }
 
+#ifdef HAVE_LIBZ
+  if (opt.always_rest || opt.start_pos >= 0)
+    {
+      if (opt.compression == compression_auto)
+        {
+          /* Compression does not work with --continue or --start-pos.
+             Since compression was not explicitly set, it will be disabled. */
+          opt.compression = compression_none;
+        }
+      else if (opt.compression != compression_none)
+        {
+          fprintf (stderr,
+                   _("Compression does not work with --continue or"
+                     " --start-pos, they will be disabled.\n"));
+          opt.always_rest = false;
+          opt.start_pos = -1;
+        }
+    }
+#endif
+
   if (opt.ask_passwd && opt.passwd)
     {
       fprintf (stderr,
@@ -2081,7 +2111,7 @@ only if outputting to a regular file.\n"));
                             &dt, opt.recursive, iri, true);
             }
 
-          if (opt.delete_after && filename != NULL && file_exists_p (filename))
+          if (opt.delete_after && filename != NULL && file_exists_p (filename, NULL))
             {
               DEBUGP (("Removing file due to --delete-after in main():\n"));
               logprintf (LOG_VERBOSE, _("Removing %s.\n"), filename);

src/metalink.c

@@ -375,6 +375,7 @@ retrieve_from_metalink (const metalink_t* metalink)
           metalink_checksum_t **mchksum_ptr, *mchksum;
           struct iri *iri;
           struct url *url;
+          file_stats_t flstats;
           int url_err;
 
           clean_metalink_string (&mres->url);
@@ -490,8 +491,9 @@ retrieve_from_metalink (const metalink_t* metalink)
 
                 Bugfix: point output_stream to destname if it exists.
               */
-              if (!output_stream && file_exists_p (destname))
-                output_stream = fopen (destname, "ab");
+              memset(&flstats, 0, sizeof(flstats));
+              if (!output_stream && file_exists_p (destname, &flstats))
+                output_stream = fopen_stat (destname, "ab", &flstats);
             }
           url_free (url);
           iri_free (iri);
@@ -901,7 +903,7 @@ gpg_skip_verification:
          Note: the file has been downloaded using *_loop. Therefore, it
          is not necessary to keep the file for continuated download.  */
       if (((retr_err != RETROK && !opt.always_rest) || opt.delete_after)
-           && destname != NULL && file_exists_p (destname))
+           && destname != NULL && file_exists_p (destname, NULL))
         {
           badhash_or_remove (destname);
         }

src/mswindows.c

@@ -580,7 +580,7 @@ run_with_timeout (double seconds, void (*fun) (void *), void *arg)
 const char *
 inet_ntop (int af, const void *src, char *dst, socklen_t cnt)
 {
-  /* struct sockaddr can't accomodate struct sockaddr_in6. */
+  /* struct sockaddr can't accommodate struct sockaddr_in6. */
   union {
     struct sockaddr_in6 sin6;
     struct sockaddr_in sin;

src/mswindows.h

@@ -57,6 +57,9 @@ as that of the covered work.  */
 /* Declares getpid(). */
 #include <process.h>
 
+/* Declares inet_ntop() and inet_pton(). */
+#include <arpa/inet.h>
+
 /* We have strcasecmp and strncasecmp, just under different names.  */
 #ifndef HAVE_STRCASECMP
 # define strcasecmp stricmp
@@ -85,11 +88,6 @@ typedef __int64 wgint;
 
 #define PATH_SEPARATOR '\\'
 
-/* Additional declarations needed for IPv6: */
-#ifdef ENABLE_IPV6
-const char *inet_ntop (int, const void *, char *, socklen_t);
-#endif
-
 /* ioctl needed by set_windows_fd_as_blocking_socket() */
 #include <sys/ioctl.h>
 

src/netrc.c

@@ -235,7 +235,7 @@ parse_netrc (const char *path)
   /* The latest token we've seen in the file.  */
   enum
   {
-    tok_nothing, tok_account, tok_login, tok_macdef, tok_machine, tok_password
+    tok_nothing, tok_account, tok_login, tok_macdef, tok_machine, tok_password, tok_port, tok_force
   } last_token = tok_nothing;
 
   current = retval = NULL;
@@ -344,6 +344,18 @@ parse_netrc (const char *path)
                 premature_token = "account";
               break;
 
+              /* We don't handle the port keyword at all.  */
+            case tok_port:
+              if (!current)
+                premature_token = "port";
+              break;
+
+              /* We don't handle the force keyword at all.  */
+            case tok_force:
+              if (!current)
+                premature_token = "force";
+              break;
+
               /* We handle tok_nothing below this switch.  */
             case tok_nothing:
               break;
@@ -365,10 +377,10 @@ parse_netrc (const char *path)
               /* Fetch the next token.  */
               if (!strcmp (tok, "account"))
                 last_token = tok_account;
+
               else if (!strcmp (tok, "default"))
-                {
                   maybe_add_to_list (&current, &retval);
-                }
+
               else if (!strcmp (tok, "login"))
                 last_token = tok_login;
 
@@ -381,6 +393,16 @@ parse_netrc (const char *path)
               else if (!strcmp (tok, "password"))
                 last_token = tok_password;
 
+				  /* GNU extensions 'port' and 'force', not operational
+					* see https://www.gnu.org/software/emacs/manual/html_node/gnus/NNTP.html#index-nntp_002dauthinfo_002dfunction-2003
+					* see https://savannah.gnu.org/bugs/index.php?52066
+					*/
+              else if (!strcmp (tok, "port"))
+                last_token = tok_port;
+
+              else if (!strcmp (tok, "force"))
+                last_token = tok_force;
+
               else
                 fprintf (stderr, _("%s: %s:%d: unknown token \"%s\"\n"),
                          exec_name, path, ln, tok);

src/options.h

@@ -43,6 +43,7 @@ struct options
   bool quiet;                   /* Are we quiet? */
   int ntry;                     /* Number of tries per URL */
   bool retry_connrefused;       /* Treat CONNREFUSED as non-fatal. */
+  char *retry_on_http_error;    /* Treat given HTTP errors as non-fatal. */
   bool background;              /* Whether we should work in background. */
   bool ignore_length;           /* Do we heed content-length at all?  */
   bool recursive;               /* Are we recursive? */
@@ -61,7 +62,7 @@ struct options
   bool add_hostdir;             /* Do we add hostname directory? */
   bool protocol_directories;    /* Whether to prepend "http"/"ftp" to dirs. */
   bool noclobber;               /* Disables clobbering of existing data. */
-  bool unlink;                  /* remove file before clobbering */
+  bool unlink_requested;        /* remove file before clobbering */
   char *dir_prefix;             /* The top of directory tree */
   char *lfilename;              /* Log filename */
   char *input_filename;         /* Input filename */
@@ -325,6 +326,14 @@ struct options
                                    name. */
   bool report_bps;              /*Output bandwidth in bits format*/
 
+#ifdef HAVE_LIBZ
+  enum compression_options {
+    compression_auto,
+    compression_gzip,
+    compression_none
+  } compression;                /* type of HTTP compression to use */
+#endif
+
   char *rejected_log;           /* The file to log rejected URLS to. */
 
 #ifdef HAVE_HSTS

src/progress.c

@@ -75,7 +75,7 @@ static struct progress_implementation implementations[] = {
 static struct progress_implementation *current_impl;
 static int current_impl_locked;
 
-/* Progress implementation used by default.  Can be overriden in
+/* Progress implementation used by default.  Can be overridden in
    wgetrc or by the fallback one.  */
 
 #define DEFAULT_PROGRESS_IMPLEMENTATION "bar"

src/recur.c

@@ -497,7 +497,7 @@ retrieve_tree (struct url *start_url_parsed, struct iri *pi)
 
       if (file
           && (opt.delete_after
-              || opt.spider /* opt.recursive is implicitely true */
+              || opt.spider /* opt.recursive is implicitly true */
               || !acceptable (file)))
         {
           /* Either --delete-after was specified, or we loaded this
@@ -698,7 +698,7 @@ download_child (const struct urlpos *upos, struct url *parent, int depth,
      for directories (no file name to match) and for non-leaf HTMLs,
      which can lead to other files that do need to be downloaded.  (-p
      automatically implies non-leaf because with -p we can, if
-     necesary, overstep the maximum depth to get the page requisites.)  */
+     necessary, overstep the maximum depth to get the page requisites.)  */
   if (u->file[0] != '\0'
       && !(has_html_suffix_p (u->file)
            /* The exception only applies to non-leaf HTMLs (but -p

src/res.c

@@ -37,12 +37,12 @@ as that of the covered work.  */
    disallow access to certain parts of the site.
 
    The first specification was written by Martijn Koster in 1994, and
-   is still available at <http://www.robotstxt.org/wc/norobots.html>.
+   is still available at <http://www.robotstxt.org/orig.html>.
    In 1996, Martijn wrote an Internet Draft specifying an improved RES
    specification; however, that work was apparently abandoned since
    the draft has expired in 1997 and hasn't been replaced since.  The
    draft is available at
-   <http://www.robotstxt.org/wc/norobots-rfc.html>.
+   <http://www.robotstxt.org/norobots-rfc.txt>.
 
    This file implements RES as specified by the draft.  Note that this
    only handles the "robots.txt" support.  The META tag that controls
@@ -428,7 +428,7 @@ free_specs (struct robot_specs *specs)
 
 /* The inner matching engine: return true if RECORD_PATH matches
    URL_PATH.  The rules for matching are described at
-   <http://www.robotstxt.org/wc/norobots-rfc.txt>, section 3.2.2.  */
+   <http://www.robotstxt.org/norobots-rfc.txt>, section 3.2.2.  */
 
 static bool
 matches (const char *record_path, const char *url_path)

src/retr.c

@@ -41,6 +41,10 @@ as that of the covered work.  */
 # include <unixio.h>            /* For delete(). */
 #endif
 
+#ifdef HAVE_LIBZ
+# include <zlib.h>
+#endif
+
 #include "exits.h"
 #include "utils.h"
 #include "retr.h"
@@ -84,6 +88,22 @@ limit_bandwidth_reset (void)
   xzero (limit_data);
 }
 
+#ifdef HAVE_LIBZ
+static voidpf
+zalloc (voidpf opaque, unsigned int items, unsigned int size)
+{
+  (void) opaque;
+  return (voidpf) xcalloc (items, size);
+}
+
+static void
+zfree (voidpf opaque, voidpf address)
+{
+  (void) opaque;
+  xfree (address);
+}
+#endif
+
 /* Limit the bandwidth by pausing the download for an amount of time.
    BYTES is the number of bytes received from the network, and TIMER
    is the timer that started at the beginning of download.  */
@@ -257,6 +277,44 @@ fd_read_body (const char *downloaded_filename, int fd, FILE *out, wgint toread,
   wgint sum_written = 0;
   wgint remaining_chunk_size = 0;
 
+#ifdef HAVE_LIBZ
+  /* try to minimize the number of calls to inflate() and write_data() per
+     call to fd_read() */
+  unsigned int gzbufsize = dlbufsize * 4;
+  char *gzbuf = NULL;
+  z_stream gzstream;
+
+  if (flags & rb_compressed_gzip)
+    {
+      gzbuf = xmalloc (gzbufsize);
+      if (gzbuf != NULL)
+        {
+          gzstream.zalloc = zalloc;
+          gzstream.zfree = zfree;
+          gzstream.opaque = Z_NULL;
+          gzstream.next_in = Z_NULL;
+          gzstream.avail_in = 0;
+
+          #define GZIP_DETECT 32 /* gzip format detection */
+          #define GZIP_WINDOW 15 /* logarithmic window size (default: 15) */
+          ret = inflateInit2 (&gzstream, GZIP_DETECT | GZIP_WINDOW);
+          if (ret != Z_OK)
+            {
+              xfree (gzbuf);
+              errno = (ret == Z_MEM_ERROR) ? ENOMEM : EINVAL;
+              ret = -1;
+              goto out;
+            }
+        }
+      else
+        {
+          errno = ENOMEM;
+          ret = -1;
+          goto out;
+        }
+    }
+#endif
+
   if (flags & rb_skip_startpos)
     skip = startpos;
 
@@ -320,6 +378,12 @@ fd_read_body (const char *downloaded_filename, int fd, FILE *out, wgint toread,
               remaining_chunk_size = strtol (line, &endl, 16);
               xfree (line);
 
+              if (remaining_chunk_size < 0)
+                {
+                  ret = -1;
+                  break;
+                }
+
               if (remaining_chunk_size == 0)
                 {
                   ret = 0;
@@ -383,12 +447,64 @@ fd_read_body (const char *downloaded_filename, int fd, FILE *out, wgint toread,
           int write_res;
 
           sum_read += ret;
-          write_res = write_data (out, out2, dlbuf, ret, &skip, &sum_written);
-          if (write_res < 0)
+
+#ifdef HAVE_LIBZ
+          if (gzbuf != NULL)
             {
-              ret = (write_res == -3) ? -3 : -2;
-              goto out;
+              int err;
+              int towrite;
+              gzstream.avail_in = ret;
+              gzstream.next_in = (unsigned char *) dlbuf;
+
+              do
+                {
+                  gzstream.avail_out = gzbufsize;
+                  gzstream.next_out = (unsigned char *) gzbuf;
+
+                  err = inflate (&gzstream, Z_NO_FLUSH);
+
+                  switch (err)
+                    {
+                    case Z_MEM_ERROR:
+                      errno = ENOMEM;
+                      ret = -1;
+                      goto out;
+                    case Z_NEED_DICT:
+                    case Z_DATA_ERROR:
+                      errno = EINVAL;
+                      ret = -1;
+                      goto out;
+                    case Z_STREAM_END:
+                      if (exact && sum_read != toread)
+                        {
+                          DEBUGP(("zlib stream ended unexpectedly after "
+                                  "%ld/%ld bytes\n", sum_read, toread));
+                        }
+                    }
+
+                  towrite = gzbufsize - gzstream.avail_out;
+                  write_res = write_data (out, out2, gzbuf, towrite, &skip,
+                                          &sum_written);
+                  if (write_res < 0)
+                    {
+                      ret = (write_res == -3) ? -3 : -2;
+                      goto out;
+                    }
+                }
+              while (gzstream.avail_out == 0);
             }
+          else
+#endif
+            {
+              write_res = write_data (out, out2, dlbuf, ret, &skip,
+                                      &sum_written);
+              if (write_res < 0)
+                {
+                  ret = (write_res == -3) ? -3 : -2;
+                  goto out;
+                }
+            }
+
           if (chunked)
             {
               remaining_chunk_size -= ret;
@@ -433,6 +549,31 @@ fd_read_body (const char *downloaded_filename, int fd, FILE *out, wgint toread,
   if (timer)
     ptimer_destroy (timer);
 
+#ifdef HAVE_LIBZ
+  if (gzbuf != NULL)
+    {
+      int err = inflateEnd (&gzstream);
+      if (ret >= 0)
+        {
+          /* with compression enabled, ret must be 0 if successful */
+          if (err == Z_OK)
+            ret = 0;
+          else
+            {
+              errno = EINVAL;
+              ret = -1;
+            }
+        }
+      xfree (gzbuf);
+
+      if (gzstream.total_in != sum_read)
+        {
+          DEBUGP(("zlib read size differs from raw read size (%lu/%lu)\n",
+                  gzstream.total_in, sum_read));
+        }
+    }
+#endif
+
   if (qtyread)
     *qtyread += sum_read;
   if (qtywritten)
@@ -963,11 +1104,16 @@ retrieve_url (struct url * orig_parsed, const char *origurl, char **file,
       u = url_parse (origurl, NULL, iri, true);
       if (u)
         {
-          DEBUGP (("[IRI fallbacking to non-utf8 for %s\n", quote (url)));
-          xfree (url);
-          url = xstrdup (u->url);
-          iri_fallbacked = 1;
-          goto redirected;
+          if (strcmp(u->url, orig_parsed->url))
+            {
+              DEBUGP (("[IRI fallbacking to non-utf8 for %s\n", quote (url)));
+              xfree (url);
+              url = xstrdup (u->url);
+              iri_fallbacked = 1;
+              goto redirected;
+            }
+          else
+              DEBUGP (("[Needn't fallback to non-utf8 for %s\n", quote (url)));
         }
       else
           DEBUGP (("[Couldn't fallback to non-utf8 for %s\n", quote (url)));
@@ -1141,7 +1287,7 @@ retrieve_from_file (const char *file, bool html, int *count)
       if (parsed_url)
           url_free (parsed_url);
 
-      if (filename && opt.delete_after && file_exists_p (filename))
+      if (filename && opt.delete_after && file_exists_p (filename, NULL))
         {
           DEBUGP (("\
 Removing file due to --delete-after in retrieve_from_file():\n"));

src/retr.h

@@ -49,7 +49,9 @@ enum {
   rb_skip_startpos = 2,
 
   /* Used by HTTP/HTTPS*/
-  rb_chunked_transfer_encoding = 4
+  rb_chunked_transfer_encoding = 4,
+
+  rb_compressed_gzip = 8
 };
 
 int fd_read_body (const char *, int, FILE *, wgint, wgint, wgint *, wgint *, double *, int, FILE *);

src/url.c

@@ -459,7 +459,7 @@ url_scheme (const char *url)
   int i;
 
   for (i = 0; supported_schemes[i].leading_string; i++)
-    if (0 == strncasecmp (url, supported_schemes[i].leading_string,
+    if (0 == c_strncasecmp (url, supported_schemes[i].leading_string,
                           strlen (supported_schemes[i].leading_string)))
       {
         if (!(supported_schemes[i].flags & scm_disabled))
@@ -925,6 +925,17 @@ url_parse (const char *url, int *error, struct iri *iri, bool percent_encode)
       url_unescape (u->host);
       host_modified = true;
 
+      /* check for invalid control characters in host name */
+      for (p = u->host; *p; p++)
+        {
+          if (c_iscntrl(*p))
+            {
+              url_free(u);
+              error_code = PE_INVALID_HOST_NAME;
+              goto error;
+            }
+        }
+
       /* Apply IDNA regardless of iri->utf8_encode status */
       if (opt.enable_iri && iri)
         {
@@ -933,7 +944,6 @@ url_parse (const char *url, int *error, struct iri *iri, bool percent_encode)
             {
               xfree (u->host);
               u->host = new;
-              u->idn_allocated = true;
               host_modified = true;
             }
         }
@@ -1212,12 +1222,7 @@ url_free (struct url *url)
 {
   if (url)
     {
-      if (url->idn_allocated) {
-        idn2_free (url->host);      /* A dummy if !defined(ENABLE_IRI) */
-        url->host = NULL;
-      }
-      else
-        xfree (url->host);
+      xfree (url->host);
 
       xfree (url->path);
       xfree (url->url);
@@ -1544,6 +1549,7 @@ append_uri_pathel (const char *b, const char *e, bool escaped,
   append_null (dest);
 }
 
+#ifdef HAVE_ICONV
 static char *
 convert_fname (char *fname)
 {
@@ -1562,9 +1568,9 @@ convert_fname (char *fname)
     to_encoding = nl_langinfo (CODESET);
 
   cd = iconv_open (to_encoding, from_encoding);
-  if (cd == (iconv_t)(-1))
-    logprintf (LOG_VERBOSE, _("Conversion from %s to %s isn't supported\n"),
-	       quote (from_encoding), quote (to_encoding));
+  if (cd == (iconv_t) (-1))
+    logprintf (LOG_VERBOSE, _ ("Conversion from %s to %s isn't supported\n"),
+               quote (from_encoding), quote (to_encoding));
   else
     {
       inlen = strlen (fname);
@@ -1573,50 +1579,62 @@ convert_fname (char *fname)
       done = 0;
 
       for (;;)
-	{
-	  if (iconv (cd, (ICONV_CONST char **) &fname, &inlen, &s, &outlen) != (size_t)(-1)
-	      && iconv (cd, NULL, NULL, &s, &outlen) != (size_t)(-1))
-	    {
-	      *(converted_fname + len - outlen - done) = '\0';
-	      iconv_close(cd);
-	      DEBUGP (("Converted file name '%s' (%s) -> '%s' (%s)\n",
-		       orig_fname, from_encoding, converted_fname, to_encoding));
-	      xfree (orig_fname);
-	      return converted_fname;
-	    }
+        {
+          errno = 0;
+          if (iconv (cd, (ICONV_CONST char **) &fname, &inlen, &s, &outlen) == 0
+              && iconv (cd, NULL, NULL, &s, &outlen) == 0)
+            {
+              *(converted_fname + len - outlen - done) = '\0';
+              iconv_close (cd);
+              DEBUGP (("Converted file name '%s' (%s) -> '%s' (%s)\n",
+                       orig_fname, from_encoding, converted_fname, to_encoding));
+              xfree (orig_fname);
+              return converted_fname;
+            }
 
-	  /* Incomplete or invalid multibyte sequence */
-	  if (errno == EINVAL || errno == EILSEQ)
-	    {
-	      logprintf (LOG_VERBOSE,
-			 _("Incomplete or invalid multibyte sequence encountered\n"));
-	      xfree (converted_fname);
-	      converted_fname = (char *)orig_fname;
-	      break;
-	    }
-	  else if (errno == E2BIG) /* Output buffer full */
-	    {
-	      done = len;
-	      len = outlen = done + inlen * 2;
-	      converted_fname = xrealloc (converted_fname, outlen + 1);
-	      s = converted_fname + done;
-	    }
-	  else /* Weird, we got an unspecified error */
-	    {
-	      logprintf (LOG_VERBOSE, _("Unhandled errno %d\n"), errno);
-	      xfree (converted_fname);
-	      converted_fname = (char *)orig_fname;
-	      break;
-	    }
-	}
+          /* Incomplete or invalid multibyte sequence */
+          if (errno == EINVAL || errno == EILSEQ || errno == 0)
+            {
+              if (errno)
+                logprintf (LOG_VERBOSE,
+                           _ ("Incomplete or invalid multibyte sequence encountered\n"));
+              else
+                logprintf (LOG_VERBOSE,
+                           _ ("Unconvertable multibyte sequence encountered\n"));
+              xfree (converted_fname);
+              converted_fname = (char *) orig_fname;
+              break;
+            }
+          else if (errno == E2BIG) /* Output buffer full */
+            {
+              done = len;
+              len = outlen = done + inlen * 2;
+              converted_fname = xrealloc (converted_fname, outlen + 1);
+              s = converted_fname + done;
+            }
+          else /* Weird, we got an unspecified error */
+            {
+              logprintf (LOG_VERBOSE, _ ("Unhandled errno %d\n"), errno);
+              xfree (converted_fname);
+              converted_fname = (char *) orig_fname;
+              break;
+            }
+        }
       DEBUGP (("Failed to convert file name '%s' (%s) -> '?' (%s)\n",
-	       orig_fname, from_encoding, to_encoding));
+               orig_fname, from_encoding, to_encoding));
     }
 
     iconv_close(cd);
 
   return converted_fname;
 }
+#else
+static char *
+convert_fname (char *fname)
+{
+  return fname;
+}
+#endif
 
 /* Append to DEST the directory structure that corresponds the
    directory part of URL's path.  For example, if the URL is
@@ -1732,6 +1750,9 @@ url_file_name (const struct url *u, char *replaced_filename)
         fname_len_check = concat_strings (u_file, FN_QUERY_SEP_STR, u->query, NULL);
       else
         fname_len_check = strdupdelim (u_file, u_file + strlen (u_file));
+
+      /* convert before concat with local path */
+      fname_len_check = convert_fname (fname_len_check);
     }
   else
     {
@@ -1793,8 +1814,6 @@ url_file_name (const struct url *u, char *replaced_filename)
 
   xfree (temp_fnres.base);
 
-  fname = convert_fname (fname);
-
   /* Check the cases in which the unique extensions are not used:
      1) Clobbering is turned off (-nc).
      2) Retrieval with regetting.
@@ -1806,7 +1825,7 @@ url_file_name (const struct url *u, char *replaced_filename)
      directory (see `mkalldirs' for explanation).  */
 
   if (ALLOW_CLOBBER
-      && !(file_exists_p (fname) && !file_non_directory_p (fname)))
+      && !(file_exists_p (fname, NULL) && !file_non_directory_p (fname)))
     {
       unique = fname;
     }

src/url.h

@@ -99,10 +99,6 @@ struct url
   /* Username and password (unquoted). */
   char *user;
   char *passwd;
-
-  /* 'host' is allocated by idn2_lookup_u8() via idn_encode().
-   * Call 'idn2_free()' to free this memory. */
-  bool idn_allocated;
 };
 
 /* Function declarations */

src/utils.c

@@ -45,6 +45,7 @@ as that of the covered work.  */
 #include <assert.h>
 #include <stdarg.h>
 #include <locale.h>
+#include <errno.h>
 
 #if HAVE_UTIME
 # include <sys/types.h>
@@ -586,21 +587,42 @@ remove_link (const char *file)
   return err;
 }
 
-/* Does FILENAME exist?  This is quite a lousy implementation, since
-   it supplies no error codes -- only a yes-or-no answer.  Thus it
-   will return that a file does not exist if, e.g., the directory is
-   unreadable.  I don't mind it too much currently, though.  The
-   proper way should, of course, be to have a third, error state,
-   other than true/false, but that would introduce uncalled-for
-   additional complexity to the callers.  */
+/* Does FILENAME exist? */
 bool
-file_exists_p (const char *filename)
+file_exists_p (const char *filename, file_stats_t *fstats)
 {
-#ifdef HAVE_ACCESS
-  return access (filename, F_OK) >= 0;
-#else
   struct stat buf;
-  return stat (filename, &buf) >= 0;
+
+#if defined(WINDOWS) || defined(__VMS)
+    int ret = stat (filename, &buf);
+    if (ret >= 0)
+    {
+      if (fstats != NULL)
+        fstats->access_err = errno;
+    }
+    return ret >= 0;
+#else
+  errno = 0;
+  if (stat (filename, &buf) == 0 && S_ISREG(buf.st_mode) &&
+              (((S_IRUSR & buf.st_mode) && (getuid() == buf.st_uid))  ||
+               ((S_IRGRP & buf.st_mode) && group_member(buf.st_gid))  ||
+                (S_IROTH & buf.st_mode))) {
+    if (fstats != NULL)
+    {
+      fstats->access_err = 0;
+      fstats->st_ino = buf.st_ino;
+      fstats->st_dev = buf.st_dev;
+    }
+    return true;
+  }
+  else
+  {
+    if (fstats != NULL)
+      fstats->access_err = (errno == 0 ? EACCES : errno);
+    errno = 0;
+    return false;
+  }
+  /* NOTREACHED */
 #endif
 }
 
@@ -668,7 +690,7 @@ unique_name_1 (const char *prefix)
 
   do
     number_to_string (template_tail, count++);
-  while (file_exists_p (template));
+  while (file_exists_p (template, NULL));
 
   return xstrdup (template);
 }
@@ -696,7 +718,7 @@ unique_name (const char *file, bool allow_passthrough)
 {
   /* If the FILE itself doesn't exist, return it without
      modification. */
-  if (!file_exists_p (file))
+  if (!file_exists_p (file, NULL))
     return allow_passthrough ? (char *)file : xstrdup (file);
 
   /* Otherwise, find a numeric suffix that results in unused file name
@@ -825,7 +847,7 @@ fopen_excl (const char *fname, int binary)
   /* Manually check whether the file exists.  This is prone to race
      conditions, but systems without O_EXCL haven't deserved
      better.  */
-  if (file_exists_p (fname))
+  if (file_exists_p (fname, NULL))
     {
       errno = EEXIST;
       return NULL;
@@ -834,6 +856,113 @@ fopen_excl (const char *fname, int binary)
 #endif /* not O_EXCL */
 }
 
+/* fopen_stat() assumes that file_exists_p() was called earlier.
+   file_stats_t passed to this function was returned from file_exists_p()
+   This is to prevent TOCTTOU race condition.
+   Details : FIO45-C from https://www.securecoding.cert.org/
+   Note that for creating a new file, this check is not useful
+
+   Input:
+     fname  => Name of file to open
+     mode   => File open mode
+     fstats => Saved file_stats_t about file that was checked for existence
+
+   Returns:
+     NULL if there was an error
+     FILE * of opened file stream
+*/
+FILE *
+fopen_stat(const char *fname, const char *mode, file_stats_t *fstats)
+{
+  int fd;
+  FILE *fp;
+  struct stat fdstats;
+
+  fp = fopen (fname, mode);
+  if (fp == NULL)
+  {
+    logprintf (LOG_NOTQUIET, _("Failed to Fopen file %s\n"), fname);
+    return NULL;
+  }
+  fd = fileno (fp);
+  if (fd < 0)
+  {
+    logprintf (LOG_NOTQUIET, _("Failed to get FD for file %s\n"), fname);
+    fclose (fp);
+    return NULL;
+  }
+  memset(&fdstats, 0, sizeof(fdstats));
+  if (fstat (fd, &fdstats) == -1)
+  {
+    logprintf (LOG_NOTQUIET, _("Failed to stat file %s, (check permissions)\n"), fname);
+    fclose (fp);
+    return NULL;
+  }
+#if !(defined(WINDOWS) || defined(__VMS))
+  if (fstats != NULL &&
+      (fdstats.st_dev != fstats->st_dev ||
+       fdstats.st_ino != fstats->st_ino))
+  {
+    /* File changed since file_exists_p() : NOT SAFE */
+    logprintf (LOG_NOTQUIET, _("File %s changed since the last check. Security check failed."), fname);
+    fclose (fp);
+    return NULL;
+  }
+#endif
+
+  return fp;
+}
+
+/* open_stat assumes that file_exists_p() was called earlier to save file_stats
+   file_stats_t passed to this function was returned from file_exists_p()
+   This is to prevent TOCTTOU race condition.
+   Details : FIO45-C from https://www.securecoding.cert.org/
+   Note that for creating a new file, this check is not useful
+
+
+   Input:
+     fname  => Name of file to open
+     flags  => File open flags
+     mode   => File open mode
+     fstats => Saved file_stats_t about file that was checked for existence
+
+   Returns:
+     -1 if there was an error
+     file descriptor of opened file stream
+*/
+int
+open_stat(const char *fname, int flags, mode_t mode, file_stats_t *fstats)
+{
+  int fd;
+  struct stat fdstats;
+
+  fd = open (fname, flags, mode);
+  if (fd < 0)
+  {
+    logprintf (LOG_NOTQUIET, _("Failed to open file %s, reason :%s\n"), fname, strerror(errno));
+    return -1;
+  }
+  memset(&fdstats, 0, sizeof(fdstats));
+  if (fstat (fd, &fdstats) == -1)
+  {
+    logprintf (LOG_NOTQUIET, _("Failed to stat file %s, error: %s\n"), fname, strerror(errno));
+    return -1;
+  }
+#if !(defined(WINDOWS) || defined(__VMS))
+  if (fstats != NULL &&
+      (fdstats.st_dev != fstats->st_dev ||
+       fdstats.st_ino != fstats->st_ino))
+  {
+    /* File changed since file_exists_p() : NOT SAFE */
+    logprintf (LOG_NOTQUIET, _("Trying to open file %s but it changed since last check. Security check failed."), fname);
+    close (fd);
+    return -1;
+  }
+#endif
+
+  return fd;
+}
+
 /* Create DIRECTORY.  If some of the pathname components of DIRECTORY
    are missing, create them first.  In case any mkdir() call fails,
    return its error status.  Returns 0 on successful completion.
@@ -862,7 +991,7 @@ make_directory (const char *directory)
       /* Check whether the directory already exists.  Allow creation of
          of intermediate directories to fail, as the initial path components
          are not necessarily directories!  */
-      if (!file_exists_p (dir))
+      if (!file_exists_p (dir, NULL))
         ret = mkdir (dir, 0777);
       else
         ret = 0;
@@ -1606,7 +1735,7 @@ numdigit (wgint number)
 {
   int cnt = 1;
   if (number < 0)
-    ++cnt;                      /* accomodate '-' */
+    ++cnt;                      /* accommodate '-' */
   while ((number /= 10) != 0)
     ++cnt;
   return cnt;
@@ -2206,7 +2335,7 @@ wget_base64_encode (const void *data, size_t length, char *dest)
 
 /* Decode data from BASE64 (a null-terminated string) into memory
    pointed to by DEST.  DEST is assumed to be large enough to
-   accomodate the decoded data, which is guaranteed to be no more than
+   accommodate the decoded data, which is guaranteed to be no more than
    3/4*strlen(base64).
 
