author | Frank Zschockelt <lm@freakysoft.de> |
Sat, 13 Feb 2016 12:16:45 +0100 | |
changeset 704 | d682ae8d7d3a |
parent 702 | 75866de0e731 |
child 718 | a1d2735ccda8 |
permissions | -rw-r--r-- |
516
4dd3aa6b83e5
Change the tab width to 4 steps in the emacs headers
Mikael Hallendal <micke@imendio.com>
parents:
515
diff
changeset
|
1 |
/* -*- Mode: C; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
2 |
/* |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
3 |
* Copyright (C) 2006 Imendio AB |
209
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
4 |
* Copyright (C) 2006 Nokia Corporation. All rights reserved. |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
5 |
* |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
6 |
* This program is free software; you can redistribute it and/or |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
7 |
* modify it under the terms of the GNU Lesser General Public License as |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
8 |
* published by the Free Software Foundation; either version 2 of the |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
9 |
* License, or (at your option) any later version. |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
10 |
* |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
11 |
* This program is distributed in the hope that it will be useful, |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
12 |
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
13 |
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
14 |
* Lesser General Public License for more details. |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
15 |
* |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
16 |
* You should have received a copy of the GNU Lesser General Public |
690
7ccf2113ec5f
Update the postal address of the FSF
Frank Zschockelt <lm@freakysoft.de>
parents:
689
diff
changeset
|
17 |
* License along with this program; if not, see <https://www.gnu.org/licenses> |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
18 |
*/ |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
19 |
|
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
20 |
#include <config.h> |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
21 |
|
209
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
22 |
#include <stdio.h> |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
23 |
#include <string.h> |
651
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
24 |
#include <sys/types.h> |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
25 |
#include <sys/stat.h> |
209
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
26 |
#include <unistd.h> |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
27 |
#include <glib.h> |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
28 |
|
213
27567fb5d37b
Use g_warning and g_log for warnings and debug printouts in OpenSSL backend.
Mikael Hallendal <micke@imendio.com>
parents:
209
diff
changeset
|
29 |
#include "lm-debug.h" |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
30 |
#include "lm-error.h" |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
31 |
#include "lm-ssl-base.h" |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
32 |
#include "lm-ssl-internals.h" |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
33 |
|
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
34 |
#ifdef HAVE_OPENSSL |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
35 |
|
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
36 |
#include <openssl/ssl.h> |
209
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
37 |
#include <openssl/err.h> |
661
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
38 |
#include <openssl/x509v3.h> |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
39 |
#include <openssl/asn1.h> |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
40 |
#include <openssl/safestack.h> |
209
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
41 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
42 |
#define LM_SSL_CN_MAX 63 |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
43 |
|
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
44 |
struct _LmSSL { |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
45 |
LmSSLBase base; |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
46 |
|
628
1ac0534623ef
Fix compilation warnings
Myhailo Danylenko <isbear@ukrpost.net>
parents:
618
diff
changeset
|
47 |
const SSL_METHOD *ssl_method; |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
48 |
SSL_CTX *ssl_ctx; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
49 |
SSL *ssl; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
50 |
/*BIO *bio;*/ |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
51 |
}; |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
52 |
|
209
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
53 |
int ssl_verify_cb (int preverify_ok, X509_STORE_CTX *x509_ctx); |
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
54 |
|
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
55 |
static gboolean ssl_verify_certificate (LmSSL *ssl, const gchar *server); |
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
56 |
static GIOStatus ssl_io_status_from_return (LmSSL *ssl, gint error); |
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
57 |
|
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
58 |
/*static char _ssl_error_code[11];*/ |
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
59 |
|
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
60 |
static void |
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
61 |
ssl_print_state (LmSSL *ssl, const char *func, int val) |
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
62 |
{ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
63 |
unsigned long errid; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
64 |
const char *errmsg; |
209
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
65 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
66 |
switch (SSL_get_error(ssl->ssl, val)) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
67 |
case SSL_ERROR_NONE: |
614
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
68 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, "%s(): %i / SSL_ERROR_NONE", |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
69 |
func, val); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
70 |
break; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
71 |
case SSL_ERROR_ZERO_RETURN: |
614
