author | Ryan Schmidt <git@ryandesign.com> |
Fri, 09 Jul 2021 10:38:43 -0500 | |
changeset 742 | ad6ffcac88a4 |
parent 734 | 866607b4c186 |
permissions | -rw-r--r-- |
516
4dd3aa6b83e5
Change the tab width to 4 steps in the emacs headers
Mikael Hallendal <micke@imendio.com>
parents:
515
diff
changeset
|
1 |
/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
2 |
/* |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
3 |
* Copyright (C) 2003-2006 Imendio AB |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
4 |
* |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
5 |
* This program is free software; you can redistribute it and/or |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
6 |
* modify it under the terms of the GNU Lesser General Public License as |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
7 |
* published by the Free Software Foundation; either version 2 of the |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
8 |
* License, or (at your option) any later version. |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
9 |
* |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
10 |
* This program is distributed in the hope that it will be useful, |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
11 |
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
12 |
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
13 |
* Lesser General Public License for more details. |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
14 |
* |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
15 |
* You should have received a copy of the GNU Lesser General Public |
690
7ccf2113ec5f
Update the postal address of the FSF
Frank Zschockelt <lm@freakysoft.de>
parents:
654
diff
changeset
|
16 |
* License along with this program; if not, see <https://www.gnu.org/licenses> |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
17 |
*/ |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
18 |
|
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
19 |
#include <config.h> |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
20 |
|
651
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
21 |
#include <errno.h> |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
22 |
#include <string.h> |
651
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
23 |
#include <sys/types.h> |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
24 |
#include <sys/stat.h> |
654
54f17719b9d0
Make opendir(3) prototypes available
Holger Weiß <holger@zedat.fu-berlin.de>
parents:
651
diff
changeset
|
25 |
#include <dirent.h> |
651
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
26 |
#include <unistd.h> |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
27 |
#include <glib.h> |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
28 |
|
319
2a892980f78b
Enable compression in GNUTLS. (Patch by Robert McQueen)
Senko Rasic <senko.rasic@collabora.co.uk>
parents:
301
diff
changeset
|
29 |
#include "lm-debug.h" |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
30 |
#include "lm-error.h" |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
31 |
#include "lm-ssl-base.h" |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
32 |
#include "lm-ssl-internals.h" |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
33 |
|
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
34 |
#ifdef HAVE_GNUTLS |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
35 |
|
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
36 |
#include <gnutls/x509.h> |
704
d682ae8d7d3a
Deprecate MD5 fingerprints for SHA256
Frank Zschockelt <lm@freakysoft.de>
parents:
703
diff
changeset
|
37 |
#include <gnutls/crypto.h> |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
38 |
|
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
39 |
struct _LmSSL { |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
40 |
LmSSLBase base; |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
41 |
|
633 | 42 |
gnutls_session_t gnutls_session; |
43 |
gnutls_certificate_credentials_t gnutls_xcred; |
|
44 |
gboolean started; |
|
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
45 |
}; |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
46 |
|
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
47 |
static gboolean ssl_verify_certificate (LmSSL *ssl, |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
48 |
const gchar *server); |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
49 |
|
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
50 |
static gboolean |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
51 |
ssl_verify_certificate (LmSSL *ssl, const gchar *server) |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
52 |
{ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
53 |
LmSSLBase *base; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
54 |
unsigned int status; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
55 |
int rc; |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
56 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
57 |
base = LM_SSL_BASE (ssl); |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
58 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
59 |
/* This verification function uses the trusted CAs in the credentials |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
60 |
* structure. So you must have installed one or more CA certificates. |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
61 |
*/ |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
62 |
rc = gnutls_certificate_verify_peers2 (ssl->gnutls_session, &status); |
273
6be9056c1fb3
Verify certificates in GnuTLS code. Fixes LM-107. Patch by Sjoerd Simons.