    Since DEST is assumed to contain binary data, it is not
@@ -2217,7 +2346,7 @@ wget_base64_encode (const void *data, size_t length, char *dest)
    This function originates from Free Recode.  */
 
 ssize_t
-wget_base64_decode (const char *base64, void *dest)
+wget_base64_decode (const char *base64, void *dest, size_t size)
 {
   /* Table of base64 values for first 128 characters.  Note that this
      assumes ASCII (but so does Wget in other places).  */
@@ -2241,7 +2370,8 @@ wget_base64_decode (const char *base64, void *dest)
 #define IS_BASE64(c) ((IS_ASCII (c) && BASE64_CHAR_TO_VALUE (c) >= 0) || c == '=')
 
   const char *p = base64;
-  char *q = dest;
+  unsigned char *q = dest;
+  ssize_t n = 0;
 
   while (1)
     {
@@ -2263,7 +2393,12 @@ wget_base64_decode (const char *base64, void *dest)
       if (c == '=' || !IS_BASE64 (c))
         return -1;              /* illegal char while decoding base64 */
       value |= BASE64_CHAR_TO_VALUE (c) << 12;
-      *q++ = value >> 16;
+      if (size)
+        {
+          *q++ = value >> 16;
+          size--;
+        }
+      n++;
 
       /* Process third byte of a quadruplet.  */
       NEXT_CHAR (c, p);
@@ -2283,7 +2418,12 @@ wget_base64_decode (const char *base64, void *dest)
         }
 
       value |= BASE64_CHAR_TO_VALUE (c) << 6;
-      *q++ = 0xff & value >> 8;
+      if (size)
+        {
+          *q++ = 0xff & value >> 8;
+          size--;
+        }
+      n++;
 
       /* Process fourth byte of a quadruplet.  */
       NEXT_CHAR (c, p);
@@ -2295,12 +2435,17 @@ wget_base64_decode (const char *base64, void *dest)
         return -1;              /* illegal char while decoding base64 */
 
       value |= BASE64_CHAR_TO_VALUE (c);
-      *q++ = 0xff & value;
+      if (size)
+        {
+          *q++ = 0xff & value;
+          size--;
+        }
+      n++;
     }
 #undef IS_BASE64
 #undef BASE64_CHAR_TO_VALUE
 
-  return q - (char *) dest;
+  return n;
 }
 
 #ifdef HAVE_LIBPCRE
@@ -2597,7 +2742,7 @@ wg_pubkey_pem_to_der (const char *pem, unsigned char **der, size_t *der_len)
 
   base64data = xmalloc (BASE64_LENGTH(stripped_pem_count));
 
-  size = wget_base64_decode (stripped_pem, base64data);
+  size = wget_base64_decode (stripped_pem, base64data, BASE64_LENGTH(stripped_pem_count));
 
   if (size < 0) {
     xfree (base64data);           /* malformed base64 from server */
@@ -2636,54 +2781,65 @@ wg_pin_peer_pubkey (const char *pinnedpubkey, const char *pubkey, size_t pubkeyl
     return result;
 
   /* only do this if pinnedpubkey starts with "sha256//", length 8 */
-  if (strncmp (pinnedpubkey, "sha256//", 8) == 0) {
-    /* compute sha256sum of public key */
-    sha256sumdigest = xmalloc (SHA256_DIGEST_SIZE);
-    sha256_buffer (pubkey, pubkeylen, sha256sumdigest);
-    expectedsha256sumdigest = xmalloc (SHA256_DIGEST_SIZE + 1);
+  if (strncmp (pinnedpubkey, "sha256//", 8) == 0)
+    {
+      /* compute sha256sum of public key */
+      sha256sumdigest = xmalloc (SHA256_DIGEST_SIZE);
+      sha256_buffer (pubkey, pubkeylen, sha256sumdigest);
+      expectedsha256sumdigest = xmalloc (SHA256_DIGEST_SIZE);
 
-    /* it starts with sha256//, copy so we can modify it */
-    pinkeylen = strlen (pinnedpubkey) + 1;
-    pinkeycopy = xmalloc (pinkeylen);
-    memcpy (pinkeycopy, pinnedpubkey, pinkeylen);
+      /* it starts with sha256//, copy so we can modify it */
+      pinkeylen = strlen (pinnedpubkey) + 1;
+      pinkeycopy = xmalloc (pinkeylen);
+      memcpy (pinkeycopy, pinnedpubkey, pinkeylen);
 
-    /* point begin_pos to the copy, and start extracting keys */
-    begin_pos = pinkeycopy;
-    do
-      {
-        end_pos = strstr (begin_pos, ";sha256//");
-        /*
-         * if there is an end_pos, null terminate,
-         * otherwise it'll go to the end of the original string
-         */
-        if (end_pos)
-          end_pos[0] = '\0';
+      /* point begin_pos to the copy, and start extracting keys */
+      begin_pos = pinkeycopy;
+      do
+        {
+          end_pos = strstr (begin_pos, ";sha256//");
+          /*
+           * if there is an end_pos, null terminate,
+           * otherwise it'll go to the end of the original string
+           */
+          if (end_pos)
+            end_pos[0] = '\0';
 
-        /* decode base64 pinnedpubkey, 8 is length of "sha256//" */
-        decoded_hash_length = wget_base64_decode (begin_pos + 8, expectedsha256sumdigest);
-        /* if valid base64, compare sha256 digests directly */
-        if (SHA256_DIGEST_SIZE == decoded_hash_length &&
-           !memcmp (sha256sumdigest, expectedsha256sumdigest, SHA256_DIGEST_SIZE)) {
-          result = true;
-          break;
+          /* decode base64 pinnedpubkey, 8 is length of "sha256//" */
+          decoded_hash_length = wget_base64_decode (begin_pos + 8, expectedsha256sumdigest, SHA256_DIGEST_SIZE);
+
+          /* if valid base64, compare sha256 digests directly */
+          if (SHA256_DIGEST_SIZE == decoded_hash_length)
+            {
+              if (!memcmp (sha256sumdigest, expectedsha256sumdigest, SHA256_DIGEST_SIZE))
+                {
+                  result = true;
+                  break;
+                }
+            }
+          else
+            logprintf (LOG_VERBOSE, _ ("Skipping key with wrong size (%d/%d): %s\n"),
+                       (strlen (begin_pos + 8) * 3) / 4, SHA256_DIGEST_SIZE,
+                       quote (begin_pos + 8));
+
+          /*
+           * change back the null-terminator we changed earlier,
+           * and look for next begin
+           */
+          if (end_pos)
+            {
+              end_pos[0] = ';';
+              begin_pos = strstr (end_pos, "sha256//");
+            }
         }
+      while (end_pos && begin_pos);
 
-        /*
-         * change back the null-terminator we changed earlier,
-         * and look for next begin
-         */
-        if (end_pos) {
-          end_pos[0] = ';';
-          begin_pos = strstr (end_pos, "sha256//");
-        }
-      } while (end_pos && begin_pos);
+      xfree (sha256sumdigest);
+      xfree (expectedsha256sumdigest);
+      xfree (pinkeycopy);
 
-    xfree (sha256sumdigest);
-    xfree (expectedsha256sumdigest);
-    xfree (pinkeycopy);
-
-    return result;
-  }
+      return result;
+    }
 
   /* fall back to assuming this is a file path */
   fm = wget_read_file (pinnedpubkey);
@@ -2703,11 +2859,12 @@ wg_pin_peer_pubkey (const char *pinnedpubkey, const char *pubkey, size_t pubkeyl
     goto cleanup;
 
   /* If the sizes are the same, it can't be base64 encoded, must be der */
-  if (pubkeylen == size) {
-    if (!memcmp (pubkey, fm->content, pubkeylen))
-      result = true;
-    goto cleanup;
-  }
+  if (pubkeylen == size)
+    {
+      if (!memcmp (pubkey, fm->content, pubkeylen))
+        result = true;
+      goto cleanup;
+    }
 
   /*
    * Otherwise we will assume it's PEM and try to decode it
@@ -2729,7 +2886,7 @@ wg_pin_peer_pubkey (const char *pinnedpubkey, const char *pubkey, size_t pubkeyl
   if (pubkeylen == pem_len && !memcmp (pubkey, pem_ptr, pubkeylen))
     result = true;
 
- cleanup:
+cleanup:
   xfree (buf);
   xfree (pem_ptr);
   wget_read_file_free (fm);

src/utils.h

@@ -78,15 +78,23 @@ void fork_to_background (void);
 char *aprintf (const char *, ...) GCC_FORMAT_ATTR (1, 2);
 char *concat_strings (const char *, ...);
 
+typedef struct file_stat_s {
+  int access_err;               /* Error in accecssing file : Not present vs permission */
+  ino_t st_ino;                 /* st_ino from stats() on the file before open() */
+  dev_t st_dev;                 /* st_dev from stats() on the file before open() */
+} file_stats_t;
+
 void touch (const char *, time_t);
 int remove_link (const char *);
-bool file_exists_p (const char *);
+bool file_exists_p (const char *, file_stats_t *);
 bool file_non_directory_p (const char *);
 wgint file_size (const char *);
 int make_directory (const char *);
 char *unique_name (const char *, bool);
 FILE *unique_create (const char *, bool, char **);
 FILE *fopen_excl (const char *, int);
+FILE *fopen_stat (const char *, const char *, file_stats_t *);
+int   open_stat  (const char *, int, mode_t, file_stats_t *);
 char *file_merge (const char *, const char *);
 
 int fnmatch_nocase (const char *, const char *, int);
@@ -141,7 +149,7 @@ void xsleep (double);
 #define BASE64_LENGTH(len) (4 * (((len) + 2) / 3))
 
 size_t wget_base64_encode (const void *, size_t, char *);
-ssize_t wget_base64_decode (const char *, void *);
+ssize_t wget_base64_decode (const char *, void *, size_t);
 
 #ifdef HAVE_LIBPCRE
 void *compile_pcre_regex (const char *);

src/warc.c

@@ -32,6 +32,7 @@ as that of the covered work.  */
 #include "utils.h"
 #include "version.h"
 #include "dirname.h"
+#include "url.h"
 
 #include <stdio.h>
 #include <stdlib.h>
@@ -1365,6 +1366,8 @@ warc_write_cdx_record (const char *url, const char *timestamp_str,
     mime_type = "-";
   if (redirect_location == NULL || strlen(redirect_location) == 0)
     redirect_location = "-";
+  else
+    redirect_location = url_escape(redirect_location);
 
   number_to_string (offset_string, offset);
 
@@ -1413,7 +1416,7 @@ warc_write_revisit_record (const char *url, const char *timestamp_str,
   warc_write_header ("WARC-Refers-To", refers_to);
   warc_write_header ("WARC-Profile", "http://netpreserve.org/warc/1.0/revisit/identical-payload-digest");
   warc_write_header ("WARC-Truncated", "length");
-  warc_write_header ("WARC-Target-URI", url);
+  warc_write_header_uri ("WARC-Target-URI", url);
   warc_write_date_header (timestamp_str);
   warc_write_ip_header (ip);
   warc_write_header ("Content-Type", "application/http;msgtype=response");
@@ -1505,7 +1508,7 @@ warc_write_response_record (const char *url, const char *timestamp_str,
   warc_write_header ("WARC-Record-ID", response_uuid);
   warc_write_header ("WARC-Warcinfo-ID", warc_current_warcinfo_uuid_str);
   warc_write_header ("WARC-Concurrent-To", concurrent_to_uuid);
-  warc_write_header ("WARC-Target-URI", url);
+  warc_write_header_uri ("WARC-Target-URI", url);
   warc_write_date_header (timestamp_str);
   warc_write_ip_header (ip);
   warc_write_header ("WARC-Block-Digest", block_digest);
@@ -1562,7 +1565,7 @@ warc_write_record (const char *record_type, const char *resource_uuid,
   warc_write_header ("WARC-Record-ID", resource_uuid);
   warc_write_header ("WARC-Warcinfo-ID", warc_current_warcinfo_uuid_str);
   warc_write_header ("WARC-Concurrent-To", concurrent_to_uuid);
-  warc_write_header ("WARC-Target-URI", url);
+  warc_write_header_uri ("WARC-Target-URI", url);
   warc_write_date_header (timestamp_str);
   warc_write_ip_header (ip);
   warc_write_digest_headers (body, payload_offset);

src/xattr.h

@@ -30,14 +30,14 @@ int set_file_metadata (const char *origin_url, const char *referrer_url, FILE *f
 #elif defined(__APPLE__)
 /* libc on OS/X has fsetxattr (6 arguments). */
 #  include <sys/xattr.h>
-#  define fsetxattr (file, name, buffer, size, flags) \
+#  define fsetxattr(file, name, buffer, size, flags) \
           fsetxattr ((file), (name), (buffer), (size), 0, (flags))
 #  define USE_XATTR
 #elif defined(__FreeBSD_version) && (__FreeBSD_version > 500000)
 /* FreeBSD */
 #  include <sys/types.h>
 #  include <sys/extattr.h>
-#  define fsetxattr (file, name, buffer, size, flags) \
+#  define fsetxattr(file, name, buffer, size, flags) \
           extattr_set_fd ((file), EXTATTR_NAMESPACE_USER, (name), (buffer), (size))
 #  define USE_XATTR
 #endif

testenv/Makefile.am

@@ -75,6 +75,10 @@ if HAVE_PYTHON3
   TESTS = Test-504.py                               \
     Test-auth-basic-fail.py                         \
     Test-auth-basic.py                              \
+    Test-auth-basic-netrc.py                        \
+    Test-auth-basic-netrc-user-given.py             \
+    Test-auth-basic-netrc-pass-given.py             \
+    Test-auth-basic-no-netrc-fail.py                \
     Test-auth-both.py                               \
     Test-auth-digest.py                             \
     Test-auth-no-challenge.py                       \

testenv/README

@@ -4,7 +4,7 @@ Install Instructions:
 ================================================================================
 
 This Test Suite exploits the Parallel Test Harness available in GNU Autotools.
-Since it uses features from a relatively recent verion of Autotools, the minimum
+Since it uses features from a relatively recent version of Autotools, the minimum
 required version as been bumped up to 1.11.
 Run the './configure' command to generate the Makefile and then run 'make check'
 to execute the Test Suite. Use the '-j n' option with 'make check' to execute
@@ -122,7 +122,7 @@ This would be very helpful to future contributors.
 Each File in the Test must be represented as a WgetFile object. The WgetFile
 Class has the following prototype:
 WgetFile (str name, str contents, str timestamp, dict rules)
-None except name is a mandatory paramter, one may pass only those parameters
+None except name is a mandatory parameter, one may pass only those parameters
 that are required by the File object.
 
 The timestamp string should be in a format: "YYYY-MM-DD HH:MM:SS" in UTC zone.
@@ -288,7 +288,7 @@ Some amount of work still remains to be done.
     * Support parallel-wget branch
         * Support to spawn multiple servers is already in place. Need to handle
         multiple requests to a server simultaneously. Use THreading MixIn.
-    * SSL Tests. Use xyne's HTTPS server implemention
+    * SSL Tests. Use xyne's HTTPS server implementation
     * Complete support for FTP Tests
     * IRI Support. This shouldn't require much effort
 

testenv/Test--rejected-log.py

@@ -14,7 +14,7 @@ mainpage = """
 </head>
 <body>
   <p>
-    Recurse to a <a href="http://127.0.0.1:{{port}}/secondpage.html">second page</a>.
+    Recurse to a <a href="http://localhost:{{port}}/secondpage.html">second page</a>.
   </p>
 </body>
 </html>
@@ -27,8 +27,8 @@ secondpage = """
 </head>
 <body>
   <p>
-    Recurse to a <a href="http://127.0.0.1:{{port}}/thirdpage.html">third page</a>.
-    Try the blacklisted <a href="http://127.0.0.1:{{port}}/index.html">main page</a>.
+    Recurse to a <a href="http://localhost:{{port}}/thirdpage.html">third page</a>.
+    Try the blacklisted <a href="http://localhost:{{port}}/index.html">main page</a>.
   </p>
 </body>
 </html>
@@ -41,7 +41,7 @@ thirdpage = """
 </head>
 <body>
   <p>
-    Try a hidden <a href="http://127.0.0.1:{{port}}/dummy.txt">dummy file</a>.
+    Try a hidden <a href="http://localhost:{{port}}/dummy.txt">dummy file</a>.
     Try to leave to <a href="http://no.such.domain/">another domain</a>.
   </p>
 </body>
@@ -55,9 +55,9 @@ Disallow: /dummy.txt
 
 log = """\
 REASON\tU_URL\tU_SCHEME\tU_HOST\tU_PORT\tU_PATH\tU_PARAMS\tU_QUERY\tU_FRAGMENT\tP_URL\tP_SCHEME\tP_HOST\tP_PORT\tP_PATH\tP_PARAMS\tP_QUERY\tP_FRAGMENT
-BLACKLIST\thttp%3A//127.0.0.1%3A{{port}}/index.html\tSCHEME_HTTP\t127.0.0.1\t{{port}}\tindex.html\t\t\t\thttp%3A//127.0.0.1%3A{{port}}/secondpage.html\tSCHEME_HTTP\t127.0.0.1\t{{port}}\tsecondpage.html\t\t\t
-ROBOTS\thttp%3A//127.0.0.1%3A{{port}}/dummy.txt\tSCHEME_HTTP\t127.0.0.1\t{{port}}\tdummy.txt\t\t\t\thttp%3A//127.0.0.1%3A{{port}}/thirdpage.html\tSCHEME_HTTP\t127.0.0.1\t{{port}}\tthirdpage.html\t\t\t
-SPANNEDHOST\thttp%3A//no.such.domain/\tSCHEME_HTTP\tno.such.domain\t80\t\t\t\t\thttp%3A//127.0.0.1%3A{{port}}/thirdpage.html\tSCHEME_HTTP\t127.0.0.1\t{{port}}\tthirdpage.html\t\t\t
+BLACKLIST\thttp%3A//localhost%3A{{port}}/index.html\tSCHEME_HTTP\tlocalhost\t{{port}}\tindex.html\t\t\t\thttp%3A//localhost%3A{{port}}/secondpage.html\tSCHEME_HTTP\tlocalhost\t{{port}}\tsecondpage.html\t\t\t
+ROBOTS\thttp%3A//localhost%3A{{port}}/dummy.txt\tSCHEME_HTTP\tlocalhost\t{{port}}\tdummy.txt\t\t\t\thttp%3A//localhost%3A{{port}}/thirdpage.html\tSCHEME_HTTP\tlocalhost\t{{port}}\tthirdpage.html\t\t\t
+SPANNEDHOST\thttp%3A//no.such.domain/\tSCHEME_HTTP\tno.such.domain\t80\t\t\t\t\thttp%3A//localhost%3A{{port}}/thirdpage.html\tSCHEME_HTTP\tlocalhost\t{{port}}\tthirdpage.html\t\t\t
 """
 
 dummyfile = "Don't care."

testenv/Test--spider-r.py

@@ -14,8 +14,8 @@ mainpage = """
 </head>
 <body>
   <p>
-    Some text and a link to a <a href="http://127.0.0.1:{{port}}/secondpage.html">second page</a>.
-    Also, a <a href="http://127.0.0.1:{{port}}/nonexistent">broken link</a>.
+    Some text and a link to a <a href="http://localhost:{{port}}/secondpage.html">second page</a>.
+    Also, a <a href="http://localhost:{{port}}/nonexistent">broken link</a>.
   </p>
 </body>
 </html>
@@ -29,8 +29,8 @@ secondpage = """
 </head>
 <body>
   <p>
-    Some text and a link to a <a href="http://127.0.0.1:{{port}}/thirdpage.html">third page</a>.
-    Also, a <a href="http://127.0.0.1:{{port}}/nonexistent">broken link</a>.
+    Some text and a link to a <a href="http://localhost:{{port}}/thirdpage.html">third page</a>.
+    Also, a <a href="http://localhost:{{port}}/nonexistent">broken link</a>.
   </p>
 </body>
 </html>
@@ -43,8 +43,8 @@ thirdpage = """
 </head>
 <body>
   <p>
-    Some text and a link to a <a href="http://127.0.0.1:{{port}}/dummy.txt">text file</a>.
-    Also, another <a href="http://127.0.0.1:{{port}}/againnonexistent">broken link</a>.
+    Some text and a link to a <a href="http://localhost:{{port}}/dummy.txt">text file</a>.
+    Also, another <a href="http://localhost:{{port}}/againnonexistent">broken link</a>.
   </p>
 </body>
 </html>

testenv/Test-auth-basic-netrc-pass-given.py

@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+from sys import exit
+from test.http_test import HTTPTest
+from misc.wget_file import WgetFile
+
+"""
+    This test ensures Wget uses credentials from .netrc for Basic Authorization Negotiation.
+    In this case we test that .netrc credentials are used in case only
+    password is given on the command line.
+    Also, we ensure that Wget saves the host after a successful auth and
+    doesn't wait for a challenge the second time.
+"""
+############# File Definitions ###############################################
+File1 = "I am an invisble man."
+File2 = "I too am an invisible man."
+
+User = "Sauron"
+Password = "TheEye"
+
+File1_rules = {
+    "Authentication"    : {
+        "Type"          : "Basic",
+        "User"          : User,
+        "Pass"          : Password
+    }
+}
+File2_rules = {
+    "ExpectHeader"      : {
+        "Authorization" : "Basic U2F1cm9uOlRoZUV5ZQ=="
+    }
+}
+
+Netrc = "machine localhost\n\tlogin {0}".format(User)
+
+A_File = WgetFile ("File1", File1, rules=File1_rules)
+B_File = WgetFile ("File2", File2, rules=File2_rules)
+Netrc_File = WgetFile (".netrc", Netrc)
+
+WGET_OPTIONS = "--password={0}".format(Password)
+WGET_URLS = [["File1", "File2"]]
+
+Files = [[A_File, B_File]]
+LocalFiles = [Netrc_File]
+
+ExpectedReturnCode = 0
+ExpectedDownloadedFiles = [A_File, B_File, Netrc_File]
+
+################ Pre and Post Test Hooks #####################################
+pre_test = {
+    "ServerFiles"       : Files,
+    "LocalFiles"        : LocalFiles
+}
+test_options = {
+    "WgetCommands"      : WGET_OPTIONS,
+    "Urls"              : WGET_URLS
+}
+post_test = {
+    "ExpectedFiles"     : ExpectedDownloadedFiles,
+    "ExpectedRetcode"   : ExpectedReturnCode
+}
+
+err = HTTPTest (
+                pre_hook=pre_test,
+                test_params=test_options,
+                post_hook=post_test
+).begin ()
+
+exit (err)

testenv/Test-auth-basic-netrc-user-given.py

@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+from sys import exit
+from test.http_test import HTTPTest
+from misc.wget_file import WgetFile
+
+"""
+    This test ensures Wget uses credentials from .netrc for Basic Authorization Negotiation.
+    In this case we test that .netrc credentials are used in case only
+    user login is given on the command line.
+    Also, we ensure that Wget saves the host after a successful auth and
+    doesn't wait for a challenge the second time.
+"""
+############# File Definitions ###############################################
+File1 = "I am an invisble man."
+File2 = "I too am an invisible man."
+
+User = "Sauron"
+Password = "TheEye"
+
+File1_rules = {
+    "Authentication"    : {
+        "Type"          : "Basic",
+        "User"          : User,
+        "Pass"          : Password
+    }
+}
+File2_rules = {
+    "ExpectHeader"      : {
+        "Authorization" : "Basic U2F1cm9uOlRoZUV5ZQ=="
+    }
+}
+
+Netrc = "machine localhost\n\tlogin {0}\n\tpassword {1}".format(User, Password)
+
+A_File = WgetFile ("File1", File1, rules=File1_rules)
+B_File = WgetFile ("File2", File2, rules=File2_rules)
+Netrc_File = WgetFile (".netrc", Netrc)
+
+WGET_OPTIONS = "--user={0}".format(User)
+WGET_URLS = [["File1", "File2"]]
+
+Files = [[A_File, B_File]]
+LocalFiles = [Netrc_File]
+
+ExpectedReturnCode = 0
+ExpectedDownloadedFiles = [A_File, B_File, Netrc_File]
+
+################ Pre and Post Test Hooks #####################################
+pre_test = {
+    "ServerFiles"       : Files,
+    "LocalFiles"        : LocalFiles
+}
+test_options = {
+    "WgetCommands"      : WGET_OPTIONS,
+    "Urls"              : WGET_URLS
+}
+post_test = {
+    "ExpectedFiles"     : ExpectedDownloadedFiles,
+    "ExpectedRetcode"   : ExpectedReturnCode
+}
+
+err = HTTPTest (
+                pre_hook=pre_test,
+                test_params=test_options,
+                post_hook=post_test
+).begin ()
+
+exit (err)

testenv/Test-auth-basic-netrc.py

@@ -0,0 +1,66 @@
+#!/usr/bin/env python3
+from sys import exit
+from test.http_test import HTTPTest
+from misc.wget_file import WgetFile
+
+"""
+    This test ensures Wget uses credentials from .netrc for Basic Authorization Negotiation.
+    In this case we test that .netrc credentials are used in case no user
+    login and no password is given on the command line.
+    Also, we ensure that Wget saves the host after a successful auth and
+    doesn't wait for a challenge the second time.
+"""
+############# File Definitions ###############################################
+File1 = "I am an invisble man."
+File2 = "I too am an invisible man."
+
+User = "Sauron"
+Password = "TheEye"
+
+File1_rules = {
+    "Authentication"    : {
+        "Type"          : "Basic",
+        "User"          : User,
+        "Pass"          : Password
+    }
+}
+File2_rules = {
+    "ExpectHeader"      : {
+        "Authorization" : "Basic U2F1cm9uOlRoZUV5ZQ=="
+    }
+}
+
+Netrc = "machine localhost\n\tlogin {0}\n\tpassword {1}".format(User, Password)
+
+A_File = WgetFile ("File1", File1, rules=File1_rules)
+B_File = WgetFile ("File2", File2, rules=File2_rules)
+Netrc_File = WgetFile (".netrc", Netrc)
+
+WGET_URLS = [["File1", "File2"]]
+
+Files = [[A_File, B_File]]
+LocalFiles = [Netrc_File]
+
+ExpectedReturnCode = 0
+ExpectedDownloadedFiles = [A_File, B_File, Netrc_File]
+
+################ Pre and Post Test Hooks #####################################
+pre_test = {
+    "ServerFiles"       : Files,
+    "LocalFiles"        : LocalFiles
+}
+test_options = {
+    "Urls"              : WGET_URLS
+}
+post_test = {
+    "ExpectedFiles"     : ExpectedDownloadedFiles,
+    "ExpectedRetcode"   : ExpectedReturnCode
+}
+
+err = HTTPTest (
+                pre_hook=pre_test,
+                test_params=test_options,
+                post_hook=post_test
+).begin ()
+
+exit (err)

testenv/Test-auth-basic-no-netrc-fail.py

@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+from sys import exit
+from test.http_test import HTTPTest
+from misc.wget_file import WgetFile
+
+"""
+    This test ensures that Wget will not use credentials from .netrc
+    when --no-netrc option is specified and Basic authentication is required
+    and fails.
+"""
+############# File Definitions ###############################################
+File1 = "I am an invisble man."
+
+User = "Sauron"
+Password = "TheEye"
+
+File1_rules = {
+    "Authentication"    : {
+        "Type"          : "Basic",
+        "User"          : User,
+        "Pass"          : Password
+    }
+}
+
+Netrc = "machine 127.0.0.1\n\tlogin {0}\n\tpassword {1}".format(User, Password)
+
+A_File = WgetFile ("File1", File1, rules=File1_rules)
+Netrc_File = WgetFile (".netrc", Netrc)
+
+WGET_OPTIONS = "--no-netrc"
+WGET_URLS = [["File1"]]
+
+Files = [[A_File]]
+LocalFiles = [Netrc_File]
+
+ExpectedReturnCode = 6
+ExpectedDownloadedFiles = [Netrc_File]
+
+################ Pre and Post Test Hooks #####################################
+pre_test = {
+    "ServerFiles"       : Files,
+    "LocalFiles"        : LocalFiles
+}
+test_options = {
+    "WgetCommands"      : WGET_OPTIONS,
+    "Urls"              : WGET_URLS
+}
+post_test = {
+    "ExpectedFiles"     : ExpectedDownloadedFiles,
+    "ExpectedRetcode"   : ExpectedReturnCode
+}
+
+err = HTTPTest (
+                pre_hook=pre_test,
+                test_params=test_options,
+                post_hook=post_test
+).begin ()
+
+exit (err)

testenv/Test-auth-basic.py

@@ -5,7 +5,7 @@ from misc.wget_file import WgetFile
 
 """
     This test ensures Wget's Basic Authorization Negotiation.
-    Also, we ensure that Wget saves the host after a successfull auth and
+    Also, we ensure that Wget saves the host after a successful auth and
     doesn't wait for a challenge the second time.
 """
 ############# File Definitions ###############################################

testenv/Test-auth-both.py

@@ -5,7 +5,7 @@ from misc.wget_file import WgetFile
 
 """
     This test ensures Wget's Basic Authorization Negotiation.
-    Also, we ensure that Wget saves the host after a successfull auth and
+    Also, we ensure that Wget saves the host after a successful auth and
     doesn't wait for a challenge the second time.
 """
 ############# File Definitions ###############################################

testenv/Test-recursive-basic.py

@@ -30,6 +30,7 @@ Existing_Files = []
 ExpectedReturnCode = 0
 ExpectedDownloadedFiles = [File1_File, File2_File, File3_File]
 Request_List = [["GET /a/File1.html",
+                 "GET /robots.txt",
                  "GET /a/File2.html",
                  "GET /b/File3.html"]]
 