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
72 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, |
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
73 |
"%s(): %i / SSL_ERROR_ZERO_RETURN", func, val); |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
74 |
break; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
75 |
case SSL_ERROR_WANT_READ: |
614
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
76 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, |
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
77 |
"%s(): %i / SSL_ERROR_WANT_READ", func, val); |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
78 |
break; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
79 |
case SSL_ERROR_WANT_WRITE: |
614
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
80 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, |
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
81 |
"%s(): %i / SSL_ERROR_WANT_WRITE", func, val); |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
82 |
break; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
83 |
case SSL_ERROR_WANT_X509_LOOKUP: |
614
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
84 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, |
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
85 |
"%s(): %i / SSL_ERROR_WANT_X509_LOOKUP", func, val); |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
86 |
break; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
87 |
case SSL_ERROR_SYSCALL: |
614
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
88 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, |
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
89 |
"%s(): %i / SSL_ERROR_SYSCALL", func, val); |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
90 |
break; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
91 |
case SSL_ERROR_SSL: |
614
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
92 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, |
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
93 |
"%s(): %i / SSL_ERROR_SSL", func, val); |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
94 |
break; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
95 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
96 |
do { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
97 |
errid = ERR_get_error(); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
98 |
if (errid) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
99 |
errmsg = ERR_error_string(errid, NULL); |
614
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
100 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, "\t%s", errmsg); |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
101 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
102 |
} while (errid != 0); |
209
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
103 |
} |
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
104 |
|
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
105 |
/*static const char * |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
106 |
ssl_get_x509_err (long verify_res) |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
107 |
{ |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
108 |
sprintf(_ssl_error_code, "%ld", verify_res); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
109 |
return _ssl_error_code; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
110 |
}*/ |
209
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
111 |
|
607 | 112 |
|
209
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
113 |
int |
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
114 |
ssl_verify_cb (int preverify_ok, X509_STORE_CTX *x509_ctx) |
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
115 |
{ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
116 |
/* As this callback doesn't get auxiliary pointer parameter we |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
117 |
* cannot really use this. However, we can retrieve results later. */ |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
118 |
return 1; |
209
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
119 |
} |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
120 |
|
682
4a092b834996
openssl: always fill the fingerprint field of LmSSL
Frank Zschockelt <lm@freakysoft.de>
parents:
664
diff
changeset
|
121 |
/* side effect: fills the ssl->fingerprint buffer */ |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
122 |
static gboolean |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
123 |
ssl_verify_certificate (LmSSL *ssl, const gchar *server) |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
124 |
{ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
125 |
gboolean retval = TRUE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
126 |
LmSSLBase *base; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
127 |
long verify_res; |
682
4a092b834996
openssl: always fill the fingerprint field of LmSSL
Frank Zschockelt <lm@freakysoft.de>
parents:
664
diff
changeset
|
128 |
int rc; |
704
d682ae8d7d3a
Deprecate MD5 fingerprints for SHA256
Frank Zschockelt <lm@freakysoft.de>
parents:
702
diff
changeset
|
129 |
const EVP_MD *digest = EVP_sha256(); |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
130 |
unsigned int digest_len; |
704
d682ae8d7d3a
Deprecate MD5 fingerprints for SHA256
Frank Zschockelt <lm@freakysoft.de>
parents:
702
diff
changeset
|
131 |
guchar digest_bin[EVP_MD_size(digest)]; |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
132 |
X509 *srv_crt; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
133 |
gchar *cn; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
134 |
X509_NAME *crt_subj; |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
135 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
136 |
base = LM_SSL_BASE(ssl); |
169
10bcf8e0e443
2006-09-06 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
140
diff
changeset
|
137 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
138 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
139 |
"%s: Cipher: %s/%s/%i\n", |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
140 |
__FILE__, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
141 |
SSL_get_cipher_version(ssl->ssl), |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
142 |
SSL_get_cipher_name(ssl->ssl), |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
143 |
SSL_get_cipher_bits(ssl->ssl, NULL)); |
213
27567fb5d37b
Use g_warning and g_log for warnings and debug printouts in OpenSSL backend.