Dafydd Harries <daf@rhydd.org>
parents:
189
diff
changeset
|
63 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
64 |
if (rc == GNUTLS_E_NO_CERTIFICATE_FOUND) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
65 |
if (base->func (ssl, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
66 |
LM_SSL_STATUS_NO_CERT_FOUND, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
67 |
base->func_data) != LM_SSL_RESPONSE_CONTINUE) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
68 |
return FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
69 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
70 |
} |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
71 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
72 |
if (rc != 0) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
73 |
if (base->func (ssl, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
74 |
LM_SSL_STATUS_GENERIC_ERROR, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
75 |
base->func_data) != LM_SSL_RESPONSE_CONTINUE) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
76 |
return FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
77 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
78 |
} |
273
6be9056c1fb3
Verify certificates in GnuTLS code. Fixes LM-107. Patch by Sjoerd Simons.
Dafydd Harries <daf@rhydd.org>
parents:
189
diff
changeset
|
79 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
80 |
if (rc == GNUTLS_E_NO_CERTIFICATE_FOUND) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
81 |
if (base->func (ssl, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
82 |
LM_SSL_STATUS_NO_CERT_FOUND, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
83 |
base->func_data) != LM_SSL_RESPONSE_CONTINUE) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
84 |
return FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
85 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
86 |
} |
607 | 87 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
88 |
if (status & GNUTLS_CERT_INVALID |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
89 |
|| status & GNUTLS_CERT_REVOKED) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
90 |
if (base->func (ssl, LM_SSL_STATUS_UNTRUSTED_CERT, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
91 |
base->func_data) != LM_SSL_RESPONSE_CONTINUE) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
92 |
return FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
93 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
94 |
} |
607 | 95 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
96 |
if (gnutls_certificate_expiration_time_peers (ssl->gnutls_session) < time (0)) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
97 |
if (base->func (ssl, LM_SSL_STATUS_CERT_EXPIRED, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
98 |
base->func_data) != LM_SSL_RESPONSE_CONTINUE) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
99 |
return FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
100 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
101 |
} |
607 | 102 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
103 |
if (gnutls_certificate_activation_time_peers (ssl->gnutls_session) > time (0)) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
104 |
if (base->func (ssl, LM_SSL_STATUS_CERT_NOT_ACTIVATED, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
105 |
base->func_data) != LM_SSL_RESPONSE_CONTINUE) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
106 |
return FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
107 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
108 |
} |
607 | 109 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
110 |
if (gnutls_certificate_type_get (ssl->gnutls_session) == GNUTLS_CRT_X509) { |
633 | 111 |
const gnutls_datum_t* cert_list; |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
112 |
guint cert_list_size; |
704
d682ae8d7d3a
Deprecate MD5 fingerprints for SHA256
Frank Zschockelt <lm@freakysoft.de>
parents:
703
diff
changeset
|
113 |
gnutls_digest_algorithm_t digest = GNUTLS_DIG_SHA256; |
d682ae8d7d3a
Deprecate MD5 fingerprints for SHA256
Frank Zschockelt <lm@freakysoft.de>
parents:
703
diff
changeset
|
114 |
guchar digest_bin[LM_FINGERPRINT_LENGTH]; |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
115 |
size_t digest_size; |
633 | 116 |
gnutls_x509_crt_t cert; |
607 | 117 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
118 |
cert_list = gnutls_certificate_get_peers (ssl->gnutls_session, &cert_list_size); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
119 |
if (cert_list == NULL) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
120 |
if (base->func (ssl, LM_SSL_STATUS_NO_CERT_FOUND, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
121 |
base->func_data) != LM_SSL_RESPONSE_CONTINUE) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
122 |
return FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
123 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
124 |
} |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
125 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
126 |
gnutls_x509_crt_init (&cert); |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