@@ -44,7 +45,8 @@ test_options = {
 }
 post_test = {
     "ExpectedFiles"     : ExpectedDownloadedFiles,
-    "ExpectedRetcode"   : ExpectedReturnCode
+    "ExpectedRetcode"   : ExpectedReturnCode,
+    "FilesCrawled"      : Request_List
 }
 
 err = HTTPTest (

testenv/certs/README

@@ -30,11 +30,11 @@ Enter a dnsName of the subject of the certificate:
 Enter a URI of the subject of the certificate:
 Enter the IP address of the subject of the certificate:
 Enter the e-mail of the subject of the certificate:
+Will the certificate be used to sign OCSP requests? (y/N):
+Will the certificate be used to sign code? (y/N):
+Will the certificate be used for time stamping? (y/N):
 Will the certificate be used to sign other certificates? (y/N): y
 Will the certificate be used to sign CRLs? (y/N): y
-Will the certificate be used to sign code? (y/N):
-Will the certificate be used to sign OCSP requests? (y/N): y
-Will the certificate be used for time stamping? (y/N):
 Enter the URI of the CRL distribution point:
 
 

testenv/certs/ca-cert.pem

@@ -1,20 +1,19 @@
 -----BEGIN CERTIFICATE-----
-MIIDPjCCAiagAwIBAgIIVGI7SyiXCDUwDQYJKoZIhvcNAQELBQAwMDERMA8GA1UE
-AxMIR05VIFdnZXQxDTALBgNVBAsTBFdnZXQxDDAKBgNVBAoTA0dOVTAiGA8yMDE0
-MTExMTE2MzczM1oYDzk5OTkxMjMxMjM1OTU5WjAwMREwDwYDVQQDEwhHTlUgV2dl
-dDENMAsGA1UECxMEV2dldDEMMAoGA1UEChMDR05VMIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEAv2IR1/gsaJsn+egtVFbMMMbivK+eVzPY8wEXb2flpe9a
-Kkwz824nSSrWfRigQmf/ODkNlK2x91kppfPmWkClUREQB3I4d/sHFnzqCkFKmNwt
-VT4DsL47VumgZF6ZjSqTYQD3MDH3VhFj1iKrRMM/aCZXwntD+67sKw6UPXfFbfUO
-Recpb7fCZPZFVFYStxgcF7cyH+DADLX5QCEjiLYH1es6FXrdw+ypgwBl+HuLkQ/4
-gE0JLQK5PAKSYeLy0JEBUPovkMXT+r9aPkQBF/9WD6uUPia0ERHbMIT0My84hBrG
-9d5u5gXPnH1ZxKIr8iJOYCydVjYndn21zs2IExwL6wIDAQABo1gwVjAPBgNVHRMB
-Af8EBTADAQH/MBMGA1UdJQQMMAoGCCsGAQUFBwMJMA8GA1UdDwEB/wQFAwMHBgAw
-HQYDVR0OBBYEFPM+TjiESqm+wW/HYaNQ2m4pi+tUMA0GCSqGSIb3DQEBCwUAA4IB
-AQCWKV1Txo3xytRSO1PwWK9ce5FhvQW9mubuuWmbEnQt9JaOhO1Og6ZmdPDlAQeo
-m0CJZZ0VNeodoBXPGopy3VyzF4ZzUR9leGk3sb1qTSoDCvJd/zLrfukHKugtwuK0
-b1fPnEjBjQ6gQI21coc1tmyX8Qsm7of5n+Ji601WG+FiVmmdEsCjmA/eAvwSbu1E
-cAVH476KUt4CrpVPQQVqzFPDz8i4iw/P+Jo+iNmL5S72OG2GfkSJq3XkUYa509W6
-N+8c3p4y0q/PcQ92s1OIHyEPZFRFhm4xw0sHkhD2KVoHseHZjCoYn4/lIzMPnJ6v
-EfZUJQXndeJnffbthaUp8Ea2
+MIIDJzCCAg+gAwIBAgIIWRQ9uws3g5owDQYJKoZIhvcNAQELBQAwMDERMA8GA1UE
+AxMIR05VIFdnZXQxDTALBgNVBAsTBFdnZXQxDDAKBgNVBAoTA0dOVTAgFw0xNzA1
+MTExMDMyMzdaGA85OTk5MTIzMTIzNTk1OVowMDERMA8GA1UEAxMIR05VIFdnZXQx
+DTALBgNVBAsTBFdnZXQxDDAKBgNVBAoTA0dOVTCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAL9iEdf4LGibJ/noLVRWzDDG4ryvnlcz2PMBF29n5aXvWipM
+M/NuJ0kq1n0YoEJn/zg5DZStsfdZKaXz5lpApVEREAdyOHf7BxZ86gpBSpjcLVU+
+A7C+O1bpoGRemY0qk2EA9zAx91YRY9Yiq0TDP2gmV8J7Q/uu7CsOlD13xW31DkXn
+KW+3wmT2RVRWErcYHBe3Mh/gwAy1+UAhI4i2B9XrOhV63cPsqYMAZfh7i5EP+IBN
+CS0CuTwCkmHi8tCRAVD6L5DF0/q/Wj5EARf/Vg+rlD4mtBER2zCE9DMvOIQaxvXe
+buYFz5x9WcSiK/IiTmAsnVY2J3Z9tc7NiBMcC+sCAwEAAaNDMEEwDwYDVR0TAQH/
+BAUwAwEB/zAPBgNVHQ8BAf8EBQMDBwYAMB0GA1UdDgQWBBTzPk44hEqpvsFvx2Gj
+UNpuKYvrVDANBgkqhkiG9w0BAQsFAAOCAQEAAsAugT64gwFMMtwDJo5r3/f9sMPA
+lWi1N7Nz8LjBa6Vqrk/3No3Fxxidb3IMO5RGecgZdGV/CL5lG7yjzgVB2ADx+68K
+TmcNEO4CDja5vDyRpG7NPGmhtc48iiOsnEhhWCw084S2rUKf7hAX3+yKg63Uwuik
+C0xHT6HwbrWcmWFQAQOqucPWEwzGRMjqn++3cHAG8XlNSL8tWIr7NmTKr7yufLPC
+HcDAVgJsBHTOWgs/Casq4EovO83hgustD6rAWJOf89DP6bB2yOPEHKVq6cBsuGDM
+F+V2Cr2ytyGPHrOCfH3IzCpQ45cxZX4TaJ7tgV9x7WlMLoNaZgo1ijsKOw==
 -----END CERTIFICATE-----

testenv/certs/server-cert.pem

@@ -1,21 +1,21 @@
 -----BEGIN CERTIFICATE-----
-MIIDgDCCAmigAwIBAgIIVGI73zrIeeMwDQYJKoZIhvcNAQELBQAwMDERMA8GA1UE
-AxMIR05VIFdnZXQxDTALBgNVBAsTBFdnZXQxDDAKBgNVBAoTA0dOVTAiGA8yMDE0
-MTExMTE2NDAwMFoYDzk5OTkxMjMxMjM1OTU5WjAxMRIwEAYDVQQDEwkxMjcuMC4w
-LjExDTALBgNVBAsTBFdnZXQxDDAKBgNVBAoTA0dOVTCCASIwDQYJKoZIhvcNAQEB
-BQADggEPADCCAQoCggEBAMjC3Gt55EfStl6mE371+pD3/cpR5MLxkdbBss5MlIP2
-TDhiPOItLXml8oxs4BjUm3wfn3GV9iJLmbzbIWL+0kbRkQ2LCPKUf+Cln3z2ZE+r
-XwdWlT8gVfv51Opfkp2lLDVUqLfNKRGQgivjSCmLqY2LqeB0SaVNvuaD3EpqZyIH
-0E5SZgjqBHgRRtvGkcy0rOmp5SI2NASLugUioXa9OLWjpYDwodsd3ERlL0DJ1aJW
-8TC8Tqix4i0osWzar+LXBIin0Qvar9/uRHN0p1kq3p0XgNHKqWpiTT54+WYx7Pem
-v4qRXz11swiJzUL+Pw1DurQ9smbzDgAsz7V2FJnUeCcCAwEAAaOBmDCBlTAMBgNV
-HRMBAf8EAjAAMB8GA1UdEQQYMBaCCTEyNy4wLjAuMYIJbG9jYWxob3N0MBMGA1Ud
-JQQMMAoGCCsGAQUFBwMBMA8GA1UdDwEB/wQFAwMHoAAwHQYDVR0OBBYEFJfm323L
-JbKTM/tMKSt0qlUqewbnMB8GA1UdIwQYMBaAFPM+TjiESqm+wW/HYaNQ2m4pi+tU
-MA0GCSqGSIb3DQEBCwUAA4IBAQCDmuSD4IGmn0UQ5jhGQquh92Iu59j64Rrg7EIM
-zoppciyYR8gDUutOI9CEisxJz6umvAdOo5L981gcFaBv6hHWaE/krAZccR+ZXZP6
-fI9btO8My8O63fYcd2KkLEFqvKDF43i01S2LrqXdPo3uELbFZwxCmUKsexFGsoW1
-CbXbRjnS7w/f72myRmvBeDiNMuGfe1lb4IflybH3DMlKC7i0AN1JKglp+IKn5XAE
-neWR03i3UaYJsibIxj0DkTS+hVPu5MXQ9RlF5CkRdFKjGinLE/u70XyAyx0/IeAN
-e7c2MJvpdfRmTXm2ew4sNyK9RXo7Bv0Yqkl65iMscF8LNnxL
+MIIDdzCCAl+gAwIBAgIMWWD1GB1UFkEICdQvMA0GCSqGSIb3DQEBCwUAMDAxETAP
+BgNVBAMTCEdOVSBXZ2V0MQ0wCwYDVQQLEwRXZ2V0MQwwCgYDVQQKEwNHTlUwIBcN
+MTcwNzA4MTUwNzA0WhgPOTk5OTEyMzEyMzU5NTlaMDExEjAQBgNVBAMTCTEyNy4w
+LjAuMTENMAsGA1UECxMEV2dldDEMMAoGA1UEChMDR05VMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEAyMLca3nkR9K2XqYTfvX6kPf9ylHkwvGR1sGyzkyU
+g/ZMOGI84i0teaXyjGzgGNSbfB+fcZX2IkuZvNshYv7SRtGRDYsI8pR/4KWffPZk
+T6tfB1aVPyBV+/nU6l+SnaUsNVSot80pEZCCK+NIKYupjYup4HRJpU2+5oPcSmpn
+IgfQTlJmCOoEeBFG28aRzLSs6anlIjY0BIu6BSKhdr04taOlgPCh2x3cRGUvQMnV
+olbxMLxOqLHiLSixbNqv4tcEiKfRC9qv3+5Ec3SnWSrenReA0cqpamJNPnj5ZjHs
+96a/ipFfPXWzCInNQv4/DUO6tD2yZvMOACzPtXYUmdR4JwIDAQABo4GNMIGKMAwG
+A1UdEwEB/wQCMAAwFAYDVR0RBA0wC4IJbG9jYWxob3N0MBMGA1UdJQQMMAoGCCsG
+AQUFBwMBMA8GA1UdDwEB/wQFAwMHoAAwHQYDVR0OBBYEFJfm323LJbKTM/tMKSt0
+qlUqewbnMB8GA1UdIwQYMBaAFPM+TjiESqm+wW/HYaNQ2m4pi+tUMA0GCSqGSIb3
+DQEBCwUAA4IBAQC1a0NQfmqT8Ky/BFo5H+G+GoQTlqi3J83ujAMdLUD57zYCEyDL
+XzAhMPfrOSLPDcQb0ooD1Ie+Rz8Xs1h00cD2OGKwH479+nisF5ksqJVJ4fn/aNFE
+6W2Xb3MCB+4FRdmy0UeDDA6N2OpVskCM30s9tmovlBLVK46HogdLvy/O1o7z/gbx
+vV8luevxobnevZ3NdWLyVE3BJZiThBHmZUvL1XNy4KAR4wDAkbCwoTN/JkehTu0i
+WR6DaG7N7M6psc7rctfzRqimlAkxnoAUwc8LwNLTB3v613xXX8iSUsLKsh6pQfZR
+e5wnYQIS4MzowvDx8WevTPMRKlN72d8HHuv9
 -----END CERTIFICATE-----

testenv/certs/server-crl.pem

@@ -1,12 +1,12 @@
 -----BEGIN X509 CRL-----
-MIIB1DCBvQIBATANBgkqhkiG9w0BAQsFADAwMREwDwYDVQQDEwhHTlUgV2dldDEN
-MAsGA1UECxMEV2dldDEMMAoGA1UEChMDR05VGA8yMDE0MTExMTE2NDU1NFoYDzk5
-OTkxMjMxMjM1OTU5WjAdMBsCCFRiO986yHnjGA8yMDE0MTExMTE2NDU1NFqgNjA0
-MB8GA1UdIwQYMBaAFPM+TjiESqm+wW/HYaNQ2m4pi+tUMBEGA1UdFAQKAghUYj1E
-KHs9ijANBgkqhkiG9w0BAQsFAAOCAQEAZgwqs1VOFG39dFHHMXvBr4eJfhwiG4bC
-cL6IvLhvl9ikcyQMHrpOBtNjkCtgclSbJjjTDdera1+zuCWE0WBOJ4mojYdAIOhR
-QvSwp4NwAtibu2F/fjeXoo+LEpcRKtLvAotB30eCZ1OPrijsa/HxFILOLlayjns8
-wM4RmQC4o43y1G/1jqM8hGDg4Wz0j1URVuyP+pU55JpubV5LlExy3gIRwevD2lam
-q3hiighenJYFO3HGZkYT2SIoSpXZnQqKPJ4HwRBSg/cjOpc1y1lIIvKhmk+Cut6M
-+S5HL4pIk8vGYg57nTfOOkj1goqFkfU0DBqvVAZj02ay/VIDu61T1g==
+MIIB1jCBvwIBATANBgkqhkiG9w0BAQsFADAwMREwDwYDVQQDEwhHTlUgV2dldDEN
+MAsGA1UECxMEV2dldDEMMAoGA1UEChMDR05VFw0xNzA3MDgxNTA3MDRaFw0xODA3
+MDgxNTA3MDRaMB8wHQIMWWD1GB1UFkEICdQvFw0xNzA3MDgxNTA3MDRaoDowODAf
+BgNVHSMEGDAWgBTzPk44hEqpvsFvx2GjUNpuKYvrVDAVBgNVHRQEDgIMWWD1GB4C
+YfERSnyEMA0GCSqGSIb3DQEBCwUAA4IBAQAAKu+Lum1l/XtcCJ43WveouPK97iOE
+bjUZWaGYx8Ys/iBdhTa1GXG+E+JuyqgyHTW0HrWJi1D+GiYmsjPJXoEgVgtxXEQ7
+8b3NyIQ8OCsSTTlVCmLECN9R0xlsitzH+HXOaIEs5sbmIxCnxu+brqno9gQocmCv
+LHYvoSxsSsOCkkmodbYtKssl2dBonvQPSijN/z3NhZ259e2U3Yv4V7/MrEoTvOxg
+M0GC0u0Nx86EWbq0sWeiUu270Qk9En5YGNtRhkeq0bXerJswmMAmvrtuKdyfouny
+4WMvtn30xsO3WwWSV2oyrDSN/IQdDbcmul/bg8ewqlnN77cVf2m70c/W
 -----END X509 CRL-----

testenv/certs/server-template.cfg

@@ -68,7 +68,6 @@ expiration_days = -1
 # X.509 v3 extensions
 
 # A dnsname in case of a WWW server.
-dns_name = "127.0.0.1"
 dns_name = "localhost"
 
 # A subject alternative name URI

testenv/conf/expected_files.py

@@ -24,6 +24,11 @@ class ExpectedFiles:
         snapshot = {}
         for parent, dirs, files in os.walk('.'):
             for name in files:
+                # pubring.kbx will be created by libgpgme if $HOME doesn't contain the .gnupg directory.
+					 # setting $HOME to CWD (in base_test.py) breaks two Metalink tests, so we skip this file here.
+                if name == 'pubring.kbx':
+                    continue
+
                 f = {'content': ''}
                 file_path = os.path.join(parent, name)
                 with open(file_path) as fp:

testenv/server/http/http_server.py

@@ -63,7 +63,7 @@ class _Handler(BaseHTTPRequestHandler):
     request. For each HTTP Request Command that the server should be capable of
     responding to, there must exist a do_REQUESTNAME() method which details the
     steps in which such requests should be processed. The rest of the methods
-    in this class are auxilliary methods created to help in processing certain
+    in this class are auxiliary methods created to help in processing certain
     requests. """
 
     def get_rule_list(self, name):
@@ -98,7 +98,7 @@ class _Handler(BaseHTTPRequestHandler):
         resource. Hence, we call the handle for processing PUT requests if the
         resource requested does not already exist.
 
-        Currently, when the server recieves a POST request for a resource, we
+        Currently, when the server receives a POST request for a resource, we
         simply append the body data to the existing file and return the new
         file to the client. If the file does not exist, a new file is created
         using the contents of the request body. """
@@ -204,7 +204,6 @@ class _Handler(BaseHTTPRequestHandler):
 
     def Response(self, resp_obj):
         self.send_response(resp_obj.response_code)
-        self.finish_headers()
         if resp_obj.response_code == 304:
             raise NoBodyServerError("Conditional get falling to head")
         raise ServerError("Custom Response code sent.")
@@ -329,7 +328,6 @@ class _Handler(BaseHTTPRequestHandler):
         except AuthError as se:
             self.send_response(401, "Authorization Required")
             self.send_challenge(auth_rule.auth_type, auth_rule.auth_parm)
-            self.finish_headers()
             raise se
 
     def handle_auth(self, auth_rule):
@@ -362,7 +360,6 @@ class _Handler(BaseHTTPRequestHandler):
             if header_recd is None or header_recd != exp_headers[header_line]:
                 self.send_error(400, "Expected Header %s not found" %
                                 header_line)
-                self.finish_headers()
                 raise ServerError("Header " + header_line + " not found")
 
     def RejectHeader(self, header_obj):
@@ -372,7 +369,6 @@ class _Handler(BaseHTTPRequestHandler):
             if header_recd and header_recd == rej_headers[header_line]:
                 self.send_error(400, 'Blacklisted Header %s received' %
                                 header_line)
-                self.finish_headers()
                 raise ServerError("Header " + header_line + ' received')
 
     def __log_request(self, method):
@@ -381,7 +377,7 @@ class _Handler(BaseHTTPRequestHandler):
 
     def send_head(self, method):
         """ Common code for GET and HEAD Commands.
-        This method is overriden to use the fileSys dict.
+        This method is overridden to use the fileSys dict.
 
         The method variable contains whether this was a HEAD or a GET Request.
         According to RFC 2616, the server should not differentiate between
@@ -400,6 +396,7 @@ class _Handler(BaseHTTPRequestHandler):
 
             content = self.server.fileSys.get(path)
             content_length = len(content)
+
             for rule_name in self.rules:
                 try:
                     assert hasattr(self, rule_name)
@@ -410,12 +407,16 @@ class _Handler(BaseHTTPRequestHandler):
                     return(None, None)
                 except AuthError as ae:
                     print(ae.__str__())
+                    self.finish_headers()
                     return(None, None)
                 except NoBodyServerError as nbse:
                     print(nbse.__str__())
+                    self.finish_headers()
                     return(None, None)
                 except ServerError as se:
                     print(se.__str__())
+                    self.add_header("Content-Length", content_length)
+                    self.finish_headers()
                     return(content, None)
 
             try:

testenv/test/base_test.py

@@ -90,7 +90,7 @@ class BaseTest:
             # ports and etc.
             # so we should record different domains respect to servers.
             domain = self.get_domain_addr(instance.server_address)
-            self.domains.append(domain[0])
+            self.domains.append('localhost')
             self.ports.append(domain[1])
 
     def exec_wget(self):
@@ -102,7 +102,7 @@ class BaseTest:
             time.sleep(float(os.getenv("SERVER_WAIT")))
 
         try:
-            ret_code = call(params)
+            ret_code = call(params, env={"HOME": os.getcwd()})
         except FileNotFoundError:
             raise TestFailed("The Wget Executable does not exist at the "
                              "expected path.")

tests/FTPServer.pm

@@ -589,7 +589,7 @@ sub new
     foreach my $file (keys %{$self->{_input}})
     {
         my $ref = \$self->{_input}{$file}{content};
-        $$ref =~ s/{{port}}/$self->sockport/eg;
+        $$ref =~ s/\Q{{port}}/$self->sockport/eg;
     }
 
     return $self;

tests/FTPTest.pm

@@ -53,7 +53,7 @@ sub _substitute_port
 {
     my $self = shift;
     my $ret  = shift;
-    $ret =~ s/{{port}}/$self->{_server}->sockport/eg;
+    $ret =~ s/\Q{{port}}/$self->{_server}->sockport/eg;
     return $ret;
 }
 

tests/HTTPServer.pm

@@ -310,7 +310,7 @@ sub _substitute_port
 {
     my $self = shift;
     my $ret  = shift;
-    $ret =~ s/{{port}}/$self->sockport/eg;
+    $ret =~ s/\Q{{port}}/$self->sockport/eg;
     return $ret;
 }
 

tests/HTTPTest.pm

@@ -47,7 +47,7 @@ sub _substitute_port
 {
     my $self = shift;
     my $ret  = shift;
-    $ret =~ s/{{port}}/$self->{_server}->sockport/eg;
+    $ret =~ s/\Q{{port}}/$self->{_server}->sockport/eg;
     return $ret;
 }
 

tests/Makefile.am

@@ -128,18 +128,27 @@ PX_TESTS = \
              Test--start-pos--continue.px \
              Test--httpsonly-r.px \
              Test-204.px \
-             Test-ftp-pasv-not-supported.px
+             Test-ftp-pasv-not-supported.px \
+             Test-https-pfs.px \
+             Test-https-tlsv1.px \
+             Test-https-tlsv1x.px \
+             Test-https-selfsigned.px \
+             Test-https-weboftrust.px \
+             Test-https-clientcert.px \
+             Test-https-crl.px \
+             Test-https-badcerts.px
 
 EXTRA_DIST = FTPServer.pm FTPTest.pm HTTPServer.pm HTTPTest.pm \
-             WgetTests.pm WgetFeature.pm WgetFeature.cfg $(PX_TESTS) \
+             SSLTest.pm SSLServer.pm \
+             WgetTests.pm WgetFeature.pm $(PX_TESTS) \
              certs valgrind-suppressions valgrind-suppressions-ssl
 
 check_PROGRAMS = unit-tests
 unit_tests_SOURCES =
 LDADD = ../src/libunittest.a ../lib/libgnu.a $(GETADDRINFO_LIB) $(HOSTENT_LIB)\
  $(INET_NTOP_LIB) $(LIBSOCKET) $(LIB_CLOCK_GETTIME) $(LIB_CRYPTO)\
- $(LIB_NANOSLEEP) $(LIB_POSIX_SPAWN) $(LIB_SELECT) $(LTLIBICONV) $(LTLIBINTL)\
- $(LTLIBTHREAD) $(LTLIBUNISTRING) $(SERVENT_LIB)
+ $(LIB_NANOSLEEP) $(LIB_POSIX_SPAWN) $(LIB_SELECT) $(LIBICONV) $(LIBINTL)\
+ $(LIBTHREAD) $(LIBUNISTRING) $(SERVENT_LIB)
 
 
 CLEANFILES = *~ *.bak core core.[0-9]*

tests/SSLServer.pm

@@ -0,0 +1,236 @@
+package SSLServer;
+
+# This is only HTTPS server for now.
+# But it is named SSLServer to easily distinguish from HTTPServer
+
+use strict;
+use warnings;
+use lib '.';
+
+use HTTP::Daemon;
+use HTTP::Status;
+use HTTP::Headers;
+use HTTP::Response;
+
+# Skip this test rather than fail it when the module isn't installed
+if (!eval {require IO::Socket::SSL;1;}) {
+    print STDERR "This test needs the perl module \"IO::Socket::SSL\".\n";
+    print STDERR "Install e.g. on Debian with 'apt-get install libio-socket-ssl-perl'\n";
+    print STDERR " or if using cpanminus 'cpanm IO::Socket::SSL' could be used to install it.\n";
+    exit 77; # skip
+}
+
+#use IO::Socket::SSLX; # 'debug4';
+use HTTPServer;
+
+our @ISA = qw(IO::Socket::SSL HTTP::Daemon::ClientConn HTTP::Daemon HTTPServer);
+
+my $VERSION = 0.01;
+
+my $CRLF = "\015\012";    # "\r\n" is not portable
+
+# Config options for server
+my $log  = undef;
+my $DEBUG = undef;
+
+my %ssl_params;
+
+my $sslsock;
+my $plaincon;
+my %args;
+
+#$HTTP::Daemon::DEBUG=5;
+#*DEBUG = \$HTTP::Daemon::DEBUG;
+
+$args{SSL_error_trap} ||= \&ssl_error;
+
+my $class = 'SSLServer';
+my $self  = {};
+$self = bless $self, $class;
+
+sub init
+{
+    my $self = shift;
+    my %sargs = @_;
+
+    %ssl_params = %sargs;
+    unless (exists($ssl_params{'lhostname'}) &&
+            exists($ssl_params{'sslport'})   &&
+            exists($ssl_params{'ciphers'})   &&
+            exists($ssl_params{'cafile'})    &&
+            exists($ssl_params{'certfile'})  &&
+            exists($ssl_params{'keyfile'})) {
+        die "Required parameters for SSL tests are missing";
+    }
+}
+
+sub ssl_setup_conn
+{
+    $sslsock = IO::Socket::SSL->new(LocalAddr       => $ssl_params{'lhostname'},
+                                    LocalPort       => $ssl_params{'sslport'},
+                                    Listen          => 10,
+                                    Timeout         => 30,
+                                    ReuseAddr       => 1,
+                                    SSL_cipher_list => $ssl_params{'ciphers'},
+                                    SSL_verify_mode => 0x00,
+                                    SSL_ca_file     => $ssl_params{'cafile'},
+                                    SSL_cert_file   => $ssl_params{'certfile'},
+                                    SSL_key_file    => $ssl_params{'keyfile'});
+
+    $sslsock || warn $IO::Socket::SSL::ERROR;
+    return $sslsock;
+}
+
+sub fileno
+{
+    my $self = shift;
+    my $fn = ${*$self}{'_SSL_fileno'};
+    return defined($fn) ? $fn : $self->SUPER::fileno();
+}
+
+sub accept
+{
+    my $self = shift;
+    my $pkg = shift || "SSLServer";
+    my ($sock, $peer) = $sslsock->accept($pkg);
+    if ($sock) {
+        ${*$sock}{'httpd_daemon'} = $self;
+        ${*$self}{'httpd_daemon'} = $sock;
+        my $fileno = ${*$self}{'_SSL_fileno'} = &fileno($self);
+        my $f = $sock->fileno;
+        return wantarray ? ($sock, $peer) : $sock;
+    }
+    else {
+        print STDERR "Failed to get socket from SSL\n" if $DEBUG;
+        return;
+    }
+
+}
+
+sub _default_port { 443; }
+sub _default_scheme { "https"; }
+
+sub url
+{
+    my $self = shift;
+    my $url = $self->SUPER::url;
+    return $url if ($self->can("HTTP::Daemon::_default_port"));
+
+    # Workaround for old versions of HTTP::Daemon
+    $url =~ s!^http:!https:!;
+    $url =~ s!/$!:80/! unless ($url =~ m!:(?:\d+)/$!);
+    $url =~ s!:443/$!/!;
+    return $url;
+}
+
+sub _need_more
+{
+    my $self = shift;
+    if ($_[1]) {
+        my($timeout, $fdset) = @_[1,2];
+        print STDERR "select(,,,$timeout)\n" if $DEBUG;
+        my $n = select($fdset,undef,undef,$timeout);
+        unless ($n) {
+            $self->reason(defined($n) ? "Timeout" : "select: $!");
+            return;
+        }
+    }
+    my $total = 0;
+    while (1){
+        print STDERR sprintf("sysread() already %d\n",$total) if $DEBUG;
+        my $n = sysread(${*$self}{'httpd_daemon'}, $_[0], 2048, length($_[0]));
+        print STDERR sprintf("sysread() just \$n=%s\n",(defined $n?$n:'undef')) if $DEBUG;
+        $total += $n if defined $n;
+        last if $! =~ 'Resource temporarily unavailable';
+        #SSL_Error because of aggressive reading
+
+        $self->reason(defined($n) ? "Client closed" : "sysread: $!") unless $n;
+        last unless $n;
+        last unless $n == 2048;
+    }
+    $total;
+}
+
+sub daemon
+{
+    my $self = shift;
+    ${*$self}{'httpd_daemon'};
+}
+
+sub conn
+{
+    my $self = shift;
+    ${*$self}{'sslcon'};
+}
+
+sub run
+{
+    my ($self, $urls, $synch_callback) = @_;
+    my $initialized = 0;
+    my $sslsock;
+
+    while (1)
+    {
+        if (!$initialized)
+        {
+            $sslsock = $self->ssl_setup_conn();
+            $sslsock || warn "Failed to get ssl sock";
+
+            $initialized = 1;
+            open (LOGFILE, '>', "/tmp/wgetserver.log");
+            LOGFILE->autoflush(1);
+            print LOGFILE "Starting logging";
+            $synch_callback->() if $synch_callback;
+        }
+
+        my $con = $self->accept();
+        ${*$self}{'sslcon'} = $con;
+
+        while (my $req = $self->get_request)
+        {
+            #my $url_path = $req->url->path;
+            my $url_path = $req->url->as_string;
+            if ($url_path =~ m{/$})
+            {    # append 'index.html'
+                $url_path .= 'index.html';
+            }
+
+            #if ($url_path =~ m{^/}) { # remove trailing '/'
+            #    $url_path = substr ($url_path, 1);
+            #}
+            if ($log)
+            {
+                print LOGFILE "Method: ", $req->method, "\n";
+                print LOGFILE "Path: ", $url_path, "\n";
+                print LOGFILE "Available URLs: ", "\n";
+                foreach my $key (keys %$urls)
+                {
+                    print LOGFILE $key, "\n";
+                }
+            }
+            if (exists($urls->{$url_path}))
+            {
+                print LOGFILE "Serving requested URL: ", $url_path, "\n" if $log;
+                next unless ($req->method eq "HEAD" || $req->method eq "GET");
+
+                my $url_rec = $urls->{$url_path};
+                HTTPServer::send_response($self, $req, $url_rec, $con);
+                last;
+            }
+            else
+            {
+                print LOGFILE "Requested wrong URL: ", $url_path, "\n" if $log;
+                $con->send_error($HTTP::Status::RC_FORBIDDEN);
+                last;
+            }
+            last;
+        }
+        print LOGFILE "Closing connection\n" if $log;
+        close(LOGFILE);
+        $con->close();
+    }
+}
+
+1;
+
+# vim: et ts=4 sw=4