Mikael Hallendal <micke@imendio.com>
parents:
209
diff
changeset
|
144 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
145 |
verify_res = SSL_get_verify_result(ssl->ssl); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
146 |
srv_crt = SSL_get_peer_certificate(ssl->ssl); |
704
d682ae8d7d3a
Deprecate MD5 fingerprints for SHA256
Frank Zschockelt <lm@freakysoft.de>
parents:
702
diff
changeset
|
147 |
rc = X509_digest(srv_crt, digest, digest_bin, &digest_len); |
689
031cb4db953f
be as precise as possible when handling return values
Frank Zschockelt <lm@freakysoft.de>
parents:
682
diff
changeset
|
148 |
if ((rc != 0) && (digest_len == EVP_MD_size(digest))) { |
704
d682ae8d7d3a
Deprecate MD5 fingerprints for SHA256
Frank Zschockelt <lm@freakysoft.de>
parents:
702
diff
changeset
|
149 |
_lm_ssl_base_set_fingerprint(base, digest_bin, digest_len); |
d682ae8d7d3a
Deprecate MD5 fingerprints for SHA256
Frank Zschockelt <lm@freakysoft.de>
parents:
702
diff
changeset
|
150 |
if (_lm_ssl_base_check_fingerprint(base) != 0) { |
d682ae8d7d3a
Deprecate MD5 fingerprints for SHA256
Frank Zschockelt <lm@freakysoft.de>
parents:
702
diff
changeset
|
151 |
if (base->func(ssl, |
d682ae8d7d3a
Deprecate MD5 fingerprints for SHA256
Frank Zschockelt <lm@freakysoft.de>
parents:
702
diff
changeset
|
152 |
LM_SSL_STATUS_CERT_FINGERPRINT_MISMATCH, |
d682ae8d7d3a
Deprecate MD5 fingerprints for SHA256
Frank Zschockelt <lm@freakysoft.de>
parents:
702
diff
changeset
|
153 |
base->func_data) != LM_SSL_RESPONSE_CONTINUE) { |
d682ae8d7d3a
Deprecate MD5 fingerprints for SHA256
Frank Zschockelt <lm@freakysoft.de>
parents:
702
diff
changeset
|
154 |
return FALSE; |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
155 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
156 |
} |
682
4a092b834996
openssl: always fill the fingerprint field of LmSSL
Frank Zschockelt <lm@freakysoft.de>
parents:
664
diff
changeset
|
157 |
} else { |
4a092b834996
openssl: always fill the fingerprint field of LmSSL
Frank Zschockelt <lm@freakysoft.de>
parents:
664
diff
changeset
|
158 |
if (base->func(ssl, |
4a092b834996
openssl: always fill the fingerprint field of LmSSL
Frank Zschockelt <lm@freakysoft.de>
parents:
664
diff
changeset
|
159 |
LM_SSL_STATUS_GENERIC_ERROR, |
4a092b834996
openssl: always fill the fingerprint field of LmSSL
Frank Zschockelt <lm@freakysoft.de>
parents:
664
diff
changeset
|
160 |
base->func_data) != LM_SSL_RESPONSE_CONTINUE) { |
4a092b834996
openssl: always fill the fingerprint field of LmSSL
Frank Zschockelt <lm@freakysoft.de>
parents:
664
diff
changeset
|
161 |
return FALSE; |
4a092b834996
openssl: always fill the fingerprint field of LmSSL
Frank Zschockelt <lm@freakysoft.de>
parents:
664
diff
changeset
|
162 |
} |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
163 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
164 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
165 |
"%s: SSL_get_verify_result() = %ld\n", |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
166 |
__FILE__, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
167 |
verify_res); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
168 |
switch (verify_res) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
169 |
case X509_V_OK: |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
170 |
break; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
171 |
case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT: |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
172 |
case X509_V_ERR_UNABLE_TO_GET_CRL: |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
173 |
if (base->func(ssl, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
174 |
LM_SSL_STATUS_NO_CERT_FOUND, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
175 |
base->func_data) != LM_SSL_RESPONSE_CONTINUE) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
176 |
retval = FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
177 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
178 |
break; |
645
b6f59df1fbaa