127 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
128 |
if (gnutls_x509_crt_import (cert, &cert_list[0], |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
129 |
GNUTLS_X509_FMT_DER) != 0) { |
607 | 130 |
if (base->func (ssl, LM_SSL_STATUS_NO_CERT_FOUND, |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
131 |
base->func_data) != LM_SSL_RESPONSE_CONTINUE) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
132 |
return FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
133 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
134 |
} |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
135 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
136 |
if (!gnutls_x509_crt_check_hostname (cert, server)) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
137 |
if (base->func (ssl, LM_SSL_STATUS_CERT_HOSTNAME_MISMATCH, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
138 |
base->func_data) != LM_SSL_RESPONSE_CONTINUE) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
139 |
return FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
140 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
141 |
} |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
142 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
143 |
gnutls_x509_crt_deinit (cert); |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
144 |
|
704
d682ae8d7d3a
Deprecate MD5 fingerprints for SHA256
Frank Zschockelt <lm@freakysoft.de>
parents:
703
diff
changeset
|
145 |
digest_size = gnutls_hash_get_len(digest); |
d682ae8d7d3a
Deprecate MD5 fingerprints for SHA256
Frank Zschockelt <lm@freakysoft.de>
parents:
703
diff
changeset
|
146 |
g_assert(digest_size < sizeof(digest_bin)); |
146
5da5bf8186dd
2006-05-27 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
137
diff
changeset
|
147 |
|
704
d682ae8d7d3a
Deprecate MD5 fingerprints for SHA256
Frank Zschockelt <lm@freakysoft.de>
parents:
703
diff
changeset
|
148 |
if (gnutls_fingerprint (digest, |
d682ae8d7d3a
Deprecate MD5 fingerprints for SHA256
Frank Zschockelt <lm@freakysoft.de>
parents:
703
diff
changeset
|
149 |
&cert_list[0], |
d682ae8d7d3a
Deprecate MD5 fingerprints for SHA256
Frank Zschockelt <lm@freakysoft.de>
parents:
703
diff
changeset
|
150 |
digest_bin, |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
151 |
&digest_size) >= 0) { |
704
d682ae8d7d3a
Deprecate MD5 fingerprints for SHA256
Frank Zschockelt <lm@freakysoft.de>
parents:
703
diff
changeset
|
152 |
_lm_ssl_base_set_fingerprint(base, digest_bin, digest_size); |
d682ae8d7d3a
Deprecate MD5 fingerprints for SHA256
Frank Zschockelt <lm@freakysoft.de>
parents:
703
diff
changeset
|
153 |
if (_lm_ssl_base_check_fingerprint(base) != 0 && |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
154 |
base->func (ssl, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
155 |
LM_SSL_STATUS_CERT_FINGERPRINT_MISMATCH, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
156 |
base->func_data) != LM_SSL_RESPONSE_CONTINUE) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
157 |
return FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
158 |
} |
607 | 159 |
} |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
160 |
else if (base->func (ssl, LM_SSL_STATUS_GENERIC_ERROR, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
161 |
base->func_data) != LM_SSL_RESPONSE_CONTINUE) { |
607 | 162 |
return FALSE; |
163 |
} |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
164 |
} |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
165 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
166 |
return TRUE; |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
167 |
} |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
168 |
|
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
169 |
/* From lm-ssl-protected.h */ |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
170 |
|
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
171 |
LmSSL * |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
172 |
_lm_ssl_new (const gchar *expected_fingerprint, |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
173 |
LmSSLFunction ssl_function, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
174 |
gpointer user_data, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
175 |
GDestroyNotify notify) |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
176 |
{ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
177 |
LmSSL *ssl; |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
178 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
179 |
ssl = g_new0 (LmSSL, 1); |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
180 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
181 |
_lm_ssl_base_init ((LmSSLBase *) ssl, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
182 |
expected_fingerprint, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
183 |
ssl_function, user_data, notify); |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
184 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
185 |
return ssl; |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
186 |
} |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
187 |
|
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
188 |
void |
607 | 189 |