tests/SSLTest.pm

@@ -0,0 +1,73 @@
+package SSLTest;
+
+use strict;
+use warnings;
+
+use SSLServer;
+use WgetTests;
+use HTTPTest;
+
+our @ISA = qw(WgetTest HTTPTest);
+my $VERSION = 0.01;
+
+my $srcdir;
+if (defined $ENV{srcdir}) {
+    $srcdir = Cwd::abs_path($ENV{srcdir});
+} else {
+    $srcdir = ".";
+}
+
+my %ssl_defaults = (
+    _certfile  => "$srcdir/certs/server.crt",
+    _keyfile   => "$srcdir/certs/server.key",
+    _cafile    => "$srcdir/certs/test-ca-cert.pem",
+    _ciphers   => 'ALL',
+    _lhostname => 'wgettestingserver',
+    _sslport   => 55443,
+);
+
+{
+    my %_attr_data = %ssl_defaults;
+
+    sub _default_for
+    {
+        my ($self, $attr) = @_;
+        return $_attr_data{$attr} if exists $_attr_data{$attr};
+        return $self->SUPER::_default_for($attr);
+    }
+
+    sub _standard_keys
+    {
+        my ($self) = @_;
+        ($self->SUPER::_standard_keys(), keys %_attr_data);
+    }
+}
+
+sub _setup_server
+{
+    my $self = shift;
+    my %ssl_config = %ssl_defaults;
+
+    $self->{_server} = SSLServer->new()
+        or die "Cannot create SSL server!!!";
+
+    for my $attrname ($self->_standard_keys())
+    {
+        my ($argname) = ($attrname =~ m/^_(.*)/msx);
+        $ssl_config{$argname} = $self->{$attrname};
+    }
+#    for my $attrname (keys %ssl_config)
+#    {
+#        if ($attrname =~ m/file$/ && !$attrname =~ m/^\//)
+#        {
+#            my $cwd = $self->SUPER::_default_for('_workdir');
+#            my $cfile = $ssl_config{$attrname};
+#            $ssl_config{$attrname} = "$cwd/$cfile";
+#        }
+#    }
+    $self->{_server}->init(%ssl_config);
+}
+
+1;
+
+# vim: et ts=4 sw=4

tests/Test-https-badcerts.px

@@ -0,0 +1,139 @@
+#!/usr/bin/env perl
+
+use strict;
+use warnings;
+use POSIX;
+use Socket;
+use WgetFeature qw(https);
+use SSLTest;
+
+###############################################################################
+
+# code, msg, headers, content
+my %urls = (
+    '/somefile.txt' => {
+        code => "200",
+        msg => "Dontcare",
+        headers => {
+            "Content-type" => "text/plain",
+        },
+        content => "blabla",
+    },
+);
+
+# Skip the test if openssl is not available
+my $ossl = `openssl version`;
+unless ($ossl =~ m/OpenSSL 1/)
+{
+  exit 77;
+}
+
+my $srcdir;
+if (@ARGV) {
+    $srcdir = shift @ARGV;
+} elsif (defined $ENV{srcdir}) {
+    $srcdir = $ENV{srcdir};
+}
+$srcdir = Cwd::abs_path("$srcdir");
+
+# HOSTALIASES env variable allows us to create hosts file alias.
+my $testhostname = "WgetTestingServer";
+$ENV{'HOSTALIASES'} = "$srcdir/certs/wgethosts";
+
+my $addr = gethostbyname($testhostname);
+unless ($addr)
+{
+    warn "Failed to resolve $addr, using $srcdir/certs/wgethosts\n";
+    exit 77;
+}
+unless (inet_ntoa($addr) =~ "127.0.0.1")
+{
+    warn "Failed to resolve $$addr, using $srcdir/certs/wgethosts\n";
+    exit 77;
+}
+
+my $caconf     = "$srcdir/certs/rootca.conf";
+my $cacrt      = "$srcdir/certs/test-ca-cert.pem";
+my $cakey      = "$srcdir/certs/test-ca-key.pem";
+
+# Use expired server certificate
+my $servercrt  = "$srcdir/certs/expired.crt";
+my $serverkey  = "$srcdir/certs/expired.key";
+
+my $servercheck =`(openssl x509 -noout -modulus -in $servercrt | openssl md5 ;
+                   openssl rsa  -noout -modulus -in $serverkey | openssl md5) |
+                   uniq | wc -l`;
+# Check if certificate and key are made correctly.
+unless(-e $servercrt && -e $serverkey && $servercheck == 1)
+{
+    exit 77; # skip
+}
+
+# Try Wget using SSL with expired cert. Expect Failure.
+my $port    = 30443;
+my $cmdline = $WgetTest::WGETPATH . " --ca-certificate=$cacrt".
+                                    " https://$testhostname:$port/somefile.txt";
+my $expected_error_code = 5;
+my %existing_files = (
+);
+
+my %expected_downloaded_files = (
+  'somefile.txt' => {
+    content => "blabla",
+  },
+);
+
+my $sslsock = SSLTest->new(cmdline   => $cmdline,
+                           input     => \%urls,
+                           errcode   => $expected_error_code,
+                           existing  => \%existing_files,
+                           output    => \%expected_downloaded_files,
+                           certfile  => $servercrt,
+                           keyfile   => $serverkey,
+                           lhostname => $testhostname,
+                           sslport   => $port);
+if ($sslsock->run() == 0)
+{
+  exit -1;
+}
+print "Test successful.\n";
+
+# Use certificate that is not yet valid
+$servercrt  = "$srcdir/certs/invalid.crt";
+$serverkey  = "$srcdir/certs/invalid.key";
+
+$servercheck =`(openssl x509 -noout -modulus -in $servercrt | openssl md5 ;
+                openssl rsa  -noout -modulus -in $serverkey | openssl md5) |
+                uniq | wc -l`;
+# Check if certificate and key are made correctly.
+unless(-e $servercrt && -e $serverkey && $servercheck == 1)
+{
+    exit 77; # skip
+}
+
+
+# Retry the test with --no-check-certificate. expect success
+$port    = 20443;
+$cmdline = $WgetTest::WGETPATH . " --ca-certificate=$cacrt".
+                                 " https://$testhostname:$port/somefile.txt";
+
+$expected_error_code = 5;
+
+my $retryssl = SSLTest->new(cmdline  => $cmdline,
+                           input     => \%urls,
+                           errcode   => $expected_error_code,
+                           existing  => \%existing_files,
+                           output    => \%expected_downloaded_files,
+                           certfile  => $servercrt,
+                           keyfile   => $serverkey,
+                           lhostname => $testhostname,
+                           sslport   => $port);
+if ($retryssl->run() == 0)
+{
+  exit 0;
+}
+else
+{
+  exit -1;
+}
+# vim: et ts=4 sw=4

tests/Test-https-clientcert.px

@@ -0,0 +1,133 @@
+#!/usr/bin/env perl
+
+use strict;
+use warnings;
+use Socket;
+use WgetFeature qw(https);
+use SSLTest;
+
+###############################################################################
+
+# code, msg, headers, content
+my %urls = (
+    '/somefile.txt' => {
+        code => "200",
+        msg => "Dontcare",
+        headers => {
+            "Content-type" => "text/plain",
+        },
+        content => "blabla",
+    },
+);
+
+# Skip the test if openssl is not available
+my $ossl = `openssl version`;
+unless ($ossl =~ m/OpenSSL 1/)
+{
+  exit 77;
+}
+
+my $srcdir;
+if (@ARGV) {
+    $srcdir = shift @ARGV;
+} elsif (defined $ENV{srcdir}) {
+    $srcdir = $ENV{srcdir};
+}
+$srcdir = Cwd::abs_path("$srcdir");
+
+# HOSTALIASES env variable allows us to create hosts file alias.
+my $testhostname = "WgetTestingServer";
+$ENV{'HOSTALIASES'} = "$srcdir/certs/wgethosts";
+
+my $addr = gethostbyname($testhostname);
+unless ($addr)
+{
+    warn "Failed to resolve $addr, using $srcdir/certs/wgethosts\n";
+    exit 77;
+}
+unless (inet_ntoa($addr) =~ "127.0.0.1")
+{
+    warn "Failed to resolve $$addr, using $srcdir/certs/wgethosts\n";
+    exit 77;
+}
+
+my $cacrt      = "$srcdir/certs/test-ca-cert.pem";
+my $cakey      = "$srcdir/certs/test-ca-key.pem";
+
+# Prepare server certificate
+my $servercrt  = "$srcdir/certs/server.crt";
+my $serverkey  = "$srcdir/certs/server.key";
+
+my $servercheck =`(openssl x509 -noout -modulus -in $servercrt | openssl md5 ;
+                   openssl rsa  -noout -modulus -in $serverkey | openssl md5) |
+                   uniq | wc -l`;
+# Check if certificate and key are made correctly.
+unless(-e $servercrt && -e $serverkey && $servercheck == 1)
+{
+    exit 77; # skip
+}
+
+# Use client certificate
+my $clientcert     = "$srcdir/certs/client.crt";
+my $clientkey      = "$srcdir/certs/client.key";
+
+my $clientcheck=`(openssl x509 -noout -modulus -in $clientcert | openssl md5 ;
+                  openssl rsa -noout -modulus -in $clientkey | openssl md5) |
+                  uniq | wc -l`;
+
+# Check if client certificate and key are made correctly.
+unless(-e $clientcert && -e $clientkey && $clientcheck == 1)
+{
+    exit 77; # skip
+}
+
+# Try Wget using SSL with mismatched client cert & key . Expect error
+my $port = 21443;
+my $cmdline = $WgetTest::WGETPATH . " --certificate=$clientcert ".
+                                    " --private-key=$serverkey ".
+                                    " --ca-certificate=$cacrt".
+                                    " https://$testhostname:$port/somefile.txt";
+my $expected_error_code = 5;
+my %existing_files = (
+);
+
+my %expected_downloaded_files = (
+  'somefile.txt' => {
+    content => "blabla",
+  },
+);
+
+my $sslsock = SSLTest->new(cmdline   => $cmdline,
+                           input     => \%urls,
+                           errcode   => $expected_error_code,
+                           existing  => \%existing_files,
+                           output    => \%expected_downloaded_files,
+                           certfile  => $servercrt,
+                           keyfile   => $serverkey,
+                           lhostname => $testhostname,
+                           sslport   => $port);
+if ($sslsock->run() == 0)
+{
+  exit 0;
+}
+
+# Retry wget using SSL with client certificate. Expect success
+$port    = 22443;
+$cmdline = $WgetTest::WGETPATH . " --certificate=$clientcert".
+                                 " --private-key=$clientkey ".
+                                 " --ca-certificate=$cacrt".
+                                 " https://$testhostname:$port/somefile.txt";
+
+$expected_error_code = 0;
+
+my $retryssl = SSLTest->new(cmdline  => $cmdline,
+                           input     => \%urls,
+                           errcode   => $expected_error_code,
+                           existing  => \%existing_files,
+                           output    => \%expected_downloaded_files,
+                           certfile  => $servercrt,
+                           keyfile   => $serverkey,
+                           lhostname => $testhostname,
+                           sslport   => $port);
+exit $retryssl->run();
+# vim: et ts=4 sw=4

tests/Test-https-crl.px

@@ -0,0 +1,136 @@
+#!/usr/bin/env perl
+
+use strict;
+use warnings;
+use Socket;
+use WgetFeature qw(https);
+use SSLTest;
+
+###############################################################################
+
+# code, msg, headers, content
+my %urls = (
+    '/somefile.txt' => {
+        code => "200",
+        msg => "Dontcare",
+        headers => {
+            "Content-type" => "text/plain",
+        },
+        content => "blabla",
+    },
+);
+
+# Skip the test if openssl is not available
+my $ossl = `openssl version`;
+unless ($ossl =~ m/OpenSSL 1/)
+{
+  exit 77;
+}
+
+my $srcdir;
+if (@ARGV) {
+    $srcdir = shift @ARGV;
+} elsif (defined $ENV{srcdir}) {
+    $srcdir = $ENV{srcdir};
+}
+$srcdir = Cwd::abs_path("$srcdir");
+
+# HOSTALIASES env variable allows us to create hosts file alias.
+my $testhostname = "WgetTestingServer";
+$ENV{'HOSTALIASES'} = "$srcdir/certs/wgethosts";
+
+my $addr = gethostbyname($testhostname);
+unless ($addr)
+{
+    warn "Failed to resolve $addr, using $srcdir/certs/wgethosts\n";
+    exit 77;
+}
+unless (inet_ntoa($addr) =~ "127.0.0.1")
+{
+    warn "Failed to resolve $$addr, using $srcdir/certs/wgethosts\n";
+    exit 77;
+}
+
+my $cacrt      = "$srcdir/certs/test-ca-cert.pem";
+my $cakey      = "$srcdir/certs/test-ca-key.pem";
+
+# Use a revoked certificate
+my $servercrt  = "$srcdir/certs/revoked.crt";
+my $serverkey  = "$srcdir/certs/revoked.key";
+
+my $servercheck =`(openssl x509 -noout -modulus -in $servercrt | openssl md5 ;
+                   openssl rsa  -noout -modulus -in $serverkey | openssl md5) |
+                   uniq | wc -l`;
+# Check if certificate and key are correct.
+unless(-e $servercrt && -e $serverkey && $servercheck == 1)
+{
+    exit 77; # skip
+}
+
+# Try Wget using SSL first without --no-check-certificate. Expect Success.
+my $port    = 32443;
+my $cmdline = $WgetTest::WGETPATH . " --ca-certificate=$cacrt".
+                                    " https://$testhostname:$port/somefile.txt";
+my $expected_error_code = 0;
+my %existing_files = (
+);
+
+my %expected_downloaded_files = (
+  'somefile.txt' => {
+    content => "blabla",
+  },
+);
+
+my $sslsock = SSLTest->new(cmdline   => $cmdline,
+                           input     => \%urls,
+                           errcode   => $expected_error_code,
+                           existing  => \%existing_files,
+                           output    => \%expected_downloaded_files,
+                           certfile  => $servercrt,
+                           keyfile   => $serverkey,
+                           lhostname => $testhostname,
+                           sslport   => $port);
+if ($sslsock->run() != 0)
+{
+  exit -1;
+}
+
+# Revoke the certificate
+my $crlfile   = "$srcdir/certs/revokedcrl.pem";
+
+# Check if CRL file is generated.
+unless(-e $crlfile)
+{
+    exit 77; # skip
+}
+
+# To read a CRL file use the following command:
+# openssl crl -text -in $srcdir/certs/root.crl.pem
+
+# Retry the test with CRL. Expect Failure.
+$port    = 23443;
+$cmdline = $WgetTest::WGETPATH . " --crl-file=$crlfile ".
+                                 " --ca-certificate=$cacrt".
+                                 " https://$testhostname:$port/somefile.txt";
+
+$expected_error_code = 5;
+
+my $retryssl = SSLTest->new(cmdline  => $cmdline,
+                           input     => \%urls,
+                           errcode   => $expected_error_code,
+                           existing  => \%existing_files,
+                           output    => \%expected_downloaded_files,
+                           certfile  => $servercrt,
+                           keyfile   => $serverkey,
+                           lhostname => $testhostname,
+                           sslport   => $port);
+if ($retryssl->run() == 0)
+{
+  exit -1;
+}
+else
+{
+  print "Test successful.\n";
+  exit 0;
+}
+# vim: et ts=4 sw=4

tests/Test-https-pfs.px

@@ -0,0 +1,78 @@
+#!/usr/bin/env perl
+
+use strict;
+use warnings;
+use Socket;
+use WgetFeature qw(https);
+use SSLTest;
+
+###############################################################################
+
+# code, msg, headers, content
+my %urls = (
+    '/somefile.txt' => {
+        code => "200",
+        msg => "Dontcare",
+        headers => {
+            "Content-type" => "text/plain",
+        },
+        content => "blabla",
+    },
+);
+
+# Skip the test if openssl is not available
+my $ossl = `openssl version`;
+unless ($ossl =~ m/OpenSSL 1/)
+{
+  exit 77;
+}
+
+my $srcdir;
+if (@ARGV) {
+    $srcdir = shift @ARGV;
+} elsif (defined $ENV{srcdir}) {
+    $srcdir = $ENV{srcdir};
+}
+$srcdir = Cwd::abs_path("$srcdir");
+
+# HOSTALIASES env variable allows us to create hosts file alias.
+my $testhostname = "WgetTestingServer";
+$ENV{'HOSTALIASES'} = "$srcdir/certs/wgethosts";
+
+my $addr = gethostbyname($testhostname);
+unless ($addr)
+{
+    warn "Failed to resolve $addr, using $srcdir/certs/wgethosts\n";
+    exit 77;
+}
+unless (inet_ntoa($addr) =~ "127.0.0.1")
+{
+    warn "Failed to resolve $$addr, using $srcdir/certs/wgethosts\n";
+    exit 77;
+}
+
+my $port    = 24443;
+my $cmdline = $WgetTest::WGETPATH . " --secure-protocol=PFS".
+                                    " --ca-certificate=$srcdir/certs/test-ca-cert.pem".
+                                    " https://$testhostname:$port/somefile.txt";
+
+my $expected_error_code = 0;
+
+my %existing_files = (
+);
+
+my %expected_downloaded_files = (
+  'somefile.txt' => {
+    content => "blabla",
+  },
+);
+
+my $sslsock = SSLTest->new(cmdline  => $cmdline,
+                           input    => \%urls,
+                           errcode  => $expected_error_code,
+                           existing => \%existing_files,
+                           output   => \%expected_downloaded_files,
+                           sslport  => $port);
+exit $sslsock->run();
+
+# vim: et ts=4 sw=4

tests/Test-https-selfsigned.px

@@ -0,0 +1,114 @@
+#!/usr/bin/env perl
+
+use strict;
+use warnings;
+use Socket;
+use WgetFeature qw(https);
+use SSLTest;
+
+###############################################################################
+
+# code, msg, headers, content
+my %urls = (
+    '/somefile.txt' => {
+        code => "200",
+        msg => "Dontcare",
+        headers => {
+            "Content-type" => "text/plain",
+        },
+        content => "blabla",
+    },
+);
+
+# Skip the test if openssl is not available
+my $ossl = `openssl version`;
+unless ($ossl =~ m/OpenSSL 1/)
+{
+  exit 77;
+}
+
+my $srcdir;
+if (@ARGV) {
+    $srcdir = shift @ARGV;
+} elsif (defined $ENV{srcdir}) {
+    $srcdir = $ENV{srcdir};
+}
+$srcdir = Cwd::abs_path("$srcdir");
+
+# HOSTALIASES env variable allows us to create hosts file alias.
+my $testhostname = "WgetTestingServer";
+$ENV{'HOSTALIASES'} = "$srcdir/certs/wgethosts";
+
+my $addr = gethostbyname($testhostname);
+unless ($addr)
+{
+    warn "Failed to resolve $addr, using $srcdir/certs/wgethosts\n";
+    exit 77;
+}
+unless (inet_ntoa($addr) =~ "127.0.0.1")
+{
+    warn "Failed to resolve $$addr, using $srcdir/certs/wgethosts\n";
+    exit 77;
+}
+
+# Prepare self-signed certificates
+my $certfile="$srcdir/certs/selfsigned.crt";
+my $keyfile="$srcdir/certs/selfsigned.key";
+
+my $sscheck=`(openssl x509 -noout -modulus -in $certfile | openssl md5 ;
+              openssl rsa  -noout -modulus -in $keyfile | openssl md5) |
+              uniq|wc -l`;
+
+# Check if Self signed certificate and key are made correctly.
+unless(-e $certfile && -e $keyfile && $sscheck == 1)
+{
+    exit 77; # skip
+}
+
+# Try Wget using SSL first without --no-check-certificate. expect error
+my $port    = 26443;
+my $cmdline = $WgetTest::WGETPATH . " --ca-certificate=$srcdir/certs/test-ca-cert.pem".
+                                    " https://$testhostname:$port/somefile.txt";
+my $expected_error_code = 5;
+my %existing_files = (
+);
+
+my %expected_downloaded_files = (
+  'somefile.txt' => {
+    content => "blabla",
+  },
+);
+
+my $sslsock = SSLTest->new(cmdline   => $cmdline,
+                           input     => \%urls,
+                           errcode   => $expected_error_code,
+                           existing  => \%existing_files,
+                           output    => \%expected_downloaded_files,
+                           certfile  => $certfile,
+                           keyfile   => $keyfile,
+                           lhostname => $testhostname,
+                           sslport   => $port);
+if ($sslsock->run() == 0)
+{
+  exit 0;
+}
+
+# Retry the test with --no-check-certificate. expect success
+$port    = 27443;
+$cmdline = $WgetTest::WGETPATH . " --no-check-certificate ".
+                                 " --ca-certificate=$srcdir/certs/test-ca-cert.pem".
+                                 " https://$testhostname:$port/somefile.txt";
+
+$expected_error_code = 0;
+
+my $retryssl = SSLTest->new(cmdline  => $cmdline,
+                           input     => \%urls,
+                           errcode   => $expected_error_code,
+                           existing  => \%existing_files,
+                           output    => \%expected_downloaded_files,
+                           certfile  => $certfile,
+                           keyfile   => $keyfile,
+                           lhostname => $testhostname,
+                           sslport   => $port);
+exit $retryssl->run();
+# vim: et ts=4 sw=4

tests/Test-https-tlsv1.px

@@ -0,0 +1,78 @@
+#!/usr/bin/env perl
+
+use strict;
+use warnings;
+use Socket;
+use WgetFeature qw(https);
+use SSLTest;
+
+###############################################################################
+
+# code, msg, headers, content
+my %urls = (
+    '/somefile.txt' => {
+        code => "200",
+        msg => "Dontcare",
+        headers => {
+            "Content-type" => "text/plain",
+        },
+        content => "blabla",
+    },
+);
+
+# Skip the test if openssl is not available
+my $ossl = `openssl version`;
+unless ($ossl =~ m/OpenSSL 1/)
+{
+  exit 77;
+}
+
+my $srcdir;
+if (@ARGV) {
+    $srcdir = shift @ARGV;
+} elsif (defined $ENV{srcdir}) {
+    $srcdir = $ENV{srcdir};
+}
+$srcdir = Cwd::abs_path("$srcdir");
+
+# HOSTALIASES env variable allows us to create hosts file alias.
+my $testhostname = "WgetTestingServer";
+$ENV{'HOSTALIASES'} = "$srcdir/certs/wgethosts";
+
+my $addr = gethostbyname($testhostname);
+unless ($addr)
+{
+    warn "Failed to resolve $addr, using $srcdir/certs/wgethosts\n";
+    exit 77;
+}
+unless (inet_ntoa($addr) =~ "127.0.0.1")
+{
+    warn "Failed to resolve $$addr, using $srcdir/certs/wgethosts\n";
+    exit 77;
+}
+
+my $port    = 28443;
+my $cmdline = $WgetTest::WGETPATH . " --secure-protocol=TLSv1".
+                                    " --ca-certificate=$srcdir/certs/test-ca-cert.pem".
+                                    " https://$testhostname:$port/somefile.txt";
+
+my $expected_error_code = 0;
+
+my %existing_files = (
+);
+
+my %expected_downloaded_files = (
+  'somefile.txt' => {
+    content => "blabla",
+  },
+);
+
+my $sslsock = SSLTest->new(cmdline  => $cmdline,
+                           input    => \%urls,
+                           errcode  => $expected_error_code,
+                           existing => \%existing_files,
+                           output   => \%expected_downloaded_files,
+                           sslport  => $port);
+exit $sslsock->run();
+
+# vim: et ts=4 sw=4

tests/Test-https-tlsv1x.px

@@ -0,0 +1,79 @@
+#!/usr/bin/env perl
+
+use strict;
+use warnings;
+use Socket;
+use Cwd;
+use WgetFeature qw(https);
+use SSLTest;
+
+###############################################################################
+
+# code, msg, headers, content
+my %urls = (
+    '/somefile.txt' => {
+        code => "200",
+        msg => "Dontcare",
+        headers => {
+            "Content-type" => "text/plain",
+        },
+        content => "blabla",
+    },
+);
+
+# Skip the test if openssl is not available
+my $ossl = `openssl version`;
+unless ($ossl =~ m/OpenSSL 1/)
+{
+  exit 77;
+}
+
+my $srcdir;
+if (@ARGV) {
+    $srcdir = shift @ARGV;
+} elsif (defined $ENV{srcdir}) {
+    $srcdir = $ENV{srcdir};
+}
+$srcdir = Cwd::abs_path("$srcdir");
+
+# HOSTALIASES env variable allows us to create hosts file alias.
+my $testhostname = "WgetTestingServer";
+$ENV{'HOSTALIASES'} = "$srcdir/certs/wgethosts";
+
+my $addr = gethostbyname($testhostname);
+unless ($addr)
+{
+    warn "Failed to resolve $addr, using $srcdir/certs/wgethosts\n";
+    exit 77;
+}
+unless (inet_ntoa($addr) =~ "127.0.0.1")
+{
+    warn "Failed to resolve $$addr, using $srcdir/certs/wgethosts\n";
+    exit 77;
+}
+
+my $port    = 29443;
+my $cmdline = $WgetTest::WGETPATH . " --secure-protocol=TLSv1_1".
+                                    " --ca-certificate=$srcdir/certs/test-ca-cert.pem".
+                                    " https://$testhostname:$port/somefile.txt";
+
+my $expected_error_code = 0;
+
+my %existing_files = (
+);
+
+my %expected_downloaded_files = (
+  'somefile.txt' => {
+    content => "blabla",
+  },
+);
+
+my $sslsock = SSLTest->new(cmdline  => $cmdline,
+                           input    => \%urls,
+                           errcode  => $expected_error_code,
+                           existing => \%existing_files,
+                           output   => \%expected_downloaded_files,
+                           sslport  => $port);
+exit $sslsock->run();
+
+# vim: et ts=4 sw=4