Change mapping of openssl errors to lm ssl errors
Myhailo Danylenko <isbear@ukrpost.net>
parents:
628
diff
changeset
|
179 |
case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: |
b6f59df1fbaa
Change mapping of openssl errors to lm ssl errors
Myhailo Danylenko <isbear@ukrpost.net>
parents:
628
diff
changeset
|
180 |
/* special case for self signed certificates? */ |
b6f59df1fbaa
Change mapping of openssl errors to lm ssl errors
Myhailo Danylenko <isbear@ukrpost.net>
parents:
628
diff
changeset
|
181 |
case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE: |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
182 |
case X509_V_ERR_INVALID_CA: |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
183 |
case X509_V_ERR_CERT_UNTRUSTED: |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
184 |
case X509_V_ERR_CERT_REVOKED: |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
185 |
if (base->func(ssl, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
186 |
LM_SSL_STATUS_UNTRUSTED_CERT, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
187 |
base->func_data) != LM_SSL_RESPONSE_CONTINUE) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
188 |
retval = FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
189 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
190 |
break; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
191 |
case X509_V_ERR_CERT_NOT_YET_VALID: |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
192 |
case X509_V_ERR_CRL_NOT_YET_VALID: |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
193 |
if (base->func(ssl, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
194 |
LM_SSL_STATUS_CERT_NOT_ACTIVATED, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
195 |
base->func_data) != LM_SSL_RESPONSE_CONTINUE) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
196 |
retval = FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
197 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
198 |
break; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
199 |
case X509_V_ERR_CERT_HAS_EXPIRED: |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
200 |
case X509_V_ERR_CRL_HAS_EXPIRED: |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
201 |
if (base->func(ssl, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
202 |
LM_SSL_STATUS_CERT_EXPIRED, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
203 |
base->func_data) != LM_SSL_RESPONSE_CONTINUE) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
204 |
retval = FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
205 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
206 |
break; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
207 |
default: |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
208 |
if (base->func(ssl, LM_SSL_STATUS_GENERIC_ERROR, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
209 |
base->func_data) != LM_SSL_RESPONSE_CONTINUE) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
210 |
retval = FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
211 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
212 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
213 |
/*if (retval == FALSE) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
214 |
g_set_error (error, LM_ERROR, LM_ERROR_CONNECTION_OPEN, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
215 |
ssl_get_x509_err(verify_res), NULL); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
216 |
}*/ |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
217 |
crt_subj = X509_get_subject_name(srv_crt); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
218 |
cn = (gchar *) g_malloc0(LM_SSL_CN_MAX + 1); |
607 | 219 |
|
661
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
220 |
/* FWB: deprecated call, can only get first entry */ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
221 |
if (X509_NAME_get_text_by_NID(crt_subj, NID_commonName, cn, LM_SSL_CN_MAX) > 0) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
222 |
gchar *domain = cn; |
274
c32a7011e435
Adding StartTLS support.