_lm_ssl_initialize (LmSSL *ssl) |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
190 |
{ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
191 |
gnutls_global_init (); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
192 |
gnutls_certificate_allocate_credentials (&ssl->gnutls_xcred); |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
193 |
} |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
194 |
|
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
195 |
gboolean |
651
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
196 |
_lm_ssl_set_ca (LmSSL *ssl, |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
197 |
const gchar *ca_path) |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
198 |
{ |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
199 |
struct stat target; |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
200 |
|
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
201 |
if (stat (ca_path, &target) != 0) { |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
202 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
203 |
"ca_path '%s': no such file or directory", ca_path); |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
204 |
return FALSE; |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
205 |
} |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
206 |
|
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
207 |
if (S_ISDIR (target.st_mode)) { |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
208 |
int success = 0; |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
209 |
int worked_at_least_once = 0; |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
210 |
DIR *dir; |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
211 |
struct dirent *entry; |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
212 |
|
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
213 |
if ((dir = opendir (ca_path)) == NULL) { |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
214 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
215 |
"Couldn't open '%s': %s", |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
216 |
ca_path, strerror(errno)); |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
217 |
return FALSE; |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
218 |
} |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
219 |
|
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
220 |
for (entry = readdir (dir); entry != NULL; entry = readdir (dir)) { |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
221 |
struct stat file; |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
222 |
gchar *path = g_build_path ("/", ca_path, entry->d_name, NULL); |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
223 |
|
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
224 |
if ((stat (path, &file) == 0) && S_ISREG (file.st_mode)) { |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
225 |
success = gnutls_certificate_set_x509_trust_file ( |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
226 |
ssl->gnutls_xcred, path, GNUTLS_X509_FMT_PEM); |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
227 |
if (success > 0) |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
228 |
worked_at_least_once = 1; |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
229 |
if (success < 0) { |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
230 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
231 |
"Loading of certificate '%s' failed: %s", |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
232 |
path, gnutls_strerror(success)); |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
233 |
} |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
234 |
} |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
235 |
g_free (path); |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
236 |
} |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
237 |
closedir (dir); |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
238 |
|
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
239 |
if (!worked_at_least_once) { |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
240 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
241 |
"No certificates in ca_path '%s'. Are they in PEM format?", |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
242 |
ca_path); |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
243 |
return FALSE; |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
244 |
} |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
245 |
|
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
246 |
} else if (S_ISREG (target.st_mode)) { |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
247 |
int success = 0; |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
248 |
success = gnutls_certificate_set_x509_trust_file (ssl->gnutls_xcred, |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
249 |
ca_path, |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
250 |
GNUTLS_X509_FMT_PEM); |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
251 |
if (success < 0) { |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
252 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
253 |