tests/Test-https-weboftrust.px

@@ -0,0 +1,125 @@
+#!/usr/bin/env perl
+
+use strict;
+use warnings;
+use Socket;
+use WgetFeature qw(https);
+use SSLTest;
+
+###############################################################################
+
+# code, msg, headers, content
+my %urls = (
+    '/somefile.txt' => {
+        code => "200",
+        msg => "Dontcare",
+        headers => {
+            "Content-type" => "text/plain",
+        },
+        content => "blabla",
+    },
+);
+
+# Skip the test if openssl is not available
+my $ossl = `openssl version`;
+unless ($ossl =~ m/OpenSSL 1/)
+{
+  exit 77;
+}
+
+my $srcdir;
+if (@ARGV) {
+    $srcdir = shift @ARGV;
+} elsif (defined $ENV{srcdir}) {
+    $srcdir = $ENV{srcdir};
+}
+$srcdir = Cwd::abs_path("$srcdir");
+
+# HOSTALIASES env variable allows us to create hosts file alias.
+my $testhostname = "WgetTestingServer";
+$ENV{'HOSTALIASES'} = "$srcdir/certs/wgethosts";
+
+my $addr = gethostbyname($testhostname);
+unless ($addr)
+{
+    warn "Failed to resolve $addr, using $srcdir/certs/wgethosts\n";
+    exit 77;
+}
+unless (inet_ntoa($addr) =~ "127.0.0.1")
+{
+    warn "Failed to resolve $$addr, using $srcdir/certs/wgethosts\n";
+    exit 77;
+}
+
+# Use Intermediate CA
+my $caconf   = "$srcdir/certs/rootca.conf";
+my $icrtfile = "$srcdir/certs/interca.crt";
+my $ikeyfile = "$srcdir/certs/interca.key";
+
+my $icacheck=`(openssl x509 -noout -modulus -in $icrtfile | openssl md5 ;
+               openssl rsa  -noout -modulus -in $ikeyfile | openssl md5) |
+               uniq | wc -l`;
+# Check if certificate and key are correct.
+unless(-e $icrtfile && -e $ikeyfile && $icacheck == 1)
+{
+    exit 77; # skip
+}
+
+# User certificate using intermediate CA
+my $usrcrt  = "$srcdir/certs/user.crt";
+my $usrkey  = "$srcdir/certs/user.key";
+
+my $usrcheck=`(openssl x509 -noout -modulus -in $usrcrt | openssl md5 ;
+               openssl rsa -noout -modulus -in $usrkey | openssl md5) |
+               uniq | wc -l`;
+# Check if certificate and key are made correctly.
+unless(-e $usrcrt && -e $ikeyfile && $usrcheck == 1)
+{
+    exit 77; # skip
+}
+
+# Try Wget using SSL using certificate signed by intermediate CA. Expect error.
+my $port    = 30443;
+my $cmdline = $WgetTest::WGETPATH . " --ca-certificate=$srcdir/certs/".
+                "test-ca-cert.pem https://$testhostname:$port/somefile.txt";
+my $expected_error_code = 5;
+my %existing_files = (
+);
+
+my %expected_downloaded_files = (
+  'somefile.txt' => {
+    content => "blabla",
+  },
+);
+
+my $sslsock = SSLTest->new(cmdline   => $cmdline,
+                           input     => \%urls,
+                           errcode   => $expected_error_code,
+                           existing  => \%existing_files,
+                           output    => \%expected_downloaded_files,
+                           certfile  => $usrcrt,
+                           keyfile   => $usrkey,
+                           lhostname => $testhostname);
+if ($sslsock->run() == 0)
+{
+  exit 0;
+}
+
+# Retry the test with --no-check-certificate. expect success
+$port    = 31443;
+$cmdline = $WgetTest::WGETPATH . " --ca-certificate=$srcdir/certs/wotca.pem".
+                                 " https://$testhostname:$port/somefile.txt";
+
+$expected_error_code = 0;
+
+my $retryssl = SSLTest->new(cmdline  => $cmdline,
+                           input     => \%urls,
+                           errcode   => $expected_error_code,
+                           existing  => \%existing_files,
+                           output    => \%expected_downloaded_files,
+                           certfile  => $usrcrt,
+                           keyfile   => $usrkey,
+                           lhostname => $testhostname,
+                           sslport   => $port);
+exit $retryssl->run();
+# vim: et ts=4 sw=4

tests/Test-idn-meta.px

@@ -27,7 +27,7 @@ my %urls = (
         code => "200",
         msg => "You want fries with that?",
         headers => {
-            # HTTP header preceeds http-equiv, simply just omit it here
+            # HTTP header preceds http-equiv, simply just omit it here
             #'Content-Type' => 'text/html; charset=UTF-8',
         },
         content => $starter_file,

tests/Test-proxied-https-auth-keepalive.px

@@ -153,7 +153,7 @@ my $cmdline = $WgetTest::WGETPATH . " --user=fiddle-dee-dee"
     . " --password=Dodgson -e https_proxy=localhost:{{port}}"
     . " --no-check-certificate"
     . " https://no.such.domain/needs-auth.txt";
-$cmdline =~ s/{{port}}/$SOCKET->sockport()/e;
+$cmdline =~ s/\Q{{port}}/$SOCKET->sockport()/e;
 
 if (defined $srcdir) {
     $VALGRIND_SUPP_FILE = $srcdir . '/valgrind-suppressions-ssl';

tests/Test-proxied-https-auth.px

@@ -152,7 +152,7 @@ my $cmdline = $WgetTest::WGETPATH . " --user=fiddle-dee-dee"
     . " --password=Dodgson -e https_proxy=localhost:{{port}}"
     . " --no-check-certificate"
     . " https://no.such.domain/needs-auth.txt";
-$cmdline =~ s/{{port}}/$SOCKET->sockport()/e;
+$cmdline =~ s/\Q{{port}}/$SOCKET->sockport()/e;
 
 if (defined $srcdir) {
     $VALGRIND_SUPP_FILE = $srcdir . '/valgrind-suppressions-ssl';

tests/WgetFeature.cfg

@@ -1,6 +0,0 @@
-%skip_messages = (
-    https => "Not running test: Wget under test doesn't support HTTPS.",
-    iri   => "Not running test: Wget under test doesn't support IDN/IRI.",
-);
-
-1;

tests/WgetFeature.pm

@@ -5,26 +5,14 @@ use warnings;
 
 our $VERSION = 0.01;
 
-use Carp;
 use English qw(-no_match_vars);
-use FindBin;
 use WgetTests;
 
-our %SKIP_MESSAGES;
-{
-    my $cfgfile = "$FindBin::Bin/WgetFeature.cfg";
-    open my $fh, '<', $cfgfile
-      or croak "Cannot open '$cfgfile': $ERRNO";
-    my @lines = <$fh>;
-    close $fh or carp "Cannot close '$cfgfile': $ERRNO";
-    my $evalstr = join q{}, @lines;
-    eval { $evalstr } or carp "Cannot eval '$cfgfile': $ERRNO";
-}
-
 sub import
 {
-    my ($class, $feature) = @_;
+    my ($class, @required_feature) = @_;
 
+    # create a list of available features from 'wget --version' output
     my $output = `$WgetTest::WGETPATH --version`;
     my ($list) = $output =~ m/^([+-]\S+(?:\s+[+-]\S+)+)/msx;
     my %have_features;
@@ -34,10 +22,19 @@ sub import
         $feat =~ s/^.//msx;
         $have_features{$feat} = $f =~ m/^[+]/msx ? 1 : 0;
     }
-    if (!$have_features{$feature})
+
+    foreach (@required_feature)
     {
-        print "$SKIP_MESSAGES{$feature}\n";
-        exit 77;    # skip
+        if (!$have_features{$_})
+        {
+            print "Skipped test: Wget misses feature '$_'\n";
+            print "Features available from 'wget --version' output:\n";
+            foreach (keys %have_features)
+            {
+                print "    $_=$have_features{$_}\n";
+            }
+            exit 77; # skip
+        }
     }
 }
 

tests/WgetTests.pm

@@ -13,7 +13,7 @@ use IO::Handle;
 use POSIX qw(locale_h);
 use locale;
 
-our $WGETPATH = '../src/wget';
+our $WGETPATH = '../src/wget -d --no-config';
 our $VALGRIND_SUPP_FILE = Cwd::getcwd();
 if (defined $ENV{'srcdir'}) {
     $VALGRIND_SUPP_FILE = $VALGRIND_SUPP_FILE
@@ -152,7 +152,7 @@ sub run
     $errcode >>= 8;    # XXX: should handle abnormal error codes.
 
     # Shutdown server
-    # if we didn't explicitely kill the server, we would have to call
+    # if we didn't explicitly kill the server, we would have to call
     # waitpid ($pid, 0) here in order to wait for the child process to
     # terminate
     kill 'TERM', $pid;
@@ -359,8 +359,9 @@ sub _verify_download
               );
     if (@unexpected_downloads)
     {
-        return 'Test failed: unexpected downloaded files [' . join ', ',
-          @unexpected_downloads . "]\n";
+        return 'Test failed: unexpected downloaded files [' .
+          (join ', ', @unexpected_downloads) . "]\n";
+
     }
 
     return q{};

tests/certs/client.crt

@@ -0,0 +1,148 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 4386 (0x1122)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=CA, L=San Jose, O=Wget Testing Department, OU=Testing, CN=WgetTesting/emailAddress=bugs-wget@gnu.org
+        Validity
+            Not Before: May  9 21:08:52 2017 GMT
+            Not After : May  9 21:08:52 2019 GMT
+        Subject: CN=., ST=CA, C=US, O=Client
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (4096 bit)
+                Modulus:
+                    00:c8:e0:0f:fd:d5:96:99:1d:f5:8e:4a:d7:84:85:
+                    fc:48:8b:e4:cf:78:27:22:ea:1b:b4:4e:f0:a2:05:
+                    29:78:37:43:42:17:fe:8d:98:4b:4b:8a:f6:b2:92:
+                    23:2c:f2:af:c8:9d:36:57:03:90:82:00:02:0c:f8:
+                    33:14:f2:5c:5f:cc:8f:f8:14:b5:df:a8:e3:0d:d1:
+                    bf:5a:f2:8d:24:37:66:1a:31:99:7e:f7:8d:8e:86:
+                    fd:ea:a6:73:60:84:dc:1c:d9:28:87:92:9f:cf:c4:
+                    8e:9f:2b:ce:c3:8a:20:ce:8d:5b:66:fe:78:f1:bd:
+                    7b:57:b1:ad:bc:db:8c:0a:a8:92:c1:92:5d:6f:b9:
+                    5f:7f:c7:62:4d:59:60:48:8e:1f:a3:02:2f:79:26:
+                    68:6f:ed:0a:95:07:c8:e5:9a:93:ba:cb:af:c7:a9:
+                    06:a7:99:b4:ce:1f:26:b7:d5:f6:bd:b4:b2:ad:14:
+                    fe:df:8c:41:94:d4:d2:41:18:43:fe:19:0e:43:67:
+                    10:8a:ac:f1:47:1c:5a:71:ed:d7:76:aa:67:81:67:
+                    1d:6f:77:db:c1:93:ee:36:ec:34:6f:c8:97:73:57:
+                    09:dc:9a:b8:54:35:ae:a3:91:2a:5d:f3:e4:70:77:
+                    7c:bc:0d:d8:f5:a2:f0:2d:b2:ba:3e:b6:ce:8a:30:
+                    16:ea:6d:20:b8:ac:dd:eb:3c:a5:62:c5:7d:3a:ef:
+                    df:64:83:a7:ab:a1:c3:65:7a:54:fc:a4:26:0f:64:
+                    a5:83:ed:29:8f:05:ef:aa:2f:98:af:87:98:87:34:
+                    a7:31:55:09:75:37:7d:70:c3:44:14:c4:05:b2:f8:
+                    6b:6b:25:b4:55:d5:fe:29:3f:ab:f0:d1:e6:3f:dc:
+                    e9:c6:83:5d:f5:4a:ca:34:e0:3d:52:a4:dd:86:09:
+                    e5:3e:b3:9e:f3:79:99:af:b1:6b:7e:6e:c8:0d:04:
+                    28:fa:38:59:94:71:3c:d2:39:84:a5:56:41:ae:8c:
+                    63:2d:5c:9b:79:ce:f0:a6:69:6c:74:b7:36:e9:87:
+                    67:ad:5b:61:6f:d2:53:d4:7a:94:e1:26:29:d0:56:
+                    02:f5:6e:15:dc:a9:0b:e6:37:2a:32:9c:35:f3:72:
+                    2d:3d:e2:d4:25:48:a9:d0:c9:7b:cb:1a:4d:c1:44:
+                    5c:57:ab:75:65:ae:06:b2:40:b6:55:a8:2e:fb:fa:
+                    6e:0b:75:eb:86:02:ea:63:fe:9a:74:9d:02:4b:60:
+                    95:ef:53:04:13:87:07:6a:52:64:ba:e6:40:09:ab:
+                    a9:50:a3:12:ce:75:51:35:af:37:34:60:6a:e9:d7:
+                    3c:00:2b:4a:92:75:48:f3:4a:26:13:08:04:d0:47:
+                    05:a1:07
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Subject Key Identifier: 
+                41:CD:E0:FB:C1:87:D6:77:38:B5:A3:94:8A:D0:5B:5C:87:70:32:E9
+            X509v3 Authority Key Identifier: 
+                keyid:17:ED:93:43:8F:A7:A6:00:75:D4:E8:B6:82:0D:88:37:7E:C0:6D:08
+
+            X509v3 Key Usage: 
+                Digital Signature, Key Encipherment, Certificate Sign, CRL Sign
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://test.wgettest.org/Bogus.crl
+
+                Full Name:
+                  URI:http://test.wgettest.org/Bogus.crl
+
+            X509v3 Subject Alternative Name: 
+                DNS:WgetTestingServer
+            Authority Information Access: 
+                CA Issuers - URI:http://test.wgettest.com/Bogus.crt
+                CA Issuers - URI:http://test.wgettest.com/Bogus.crt
+                OCSP - URI:http://test.wgettest.com/ocsp/
+                OCSP - URI:http://test.wgettest.com/ocsp/
+
+    Signature Algorithm: sha1WithRSAEncryption
+         46:a4:f3:c2:63:cf:c3:76:84:aa:a3:ba:27:32:25:15:54:e6:
+         69:d2:2f:7c:c9:68:88:01:10:8c:0d:4e:f7:3c:cc:e5:7f:e6:
+         87:55:e9:80:69:e0:05:cb:40:84:65:cc:4d:35:f3:a0:6a:95:
+         28:08:cb:95:16:9c:2b:d2:15:5b:d7:43:81:e1:ff:7e:e0:0f:
+         d7:25:01:f5:3d:d5:0f:88:15:1b:59:5f:6f:31:75:03:19:2b:
+         24:5a:d4:b4:e8:1a:19:81:c9:c6:b9:e2:b2:cb:dc:fd:b3:fc:
+         18:ec:76:68:2d:9e:78:41:31:0b:c0:f2:ca:70:93:66:6b:97:
+         cf:b8:8e:69:3e:86:63:7b:12:40:8f:1b:de:25:2a:a7:97:83:
+         4f:a1:7e:0b:07:15:bb:42:e9:a0:a8:80:17:c2:75:a9:35:e6:
+         57:bf:09:83:71:b5:51:3b:95:37:79:d6:8b:4e:96:86:22:d3:
+         54:53:ac:af:ea:ec:0c:58:4c:18:11:4d:77:35:ae:40:7c:6d:
+         5d:c5:36:46:19:fa:d9:83:76:cf:e6:70:69:3a:32:a3:0c:4f:
+         6f:28:18:0d:6a:d3:47:b4:e8:e3:77:a8:90:0d:74:08:f1:4e:
+         68:45:27:fc:22:57:ad:63:92:7c:fd:bf:44:ad:ec:be:12:42:
+         49:b9:e0:23:2c:95:98:f2:d3:07:a3:00:6a:4f:eb:3d:8b:6d:
+         c6:0a:ef:1e:c8:71:1b:d2:3b:2e:81:86:5b:36:05:6a:f4:3f:
+         25:cc:4a:d1:a4:d9:f6:8e:6d:a2:db:54:1e:c5:1b:dd:44:e3:
+         fc:0b:8b:8c:84:7d:e0:bf:1b:d4:53:3e:ab:31:fd:f4:25:1f:
+         29:b9:55:f0:92:0e:fe:ab:46:cc:a1:50:96:10:6a:d9:c0:cd:
+         6d:c1:e9:86:77:7e:ef:93:bf:be:03:21:87:d9:dc:36:53:41:
+         f6:a6:6c:f2:23:ee:be:34:4a:2e:95:29:09:7d:8f:1a:10:d2:
+         ff:a5:6b:26:93:e1:83:da:be:22:fd:7f:14:f2:1c:03:f5:64:
+         f8:75:00:f0:da:5e:78:e3:07:90:a0:4a:16:1c:31:70:09:b5:
+         46:4d:71:42:64:19:b0:53:ce:27:f7:9a:34:5d:c4:df:7d:06:
+         bf:af:8e:c2:9a:19:c1:f9:90:36:eb:41:0c:2c:3d:51:22:bb:
+         18:eb:ed:0b:5c:92:15:60:79:42:be:c1:f6:f1:46:29:c9:6c:
+         0a:ba:f9:4c:46:44:1e:32:7d:83:df:55:b1:31:1f:c2:db:22:
+         a4:bd:2d:79:d1:ca:a1:80:12:ce:5a:26:68:54:8b:d3:f4:8b:
+         cf:45:d3:57:92:70:b6:7c
+-----BEGIN CERTIFICATE-----
+MIIHDjCCBPagAwIBAgICESIwDQYJKoZIhvcNAQEFBQAwgZkxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTERMA8GA1UEBwwIU2FuIEpvc2UxIDAeBgNVBAoMF1dnZXQg
+VGVzdGluZyBEZXBhcnRtZW50MRAwDgYDVQQLDAdUZXN0aW5nMRQwEgYDVQQDDAtX
+Z2V0VGVzdGluZzEgMB4GCSqGSIb3DQEJARYRYnVncy13Z2V0QGdudS5vcmcwHhcN
+MTcwNTA5MjEwODUyWhcNMTkwNTA5MjEwODUyWjA3MQowCAYDVQQDDAEuMQswCQYD
+VQQIDAJDQTELMAkGA1UEBhMCVVMxDzANBgNVBAoMBkNsaWVudDCCAiIwDQYJKoZI
+hvcNAQEBBQADggIPADCCAgoCggIBAMjgD/3Vlpkd9Y5K14SF/EiL5M94JyLqG7RO
+8KIFKXg3Q0IX/o2YS0uK9rKSIyzyr8idNlcDkIIAAgz4MxTyXF/Mj/gUtd+o4w3R
+v1ryjSQ3ZhoxmX73jY6G/eqmc2CE3BzZKIeSn8/Ejp8rzsOKIM6NW2b+ePG9e1ex
+rbzbjAqoksGSXW+5X3/HYk1ZYEiOH6MCL3kmaG/tCpUHyOWak7rLr8epBqeZtM4f
+JrfV9r20sq0U/t+MQZTU0kEYQ/4ZDkNnEIqs8UccWnHt13aqZ4FnHW9328GT7jbs
+NG/Il3NXCdyauFQ1rqORKl3z5HB3fLwN2PWi8C2yuj62zoowFuptILis3es8pWLF
+fTrv32SDp6uhw2V6VPykJg9kpYPtKY8F76ovmK+HmIc0pzFVCXU3fXDDRBTEBbL4
+a2sltFXV/ik/q/DR5j/c6caDXfVKyjTgPVKk3YYJ5T6znvN5ma+xa35uyA0EKPo4
+WZRxPNI5hKVWQa6MYy1cm3nO8KZpbHS3NumHZ61bYW/SU9R6lOEmKdBWAvVuFdyp
+C+Y3KjKcNfNyLT3i1CVIqdDJe8saTcFEXFerdWWuBrJAtlWoLvv6bgt164YC6mP+
+mnSdAktgle9TBBOHB2pSZLrmQAmrqVCjEs51UTWvNzRgaunXPAArSpJ1SPNKJhMI
+BNBHBaEHAgMBAAGjggG/MIIBuzAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRB
+zeD7wYfWdzi1o5SK0Ftch3Ay6TAfBgNVHSMEGDAWgBQX7ZNDj6emAHXU6LaCDYg3
+fsBtCDALBgNVHQ8EBAMCAaYwEwYDVR0lBAwwCgYIKwYBBQUHAwEwXQYDVR0fBFYw
+VDAooCagJIYiaHR0cDovL3Rlc3Qud2dldHRlc3Qub3JnL0JvZ3VzLmNybDAooCag
+JIYiaHR0cDovL3Rlc3Qud2dldHRlc3Qub3JnL0JvZ3VzLmNybDAcBgNVHREEFTAT
+ghFXZ2V0VGVzdGluZ1NlcnZlcjCByAYIKwYBBQUHAQEEgbswgbgwLgYIKwYBBQUH
+MAKGImh0dHA6Ly90ZXN0LndnZXR0ZXN0LmNvbS9Cb2d1cy5jcnQwLgYIKwYBBQUH
+MAKGImh0dHA6Ly90ZXN0LndnZXR0ZXN0LmNvbS9Cb2d1cy5jcnQwKgYIKwYBBQUH
+MAGGHmh0dHA6Ly90ZXN0LndnZXR0ZXN0LmNvbS9vY3NwLzAqBggrBgEFBQcwAYYe
+aHR0cDovL3Rlc3Qud2dldHRlc3QuY29tL29jc3AvMA0GCSqGSIb3DQEBBQUAA4IC
+AQBGpPPCY8/DdoSqo7onMiUVVOZp0i98yWiIARCMDU73PMzlf+aHVemAaeAFy0CE
+ZcxNNfOgapUoCMuVFpwr0hVb10OB4f9+4A/XJQH1PdUPiBUbWV9vMXUDGSskWtS0
+6BoZgcnGueKyy9z9s/wY7HZoLZ54QTELwPLKcJNma5fPuI5pPoZjexJAjxveJSqn
+l4NPoX4LBxW7QumgqIAXwnWpNeZXvwmDcbVRO5U3edaLTpaGItNUU6yv6uwMWEwY
+EU13Na5AfG1dxTZGGfrZg3bP5nBpOjKjDE9vKBgNatNHtOjjd6iQDXQI8U5oRSf8
+IletY5J8/b9Erey+EkJJueAjLJWY8tMHowBqT+s9i23GCu8eyHEb0jsugYZbNgVq
+9D8lzErRpNn2jm2i21QexRvdROP8C4uMhH3gvxvUUz6rMf30JR8puVXwkg7+q0bM
+oVCWEGrZwM1twemGd37vk7++AyGH2dw2U0H2pmzyI+6+NEoulSkJfY8aENL/pWsm
+k+GD2r4i/X8U8hwD9WT4dQDw2l544weQoEoWHDFwCbVGTXFCZBmwU84n95o0XcTf
+fQa/r47CmhnB+ZA260EMLD1RIrsY6+0LXJIVYHlCvsH28UYpyWwKuvlMRkQeMn2D
+31WxMR/C2yKkvS150cqhgBLOWiZoVIvT9IvPRdNXknC2fA==
+-----END CERTIFICATE-----

tests/certs/client.key

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKQIBAAKCAgEAyOAP/dWWmR31jkrXhIX8SIvkz3gnIuobtE7wogUpeDdDQhf+
+jZhLS4r2spIjLPKvyJ02VwOQggACDPgzFPJcX8yP+BS136jjDdG/WvKNJDdmGjGZ
+fveNjob96qZzYITcHNkoh5Kfz8SOnyvOw4ogzo1bZv548b17V7GtvNuMCqiSwZJd
+b7lff8diTVlgSI4fowIveSZob+0KlQfI5ZqTusuvx6kGp5m0zh8mt9X2vbSyrRT+
+34xBlNTSQRhD/hkOQ2cQiqzxRxxace3XdqpngWcdb3fbwZPuNuw0b8iXc1cJ3Jq4
+VDWuo5EqXfPkcHd8vA3Y9aLwLbK6PrbOijAW6m0guKzd6zylYsV9Ou/fZIOnq6HD
+ZXpU/KQmD2Slg+0pjwXvqi+Yr4eYhzSnMVUJdTd9cMNEFMQFsvhrayW0VdX+KT+r
+8NHmP9zpxoNd9UrKNOA9UqTdhgnlPrOe83mZr7Frfm7IDQQo+jhZlHE80jmEpVZB
+roxjLVybec7wpmlsdLc26YdnrVthb9JT1HqU4SYp0FYC9W4V3KkL5jcqMpw183It
+PeLUJUip0Ml7yxpNwURcV6t1Za4GskC2Vagu+/puC3XrhgLqY/6adJ0CS2CV71ME
+E4cHalJkuuZACaupUKMSznVRNa83NGBq6dc8ACtKknVI80omEwgE0EcFoQcCAwEA
+AQKCAgADk7HVNEt1OIpZ2U1TJ8uhQxR0+U/BGGgb4tf4Gp1tbZZ+A81dmhulIblY
+3q9PqpakvN/t1rtpBTUEJBtMwTAR6KObqErAy9IXOeftZ6pJvc7Mopt4HlJf+lll
+J0egrVz6CoflOiAsY/SiMvaAluIUq4G4KMngjB45JonQdhxdSDksxz1wst1XeiZu
++Ct1v0oi7fQIdT2g2Ji6pKPYKtN8nQnpRUJAE8WbcgSPe3jkUeZonJoZQvcb/los
+HJGBYdLWMmyh+4hkWsXlh3WxwEENldd5V6oLHWY9hiE86FaCEEe1rO+hWD9e3EPj
+3mbv9cC73IdDgH5EYg1c9oZhAZA23lvH1u8yFpfPAOdvl0X2T6rSmd0zWrrWpKem
+yoghSaW9rpWsM6rwI/B+gZlgwQQHLcRVrNJuXW7kTqRQnD+y9EM8HNddkNjmI6Op
+z135xRR4JNX15b1CCgiVWoHO/o/U/ivMRo4zjaoASxUB50TX9C+HTVY75Sr7tSAb
+v9/+8TWrCWJVXrCg/SddPF1DfBrpSPR77wa/zoD9IY7MHwnrmgdDt5I59Faa0KDF
+F1E0RLsVUUS8byLNcb26KpWUJQRi6ILr8KDQ+iVbk6QE/TqVQ5oxwmaa7dRdAL5s
+ao8gKU8XiGezbXFtN22adTEGIUPBAxGBcuEr8CYqlX1Gz0YvmQKCAQEA6wpdT6OZ
+s4bYuuMJiXxSwSSmXuqslP6JDSWliqznsJJnfn2Dy4+d945DRAE24IDgzJdrPtWv
+MfgRFJOG7Gri+7eVlLR7H+zfKnge/lOsdmVdBCrTiqTNt0XhAKZAEAq9j+4/5GMF
+bj9Mt9LUN12YgmVnWIfLgGDfQA0B5sTUjQwaSImAv4s24MLXW+sE8Jzq+k3C5u44
+oWqmU1LEBGqXVamtlM8xIRKghWVofeAVKjkGdUBrPptIEwYMAWub40Q2I9G7w5cF
+PGSFn51R8ahLOGICE42n3Aus0N6iDsNvDc2EdlR0NIKT0sbkya/sy9jgDLg1UhkG
+LJblXa5OXCDmWwKCAQEA2snBNmRuiczN43VzRgTVS840Ri46Hhx1BGaKRwNmGiTK
+4p/TLSnL1MgjdBLs/M678srxTSCzQX1YuV6G3p708ez+Q1IwHAuWiwBc7bmHHgxj
+v4gimIrPux+cMtOEmyxUL8s9leqZflGqoc3UILNNq9QcrVITcEkwCNqdpDk9vmii
+l54bjwuyad7IyFe7txIzLzNib5bbrK+t/R10RuvHKPaAeLDa1kDvwyOQa5ImRHWt
+yg1Kj63lVBwXJv+K6d+Z/NFMgT7fVJk70j6WcKfEcufyYdKzhkj+ai1wJzeQplu4
++x2YFS9ygonISPge+55LJ3PCLj0g0MIhPK+BI32nxQKCAQEA4HUDa1x3GeT68G6E
+2xEpDl3rq9U8fwUc6Ls8/dPlZtBJmZhP1oQOfS0Uu8rVF0y8YWVw+46hQnz+AsJo
+JTpmDbDiXiKFOpXBARO5tXM+zco7LBGh91MvSYioOTCLGUbIhL0nsvmFZCV7JElo
+dH8jd9NTAE6eXrkkOkyxtineOdyG9SKrG0DdZYNsmtEz5HxWQjckm9h/qFbrA8OU
+ggsw/pONuwCqkETzmrCfOyZVz/6pVivwvtcX22L48BpNwpmPgmF2iHCehXAR074v
+VTI8s1mVVgr/dLqJjOYvqR2l3m6Xw1EfsE3K0Y0zTBB/eKRiQoNgGEjhho+L9wzQ
+tFaO5QKCAQEAmYvCh5PQZ/FOBXYmIlu9/eeHlEFZFEzQavgzz0a5X1u273lPUYDl
+xj13dDzcCUhlay22T3TFmQ6JN/75FD/mk+rJPyHtFaGkU4U7srLj+tijIIZAEWJK
+C39RtfHwPJ7NroUqgY4VjyttXwT+/LwZpJ/GSHUzozgZ9/zFab2qcXkpstKJcMi6
+u8ZYjxHTcdXaCiQ7zyjGntjkeKE1O5i5OyxUWV91FayZGBBbiMMXDDCyePz++PsH
+2RGlxf7N1PjSLzYMRSCEx/CKpTC7j/CN1D6oQrMGvxV3R7j/3uYGJFp25fWNCEE2
+Uhq0b1GDHP+oqtV4z86iux+jB937+ZZ0KQKCAQBetr8pywp3jftYVhGU9+VZxYc/
+2vM5+WEdOqJAoHwXed5AMHReycKUmbDilWbswXyiBDGmIokoMKP09JMXfCbHMTkX
+LZCsxFGUpzAGg7sHI1NLTqWGU+fOmtzg7SJ77tZqJj1zzmgLX54oQ9qx53V6StWV
+Zw7YxkRbnLQ+LZU0HyYb11v5oh1CnWUoGINMkV6Bhv+jPCzUP/vs4/JgOFqhwjlN
+GVX0ewFGykinTK34ia9TI1Updgb3FWt3i9+twwAis1nnnuHt19tdi22BPwAuyFPx
+hsf5t4Kcm8xibjeHzQMLqP4v2arW09zsg5kDTQHoQDcUajJ+cdbpY2PeosfN
+-----END RSA PRIVATE KEY-----