Senko Rasic <senko@phyrexia.(none)>
parents:
269
diff
changeset
|
223 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
224 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
225 |
"%s: server = '%s', cn = '%s'\n", |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
226 |
__FILE__, server, cn); |
607 | 227 |
|
661
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
228 |
if (domain != NULL) { |
274
c32a7011e435
Adding StartTLS support.
Senko Rasic <senko@phyrexia.(none)>
parents:
269
diff
changeset
|
229 |
|
661
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
230 |
if ((cn[0] == '*') && (cn[1] == '.')) { |
664
f57b1b61e1fe
Remove trailing whitespace and mixed indenting
Till Maas <opensource@till.name>
parents:
661
diff
changeset
|
231 |
/* |
661
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
232 |
* FWB: huh? ever tested? |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
233 |
* server="sub.domain.tld"; |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
234 |
* cn="*.domain.tld"; |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
235 |
* domain=strstr(cn, server); ??? |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
236 |
*/ |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
237 |
/* domain = strstr (cn, server); */ |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
238 |
server = strchr(server, '.') + 1; |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
239 |
domain = cn + 2; |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
240 |
} |
664
f57b1b61e1fe
Remove trailing whitespace and mixed indenting
Till Maas <opensource@till.name>
parents:
661
diff
changeset
|
241 |
|
661
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
242 |
if (strncasecmp (server, domain, LM_SSL_CN_MAX) != 0) { |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
243 |
/* FWB: CN doesn't match, try SANs */ |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
244 |
int subject_alt_names_nb = -1; |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
245 |
int san_result = 0; |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
246 |
int san_counter; |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
247 |
STACK_OF(GENERAL_NAME) *subject_alt_names = NULL; |
664
f57b1b61e1fe
Remove trailing whitespace and mixed indenting
Till Maas <opensource@till.name>
parents:
661
diff
changeset
|
248 |
|
661
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
249 |
/* g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, "%s: CN does not match server name\n", __FILE__); */ |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
250 |
// Try to extract the names within the SAN extension from the certificate |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
251 |
subject_alt_names = X509_get_ext_d2i((X509 *) srv_crt, NID_subject_alt_name, NULL, NULL); |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
252 |
if (subject_alt_names != NULL) { |
664
f57b1b61e1fe
Remove trailing whitespace and mixed indenting
Till Maas <opensource@till.name>
parents:
661
diff
changeset
|
253 |
|
661
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
254 |
// Check each name within the extension |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
255 |
subject_alt_names_nb = sk_GENERAL_NAME_num(subject_alt_names); |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
256 |
for (san_counter=0; san_counter<subject_alt_names_nb; san_counter++) { |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
257 |
const GENERAL_NAME *current_name = sk_GENERAL_NAME_value(subject_alt_names, san_counter); |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
258 |
if (current_name->type == GEN_DNS) { |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
259 |
// Current name is a DNS name, let's check it, it's ASCII |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
260 |
if (strcasecmp(server, (char *)current_name->d.dNSName->data) == 0) { |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
261 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, "%s: found SAN '%s' - MATCH\n", __FILE__, current_name->d.dNSName->data); |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
262 |
san_result = 1; /* break; */ |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
263 |
} else { |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
264 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, "%s: found SAN '%s'\n", __FILE__, current_name->d.dNSName->data); |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
265 |
} |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
266 |
} |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
267 |
} |
664
f57b1b61e1fe
Remove trailing whitespace and mixed indenting
Till Maas <opensource@till.name>
parents:
661
diff
changeset
|
268 |
|
661
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
269 |
} |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
270 |
sk_GENERAL_NAME_pop_free(subject_alt_names, GENERAL_NAME_free); |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
271 |
if (!san_result) goto cn_and_san_mismatch; |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
272 |
} /* SAN */ |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
273 |
} else { |
22492003e3f7
CERTs: added checking of SAN(s) when CN does not match; fix CN wildcard handling
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
660
diff
changeset
|
274 |
cn_and_san_mismatch: |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
275 |
if (base->func (ssl, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
276 |
LM_SSL_STATUS_CERT_HOSTNAME_MISMATCH, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
277 |
base->func_data) != LM_SSL_RESPONSE_CONTINUE) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
278 |
retval = FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
279 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
280 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
281 |
} else { |
614
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
282 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, |
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
283 |
"X509_NAME_get_text_by_NID() failed"); |
274
c32a7011e435
Adding StartTLS support.