"Loading of ca_path '%s' failed: %s", |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
254 |
ca_path, gnutls_strerror(success)); |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
255 |
return FALSE; |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
256 |
} |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
257 |
} |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
258 |
return TRUE; |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
259 |
} |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
260 |
|
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
261 |
gboolean |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
262 |
_lm_ssl_begin (LmSSL *ssl, gint fd, const gchar *server, GError **error) |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
263 |
{ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
264 |
int ret; |
650
a51209f570b6
Implemented lm_ssl_set_cipher_list
Frank Zschockelt <lm@freakysoft.de>
parents:
649
diff
changeset
|
265 |
LmSSLBase *base; |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
266 |
gboolean auth_ok = TRUE; |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
267 |
|
650
a51209f570b6
Implemented lm_ssl_set_cipher_list
Frank Zschockelt <lm@freakysoft.de>
parents:
649
diff
changeset
|
268 |
base = LM_SSL_BASE(ssl); |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
269 |
gnutls_init (&ssl->gnutls_session, GNUTLS_CLIENT); |
650
a51209f570b6
Implemented lm_ssl_set_cipher_list
Frank Zschockelt <lm@freakysoft.de>
parents:
649
diff
changeset
|
270 |
if (base->cipher_list) { |
703 | 271 |
gnutls_priority_set_direct (ssl->gnutls_session, base->cipher_list, NULL); |
650
a51209f570b6
Implemented lm_ssl_set_cipher_list
Frank Zschockelt <lm@freakysoft.de>
parents:
649
diff
changeset
|
272 |
} else { |
703 | 273 |
gnutls_priority_set_direct (ssl->gnutls_session, "NORMAL", NULL); |
650
a51209f570b6
Implemented lm_ssl_set_cipher_list
Frank Zschockelt <lm@freakysoft.de>
parents:
649
diff
changeset
|
274 |
} |
651
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
275 |
if (base->ca_path) { |
703 | 276 |
_lm_ssl_set_ca(ssl, base->ca_path); |
702
75866de0e731
Load system certs only if user doesn't specify trusted certs
Frank Zschockelt <lm@freakysoft.de>
parents:
700
diff
changeset
|
277 |
} else { |
75866de0e731
Load system certs only if user doesn't specify trusted certs
Frank Zschockelt <lm@freakysoft.de>
parents:
700
diff
changeset
|
278 |
gnutls_certificate_set_x509_system_trust(ssl->gnutls_xcred); |
651
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
279 |
} |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
280 |
gnutls_credentials_set (ssl->gnutls_session, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
281 |
GNUTLS_CRD_CERTIFICATE, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
282 |
ssl->gnutls_xcred); |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
283 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
284 |
gnutls_transport_set_ptr (ssl->gnutls_session, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
285 |
(gnutls_transport_ptr_t)(glong) fd); |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
286 |
|
715
e098e49fcc34
retry gnutls handshake on GNUTLS_E_INTERRUPTED
Frank Zschockelt <lm@freakysoft.de>
parents:
714
diff
changeset
|
287 |
do { |
e098e49fcc34
retry gnutls handshake on GNUTLS_E_INTERRUPTED
Frank Zschockelt <lm@freakysoft.de>
parents:
714
diff
changeset
|
288 |
ret = gnutls_handshake(ssl->gnutls_session); |
e098e49fcc34
retry gnutls handshake on GNUTLS_E_INTERRUPTED
Frank Zschockelt <lm@freakysoft.de>
parents:
714
diff
changeset
|
289 |
} while (GNUTLS_E_AGAIN == ret || GNUTLS_E_INTERRUPTED == ret); |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
290 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
291 |
if (ret >= 0) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
292 |
auth_ok = ssl_verify_certificate (ssl, server); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
293 |
} |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
294 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
295 |
if (ret < 0 || !auth_ok) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
296 |
char *errmsg; |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
297 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
298 |
if (!auth_ok) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
299 |
errmsg = "authentication error"; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
300 |
} else { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
301 |
errmsg = "handshake failed"; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
302 |
} |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
303 |
|
607 | 304 |
g_set_error (error, |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
305 |
LM_ERROR, LM_ERROR_CONNECTION_OPEN, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
306 |
"*** GNUTLS %s: %s", |
607 | 307 |
errmsg, gnutls_strerror (ret)); |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
308 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
309 |
return FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
310 |
} |
301
e83880152e77
Don't crash on connection close if SSL wasn't started.