tests/certs/expired.crt

@@ -0,0 +1,149 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=CA, L=San Jose, O=Wget Testing Department, OU=Testing, CN=WgetTesting/emailAddress=bugs-wget@gnu.org
+        Validity
+            Not Before: May 14 09:05:02 2017 GMT
+            Not After : May  8 16:03:42 2017 GMT
+        Subject: CN=WgetTestingServer, ST=CA, C=US/emailAddress=ExpiredTester, O=Dis
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (4096 bit)
+                Modulus:
+                    00:d8:ed:cc:9c:e5:35:42:f2:1b:d8:30:36:40:a5:
+                    01:8e:0f:c2:3c:5b:f0:d1:09:a0:aa:63:07:44:b9:
+                    2e:20:20:47:5e:43:f3:bc:3b:df:88:f9:26:e6:07:
+                    d9:9c:4c:67:53:46:3a:78:c5:0a:90:0c:f2:e9:a1:
+                    e0:d9:f3:52:bc:51:07:32:ac:9b:d3:ac:f9:25:7d:
+                    52:8b:2f:fa:06:6e:2d:c4:d4:2e:c7:38:81:f3:30:
+                    4e:b5:d6:7b:2e:fe:4c:12:84:db:f4:7f:22:91:4d:
+                    45:37:bb:01:96:61:59:62:af:2e:de:21:70:fa:3e:
+                    29:97:9d:3c:bf:41:5c:cd:2a:b4:f7:4f:6f:78:a1:
+                    b3:d5:79:53:4e:68:7b:cf:0e:78:87:47:9c:3f:3f:
+                    da:50:27:08:7d:12:c7:e2:da:cc:6f:a4:63:12:ca:
+                    28:a0:7d:f8:a8:ac:a3:72:77:ab:18:52:83:b1:2e:
+                    44:49:1a:0c:25:bc:21:bd:40:09:96:6b:60:04:e4:
+                    f2:3f:bc:c4:1e:3c:43:55:1d:fa:40:18:cd:70:91:
+                    24:03:1a:b8:95:e0:b2:70:3f:1e:05:a8:21:37:b1:
+                    d0:ff:54:36:65:9f:a7:ba:2d:c2:ef:e2:a9:a4:c4:
+                    72:c5:4c:82:8e:46:3e:b6:d9:aa:62:14:07:1d:53:
+                    19:08:9b:88:6d:b9:20:88:7c:bc:89:95:02:d5:54:
+                    96:7b:b0:a8:14:fd:30:ce:5f:41:b7:bf:e2:75:9a:
+                    a3:fa:20:43:2f:c8:80:cd:97:f7:57:37:5d:11:9b:
+                    fe:bf:aa:56:0e:2f:cd:47:7e:0f:db:2d:f7:71:44:
+                    c5:21:7d:c6:b3:50:5d:30:b0:4c:54:8f:7e:05:82:
+                    e6:5e:3b:62:d7:1b:5a:f5:de:57:76:2a:90:b0:d4:
+                    ec:72:8e:ab:64:f1:6f:12:21:80:7c:64:8a:5c:da:
+                    c1:86:12:ff:a9:e9:93:2f:2c:70:59:84:a4:5c:13:
+                    e0:02:d4:9a:72:0e:40:c3:db:99:1b:60:85:c0:94:
+                    1d:15:24:5b:8b:f6:6f:2c:d1:b5:95:50:e2:53:76:
+                    4f:cf:57:8e:d5:8b:c1:f5:3f:ad:07:aa:7b:84:32:
+                    dd:32:b5:59:a5:1b:d4:a2:b6:3b:6c:07:cc:4b:e8:
+                    fc:6a:d8:42:e8:08:dc:f1:f1:91:74:cf:9f:5f:57:
+                    6e:ab:93:5b:5e:af:7d:1c:b7:d3:eb:08:4c:a9:a7:
+                    b5:aa:d6:46:a8:a0:63:68:7b:44:cf:5c:21:42:3c:
+                    98:ff:42:31:77:94:4f:85:d2:7a:da:56:b1:c4:3c:
+                    b9:2d:e9:d6:88:f3:6c:ff:7b:39:19:83:80:ab:31:
+                    ab:19:6b
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Subject Key Identifier: 
+                E6:C0:06:2E:89:41:44:32:AE:B6:C5:62:B6:7E:B5:DA:3B:75:D4:04
+            X509v3 Authority Key Identifier: 
+                keyid:17:ED:93:43:8F:A7:A6:00:75:D4:E8:B6:82:0D:88:37:7E:C0:6D:08
+
+            X509v3 Key Usage: 
+                Digital Signature, Key Encipherment, Certificate Sign, CRL Sign
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://test.wgettest.org/Bogus.crl
+
+                Full Name:
+                  URI:http://test.wgettest.org/Bogus.crl
+
+            X509v3 Subject Alternative Name: 
+                DNS:WgetTestingServer
+            Authority Information Access: 
+                CA Issuers - URI:http://test.wgettest.com/Bogus.crt
+                CA Issuers - URI:http://test.wgettest.com/Bogus.crt
+                OCSP - URI:http://test.wgettest.com/ocsp/
+                OCSP - URI:http://test.wgettest.com/ocsp/
+
+    Signature Algorithm: sha1WithRSAEncryption
+         41:03:d8:91:54:f2:5c:e5:15:80:cd:96:a2:89:94:df:8c:d4:
+         ce:99:1a:f6:69:03:1d:aa:a8:3d:7f:8a:65:bd:b2:3a:f0:46:
+         00:6d:c7:cc:7a:18:44:cb:b4:17:f1:40:83:b1:17:90:64:ba:
+         22:2e:18:7e:35:29:20:4c:8f:34:14:86:34:1f:42:6e:a6:e7:
+         d7:18:a3:11:77:3d:ec:b1:39:59:7b:12:3f:55:b0:86:4a:9f:
+         6a:1c:b6:9e:03:3d:39:bf:f6:34:f5:d7:6f:44:bd:9a:54:e5:
+         f9:d9:14:85:01:d9:3d:0e:18:89:d0:bf:27:df:9a:4f:39:7c:
+         ec:46:92:e5:3e:9e:e5:10:4a:ed:03:aa:3b:93:02:e9:f3:18:
+         c1:5f:e8:cb:16:e0:54:9f:8b:0a:c9:65:48:32:93:90:91:2e:
+         84:26:14:28:b5:5c:61:38:39:28:3e:8e:74:dd:08:07:67:41:
+         9a:82:67:48:ba:3b:c1:66:76:27:7a:9c:c5:95:45:b5:9c:4d:
+         94:9b:f5:e2:93:39:2c:d8:15:31:27:82:56:9b:1a:73:e5:f2:
+         6a:9a:cd:47:0a:2b:ff:6e:5f:b2:f8:53:4f:fc:c3:1c:b7:25:
+         00:30:77:21:87:9b:88:d4:87:f7:30:79:f7:bd:a2:df:42:c4:
+         95:c4:e3:3c:94:4a:87:96:94:54:de:fe:80:13:e6:ec:37:dd:
+         33:a2:e4:f7:15:e7:a8:08:c6:3d:3b:65:34:96:5f:46:c8:41:
+         7f:ce:c5:ca:3a:44:d2:fb:9c:3c:c7:2c:da:12:b3:1f:62:40:
+         38:12:cb:36:b7:5c:e7:32:5c:e3:2a:af:b5:36:e8:83:d3:8e:
+         da:4c:b5:52:5f:f4:d6:54:b7:3b:9d:62:86:5a:26:f1:58:a8:
+         2e:f6:46:9c:6f:98:76:e1:bb:9c:27:73:0f:78:11:60:b9:ac:
+         13:6e:d9:ec:24:5f:64:e9:59:14:36:02:f1:f0:57:97:ce:31:
+         0a:80:1e:d0:c0:c0:77:62:24:c5:d9:61:e9:d9:57:76:64:e1:
+         1c:c7:5a:55:e2:58:ab:2f:58:6f:42:91:03:aa:6f:1c:9b:fc:
+         0a:c5:ee:14:1d:07:a1:b3:ec:97:6f:ac:2f:85:7f:ea:88:18:
+         78:84:ac:af:d8:e9:b7:23:5c:a3:14:ab:8e:ee:95:5b:0d:6c:
+         e4:25:be:77:04:59:19:57:1e:f7:e0:5a:f2:fc:33:12:57:28:
+         11:2e:1f:05:6b:43:62:8f:c0:c3:4a:97:f9:6a:73:1d:dd:c0:
+         6f:d4:a2:23:0a:d2:86:68:df:bd:ac:75:61:cf:d8:3f:9a:d1:
+         8e:e9:33:59:bd:13:9a:27
+-----BEGIN CERTIFICATE-----
+MIIHODCCBSCgAwIBAgIBATANBgkqhkiG9w0BAQUFADCBmTELMAkGA1UEBhMCVVMx
+CzAJBgNVBAgMAkNBMREwDwYDVQQHDAhTYW4gSm9zZTEgMB4GA1UECgwXV2dldCBU
+ZXN0aW5nIERlcGFydG1lbnQxEDAOBgNVBAsMB1Rlc3RpbmcxFDASBgNVBAMMC1dn
+ZXRUZXN0aW5nMSAwHgYJKoZIhvcNAQkBFhFidWdzLXdnZXRAZ251Lm9yZzAeFw0x
+NzA1MTQwOTA1MDJaFw0xNzA1MDgxNjAzNDJaMGIxGjAYBgNVBAMMEVdnZXRUZXN0
+aW5nU2VydmVyMQswCQYDVQQIDAJDQTELMAkGA1UEBhMCVVMxHDAaBgkqhkiG9w0B
+CQEWDUV4cGlyZWRUZXN0ZXIxDDAKBgNVBAoMA0RpczCCAiIwDQYJKoZIhvcNAQEB
+BQADggIPADCCAgoCggIBANjtzJzlNULyG9gwNkClAY4Pwjxb8NEJoKpjB0S5LiAg
+R15D87w734j5JuYH2ZxMZ1NGOnjFCpAM8umh4NnzUrxRBzKsm9Os+SV9Uosv+gZu
+LcTULsc4gfMwTrXWey7+TBKE2/R/IpFNRTe7AZZhWWKvLt4hcPo+KZedPL9BXM0q
+tPdPb3ihs9V5U05oe88OeIdHnD8/2lAnCH0Sx+LazG+kYxLKKKB9+Kiso3J3qxhS
+g7EuREkaDCW8Ib1ACZZrYATk8j+8xB48Q1Ud+kAYzXCRJAMauJXgsnA/HgWoITex
+0P9UNmWfp7otwu/iqaTEcsVMgo5GPrbZqmIUBx1TGQibiG25IIh8vImVAtVUlnuw
+qBT9MM5fQbe/4nWao/ogQy/IgM2X91c3XRGb/r+qVg4vzUd+D9st93FExSF9xrNQ
+XTCwTFSPfgWC5l47YtcbWvXeV3YqkLDU7HKOq2TxbxIhgHxkilzawYYS/6npky8s
+cFmEpFwT4ALUmnIOQMPbmRtghcCUHRUkW4v2byzRtZVQ4lN2T89XjtWLwfU/rQeq
+e4Qy3TK1WaUb1KK2O2wHzEvo/GrYQugI3PHxkXTPn19XbquTW16vfRy30+sITKmn
+tarWRqigY2h7RM9cIUI8mP9CMXeUT4XSetpWscQ8uS3p1ojzbP97ORmDgKsxqxlr
+AgMBAAGjggG/MIIBuzAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBTmwAYuiUFE
+Mq62xWK2frXaO3XUBDAfBgNVHSMEGDAWgBQX7ZNDj6emAHXU6LaCDYg3fsBtCDAL
+BgNVHQ8EBAMCAaYwEwYDVR0lBAwwCgYIKwYBBQUHAwEwXQYDVR0fBFYwVDAooCag
+JIYiaHR0cDovL3Rlc3Qud2dldHRlc3Qub3JnL0JvZ3VzLmNybDAooCagJIYiaHR0
+cDovL3Rlc3Qud2dldHRlc3Qub3JnL0JvZ3VzLmNybDAcBgNVHREEFTATghFXZ2V0
+VGVzdGluZ1NlcnZlcjCByAYIKwYBBQUHAQEEgbswgbgwLgYIKwYBBQUHMAKGImh0
+dHA6Ly90ZXN0LndnZXR0ZXN0LmNvbS9Cb2d1cy5jcnQwLgYIKwYBBQUHMAKGImh0
+dHA6Ly90ZXN0LndnZXR0ZXN0LmNvbS9Cb2d1cy5jcnQwKgYIKwYBBQUHMAGGHmh0
+dHA6Ly90ZXN0LndnZXR0ZXN0LmNvbS9vY3NwLzAqBggrBgEFBQcwAYYeaHR0cDov
+L3Rlc3Qud2dldHRlc3QuY29tL29jc3AvMA0GCSqGSIb3DQEBBQUAA4ICAQBBA9iR
+VPJc5RWAzZaiiZTfjNTOmRr2aQMdqqg9f4plvbI68EYAbcfMehhEy7QX8UCDsReQ
+ZLoiLhh+NSkgTI80FIY0H0JupufXGKMRdz3ssTlZexI/VbCGSp9qHLaeAz05v/Y0
+9ddvRL2aVOX52RSFAdk9DhiJ0L8n35pPOXzsRpLlPp7lEErtA6o7kwLp8xjBX+jL
+FuBUn4sKyWVIMpOQkS6EJhQotVxhODkoPo503QgHZ0GagmdIujvBZnYnepzFlUW1
+nE2Um/Xikzks2BUxJ4JWmxpz5fJqms1HCiv/bl+y+FNP/MMctyUAMHchh5uI1If3
+MHn3vaLfQsSVxOM8lEqHlpRU3v6AE+bsN90zouT3FeeoCMY9O2U0ll9GyEF/zsXK
+OkTS+5w8xyzaErMfYkA4Ess2t1znMlzjKq+1NuiD047aTLVSX/TWVLc7nWKGWibx
+WKgu9kacb5h24bucJ3MPeBFguawTbtnsJF9k6VkUNgLx8FeXzjEKgB7QwMB3YiTF
+2WHp2Vd2ZOEcx1pV4lirL1hvQpEDqm8cm/wKxe4UHQehs+yXb6wvhX/qiBh4hKyv
+2Om3I1yjFKuO7pVbDWzkJb53BFkZVx734Fry/DMSVygRLh8Fa0Nij8DDSpf5anMd
+3cBv1KIjCtKGaN+9rHVhz9g/mtGO6TNZvROaJw==
+-----END CERTIFICATE-----

tests/certs/expired.key

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKAIBAAKCAgEA2O3MnOU1QvIb2DA2QKUBjg/CPFvw0QmgqmMHRLkuICBHXkPz
+vDvfiPkm5gfZnExnU0Y6eMUKkAzy6aHg2fNSvFEHMqyb06z5JX1Siy/6Bm4txNQu
+xziB8zBOtdZ7Lv5MEoTb9H8ikU1FN7sBlmFZYq8u3iFw+j4pl508v0FczSq0909v
+eKGz1XlTTmh7zw54h0ecPz/aUCcIfRLH4trMb6RjEsoooH34qKyjcnerGFKDsS5E
+SRoMJbwhvUAJlmtgBOTyP7zEHjxDVR36QBjNcJEkAxq4leCycD8eBaghN7HQ/1Q2
+ZZ+nui3C7+KppMRyxUyCjkY+ttmqYhQHHVMZCJuIbbkgiHy8iZUC1VSWe7CoFP0w
+zl9Bt7/idZqj+iBDL8iAzZf3VzddEZv+v6pWDi/NR34P2y33cUTFIX3Gs1BdMLBM
+VI9+BYLmXjti1xta9d5XdiqQsNTsco6rZPFvEiGAfGSKXNrBhhL/qemTLyxwWYSk
+XBPgAtSacg5Aw9uZG2CFwJQdFSRbi/ZvLNG1lVDiU3ZPz1eO1YvB9T+tB6p7hDLd
+MrVZpRvUorY7bAfMS+j8athC6Ajc8fGRdM+fX1duq5NbXq99HLfT6whMqae1qtZG
+qKBjaHtEz1whQjyY/0Ixd5RPhdJ62laxxDy5LenWiPNs/3s5GYOAqzGrGWsCAwEA
+AQKCAgBPnog5Fc+EsMQThy6Cb42wjIwoBz7OGpCDuTETwjvxwqcvLBWrgvY6mefz
+CfKO8WQDJoWTig6kbHxD0AxtMmetgrf3m27eNGCFqAfB2mwULCBUW+SHbnATyCk7
+iGtSBjf5nBX3GSqg1hGPsO2WOkjKda3oDbIfxu0RHr8LG3xqOUCOfPNW/VK6CXvQ
+DX1Ts+X9EQWCGXeRb6In9dqzosbiOx256cUbkuDPV/3tp4p+tNptD6Q0iIDo4LIp
+efWK5gIqCbX4OtpolonIFeah2/ibVko3cXlKWVxk4mWsgdcfT/57mHcWuZCgPueL
+kE/fj9LoI3rPqWyfRCjLMrqhwrwuxZArvsN56CALrbBRpmJql+JL68bPu3fXBgak
+X457pXZVGj6GNFdv8JMXRMo/oyn/73jJdWt4g83HiXkXlcxuoLwsbiA8hq72DLMn
+dLTVS31Kn3T9RczKSk44xbGSJQUV/s3ErOA378lHJe5wQHk+A0p59fKen7GiT7dj
+4ZOzFy1sJW+DS9rklq6gGupdoHJVhcCLe9ryanb28MidMeWsUMa11OGXCpoRk8Np
+ZY9ASgfW0+o2XUZukL+NpU7/1ihdybr3E5w0N1IFAAvUa+f7A4iKJW65COdB53wz
+jG7zGal2aDqTbC2xLpaUk54Z3sEgpZNW7PqB+O21Yu/ZzC8wkQKCAQEA8MDWS7LF
+MkAppvl3M7ATU2tzq0PisoiUS595Sp+Y3LxB3GHKEQKKeMz2P2mHcg4tzYCg4bvP
+LE0HXizfFNBKwGMyi40+T2fYz+FC8zAYHKbsZQt0O2uvSGcMriZLCWuAEs45U/b0
+N9UN9BuE4yYizmUGYFjYmUMBUB0Oj/nIU8iikdbV3wBoCzuH1sP5f3kIQzAqNJgt
+zci+etMVCPecT8brbLAxKZOEaIX3IAxQu2t2V3geDvukLNECWsVeDAY9DGuL2x3e
+BnS+HGrOYDyAPVjxyzzNkjjzBdCV2ciipxwL2QzKsgVPx8L21RdK8mYEDB0dkv7B
+kTLw8wH4fxMavwKCAQEA5qq264K+QCRBTYtdayoK2qQksWd3U1QynF3zM0XMb8Ip
+J1HnCbzhQ2/ccXKgT9j9KuK+8A4q4Mw+RggwM5QWIfxzD7AjOYPO4G4mCFwwViM7
+H/HbH1WJMHo2LWDEx4/UrphXg2FF2yApX3nCDzNx2cVz39BDyiIKNXs+O8PFoF9N
+7emitJ7U+GV7wLWacMgTz4qvTuNu/dQfoCVzsfEvxYay6sAW2cX0nrwr5/+T7js8
+KrfklAOD5Rd36cLRTB7vUDgYQ39MN9Ab1X1e5kwn2HSLbcBJyUMDfRgnc82MnLKn
+O8CS2AS4j6tyEvRYrAOwqMmcwWnDBJzrfVicThLIVQKCAQBh7P39YmTFcMXAbh4n
+PwpNVxqAYid2mQlAzUgHq20A8+4SFxCa5J6wTiYnWuRF5zCIMza9OqglC9vgWX4P
+uD1/jZnEm5npsILG44hY5IoaNWdYHlWTydRNLeVBfL/uv/QjMhCtb3icsSNw1DS0
+NBHaQ8tZKypHBLMnA/qlY2MxeR1vFqR9hWvMjdVN7P6x8+gBdDjmlbOjzXB1AyC+
+OgExjea6mdwVXjRwU3VWasv3v9kt8OTBEWgQ9p7vjvIXD/6K67/CS57An4Goi2UQ
+TeuXiHMpSL0RKernxZT+NZa7RDQpgAN+b5yo00uVF1lbyVUCHGGoJclUJxVMstOB
+1KJ/AoIBAFCOvmNxvc/Y2ZWjXnTWsgO537a1U88eUK6bgRwe/E7rmEPLLs0P0fwj
+TPGx/prkRUZ8+gIMcJ0ht33tzie1SCWGbQjFkwe7KLzouw+gYqEynKuDY+uFi+wK
+QnGGojKv4K85NRcFGch1av2VIFj+tnw/oUBBE+u8B6S17f4hWRuxLR4xwkkiT26Q
+wq+CvPU2avTIkoESnOi49HKRod47RVvOtx2VCGX15ICrZwoXECrbNSAWKRYoRB/2
+GkLhbwcOprV1YcPw6UV0wMPGjSYQ4rmNukQSK7LGXKmLjfu7hagUHKOZla8rtuk2
+DxjfjThF8aSBBOXncdxikTutfqklliECggEBANGHBID63eBukoc16NOIRenrRNSJ
+Oa2W0VhQ/iI9Di9fjZuQutPq2UqR+N0tW5V7qiGm7vb7lRlrnB/jt3pNqGj3qSdC
+CEp7IEH0kJ/hp9KwA7MxVzmk5hbDbSrtzxYFYjYNEybKndPmKt+J9AZS3u21WGwU
+MaaX2WS2JHLwnSJ0qgp/rg+uoYIXzPLn/1k7H0s8s6lMhY40nZSaxx9dEEe5RWSz
+HY9ajmcRUqEbdFNmu+J9yR5q5mku++CLRGU921XomoIf/R3dBvMFFRtiymiVV0qt
++fueaAfibaLDFRSutkfLCyOl2EFyvsSk5TJmutAIe8ba5d1CdCkm4w9SsBI=
+-----END RSA PRIVATE KEY-----

tests/certs/interca.conf.in

@@ -0,0 +1,64 @@
+[ ca ]
+default_ca = myca
+
+[ crl_ext ]
+issuerAltName=issuer:copy
+authorityKeyIdentifier=keyid:always
+
+ [ myca ]
+ dir = @abs_srcdir@
+ new_certs_dir = ./
+ unique_subject = no
+ certificate = interca.crt
+ database = certindex
+ private_key = interca.key
+ serial = certserial
+ default_days = 730
+ default_md = sha1
+ policy = myca_policy
+ x509_extensions = myca_extensions
+ crlnumber = crlnumber
+ default_crl_days = 730
+
+ [ myca_policy ]
+ commonName = supplied
+ stateOrProvinceName = supplied
+ countryName = optional
+ emailAddress = optional
+ organizationName = supplied
+ organizationalUnitName = optional
+
+ [ myca_extensions ]
+ basicConstraints = critical,CA:TRUE
+ keyUsage = critical,any
+ subjectKeyIdentifier = hash
+ authorityKeyIdentifier = keyid:always,issuer
+ keyUsage = digitalSignature,keyEncipherment
+ extendedKeyUsage = serverAuth
+ crlDistributionPoints = @crl_section
+ subjectAltName  = @alt_names
+ authorityInfoAccess = @ocsp_section
+
+ [ v3_ca ]
+ basicConstraints = critical,CA:TRUE,pathlen:0
+ keyUsage = critical,any
+ subjectKeyIdentifier = hash
+ authorityKeyIdentifier = keyid:always,issuer
+ keyUsage = digitalSignature,keyEncipherment
+ extendedKeyUsage = serverAuth
+ crlDistributionPoints = @crl_section
+ subjectAltName  = @alt_names
+ authorityInfoAccess = @ocsp_section
+
+ [alt_names]
+ DNS.0 = WgetTestingServer
+
+ [crl_section]
+ URI.0 = http://intertest.wgettest.org/Bogus.crl
+ URI.1 = http://intertest.wgettest.org/Bogus.crl
+
+ [ocsp_section]
+ caIssuers;URI.0 = http://intertest.wgettest.com/Bogus.crt
+ caIssuers;URI.1 = http://intertest.wgettest.com/Bogus.crt
+ OCSP;URI.0 = http://intertest.wgettest.com/ocsp/
+ OCSP;URI.1 = http://intertest.wgettest.com/ocsp/

tests/certs/interca.crt

@@ -0,0 +1,41 @@
+-----BEGIN CERTIFICATE-----
+MIIHOTCCBSGgAwIBAgICESMwDQYJKoZIhvcNAQEFBQAwgZkxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTERMA8GA1UEBwwIU2FuIEpvc2UxIDAeBgNVBAoMF1dnZXQg
+VGVzdGluZyBEZXBhcnRtZW50MRAwDgYDVQQLDAdUZXN0aW5nMRQwEgYDVQQDDAtX
+Z2V0VGVzdGluZzEgMB4GCSqGSIb3DQEJARYRYnVncy13Z2V0QGdudS5vcmcwHhcN
+MTcwNTA5MjEyNDMwWhcNMTkwNTA5MjEyNDMwWjBiMR4wHAYDVQQDDBVpY2Etd2dl
+dFRlc3RpbmdTZXJ2ZXIxCzAJBgNVBAgMAkNBMQswCQYDVQQGEwJVUzEYMBYGCSqG
+SIb3DQEJARYJaWNhdGVzdGVyMQwwCgYDVQQKDANJbnQwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQCpFc5lZraIIP8PVVbnwSrE11p2kjVgzDPwIJ/bDYGd
+60VEMc2ehVOMtj3lFbAUu4nb6j7IbAGB4bUqg4BUVfRodvd2f1WsfAfhf3AUnpI0
+c+ytK8HuXSfv3s44+/iQJftLE0kTADZf9iV/GxdEbhwQXBWku0xU/mxRH4zxDGwZ
+6gurQ96Md6DVUgnZsnRgrukQikr9C5e8cbKj7FHLZgq9E+NlGppmKi8qGTUXK17L
+cLBEP04glOnMuRQKB6SCIoX+VCiw33hWYfzIiXDKFqcj0liYANyLbM9TiFITGyTj
+Jr+Ne1Lac0HlNd8vNeP6IPBjViNZ8Iw3GYly1i8li4THzo8VpXBkJlwOLEYSq9Hr
+ZJ0QzUbyzVTLdhlCBhFme17Z9PxQyBr+2A0Lp+r/oKdr+KfMYZN3tzV3YozSw5d6
+4uV2Nz9pVCmLjR8UAV6cJqJILAxCQRVs4Qs7Ko3mGWKWi3T5xxvFy8gQrNHg7+IN
+g+0OhsIkfHTGsfW7WGukGhfmispi6sjrbNABRws8Vlr7JcVNFS4uu4H3cVCZ3Rde
+9IduNYs0gqss4SYMAxKAz0/M7OCY8Z9obh7zIdsG1A2S07cv9OMsjgPhLiO/i4HF
+RriQtYR5sWZKkmZgmS68aJuh/JLijlF/m2HLbI5gSlgwuSAtKUj2C68mTrXZJ3Xl
+IwIDAQABo4IBvzCCAbswDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUJNB884gq
+c/+HoMtp4GsuFr1O1eYwHwYDVR0jBBgwFoAUF+2TQ4+npgB11Oi2gg2IN37AbQgw
+CwYDVR0PBAQDAgGmMBMGA1UdJQQMMAoGCCsGAQUFBwMBMF0GA1UdHwRWMFQwKKAm
+oCSGImh0dHA6Ly90ZXN0LndnZXR0ZXN0Lm9yZy9Cb2d1cy5jcmwwKKAmoCSGImh0
+dHA6Ly90ZXN0LndnZXR0ZXN0Lm9yZy9Cb2d1cy5jcmwwHAYDVR0RBBUwE4IRV2dl
+dFRlc3RpbmdTZXJ2ZXIwgcgGCCsGAQUFBwEBBIG7MIG4MC4GCCsGAQUFBzAChiJo
+dHRwOi8vdGVzdC53Z2V0dGVzdC5jb20vQm9ndXMuY3J0MC4GCCsGAQUFBzAChiJo
+dHRwOi8vdGVzdC53Z2V0dGVzdC5jb20vQm9ndXMuY3J0MCoGCCsGAQUFBzABhh5o
+dHRwOi8vdGVzdC53Z2V0dGVzdC5jb20vb2NzcC8wKgYIKwYBBQUHMAGGHmh0dHA6
+Ly90ZXN0LndnZXR0ZXN0LmNvbS9vY3NwLzANBgkqhkiG9w0BAQUFAAOCAgEAqUa7
+cQLhjXCAHiMT9V5+hzB/ngriEKC456htspq9RC/FWnYXZ+au89FehFunjy5qzbSz
+q7N97rCD2drSwn4B6uBymmIxU6iARmtcsPrfhgXHdvhuVop6yuXspoaU7+g1WMXi
+t0RGBx0FahYlggt8a7HnMu3Qz6v8llDeA3U2BCe5ui7mWTauj3bFv/pLW3sigvm0
+Cr3aBHpkIzfHU5D6EC3fKNXQNQruXCCIcBayNiaX+FJcK18sU8tRewiWo/VvffHi
+J89/oHvZnXkteT/mEyeAbjkPkNrmNQTmG69t/x4NdxNDe5ZrEpbEPE/6S5z+YP1T
+bXG7OeES2/+K3Fprwv/oCoeQdv3bBh4IcRhhE7KpEGnJOLfV1a5aRpVCz/0C30xk
+x5GYo0a+AkPAW3zYTaKQXIKDJLpAU6QJ13WaEjVS1EYnUE2o3XEjyZPJVL1y7VSd
+1gdk5MEto6RsVH6EmJBBaSiiAj6d1GbkmNku73FiUvRGk39WbGN9qfjrMPvGhAcL
+0GrIg5oQLOf0f6sdIU3TJkARNSmgSoLV+RatIEgKI+/i6FxlRdBPoGopPJkrh/gS
+stf93A7rFKWmYNKZOMhWXxyv14lwWhBi0bW9QfzavJse047v9X3UvRki06uWXH2t
+H51/0uT9gISqZ1CKDpnez4wrjACuKmfI9D2p6J4=
+-----END CERTIFICATE-----