Senko Rasic <senko@phyrexia.(none)>
parents:
269
diff
changeset
|
284 |
} |
213
27567fb5d37b
Use g_warning and g_log for warnings and debug printouts in OpenSSL backend.
Mikael Hallendal <micke@imendio.com>
parents:
209
diff
changeset
|
285 |
|
607 | 286 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
287 |
"%s:\n\tIssuer: %s\n\tSubject: %s\n\tFor: %s\n", |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
288 |
__FILE__, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
289 |
X509_NAME_oneline(X509_get_issuer_name(srv_crt), NULL, 0), |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
290 |
X509_NAME_oneline(X509_get_subject_name(srv_crt), NULL, 0), |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
291 |
cn); |
213
27567fb5d37b
Use g_warning and g_log for warnings and debug printouts in OpenSSL backend.
Mikael Hallendal <micke@imendio.com>
parents:
209
diff
changeset
|
292 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
293 |
g_free(cn); |
607 | 294 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
295 |
return retval; |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
296 |
} |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
297 |
|
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
298 |
static GIOStatus |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
299 |
ssl_io_status_from_return (LmSSL *ssl, gint ret) |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
300 |
{ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
301 |
gint error; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
302 |
GIOStatus status; |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
303 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
304 |
if (ret > 0) return G_IO_STATUS_NORMAL; |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
305 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
306 |
error = SSL_get_error(ssl->ssl, ret); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
307 |
switch (error) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
308 |
case SSL_ERROR_WANT_READ: |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
309 |
case SSL_ERROR_WANT_WRITE: |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
310 |
status = G_IO_STATUS_AGAIN; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
311 |
break; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
312 |
case SSL_ERROR_ZERO_RETURN: |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
313 |
status = G_IO_STATUS_EOF; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
314 |
break; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
315 |
default: |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
316 |
status = G_IO_STATUS_ERROR; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
317 |
} |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
318 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
319 |
return status; |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
320 |
} |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
321 |
|
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
322 |
/* From lm-ssl-protected.h */ |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
323 |
|
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
324 |
LmSSL * |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
325 |
_lm_ssl_new (const gchar *expected_fingerprint, |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
326 |
LmSSLFunction ssl_function, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
327 |
gpointer user_data, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
328 |
GDestroyNotify notify) |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
329 |
{ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
330 |
LmSSL *ssl; |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
331 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
332 |
ssl = g_new0 (LmSSL, 1); |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
333 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
334 |
_lm_ssl_base_init ((LmSSLBase *) ssl, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
335 |
expected_fingerprint, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
336 |
ssl_function, user_data, notify); |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
337 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
338 |
return ssl; |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
339 |
} |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
340 |
|
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
341 |
void |
607 | 342 |
_lm_ssl_initialize (LmSSL *ssl) |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
343 |
{ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
344 |
static gboolean initialized = FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
345 |