Senko Rasic <senko.rasic@collabora.co.uk>
parents:
273
diff
changeset
|
311 |
|
650
a51209f570b6
Implemented lm_ssl_set_cipher_list
Frank Zschockelt <lm@freakysoft.de>
parents:
649
diff
changeset
|
312 |
lm_verbose ("GNUTLS negotiated cipher suite: %s", |
a51209f570b6
Implemented lm_ssl_set_cipher_list
Frank Zschockelt <lm@freakysoft.de>
parents:
649
diff
changeset
|
313 |
gnutls_cipher_suite_get_name(gnutls_kx_get(ssl->gnutls_session), |
a51209f570b6
Implemented lm_ssl_set_cipher_list
Frank Zschockelt <lm@freakysoft.de>
parents:
649
diff
changeset
|
314 |
gnutls_cipher_get(ssl->gnutls_session), |
a51209f570b6
Implemented lm_ssl_set_cipher_list
Frank Zschockelt <lm@freakysoft.de>
parents:
649
diff
changeset
|
315 |
gnutls_mac_get(ssl->gnutls_session))); |
734
866607b4c186
Don't use compression API for GnuTLS >= 3.6.0
Frank Zschockelt <lm@freakysoft.de>
parents:
715
diff
changeset
|
316 |
#if GNUTLS_VERSION_NUMBER < 0x030600 |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
317 |
lm_verbose ("GNUTLS negotiated compression: %s", |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
318 |
gnutls_compression_get_name (gnutls_compression_get |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
319 |
(ssl->gnutls_session))); |
734
866607b4c186
Don't use compression API for GnuTLS >= 3.6.0
Frank Zschockelt <lm@freakysoft.de>
parents:
715
diff
changeset
|
320 |
#endif |
319
2a892980f78b
Enable compression in GNUTLS. (Patch by Robert McQueen)
Senko Rasic <senko.rasic@collabora.co.uk>
parents:
301
diff
changeset
|
321 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
322 |
ssl->started = TRUE; |
301
e83880152e77
Don't crash on connection close if SSL wasn't started.
Senko Rasic <senko.rasic@collabora.co.uk>
parents:
273
diff
changeset
|
323 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
324 |
return TRUE; |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
325 |
} |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
326 |
|
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
327 |
GIOStatus |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
328 |
_lm_ssl_read (LmSSL *ssl, gchar *buf, gint len, gsize *bytes_read) |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
329 |
{ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
330 |
GIOStatus status; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
331 |
gint b_read; |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
332 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
333 |
*bytes_read = 0; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
334 |
b_read = gnutls_record_recv (ssl->gnutls_session, buf, len); |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
335 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
336 |
if (b_read == GNUTLS_E_AGAIN) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
337 |
status = G_IO_STATUS_AGAIN; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
338 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
339 |
else if (b_read == 0) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
340 |
status = G_IO_STATUS_EOF; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
341 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
342 |
else if (b_read < 0) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
343 |
status = G_IO_STATUS_ERROR; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
344 |
} else { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
345 |
*bytes_read = (guint) b_read; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
346 |
status = G_IO_STATUS_NORMAL; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
347 |
} |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
348 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
349 |
return status; |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
350 |
} |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
351 |
|
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
352 |
gint |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
353 |
_lm_ssl_send (LmSSL *ssl, const gchar *str, gint len) |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
354 |
{ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
355 |
gint bytes_written; |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
356 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
357 |
bytes_written = gnutls_record_send (ssl->gnutls_session, str, len); |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
358 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
359 |
while (bytes_written < 0) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
360 |
if (bytes_written != GNUTLS_E_INTERRUPTED && |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
361 |
bytes_written != GNUTLS_E_AGAIN) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
362 |
return -1; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
363 |
} |
607 | 364 |
|
365 |
bytes_written = gnutls_record_send (ssl->gnutls_session, |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
366 |
str, len); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
367 |
} |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
368 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
369 |
return bytes_written; |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
370 |
} |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
371 |
|
607 | 372 |
void |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
373 |
_lm_ssl_close (LmSSL *ssl) |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
374 |
{ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
375 |
if (!ssl->started) |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
376 |
return; |
301
e83880152e77
Don't crash on connection close if SSL wasn't started.
Senko Rasic <senko.rasic@collabora.co.uk>
parents:
273
diff
changeset
|
377 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
378 |
gnutls_deinit (ssl->gnutls_session); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
379 |
gnutls_certificate_free_credentials (ssl->gnutls_xcred); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
380 |
gnutls_global_deinit (); |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
381 |
} |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
382 |
|
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
383 |
void |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
384 |
_lm_ssl_free (LmSSL *ssl) |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
385 |
{ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
386 |
_lm_ssl_base_free_fields (LM_SSL_BASE (ssl)); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
387 |
g_free (ssl); |
137
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
388 |
} |
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
389 |
|
18785575aa7a
2006-04-05 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
390 |
#endif /* HAVE_GNUTLS */ |