tests/certs/interca.key

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKAIBAAKCAgEAqRXOZWa2iCD/D1VW58EqxNdadpI1YMwz8CCf2w2BnetFRDHN
+noVTjLY95RWwFLuJ2+o+yGwBgeG1KoOAVFX0aHb3dn9VrHwH4X9wFJ6SNHPsrSvB
+7l0n797OOPv4kCX7SxNJEwA2X/YlfxsXRG4cEFwVpLtMVP5sUR+M8QxsGeoLq0Pe
+jHeg1VIJ2bJ0YK7pEIpK/QuXvHGyo+xRy2YKvRPjZRqaZiovKhk1Fytey3CwRD9O
+IJTpzLkUCgekgiKF/lQosN94VmH8yIlwyhanI9JYmADci2zPU4hSExsk4ya/jXtS
+2nNB5TXfLzXj+iDwY1YjWfCMNxmJctYvJYuEx86PFaVwZCZcDixGEqvR62SdEM1G
+8s1Uy3YZQgYRZnte2fT8UMga/tgNC6fq/6Cna/inzGGTd7c1d2KM0sOXeuLldjc/
+aVQpi40fFAFenCaiSCwMQkEVbOELOyqN5hlilot0+ccbxcvIEKzR4O/iDYPtDobC
+JHx0xrH1u1hrpBoX5orKYurI62zQAUcLPFZa+yXFTRUuLruB93FQmd0XXvSHbjWL
+NIKrLOEmDAMSgM9PzOzgmPGfaG4e8yHbBtQNktO3L/TjLI4D4S4jv4uBxUa4kLWE
+ebFmSpJmYJkuvGibofyS4o5Rf5thy2yOYEpYMLkgLSlI9guvJk612Sd15SMCAwEA
+AQKCAgA4Wi4pmWvoPqcDIzwNjVGFvQhHUD89/ZCpzRW52eyDBzBUpAyVcnYABZTn
+Tq0am848XvuBrI1sDh9lBeK1ONh2IIAlHBcfn065FtHx7U9o7+HHbTf7C00OIsG0
+ODYFRMNVqB3ImV+F5/FjRVIh2li8ExSbjFjKUukiuFMu2ycEE/7Dm6EGS7BsqCTk
+SxeCSYkfnBeV8lEl2vbgrxgro9ycW46D2bPvrMt/SltpV2kGgI4ekMKnFTo+oshM
+93MadAsYUlAlcrUWhR3McBIJKDeYNriUIGVgimkmu94uw/MtSXK54oogiB1EGQpD
+H8DVUjkLwl+R0BvLGVW30i5wYulja2wJuYbY146+jxPkohpGQv7lChLnXN4HsJio
+W5TVqPii5EXKYm1LzuwIQba7EdvVLjA4I+b//qIADtEWA0sQZLiWLSk2/58WMjix
+pTbPhAy3xTTebCwz+mxMjZVQ3V2KHVvGUWq0x4rje/yF0mKIFt1CjUgTiUQ8DGSV
+MZhiqt6hV4ipo2/GUQLBzxiEr7H89vjsXnUBUb0BQCh6Ykg1P3hfoShxs62kEqtu
+b7huQhHL2ch3Cfb2gZ7S9UpO2TjnPpDyhyapJ/MmtTiHIhsts1DYEPLq4+n9FdC2
+FQYkRhR1OCtA+Tw1W4LvTu+57EgMMOdDJK1k+/j6+cV+9vRKEQKCAQEA19kMib0J
+lCTagMtVxPDfhWdAueREKTrEGBSyReWJHUqoR4AV34BxsL6fr+8BDpgs6GMTqSWk
+YTBz7KgyjSBQh2KgNwMAE89uIez4I8nTq5M92ZfqEZ98bn6ls3A4fwZeZ/wwrVd9
+OVeH54qrINV/wFyLRu9CIkyPXLia39cobotTZXu2d/tQaFG7JXkE4zj2dl6e0zyG
+Q5XE+GtAJYWpSPYd5N/J3eFEdoJDWFygM+WSHaYEE+iFbENyiWmDd3O/mHVqovub
+rFM/SMsWqfSK5MZVEpFSXPFIlRKLsZ2FiO6Dorei0NAp1VUriDELH0EVzoxErHhu
+S+2aN5WlYaFfnQKCAQEAyInb8T364UOHzUyz+IsDaxHOkGu8r1ZKDL5YJUg8wGMl
+LEUiyQJGf+RcSiI9tsH47XcptHpAIV745wedFzS2s6NWlAQCkdUKxIrtvA4bB7PV
+TJwy2uDCKtzzrSYul1rjpXoyIEt3Q4Ryd8gpa9eeRgWPkq48d6YOTcDw3C+i8VFo
+MyMzO8U3bj8vNR3/kE8id67XDWV7qfEtszhxVjYhgL7GyrP2ZeFsFNnrdp09tY0W
+aRGkzQw67Yq3tEDNCuNgtF/tNyr0l8DSjiGLqoIkh5wSH/MVz0crM4aPMaNvsTsb
+/+JQlrJF6EUVo1mwcqH87I2gGisQTP0rkxmhTsIbvwKCAQBKWRr2fsTD4IXbAy8B
+7S4w10X2Qegwg2t0F/zoEo5OJp8cMcRW/fkrNh3vDdZBXq1pRmdJRgv+5h+oDq+K
+6OyUFaa2DDSEnliDGwrF2Qkt+kO9pZQcieDkdn9A9ZCgQGNYUge6TX52t+26FYuo
+faHJcpcO0e7nvZNMDtJZ89SbbyZEuH47ibdCl5Rs7eh/E+nhD+qJPDnLIdV89ARe
+aFHNLelSIrt3z9YzM99aml0cQyE3US3qZZc/mWPkbRG5nYcLTrZyeVQ/4VTVEA84
+b2FAOAipoqDKHtovbvnrLiUG65EwBSzx3CHst6+M88eu9k46nRoyhjEHukn6h3M1
+084JAoIBAB7uBFpE8PjlbYCgn/Fpn3FYIb/sngF9EZa9lOLLLXOO1yDo2OCf1TfM
+hN96QIJ7kGUvx+LqKBH9j+4yImx92OAEBUp3A95yOWLu+pPSqSCa//786GsR12C9
+C2hdRzpY7luLaUfJ2+8x8mW/HYRgkSzDls1Myk658eLUK1IKltsZbzTT7Qb+9/mt
+DR7oLY6YZfyHnuuWB2jCpgXKYtClMK2mvwpsj0hPaFge9E4rGmVyCU7TRdPKWxxg
+FM1cYUOYpkWrte6YVXlCaDc7vUrjH7c6vyDmYSrDE0qzKkrBpmxzbXId+cgEXvvg
+C+JR5wEHMvdZMKRYl/8H3Tym61Y2YgkCggEBAI6yQmYwqL9ELqFfWxuqSQfiEoPA
+tENwVIhwhbGKje/FgNotgC+EjToQzBfZDVudOlnRyOTjgxfeZ5mtsdH9sJ278L7I
+mZmZezmAC1GPE4Ev8GZjpFYqcx0GYGy2pvlNea2Rt8Xnw2B+GDGPTf299djeRgS1
+Xnd0j9ltxTsmiOxF1AMYuMeg57jcUAAG0N81SrOASYc7P7DKpn8PGUim9szNccXy
+jcWEJb9WRLuGfrMTwf4gpb7mShod9A4B5TziF9FNxR5u7MMW8NItMRndqI+/2ylP
+e3MAV+ZhxtLs/sWOwcJk/rwhvRsbadzKhEiZPDYDDZ10oWWsCdeawp0VZEk=
+-----END RSA PRIVATE KEY-----

tests/certs/invalid.crt

@@ -0,0 +1,149 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha1WithRSAEncryption
+        Issuer: C=US, ST=CA, L=San Jose, O=Wget Testing Department, OU=Testing, CN=WgetTesting/emailAddress=bugs-wget@gnu.org
+        Validity
+            Not Before: May 15 15:28:03 2037 GMT
+            Not After : May 15 13:28:04 2019 GMT
+        Subject: CN=WgetTestingServer, ST=CA, C=US/emailAddress=ServerTester, O=Dis
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (4096 bit)
+                Modulus:
+                    00:b4:d4:0b:fe:35:25:05:a2:ec:28:c3:6a:d8:13:
+                    f7:57:7f:f6:f2:4b:87:64:59:29:cb:81:93:c0:3d:
+                    f5:2b:30:d4:30:4b:ab:e1:0e:5a:57:e9:ac:d0:ef:
+                    62:f6:a3:f2:d7:24:f6:8b:e3:54:98:68:75:bc:f8:
+                    34:4c:2f:96:6c:dc:1d:af:72:f9:c6:5a:6e:0f:03:
+                    4c:45:ed:0a:17:9b:ba:2e:f3:8d:7d:6e:e9:4b:3d:
+                    36:d9:7a:18:2e:24:72:5b:98:84:5b:09:6f:a5:f2:
+                    87:b3:0d:d7:93:92:2e:6f:68:4f:db:5d:78:77:c6:
+                    63:04:c6:29:67:42:3a:6f:0f:c0:e2:cb:1e:52:f3:
+                    11:0b:c3:80:4a:3f:b5:5e:1f:43:0c:04:c4:b4:f1:
+                    95:98:e4:b7:b0:4b:14:fe:1c:99:70:f4:1c:91:1e:
+                    e3:9a:a2:ff:48:54:fa:3d:01:e7:48:6f:0b:3f:4f:
+                    a5:45:b1:1b:98:0d:57:6f:15:a6:75:bb:45:0a:52:
+                    66:e6:1b:77:29:ba:c5:13:41:91:8b:0b:a0:6a:44:
+                    fa:8e:60:46:8c:c6:43:de:67:46:1d:30:c5:ce:77:
+                    f2:4a:53:c2:27:85:1f:48:69:c8:27:df:b1:71:09:
+                    42:10:2e:7f:b8:fe:85:fe:bd:39:2c:84:2a:10:a5:
+                    80:00:79:42:a8:6f:3b:55:08:f2:98:c7:44:e7:a0:
+                    b4:dc:c5:c1:3e:75:30:cb:a9:7a:44:a8:a1:03:8a:
+                    44:cb:dd:04:74:54:91:91:11:2d:32:ce:67:2b:af:
+                    23:a9:69:35:39:8c:7e:4a:fe:d9:b4:86:c9:ff:f8:
+                    09:86:2b:ad:eb:12:74:2c:6a:25:29:8c:ab:13:68:
+                    9a:26:8f:12:2d:ac:36:23:99:91:7f:5f:22:3e:f3:
+                    6c:a3:a1:5b:fa:64:da:dd:80:81:8f:8d:36:5b:e7:
+                    8f:0a:0f:84:c7:6a:fb:f4:6d:4d:3f:ce:ff:f4:1e:
+                    c2:62:d7:95:e7:af:f4:57:c2:b8:e4:ba:d2:18:1f:
+                    2c:47:ef:6b:b8:7f:e3:92:4d:6d:b2:86:70:fe:fd:
+                    54:42:0e:88:cf:9c:02:7d:a5:11:72:ef:6e:63:05:
+                    81:1a:00:fc:cb:b7:91:af:3c:7c:53:da:7a:54:d8:
+                    3b:98:e7:de:bc:1e:10:7b:fb:60:89:e6:40:13:da:
+                    da:d7:d6:7c:f6:61:b9:82:33:1c:c6:62:06:6e:ae:
+                    5c:99:ab:1d:44:a7:10:7e:03:51:dd:59:97:0a:da:
+                    ab:c8:85:28:bd:e0:5d:12:5d:aa:02:3c:1d:a6:0e:
+                    6e:43:18:b6:ac:4e:7f:f3:4a:2f:67:84:dc:7c:0c:
+                    c0:9f:bf
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+            X509v3 Subject Key Identifier: 
+                EA:FC:B3:3E:7E:5E:68:61:80:61:59:4C:D5:B7:A0:9D:1D:86:E5:97
+            X509v3 Authority Key Identifier: 
+                keyid:17:ED:93:43:8F:A7:A6:00:75:D4:E8:B6:82:0D:88:37:7E:C0:6D:08
+
+            X509v3 Key Usage: 
+                Digital Signature, Key Encipherment, Certificate Sign, CRL Sign
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://test.wgettest.org/Bogus.crl
+
+                Full Name:
+                  URI:http://test.wgettest.org/Bogus.crl
+
+            X509v3 Subject Alternative Name: 
+                DNS:WgetTestingServer
+            Authority Information Access: 
+                CA Issuers - URI:http://test.wgettest.com/Bogus.crt
+                CA Issuers - URI:http://test.wgettest.com/Bogus.crt
+                OCSP - URI:http://test.wgettest.com/ocsp/
+                OCSP - URI:http://test.wgettest.com/ocsp/
+
+    Signature Algorithm: sha1WithRSAEncryption
+         3d:8d:a9:7a:8c:32:7e:7a:9c:c5:d6:14:d4:05:3e:49:50:d3:
+         11:a4:61:df:82:91:c3:87:26:9d:fb:3f:2f:b5:10:86:22:f0:
+         4e:c5:54:6d:09:33:17:3c:0d:aa:87:43:2a:89:62:c6:28:b5:
+         4e:41:17:7d:57:ad:76:f5:3e:c6:e7:b5:3b:21:16:79:7b:a0:
+         42:ee:59:88:16:92:4e:3d:8d:ec:8e:87:07:3b:8a:dd:55:1d:
+         0a:f2:ea:aa:e7:20:6b:0e:4e:f5:33:46:34:16:8c:be:61:b1:
+         6c:47:52:03:cc:df:8a:3e:cd:01:92:6d:1a:39:5a:d0:75:38:
+         71:f2:b2:78:65:26:5c:c9:72:c6:26:dc:09:ee:b6:e8:b5:60:
+         d6:e8:09:d0:db:ea:c5:80:8a:86:c0:f9:97:1d:44:94:33:c7:
+         73:39:d0:5e:62:e7:90:d8:1f:23:09:98:18:c6:da:28:b4:30:
+         e0:d0:6f:20:a7:a4:06:4e:ee:b4:ef:3e:18:16:0b:f7:46:f0:
+         c7:d0:6d:41:1e:cf:c7:08:78:f7:22:b6:a7:c5:40:be:09:61:
+         5a:65:71:c5:37:33:f5:c1:8c:b0:c3:1a:d8:9e:a2:98:71:10:
+         a3:39:c5:d2:57:5d:24:62:dc:48:58:2d:1e:f1:29:54:a2:e7:
+         dd:86:09:1b:a6:b4:27:27:e1:7f:04:98:92:2e:e1:68:48:51:
+         38:44:59:9a:3e:3d:e9:d1:69:db:eb:4d:27:d6:9f:a4:d0:4a:
+         58:10:ca:b4:60:dc:52:5d:63:a0:73:9c:74:89:aa:92:40:81:
+         91:0a:b1:ad:ea:d2:f6:bf:9c:49:ab:ce:d9:47:ae:86:8f:da:
+         41:ad:ec:0f:2a:cb:f6:ce:0e:67:09:0b:75:60:16:99:cd:4a:
+         2b:d1:b8:be:9b:37:58:4d:78:c5:67:69:5c:c7:48:31:50:83:
+         dd:10:40:b7:80:fe:d7:a4:a9:59:32:c4:3c:80:ad:6b:7c:9c:
+         47:14:e8:74:18:e8:f9:ad:b4:dc:e9:f6:38:21:90:0b:58:60:
+         48:a2:95:2b:a1:58:0a:52:5a:ba:5d:8e:4a:96:22:a7:8e:cc:
+         f1:db:5e:15:cd:e2:77:db:25:1f:83:ad:d6:10:98:1b:0a:b0:
+         43:23:8c:14:65:72:8e:c4:b8:81:f8:a2:27:55:69:37:e6:fa:
+         4a:74:30:fc:d0:31:e8:9a:67:cf:b0:59:e3:82:92:37:2e:f1:
+         77:7f:ec:41:2d:9c:6e:46:11:65:b7:5f:b6:8b:90:fa:a7:2c:
+         4e:3e:fd:18:c7:5c:6c:b6:f3:f4:07:13:66:48:43:b4:30:ec:
+         b6:ca:f1:3d:03:57:c1:38
+-----BEGIN CERTIFICATE-----
+MIIHNzCCBR+gAwIBAgIBATANBgkqhkiG9w0BAQUFADCBmTELMAkGA1UEBhMCVVMx
+CzAJBgNVBAgMAkNBMREwDwYDVQQHDAhTYW4gSm9zZTEgMB4GA1UECgwXV2dldCBU
+ZXN0aW5nIERlcGFydG1lbnQxEDAOBgNVBAsMB1Rlc3RpbmcxFDASBgNVBAMMC1dn
+ZXRUZXN0aW5nMSAwHgYJKoZIhvcNAQkBFhFidWdzLXdnZXRAZ251Lm9yZzAeFw0z
+NzA1MTUxNTI4MDNaFw0xOTA1MTUxMzI4MDRaMGExGjAYBgNVBAMMEVdnZXRUZXN0
+aW5nU2VydmVyMQswCQYDVQQIDAJDQTELMAkGA1UEBhMCVVMxGzAZBgkqhkiG9w0B
+CQEWDFNlcnZlclRlc3RlcjEMMAoGA1UECgwDRGlzMIICIjANBgkqhkiG9w0BAQEF
+AAOCAg8AMIICCgKCAgEAtNQL/jUlBaLsKMNq2BP3V3/28kuHZFkpy4GTwD31KzDU
+MEur4Q5aV+ms0O9i9qPy1yT2i+NUmGh1vPg0TC+WbNwdr3L5xlpuDwNMRe0KF5u6
+LvONfW7pSz022XoYLiRyW5iEWwlvpfKHsw3Xk5Iub2hP2114d8ZjBMYpZ0I6bw/A
+4sseUvMRC8OASj+1Xh9DDATEtPGVmOS3sEsU/hyZcPQckR7jmqL/SFT6PQHnSG8L
+P0+lRbEbmA1XbxWmdbtFClJm5ht3KbrFE0GRiwugakT6jmBGjMZD3mdGHTDFznfy
+SlPCJ4UfSGnIJ9+xcQlCEC5/uP6F/r05LIQqEKWAAHlCqG87VQjymMdE56C03MXB
+PnUwy6l6RKihA4pEy90EdFSRkREtMs5nK68jqWk1OYx+Sv7ZtIbJ//gJhiut6xJ0
+LGolKYyrE2iaJo8SLaw2I5mRf18iPvNso6Fb+mTa3YCBj402W+ePCg+Ex2r79G1N
+P87/9B7CYteV56/0V8K45LrSGB8sR+9ruH/jkk1tsoZw/v1UQg6Iz5wCfaURcu9u
+YwWBGgD8y7eRrzx8U9p6VNg7mOfevB4Qe/tgieZAE9ra19Z89mG5gjMcxmIGbq5c
+masdRKcQfgNR3VmXCtqryIUoveBdEl2qAjwdpg5uQxi2rE5/80ovZ4TcfAzAn78C
+AwEAAaOCAb8wggG7MA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFOr8sz5+Xmhh
+gGFZTNW3oJ0dhuWXMB8GA1UdIwQYMBaAFBftk0OPp6YAddTotoINiDd+wG0IMAsG
+A1UdDwQEAwIBpjATBgNVHSUEDDAKBggrBgEFBQcDATBdBgNVHR8EVjBUMCigJqAk
+hiJodHRwOi8vdGVzdC53Z2V0dGVzdC5vcmcvQm9ndXMuY3JsMCigJqAkhiJodHRw
+Oi8vdGVzdC53Z2V0dGVzdC5vcmcvQm9ndXMuY3JsMBwGA1UdEQQVMBOCEVdnZXRU
+ZXN0aW5nU2VydmVyMIHIBggrBgEFBQcBAQSBuzCBuDAuBggrBgEFBQcwAoYiaHR0
+cDovL3Rlc3Qud2dldHRlc3QuY29tL0JvZ3VzLmNydDAuBggrBgEFBQcwAoYiaHR0
+cDovL3Rlc3Qud2dldHRlc3QuY29tL0JvZ3VzLmNydDAqBggrBgEFBQcwAYYeaHR0
+cDovL3Rlc3Qud2dldHRlc3QuY29tL29jc3AvMCoGCCsGAQUFBzABhh5odHRwOi8v
+dGVzdC53Z2V0dGVzdC5jb20vb2NzcC8wDQYJKoZIhvcNAQEFBQADggIBAD2NqXqM
+Mn56nMXWFNQFPklQ0xGkYd+CkcOHJp37Py+1EIYi8E7FVG0JMxc8DaqHQyqJYsYo
+tU5BF31XrXb1PsbntTshFnl7oELuWYgWkk49jeyOhwc7it1VHQry6qrnIGsOTvUz
+RjQWjL5hsWxHUgPM34o+zQGSbRo5WtB1OHHysnhlJlzJcsYm3Anutui1YNboCdDb
+6sWAiobA+ZcdRJQzx3M50F5i55DYHyMJmBjG2ii0MODQbyCnpAZO7rTvPhgWC/dG
+8MfQbUEez8cIePcitqfFQL4JYVplccU3M/XBjLDDGtieophxEKM5xdJXXSRi3EhY
+LR7xKVSi592GCRumtCcn4X8EmJIu4WhIUThEWZo+PenRadvrTSfWn6TQSlgQyrRg
+3FJdY6BznHSJqpJAgZEKsa3q0va/nEmrztlHroaP2kGt7A8qy/bODmcJC3VgFpnN
+SivRuL6bN1hNeMVnaVzHSDFQg90QQLeA/tekqVkyxDyArWt8nEcU6HQY6PmttNzp
+9jghkAtYYEiilSuhWApSWrpdjkqWIqeOzPHbXhXN4nfbJR+DrdYQmBsKsEMjjBRl
+co7EuIH4oidVaTfm+kp0MPzQMeiaZ8+wWeOCkjcu8Xd/7EEtnG5GEWW3X7aLkPqn
+LE4+/RjHXGy28/QHE2ZIQ7Qw7LbK8T0DV8E4
+-----END CERTIFICATE-----

tests/certs/invalid.key

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKAIBAAKCAgEAtNQL/jUlBaLsKMNq2BP3V3/28kuHZFkpy4GTwD31KzDUMEur
+4Q5aV+ms0O9i9qPy1yT2i+NUmGh1vPg0TC+WbNwdr3L5xlpuDwNMRe0KF5u6LvON
+fW7pSz022XoYLiRyW5iEWwlvpfKHsw3Xk5Iub2hP2114d8ZjBMYpZ0I6bw/A4sse
+UvMRC8OASj+1Xh9DDATEtPGVmOS3sEsU/hyZcPQckR7jmqL/SFT6PQHnSG8LP0+l
+RbEbmA1XbxWmdbtFClJm5ht3KbrFE0GRiwugakT6jmBGjMZD3mdGHTDFznfySlPC
+J4UfSGnIJ9+xcQlCEC5/uP6F/r05LIQqEKWAAHlCqG87VQjymMdE56C03MXBPnUw
+y6l6RKihA4pEy90EdFSRkREtMs5nK68jqWk1OYx+Sv7ZtIbJ//gJhiut6xJ0LGol
+KYyrE2iaJo8SLaw2I5mRf18iPvNso6Fb+mTa3YCBj402W+ePCg+Ex2r79G1NP87/
+9B7CYteV56/0V8K45LrSGB8sR+9ruH/jkk1tsoZw/v1UQg6Iz5wCfaURcu9uYwWB
+GgD8y7eRrzx8U9p6VNg7mOfevB4Qe/tgieZAE9ra19Z89mG5gjMcxmIGbq5cmasd
+RKcQfgNR3VmXCtqryIUoveBdEl2qAjwdpg5uQxi2rE5/80ovZ4TcfAzAn78CAwEA
+AQKCAgAZRMBgR4Di5r9letlFVJTtrz4M4a0LwsHqZDMHXCEUZgBgt1JPYrgRLOAv
+WiRUHtjiY5HoPl4l5gL94xk7xDKbB69GQyTQKPbUNjvEUbllTyeXRAVzj7od/3HY
+tg0G9aTdU9S6+/iUEe4QgVCsmHLQspzmJIufASP5GM/UVBbiSitEBeo44SpyoGEe
+/wQTIP83gLsUJeYntV5NzlAiqlBuzk3noY9gnoJZ0zYcrFVrc8j4keKgeH1IpCSh
+qz7VmNOu+5DReukN9cFwTWtPKNLDxtvUZXO2XEZDn97WWWhqz6wV4tpwt1OFxPJp
+UAL1rruCk1zZtwd2b26738QZC2d1bUdWwFo/d100cihzgvycMNCERne37ZDl4/NA
+izm1nfWraYiFcbAMXLccnt19SWvPo1/UgtHVutOgTuV/dHnLq4iBktUnbiwnHrn6
+aVchQeetKtVYtjDx3ioP1v8vnYtZiKh7TSePVrOZPQah4H3wqCvxawdRFsK4jSXq
+KFtCCDaspFcIcbkPnfRnCnojFnXwso0d0o3g0sY6RIRmkIrdzbFTwtYPTgiTP7A+
+F2LMjvAdkEQFHPop2vtji9tlMdNSK/zlG4M74Vc68IKa5/JtsnN+TjCkVlQ2uwfo
+/NJnGANZZZm3kpS+an7XrwJMo8WqWt35jS9i3mt0/awzTEVAoQKCAQEA4jvWInF/
+PK34RUzrVA4Xc5QCkVqxbcSu6+V2EKKLhS15eqp+jaBhUSL+d8e2oTIYCIEf2YWK
+7lrD424NR/i93TlBVdkg4AjZ6yvjFRqdK6+6NjINvgObkcdDMORrPxE5h2n1LoO0
+efHwRD3Ae1PHOgSPZHNHL75lfH4wzQOmHsBm6Oucu9DBFa8mAhFONrZOSFsD6cbi
+6B0Qdpz/Eb0MrNF8pJA0rupe88Jg1d6/DX24TIUMaKEd3rbqb3YENBw9mPlT1Vr7
+VHvR9oxyZgQ69sx9BblBVilyXoxtZclL1ebx/03zvzZ4v1PgP7x4eW1Upz8QyaBh
+KFed6yrzrJYc5wKCAQEAzJ7VNzxzTMfKgw/Ps3Y10qHTigyZ48y+6tMFGoc5ecul
+8zsElksR35D0wBsJHmoVLs0JFH2vsuWPFqAaS34o3ayaXhMOkD6PuwKN2jJOckxn
+3Urh9dQ5S0j2L4ektRt1dTTJrYDTpMShBEAuYBeDEiuEVYH+ccnPLhL7Tz/Kwfkj
+cfjo1WwmU3JMo3hSuEKRkdchYdS6F9sHeC04qjYzJSyKkvuularZN8alkiR8xJTx
+9iwjst0K9JEgL/pe3KvNx1ukh/jLPB3B6RtUhy5EWlT/IsO2MUyn0GrBRvR+CugF
+LdND4zJQEMy1FRdVjch2HZjOBuNCW5YOjvtb+NVzaQKCAQEAy4UC3Vd3HFJxD37k
+EWjf5gTXzoVlKpeOuP5jGRHxK6y+JQDt+mC2S3SMsZrDi/3xquzmhxvg4Q5cPOQL
+JJz7yOEyCpXbQlAUIsEHdzvK+rsKbKjYvgCm2h0FMB288S6Ar3Y9sEuhdzaUa/+V
+ghzbFDF4AejGuIey6qznH/fRYMa7jXwwMrHYkbZQHfoNf6C/ic3/Fjbqd991qQ8R
+U5bbqTiHxc9I5bZIF0fdL2lEPFHGE2h5wkJ3CZ1KB12G6I4jR9O8fCpuARGm0AKH
+A4l4tf891YFT6rw8fBweajwNce9h8sfgqDrLo2tESHI3ex1E03QjmQ8jeFRh52Zr
+ce5VLwKCAQAxUyBmnkXU/lxM16Tjx90VlzjdEEiQZyymgpO6X1p1h6fLSDDE4fe/
+ArxdCqdaE4xjqb1EmT+fSkMB2zo7dH/5X8AeaU2ba9lN5UG4lWPfnZdz+rcZgT0G
+buIZdwM3PRVFWaI8Fs/t6hA+bBJBy6km2iKeUiW53EH7A0xdQC1qMNpggPXvbJCY
+kPb0eO7HyBQ7Kba8VIE/eucECzKbpVES5vfIkq71GSgfj90dq3oAET96bg108l/P
+sKQnrJztaOTD581zkX+8UBgMTzBDHd4QQGj4QmFK5QWW8gUBS7KOgnutHj5BKEGw
+qwgDu4o+EVKXs9wGQQYf+b4srV7wTtPxAoIBAGnAVJA9pLhXHG0ClgbAyHDyK/uG
+/OSDkfJwLtauYs5ZpLIe0wnNJgDUWs4Sk/1UpedZeg5YuyjGJsBwwOLKmv4Smxgf
+2/j7mEU6otSeIdgGwrWdCGbQij4tWE0g6KehNbovOZm0dpUPw5LZqynWbkioSP/L
+qFSGfxvqdwYM0Oe+GI6gxXA9OU6kzZcXXYiq08eFaRWHcrksGHL84tp4T3OoL/Xq
+EBDHD8byyvCcOTb7aAopAA+XVWZEACeHbAHbyoD8t4aXRVWSddOBix/tM5aSIcvb
+G4I/tnbAb23NFmgLNxsUEg5zE0NklQx6ogt+OdEHmjTbDFCAnPFYEZ3Romc=
+-----END RSA PRIVATE KEY-----