/*const char *cert_file = NULL;*/ |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
346 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
347 |
if (!initialized) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
348 |
SSL_library_init(); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
349 |
/* FIXME: Is this needed when we are not in debug? */ |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
350 |
SSL_load_error_strings(); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
351 |
initialized = TRUE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
352 |
} |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
353 |
|
660
1da5ff42dc1f
activate TLS 1.1 and 1.2; deactivate SSL 2 and 3
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
651
diff
changeset
|
354 |
/* don't use TLSv1_client_method() because otherwise we don't get |
1da5ff42dc1f
activate TLS 1.1 and 1.2; deactivate SSL 2 and 3
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
651
diff
changeset
|
355 |
* connections to TLS1_1 and TLS1_2 only servers |
1da5ff42dc1f
activate TLS 1.1 and 1.2; deactivate SSL 2 and 3
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
651
diff
changeset
|
356 |
*/ |
1da5ff42dc1f
activate TLS 1.1 and 1.2; deactivate SSL 2 and 3
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
651
diff
changeset
|
357 |
ssl->ssl_method = SSLv23_client_method(); |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
358 |
if (ssl->ssl_method == NULL) { |
614
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
359 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, |
660
1da5ff42dc1f
activate TLS 1.1 and 1.2; deactivate SSL 2 and 3
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
651
diff
changeset
|
360 |
"SSLv23_client_method() == NULL"); |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
361 |
abort(); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
362 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
363 |
ssl->ssl_ctx = SSL_CTX_new(ssl->ssl_method); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
364 |
if (ssl->ssl_ctx == NULL) { |
614
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
365 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, "SSL_CTX_new() == NULL"); |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
366 |
abort(); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
367 |
} |
565
87a57a62be8c
Use option NO_TICKET for OpenSSL [#28]
Mikael Hallendal <micke@imendio.com>
parents:
518
diff
changeset
|
368 |
|
607 | 369 |
/* Set the NO_TICKET option on the context to allow for talk to Google Talk |
370 |
* which apparently seems to be having a problem handling empty session |
|
565
87a57a62be8c
Use option NO_TICKET for OpenSSL [#28]
Mikael Hallendal <micke@imendio.com>
parents:
518
diff
changeset
|
371 |
* tickets due to a bug in Java. |
87a57a62be8c
Use option NO_TICKET for OpenSSL [#28]
Mikael Hallendal <micke@imendio.com>
parents:
518
diff
changeset
|
372 |
* |
87a57a62be8c
Use option NO_TICKET for OpenSSL [#28]
Mikael Hallendal <micke@imendio.com>
parents:
518
diff
changeset
|
373 |
* See http://twistedmatrix.com/trac/ticket/3463 and |
87a57a62be8c
Use option NO_TICKET for OpenSSL [#28]
Mikael Hallendal <micke@imendio.com>
parents:
518
diff
changeset
|
374 |
* Loudmouth [#28]. |
87a57a62be8c
Use option NO_TICKET for OpenSSL [#28]
Mikael Hallendal <micke@imendio.com>
parents:
518
diff
changeset
|
375 |
*/ |
660
1da5ff42dc1f
activate TLS 1.1 and 1.2; deactivate SSL 2 and 3
Frank W. Bergmann <loudmouth@tuxad.com>
parents:
651
diff
changeset
|
376 |
SSL_CTX_set_options (ssl->ssl_ctx, (SSL_OP_NO_TICKET | SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3)); |
565
87a57a62be8c
Use option NO_TICKET for OpenSSL [#28]
Mikael Hallendal <micke@imendio.com>
parents:
518
diff
changeset
|
377 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
378 |
/*if (access("/etc/ssl/cert.pem", R_OK) == 0) |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
379 |
cert_file = "/etc/ssl/cert.pem"; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
380 |
if (!SSL_CTX_load_verify_locations(ssl->ssl_ctx, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
381 |
cert_file, "/etc/ssl/certs")) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
382 |
g_warning("SSL_CTX_load_verify_locations() failed"); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
383 |
}*/ |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
384 |
SSL_CTX_set_verify (ssl->ssl_ctx, SSL_VERIFY_PEER, ssl_verify_cb); |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
385 |
} |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
386 |
|
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
387 |
gboolean |
651
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
388 |
_lm_ssl_set_ca (LmSSL *ssl, |
664
f57b1b61e1fe
Remove trailing whitespace and mixed indenting
