wget: allow HTTPS certificate check to be skipped

The Microsoft Windows Schannel implementation of TLS validates
the server certificate.  Enable the --no-check-certificate
option to wget to allow these checks to be skipped.  This may
be useful to connect to badly configured websites.

Adds 202 bytes to the x86_64 build with Schannel enabled.

(GitHub issue #581)

4 files changed, 36 insertions, 2 deletions

diff --git a/include/libbb.h b/include/libbb.h
index a73a04153..fdbab574d 100644
--- a/include/libbb.h
+++ b/include/libbb.h
@@ -1026,6 +1026,7 @@ typedef struct tls_state {
         char *hostname;
         SecPkgContext_StreamSizes stream_sizes;
         bool initialized;
+        bool no_check_cert;
         enum schannel_connection_state connection_state;
 } tls_state_t;
 #else
@@ -1105,6 +1106,7 @@ void FAST_FUNC tls_handshake(tls_state_t *tls, const char *sni);
 void FAST_FUNC tls_handshake_as_server(tls_state_t *tls,
         const char *pem_filename);
 #define TLSLOOP_EXIT_ON_LOCAL_EOF (1 << 0)
+#define TLS_NO_CHECK_CERTIFICATE (1 << 1)
 void tls_run_copy_loop(tls_state_t *tls, unsigned flags) FAST_FUNC;
 
 
diff --git a/networking/ssl_client.c b/networking/ssl_client.c
index 4d021a4ec..50c2180b0 100644
--- a/networking/ssl_client.c
+++ b/networking/ssl_client.c
@@ -19,6 +19,7 @@
 //usage:       "[-n SNI] { -s FD [-r FD] | HOST | -e PROG ARGS }"
 //usage:    )
 //usage:    IF_PLATFORM_MINGW32(
+//usage:    IF_FEATURE_TLS_SCHANNEL("[-c] ")
 //usage:       "[-e] -h handle [-n SNI]"
 //usage:    )
 //usage:#define ssl_client_full_usage ""
@@ -40,6 +41,9 @@ int ssl_client_main(int argc UNUSED_PARAM, char **argv)
                 OPT_s = (1 << 0),
                 OPT_h = (1 << 1),
                 OPT_n = (1 << 2),
+# if ENABLE_FEATURE_TLS_SCHANNEL
+                OPT_c = (1 << 3),
+# endif
         };
 #else
         enum {
@@ -53,12 +57,15 @@ int ssl_client_main(int argc UNUSED_PARAM, char **argv)
         // INIT_G();
         tls = new_tls_state();
 #if ENABLE_PLATFORM_MINGW32
-        opt = getopt32(argv, "eh:n:", &hstr, &sni);
+        opt = getopt32(argv, "eh:n:"IF_FEATURE_TLS_SCHANNEL("c"), &hstr, &sni);
 
         if (!hstr || sscanf(hstr, "%p", &h) != 1)
                 bb_error_msg_and_die("invalid handle");
         init_winsock();
         tls->ifd = tls->ofd = _open_osfhandle((intptr_t)h, _O_RDWR|_O_BINARY);
+# if ENABLE_FEATURE_TLS_SCHANNEL
+        tls->no_check_cert = (opt & OPT_c) != 0;
+# endif
 #else
         /* "+": stop on first non-option */
         opt = getopt32(argv, "^+" "s:+r:+n:e" "\0"
diff --git a/networking/tls.c b/networking/tls.c
index c7015e044..cccdbf22e 100644
--- a/networking/tls.c
+++ b/networking/tls.c
@@ -3544,6 +3544,11 @@ void FAST_FUNC tls_handshake(tls_state_t *state, const char *hostname) {
         };
 #endif
 
+        if (state->no_check_cert) {
+                credential.dwFlags &= ~SCH_CRED_AUTO_CRED_VALIDATION;
+                credential.dwFlags |= SCH_CRED_MANUAL_CRED_VALIDATION;
+        }
+
         state->in_buffer_offset = 0;
 
         state->out_buffer = NULL;
diff --git a/networking/wget.c b/networking/wget.c
index 6a64836fb..6bedd77b8 100644
--- a/networking/wget.c
+++ b/networking/wget.c
@@ -140,8 +140,13 @@
 /* Since we ignore these opts, we don't show them in --help */
 /* //usage:    "        [--no-cache] [--passive-ftp] [-t TRIES]" */
 /* //usage:    "        [-nv] [-nc] [-nH] [-np]" */
+//usage:        IF_PLATFORM_MINGW32(
+//usage:       "        "IF_FEATURE_TLS_SCHANNEL("[--no-check-certificate] ")"[-P DIR] [-U AGENT]"IF_FEATURE_WGET_TIMEOUT(" [-T SEC]")" URL..."
+//usage:        )
+//usage:        IF_PLATFORM_POSIX(
 //usage:       "        "IF_FEATURE_WGET_OPENSSL("[--no-check-certificate] ")"[-P DIR] [-U AGENT]"IF_FEATURE_WGET_TIMEOUT(" [-T SEC]")" URL..."
 //usage:        )
+//usage:        )
 //usage:        IF_NOT_FEATURE_WGET_LONG_OPTIONS(
 //usage:       "[-cqS] [-O FILE] [-o LOGFILE] [-Y on/off] [-P DIR] [-U AGENT]"IF_FEATURE_WGET_TIMEOUT(" [-T SEC]")" URL..."
 //usage:        )
@@ -155,6 +160,9 @@
 //usage:        IF_FEATURE_WGET_OPENSSL(
 //usage:     "\n        --no-check-certificate  Don't validate the server's certificate"
 //usage:        )
+//usage:        IF_FEATURE_TLS_SCHANNEL(
+//usage:     "\n        --no-check-certificate  Don't validate the server's certificate"
+//usage:        )
 //usage:        )
 //usage:     "\n        -c              Continue retrieval of aborted transfer"
 //usage:     "\n        -q              Quiet"
@@ -847,9 +855,16 @@ static void spawn_ssl_client(const char *host, int network_fd, int flags)
 
         fflush_all();
 
+#  if !ENABLE_FEATURE_TLS_SCHANNEL
         cmd = xasprintf("ssl_client -h %p -n %s%s",
                                         (void *)_get_osfhandle(network_fd), servername,
                                         flags & TLSLOOP_EXIT_ON_LOCAL_EOF ? " -e" : "");
+#  else
+        cmd = xasprintf("ssl_client -h %p -n %s%s%s",
+                                        (void *)_get_osfhandle(network_fd), servername,
+                                        flags & TLSLOOP_EXIT_ON_LOCAL_EOF ? " -e" : "",
+                                        flags & TLS_NO_CHECK_CERTIFICATE ? " -c" : "");
+#  endif
 
         if ((fd1=mingw_popen_fd("ssl_client", cmd, "b", -1, NULL)) == -1) {
                 bb_perror_msg_and_die("can't execute ssl_client");
@@ -1255,7 +1270,12 @@ static void download_one_url(const char *url)
                 /* Only internal TLS support is configured */
                 sfp = open_socket(lsa);
                 if (server.protocol == P_HTTPS)
-                        spawn_ssl_client(server.host, fileno(sfp), /*flags*/ 0);
+                        spawn_ssl_client(server.host, fileno(sfp), /*flags*/
+#  if ENABLE_FEATURE_TLS_SCHANNEL
+                                (option_mask32 & WGET_OPT_NO_CHECK_CERT) ?
+                                        TLS_NO_CHECK_CERTIFICATE :
+#  endif
+                                        0);
 #else
                 /* ssl (https) support is not configured */
                 sfp = open_socket(lsa);