tests/certs/revoked.crt

@@ -0,0 +1,41 @@
+-----BEGIN CERTIFICATE-----
+MIIHOTCCBSGgAwIBAgICESUwDQYJKoZIhvcNAQEFBQAwgZkxCzAJBgNVBAYTAlVT
+MQswCQYDVQQIDAJDQTERMA8GA1UEBwwIU2FuIEpvc2UxIDAeBgNVBAoMF1dnZXQg
+VGVzdGluZyBEZXBhcnRtZW50MRAwDgYDVQQLDAdUZXN0aW5nMRQwEgYDVQQDDAtX
+Z2V0VGVzdGluZzEgMB4GCSqGSIb3DQEJARYRYnVncy13Z2V0QGdudS5vcmcwHhcN
+MTcwNTA5MjIzMDE5WhcNMTkwNTA5MjIzMDE5WjBiMRowGAYDVQQDDBFXZ2V0VGVz
+dGluZ1NlcnZlcjELMAkGA1UECAwCQ0ExCzAJBgNVBAYTAlVTMRswGQYJKoZIhvcN
+AQkBFgxzZXJ2ZXJ0ZXN0ZXIxDTALBgNVBAoMBFNlcnYwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQDOQ+DNimL/GtTaZZotU21lLk4tZnbLrgJkBjlIWQvU
+N91vhjrQqJDK7pwojk5kKZ4RL+ZBPdd0dYgXMNaDflv9mlwlzTIwy0nveY7/APML
+R4p+PtbmKVP3YXe8kLmgkJklWntu6iCVhESO8PJ/It2KUS6bgr/M2zXN6HiPlgns
+IyH1Mo+Nxtvs7Hz+Qc+37rctmgtSR25qfQtqK4MmzeAGcMIG3JRlVT6B1cjlOmIJ
+23+KCd24tng3+G0+4u1FnIQS0Z25yrPWSvRSZJE678zQDDxzd6gGsuQbG/fniTIt
+Csj/9SV+6C12ZIl/j5snzdNJtb72s5BlcTVIiTXXwOxx+1/IKvTRCpGUDF+7jLHF
+68jIIzbP7z2lSWJz70MDzZoyT63rgnlakrwwcvWK45cCuyHVrItPDOcPbiVfJYP7
+OSafzC2NqtK+JdY5/RWhEJIgm86nbPvZCIh9xAVpVXg4NXLvPBW+hwN1V5GFY6Pk
+9LG2IYEedUabHtojFC8JK8A+cHFsVn1Kur5Gn1aqp/lYotIKZ1hWryFB6gmOfK6J
+RI1Vrj/j/hSfFY5yZFRcb1qlP1Z1yi6X6WFlIU10JRB9qr1Pc5ohDDN9fwtL/n5b
+gzPP22NsOcIomf5PdPTjmI2JKe2cQRPZkatNoKqFmgPy6gR+jm2auQkKDzXhP18+
+xwIDAQABo4IBvzCCAbswDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUqTa7LrpK
+PiP4/zI29dHqqxgv/SkwHwYDVR0jBBgwFoAUF+2TQ4+npgB11Oi2gg2IN37AbQgw
+CwYDVR0PBAQDAgGmMBMGA1UdJQQMMAoGCCsGAQUFBwMBMF0GA1UdHwRWMFQwKKAm
+oCSGImh0dHA6Ly90ZXN0LndnZXR0ZXN0Lm9yZy9Cb2d1cy5jcmwwKKAmoCSGImh0
+dHA6Ly90ZXN0LndnZXR0ZXN0Lm9yZy9Cb2d1cy5jcmwwHAYDVR0RBBUwE4IRV2dl
+dFRlc3RpbmdTZXJ2ZXIwgcgGCCsGAQUFBwEBBIG7MIG4MC4GCCsGAQUFBzAChiJo
+dHRwOi8vdGVzdC53Z2V0dGVzdC5jb20vQm9ndXMuY3J0MC4GCCsGAQUFBzAChiJo
+dHRwOi8vdGVzdC53Z2V0dGVzdC5jb20vQm9ndXMuY3J0MCoGCCsGAQUFBzABhh5o
+dHRwOi8vdGVzdC53Z2V0dGVzdC5jb20vb2NzcC8wKgYIKwYBBQUHMAGGHmh0dHA6
+Ly90ZXN0LndnZXR0ZXN0LmNvbS9vY3NwLzANBgkqhkiG9w0BAQUFAAOCAgEAPUgd
+LtrK+WYYhSJkvsa7pB6hUmZFMiqs1/uJqz8b8Q6uX33IXyg5zmFU07d3uOrFYSXi
+MFMhpw2A/D+CbPECaPEWGXII8dh9WlomxpjpZABZ/cmeG2SM7BxVwjIjACscXogJ
+A/Gm7I0hhvYSZ/G+kFbYbSf/Pj7Rz/4KW6WSwwQK23ab00MXBM6jWEueAeWebzeW
+rzWgyyy+GiqgLqQAKQrYtD51uF5Co+S0e2wazORLakvdF/USCBQwX+Pla09Wyf+b
+0HBqNjuxQc278/69Xp0mg8k67oUrWt3zgJ8kDhNIGvLnCB+0595G/z+7+mxdEztc
+BavKAMEDWTSCClwxO6lBQR7+oiNWdaaqHP1SS8sckjtt2jTbmjmRzWWkU+xSIlt2
+waIXS/BYRbyhLuWfxivvRjS7eQogeSP0rtZj/upBwM4xKVPF0bal/LMyEfrY3qV5
+8YXXFhnoVr7q3t0YaioIZXY35QcA5aR+P4XyLnzCTVuKUi172BS8KJBXMijEXxta
+rRQxtHLQeYB5eP/MaC2qMJH/OMR3A9Z7sXYbp/YuE+V/MxcGwAoHWKxMeKtdF420
+HGeKfzMla6uJQk26VEFAt+TYV2KUriPWyL/IPDzAjrSPMF9ZDIMhqELjFYCRGPwc
+X6txpIEgZCGdJWK0H3et8ZSe469AED6oqTfn44w=
+-----END CERTIFICATE-----

tests/certs/revoked.key

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJJwIBAAKCAgEAzkPgzYpi/xrU2mWaLVNtZS5OLWZ2y64CZAY5SFkL1Dfdb4Y6
+0KiQyu6cKI5OZCmeES/mQT3XdHWIFzDWg35b/ZpcJc0yMMtJ73mO/wDzC0eKfj7W
+5ilT92F3vJC5oJCZJVp7buoglYREjvDyfyLdilEum4K/zNs1zeh4j5YJ7CMh9TKP
+jcbb7Ox8/kHPt+63LZoLUkduan0LaiuDJs3gBnDCBtyUZVU+gdXI5TpiCdt/ignd
+uLZ4N/htPuLtRZyEEtGducqz1kr0UmSROu/M0Aw8c3eoBrLkGxv354kyLQrI//Ul
+fugtdmSJf4+bJ83TSbW+9rOQZXE1SIk118DscftfyCr00QqRlAxfu4yxxevIyCM2
+z+89pUlic+9DA82aMk+t64J5WpK8MHL1iuOXArsh1ayLTwznD24lXyWD+zkmn8wt
+jarSviXWOf0VoRCSIJvOp2z72QiIfcQFaVV4ODVy7zwVvocDdVeRhWOj5PSxtiGB
+HnVGmx7aIxQvCSvAPnBxbFZ9Srq+Rp9Wqqf5WKLSCmdYVq8hQeoJjnyuiUSNVa4/
+4/4UnxWOcmRUXG9apT9Wdcoul+lhZSFNdCUQfaq9T3OaIQwzfX8LS/5+W4Mzz9tj
+bDnCKJn+T3T045iNiSntnEET2ZGrTaCqhZoD8uoEfo5tmrkJCg814T9fPscCAwEA
+AQKCAgAEWkxZKg1ywrcxMKmzQSpy0ypVLO9e1vo38CWvUCm+vbsPim6dTqFXlvd2
+p6Ih3Pr38+HRCKQOUhigHKi6N6VrUaGWLqFbhD64LgGFghie6VCT33Gbg83Az66+
+LPOt3r9MmX83VPuBDDyCI7WKV0sDizkHkRfJE+srwDcjGJB3CjrCOOHspQCpHEh6
++RqQEBqPfMu2XcmHt8HQ6MAoxnluyVxe1rLO/KCIDuHhbHz7JkWnvROPvVIGJFjx
+1coaCPaEiyXf8NYgtI45WuPxsXPKBCgWa7UBBy9nHwz5Ntz3NF4PgLXc2rty3yZD
+qd0lVuOZj5tLC3kFmwD72eFn/ys+JtIw9a2wwQ1sGbNa764yY4T3GWLJ6HgHHhPk
+D94PC7wfBFzoZtUoZrE0T4XP8TrM730SERj0HCNfURnYlYR6mqj+0pVTHZaeXEho
+NZdDgdWP0b8v+EZky1L5pgM761GtJ9vKHZMMBj0/hVULIkpVcf5gs5fwGiXzj/o6
+CcSoLP4JvFm8nINH302dBzS0o2bW4fZehvRtiapdu6kXE9k7ZsnpFcvMCxmtHJGd
+p3yRyhqO5CEMVJOVJSpNQqRueyd8X6QRbuFsGG+FcBOTe9DxIcdzKkwHRAo1osRw
+mPF85QzsgF7tWw/AoYzi5FupLud7HUNg4ucQS6NZdKM+DvEzcQKCAQEA7tPxo01m
+z3MAJdHtyG8PE66SNCXBDyoIYhXl1EiYppPn75jjOnaIK0sRSJF9DX6rt+7OX6Jd
+InhqEJKFk22pJ7lcACBZl0Obg9RBTd2hNKWkH5oRvPOHwGC8NF34HDxpgY6utw3Z
+LiLr8nwLZkd7FXGi6GFL0wB2YQhXqn2cJvPSgnNE8HQINU5OHfEMPRhikat8+OoJ
+ZVgm8kQ5N7sy6Up9G2OCF8iV/qkSLYyVATN/5SZmLohSWlSJZIfMJe1tEexSOQEM
+8wQxgBaJNqBXeeEOR7XIrbCcc50ZZ6INzR1Hdakyd27Qi8gOJqCKkAOS8bwlGzMb
+5Na7xm4/GQn5eQKCAQEA3RiO6x66Pmsuz4Q+2+3sZFipX9D1GRnMRVSsgd/HjtZk
+8NkaGXI2NA5GdVXmZrWl/65kAcDsh93+rv1X7hKYkTkpOE+G1Zkj8mLgEN3V0nh9
+WoPcrqthzvRNUUuklJCuxAGA3mgKIUuSW4oBnBgop5EFtz9Y0aai/wP0gdAp4/7S
+CR2g910KgvDtbsAp93hTBrzzu/+Engar5mdZKvqCl7uOxWqSmeaPD1tucraDX0e5
+rd3KE/vXd9RSlcWiJmKkqEiNnsQ2XnwjiE0jJdJdH5z+Vo7OqfexXDsydtFKrmke
+2ZQ+eajLU7iXipiYpM+wWkwGGdUFdJAi+N7T6KUqPwKCAQAe03Zt+JCbmCFdwFHr
+vAH7LV4rou/fUDKSznbCxrgFUDPwphA2PJRo2iCZ+EVm14G8lPNIPsG8sEQobXEW
+TWI3AWLRlVta/dv10RC4xzGGhRbBCXbep6RO/W1taO+cXWPU2CDO+dedb956hu5F
+vlYxt2AqlFxgGMAu2A/QrrPYB0KVmeE9FAz3LGtCzBkjTaFzYeoYisS5sv4b6Rhl
+jCEPIZEyVs602SwbGaGCBZI5/Ha2khVATlIq3Jx7QFfmUVXxqUoXl34fY9wrxzzg
+syN3VMguE1WaraAUACQGT1FutyfBFRyxc7kxQZop/DDGU9/Emd9EOn2QNPM5soMs
+bTApAoIBAAZnMaxphWdNX1uvLsrbxx7Y2n7l5FNHxfy0CRLx0iu21dGL2A+omR1E
+1JGNXVDYLeiLumW6mp8MtNWIjMVeUIDUMPdqhjMlbj8U0fxrEEg6KRc3/moomHqP
+5LVYBXov/n+6s2q9hJ2WPLTd+FH2+SZxMsMt2Hqp4sqT6L7hsnTh6l9NNl4zmZxV
+MeslMZHzMCRf0Ic/TS3ub4gKsjBmdOXEDsx0264NWVNOiJJV6tQVlbENXU7a2lCk
+G4gu4xVNggtFnqRcdl6iJb1KzpvHzd6eg1cqZ53QiJhtNnbudMU8UiJnArAvTUQt
+cmYXKUSMp0TWMs8ItlG74udmPKjeL60CggEAdUp2FbZZEB3/G8tR7Z5slF925zXK
+N8ku/qOUEk3d76kcqYi9XJLmyJAXu9PhQnsN8DpfThOqJUXCh9xtk+1AiHTdXk8m
+BP7RE2oI2aoT9lO0ozwFJBFRRCkd6zTtYJYUbwIk1nayro83xl/AQPF2wRm5unKU
+xl5KJ8I2GCUw4Bh5Gjwk21y6XpPsjO8tfbO5jrAIQVTqab3hAcBouwQNsxNpunJm
+BaP+XYTBNM+HVamwLwDQgtVxPb8WUX8TSTuFv99jpWBYhlhq/OUcbo8f1D7miIFt
+b6UYNl1ofvBtqjlNz3NKJ+S57AN+jcdQfOG8xAiKPWCj1QnVc3aJdr+8bQ==
+-----END RSA PRIVATE KEY-----

tests/certs/revokedcrl.pem

@@ -0,0 +1,19 @@
+-----BEGIN X509 CRL-----
+MIIDCjCB8wIBATANBgkqhkiG9w0BAQUFADCBmTELMAkGA1UEBhMCVVMxCzAJBgNV
+BAgMAkNBMREwDwYDVQQHDAhTYW4gSm9zZTEgMB4GA1UECgwXV2dldCBUZXN0aW5n
+IERlcGFydG1lbnQxEDAOBgNVBAsMB1Rlc3RpbmcxFDASBgNVBAMMC1dnZXRUZXN0
+aW5nMSAwHgYJKoZIhvcNAQkBFhFidWdzLXdnZXRAZ251Lm9yZxcNMTcwNTA5MjIz
+MjEyWhcNMTkwNTA5MjIzMjEyWjAVMBMCAhElFw0xNzA1MDkyMjMxMDBaoA4wDDAK
+BgNVHRQEAwIBADANBgkqhkiG9w0BAQUFAAOCAgEADReMcnUQbWyXE1xYcPHlSAfh
+bBBY2w7e/CUeuCXaalaM9cfdMz0trR+JApdoBg/g+UV/+q8xYXEeQM7wKXOXOax4
+tYpS3+EdCpm1r+e4hhuGBMp01qtoJD8v5y3a77ujXWldgCEJHz05qjtpBkya775V
+w1UzLsbh6DVgrwSEOgMJHYfgJHuPwfD4PpCTSbAUSwNrHXIbDG6zPVyoBpl8WRCc
+4uDWVeh2+N0fmTucbm3x1dBnOol1JXI7LvnVDr+mtQVcHLD9OknNylmLOiuMrpmc
+9PENMdbgRKA4kkHcV9lg37elYubaIBA48Vkssnr90wU6nITLabojWYNEspjqQejG
+QOE78ASG0bS8O4vKxCVx4pX/ZQwcO9BeCnuIOsTlV2KUYiCA6yxNPkPoBjpdfOAB
+j3hu+Jk3S0aX6At1AHDvmtWErEnH4B0gGopt8VJL1ZBEglb9rUIg5OlbTr+x5vIX
+7FVuxhZYSxl1AYGqajmcLIwvucidaIlwtgFGeZR8GZ0y3aFdIoKO8V+wyNEPjI5I
+i9tvavJ23nlYFTQJwNgESIR0voipoiiYeSa8cED28rHfkQvnY2iNsCO+ztxZvC70
+4K0CAIbfhYx1eeIakeFFHdIGPSXf+oFGomij0yt3bZC2h4sFhsr7sYUIMb5KlSSW
+mZ3uHBLaS0xQ9p1vSRo=
+-----END X509 CRL-----

tests/certs/rootca.conf.in

@@ -0,0 +1,64 @@
+[ ca ]
+default_ca = myca
+
+[ crl_ext ]
+issuerAltName=issuer:copy
+authorityKeyIdentifier=keyid:always
+
+ [ myca ]
+ dir = @abs_srcdir@
+ new_certs_dir = ./
+ unique_subject = no
+ certificate = $dir/test-ca-cert.pem
+ database = certindex
+ private_key = $dir/test-ca-key.pem
+ serial = certserial
+ default_days = 730
+ default_md = sha1
+ policy = myca_policy
+ x509_extensions = myca_extensions
+ crlnumber = crlnumber
+ default_crl_days = 730
+
+ [ myca_policy ]
+ commonName = supplied
+ stateOrProvinceName = supplied
+ countryName = optional
+ emailAddress = optional
+ organizationName = supplied
+ organizationalUnitName = optional
+
+ [ myca_extensions ]
+ basicConstraints = critical,CA:TRUE
+ keyUsage = critical,any
+ subjectKeyIdentifier = hash
+ authorityKeyIdentifier = keyid:always,issuer
+ keyUsage = digitalSignature,keyEncipherment,cRLSign,keyCertSign
+ extendedKeyUsage = serverAuth
+ crlDistributionPoints = @crl_section
+ subjectAltName  = @alt_names
+ authorityInfoAccess = @ocsp_section
+
+ [ v3_ca ]
+ basicConstraints = critical,CA:TRUE,pathlen:0
+ keyUsage = critical,any
+ subjectKeyIdentifier = hash
+ authorityKeyIdentifier = keyid:always,issuer
+ keyUsage = digitalSignature,keyEncipherment,cRLSign,keyCertSign
+ extendedKeyUsage = serverAuth
+ crlDistributionPoints = @crl_section
+ subjectAltName  = @alt_names
+ authorityInfoAccess = @ocsp_section
+
+ [alt_names]
+ DNS.0 = WgetTestingServer
+
+ [crl_section]
+ URI.0 = http://test.wgettest.org/Bogus.crl
+ URI.1 = http://test.wgettest.org/Bogus.crl
+
+ [ocsp_section]
+ caIssuers;URI.0 = http://test.wgettest.com/Bogus.crt
+ caIssuers;URI.1 = http://test.wgettest.com/Bogus.crt
+ OCSP;URI.0 = http://test.wgettest.com/ocsp/
+ OCSP;URI.1 = http://test.wgettest.com/ocsp/

tests/certs/selfsigned.crt

@@ -0,0 +1,33 @@
+-----BEGIN CERTIFICATE-----
+MIIFtzCCA5+gAwIBAgIJANAKYgHn6Nk9MA0GCSqGSIb3DQEBCwUAMHIxCzAJBgNV
+BAYTAlVTMQswCQYDVQQIDAJDQTEVMBMGA1UEBwwMTXlzdGVyeSBTcG90MQwwCgYD
+VQQKDANEaXMxGjAYBgNVBAMMEVdnZXRUZXN0aW5nU2VydmVyMRUwEwYJKoZIhvcN
+AQkBFgZ0ZXN0ZXIwHhcNMTcwNTA5MjI0OTQ0WhcNMTgwNTA5MjI0OTQ0WjByMQsw
+CQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExFTATBgNVBAcMDE15c3RlcnkgU3BvdDEM
+MAoGA1UECgwDRGlzMRowGAYDVQQDDBFXZ2V0VGVzdGluZ1NlcnZlcjEVMBMGCSqG
+SIb3DQEJARYGdGVzdGVyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
+2Zc7ZtsoPrlnQLTfMTrfuH7ghL6OrNVPAGpHQ4N+ddJwkF52lQXbeo9JO+09HF7s
+VFnxTG2+0Ld98kcvY3Ylco1Sxl18Bdjzv13sIJtgh7HyuRJ6Ryq2LZGWLKPBaGq1
+G2bBO4nUmsJLjj/1KqKxjk38iJ3Sf02nh8MhRGr8OHFSTMf9pPKW6hibXbsMUVyQ
+2u2RUXbvEtR1rkInWAVhEo97Row0+Z1+ZiqINOcBgpQl0sWh204dZqqi/y3uBbLQ
+3MkenioCb/udLdPRsileVhhwnrq6/0M/YhghMyI9Y+ajQ90h6tM10iyrILYzMCLx
+FB+3iReEJVX7Sy9qaqLJmTttxD7yqReCAxsrdDp1ZmrkQWLRAqBRdZo8RahkfdTu
+wa/fNuwuFFnMC8w/UgCWgDOEH85n4asRNlufYz+GXTsYybiH3klkAe9o09/Cm+zk
+pcX+zcHUkw6aZLC4VbKHNfyKDbWqTMzS66C2Ln4g9p8Zk0KJIvcmVG9uz/zjVIwM
+BWrbEawjMuejy+HUNcaV9CoaBFquwRJd4hlsE6FEryo3k1hEtDancobXl0XLsylU
+SMKMPr6PHjdxt+PdUhL79VNUJT2k35LqLKvtWZAuTOOcfjm0uXSDUC4GvW+onD7L
+n0XB/m4Gqm55EPLnDJgFYdEylvozglg+hSuoywab6NkCAwEAAaNQME4wHQYDVR0O
+BBYEFJF+Iyz8/pwx50cqFXckWIXoat/AMB8GA1UdIwQYMBaAFJF+Iyz8/pwx50cq
+FXckWIXoat/AMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggIBAGRKLYCQ
+W+pdPOF0ojwrufYNbF2qryjJU7OzT7HbdrQOFZ+vcegi5rpZXOsFENTh0gdbI+M3
+FwxDIdyF7CvaRS1uMoTboqaqAzTy+gVVW/6d+UdOdHhJTpduhtQi3gtNvqzdkUpl
+01rX+Da6/jy4kPZfJap3mFPQLVvqVmcvJEcgHVOyB5/23RWS6TSEX35O3De9pnha
+XLqliFBQ/Sqj/2vZmkHBEXdNRfwfw1dHIcxmg25YTb6tyvrKURpXN6suDJEO+M6h
+9IVRv9qCNtvVHpo/xUxwjf7ZBHnGdcGl8AaAoIhRF7JTTGoRX7VAR+DLa5jHMAE2
+BmXzt+HHPMXZiQtzcUUcWc7+a740F8kM03CUMcz8sB4xzovGsZTLJ64afRFP1yaf
++1H7efbrogVjtpGzreWhJ8I5UXO/AoMjwUgyjjHb51KVRn6VrQfDHtw/hrIZVryI
+y8wOH0qzMK2JhB2oh1JvmjhtGxkWlqDztttfglYJENuMf8m/DxsmkSPksSnm8GkA
+El/GdocnZhl8vl8PcqzJ0nNn6EOTiZe+urGxG0r50ckVD+km/J7b56i+Gow46UH3
+Kkp69X9FHDfh3akaeU5chRfH99A/ehtdalD/W5Dy/hA9giA19foPUo6wKBE5unqz
+bfjzK+eNfIkER5JDL6hZQICdjiqa2+IzUnG8
+-----END CERTIFICATE-----

tests/certs/selfsigned.key

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQgIBADANBgkqhkiG9w0BAQEFAASCCSwwggkoAgEAAoICAQDZlztm2yg+uWdA
+tN8xOt+4fuCEvo6s1U8AakdDg3510nCQXnaVBdt6j0k77T0cXuxUWfFMbb7Qt33y
+Ry9jdiVyjVLGXXwF2PO/Xewgm2CHsfK5EnpHKrYtkZYso8FoarUbZsE7idSawkuO
+P/UqorGOTfyIndJ/TaeHwyFEavw4cVJMx/2k8pbqGJtduwxRXJDa7ZFRdu8S1HWu
+QidYBWESj3tGjDT5nX5mKog05wGClCXSxaHbTh1mqqL/Le4FstDcyR6eKgJv+50t
+09GyKV5WGHCeurr/Qz9iGCEzIj1j5qND3SHq0zXSLKsgtjMwIvEUH7eJF4QlVftL
+L2pqosmZO23EPvKpF4IDGyt0OnVmauRBYtECoFF1mjxFqGR91O7Br9827C4UWcwL
+zD9SAJaAM4QfzmfhqxE2W59jP4ZdOxjJuIfeSWQB72jT38Kb7OSlxf7NwdSTDppk
+sLhVsoc1/IoNtapMzNLroLYufiD2nxmTQoki9yZUb27P/ONUjAwFatsRrCMy56PL
+4dQ1xpX0KhoEWq7BEl3iGWwToUSvKjeTWES0NqdyhteXRcuzKVRIwow+vo8eN3G3
+491SEvv1U1QlPaTfkuosq+1ZkC5M45x+ObS5dINQLga9b6icPsufRcH+bgaqbnkQ
+8ucMmAVh0TKW+jOCWD6FK6jLBpvo2QIDAQABAoICABF+ZCs30XuBgnikUhFuL1Bw
++vIRM/1XRPu+j64w4zjry1sADT6b8vJelL+5qiEezJdXh9viMuYq6nhRGtE/TXFx
+RUdnerIpqCcpkPNqKo+eUeppPuV73Ju7SbybCdCwS5FBaKW1xh8PIe303GwqGmZb
+hMMjFSpg/ugeWw1aIJ8VFU3RAmaBjnqRseQORsY/z/GaCgXnrv7vj+qLrQgZnp1U
+Zc/dM+EhtWjXYI4ISInMCWJxuzqbhCed7m7frXRN1Rb7IHgM3pdMPm3RytktFEWN
+v3gzgRdGu9DSKdEnnpHqmBO7sp9jjb8xEi0WGPV0ybcZebMO7fPmfsajsEWUguql
+8kAwq6DkoQXPm8uMHoYaJhs14X2cJhITLccVWccCF7DO52y/KrL/k6QICnqTLtZq
+mdzwdOLCKXews0IeK3Ut/VEEi/+pMpAjdmxnSEv8lPKyLE8moOoxU/xdegUffn+j
+BwmtqFamdP817MzypPbfujR/muuM4+XNMTt8t81WvQtL7/7ZID3NUN4m+XgtJy++
+noi8etnANgT2jMATvzNIAAh3utbcP8mA7HGF7FT7tyqYkOd/1VxlY4kYl7d6Au1S
+75qmiAd8c+yBOS/y2E34HrrPuIcEdttyOhvhAiHJZuJ7akkAk0uLPJ25RK0qCYzl
+sO5rtWaqBfBCS3fts6gRAoIBAQDy0Aw0RrxZxB0XZHb9Xl/whUASFwxlSn2whVSV
+4eFL/bhpWhrKXsAwQ9HsI5q1vPOZIlzssVUnjAdN8tTiMiwGmgv33PJNnZBs8opy
+upTpbBpk97D847phzkJqCkuAmLaYEpOovVBBDN7xhgzu7ZcT+lLiSDCtQGIwgI+O
+TxhDJOLapLYs65ujVPSs4rO0DYh9cC4t4CwJv8JS7D3e1xnrnL2RA5RrrLgfphxU
+SQzrRyo3eXgjHC67KkeBBSi978IAE3NFBzyo945us/KxePXhIU0KlWmH0gHDNNcv
+0D6x4kod3UgDxep4aJnYZQKEfNI7xZo1zCkrFmwQE4s9HWSNAoIBAQDlaIKysObZ
+iYBXjw8fWhA2DImAsgS6C/Y/uBhS2EzDTtxaYV4VTTUNwijiwXY0F2sz/1kkk3WU
+LJ5bH2wjoRZEQu5xRvhdCJnullwxxVqvRj6O/W2SKkincbrpOukIzDCC/pvhlg0T
+P603bDz9J7xoCgIlfihG6adezS4eDtC8z4U+FnJgBUJcIZWTHx+CdSMMN/twmsc4
+VyGkgMa45EcC4JT53bysSkaKFKWh+2Pri3n+x/M403cBEW+zHh89UWtaAnn+UN6a
+S5TOahOj9JukJEZk8HB6R0u9rkfaZZ12uTzyBdP2T+ck8S2AUy5uvkzdAFfuojdv
+4nXlU1sJHRB9AoIBAE269G03x8wkz/tRGhZ6Q9RHk/82ia1Tb3E2/aENsoYVLxfq
+1HC8bGIHFAi4TSqo1oLLUVwkWNJULXJyrlvLG/TxE6vBe4AFVNrLui6INGuVQ83W
+zT3n2R6+XNx9dzYvrSR5rfNyx2JLsIM5GqLSRG8Mz8PIwGx2E/ja7xnrkCTOhiDg
+YcF3m1dqNvmxiT22p18grmfZP7/PN3I8VoIj8hRPFRB7SOQ/YqIfFyqUSCJ5obYo
+mKEEwKECI+nVsPk866oCkAAlFPIybdJaoPLXej8b3gHpWuM0A4RuQgT4cVmYy4lL
+8WXj0e/B7J4tl+S54MNpurhGJ1e30dhDqWtjIXECggEBAKVMNtB2swAQGY/9ntHi
+XUf0pKc8njdIIzkqdyxKepVIH3JoMhh7Nz0gp8Er0PYb4bznwt2d+ty3gar66zqI
++bhZ2eF5V8ABUJkfcnLSV1Nv8+eoJ+ln2k38nscrEXqrVlEtEDjtm6JBAZirvw5S
+MWltvLozOuZNubGPeiliV3mUtddU6TjS0Uv9Tv9hL50athQ5yk0K2X15Gt6jg4z5
+v0kNdYrNAQPLySP5WJdswkSYjWDNxi0uAdOdMrUHgU73ebizjB95OcxHpYNN37UF
+rZgKI0bcEM+qy6JzD4cILPu84XMqS95xGIX/2d9bEFvvdwbPFoz2CafurzB8bV4V
+uSkCggEAQRL390lx9uI4csLTTCUSa3Fl4BVPseqKlyadoxyzTMDyxAPxktw0vzht
+OyQdLssTVjL/0cHEBMnDawddk5L+1UF7izwhZinVtTGDvn5TC2elk+bJ1aWMQ5qg
+yUPdFbeLypmRlDUU8lJxppHcmrMY7/eAmOYAJTXn7Ygk030S6Hv1npSCtpyT1Stv
+CMtiE8bDaTv7qN2RJjPcvZ9xMB9GFcIdVpw8pf5jXQeci6kOR1FPW1j9DOSMAdf4
+0xPly00agfZxG/kkmL2rBrTGOJLYI8tgGpjPciJaSJ4NArFzxJbDG1DFw6GNKzBU
+qNaPYEH/kYsrfWzp/w1WMUpPdbl5iQ==
+-----END PRIVATE KEY-----