Till Maas <opensource@till.name>
parents:
661
diff
changeset
|
389 |
const gchar *ca_path) |
651
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
390 |
{ |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
391 |
struct stat target; |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
392 |
int success = 0; |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
393 |
|
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
394 |
if (stat (ca_path, &target) != 0) { |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
395 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, |
664
f57b1b61e1fe
Remove trailing whitespace and mixed indenting
Till Maas <opensource@till.name>
parents:
661
diff
changeset
|
396 |
"ca_path '%s': no such file or directory", ca_path); |
651
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
397 |
return FALSE; |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
398 |
} |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
399 |
|
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
400 |
if (S_ISDIR (target.st_mode)) { |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
401 |
success = SSL_CTX_load_verify_locations(ssl->ssl_ctx, NULL, ca_path); |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
402 |
} else if (S_ISREG (target.st_mode)) { |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
403 |
success = SSL_CTX_load_verify_locations(ssl->ssl_ctx, ca_path, NULL); |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
404 |
} |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
405 |
if (success == 0) { |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
406 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, |
664
f57b1b61e1fe
Remove trailing whitespace and mixed indenting
Till Maas <opensource@till.name>
parents:
661
diff
changeset
|
407 |
"Loading of ca_path '%s' failed: %s", |
f57b1b61e1fe
Remove trailing whitespace and mixed indenting
Till Maas <opensource@till.name>
parents:
661
diff
changeset
|
408 |
ca_path, |
f57b1b61e1fe
Remove trailing whitespace and mixed indenting
Till Maas <opensource@till.name>
parents:
661
diff
changeset
|
409 |
ERR_error_string(ERR_peek_last_error(), NULL)); |
651
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
410 |
return FALSE; |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
411 |
} |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
412 |
|
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
413 |
return TRUE; |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
414 |
} |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
415 |
|
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
416 |
gboolean |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
417 |
_lm_ssl_begin (LmSSL *ssl, gint fd, const gchar *server, GError **error) |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
418 |
{ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
419 |
gint ssl_ret; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
420 |
GIOStatus status; |
650
a51209f570b6
Implemented lm_ssl_set_cipher_list
Frank Zschockelt <lm@freakysoft.de>
parents:
645
diff
changeset
|
421 |
LmSSLBase *base; |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
422 |
|
650
a51209f570b6
Implemented lm_ssl_set_cipher_list
Frank Zschockelt <lm@freakysoft.de>
parents:
645
diff
changeset
|
423 |
base = LM_SSL_BASE(ssl); |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
424 |
if (!ssl->ssl_ctx) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
425 |
g_set_error (error, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
426 |
LM_ERROR, LM_ERROR_CONNECTION_OPEN, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
427 |
"No SSL Context for OpenSSL"); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
428 |
return FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
429 |
} |
309
329900413057
Check to see that the OpenSSL session is setup correctly. Fixes LM-88.
Senko Rasic <senko.rasic@collabora.co.uk>
parents:
301
diff
changeset
|
430 |
|
650
a51209f570b6
Implemented lm_ssl_set_cipher_list
Frank Zschockelt <lm@freakysoft.de>
parents:
645
diff
changeset
|
431 |
if (base->cipher_list) { |
a51209f570b6
Implemented lm_ssl_set_cipher_list
Frank Zschockelt <lm@freakysoft.de>
parents:
645
diff
changeset
|
432 |
SSL_CTX_set_cipher_list(ssl->ssl_ctx, base->cipher_list); |
a51209f570b6
Implemented lm_ssl_set_cipher_list
Frank Zschockelt <lm@freakysoft.de>
parents:
645
diff
changeset
|
433 |
} |
651
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
434 |
if (base->ca_path) { |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
435 |
_lm_ssl_set_ca (ssl, base->ca_path); |
702
75866de0e731
Load system certs only if user doesn't specify trusted certs
Frank Zschockelt <lm@freakysoft.de>
parents:
690
diff
changeset
|
436 |
} else { |
75866de0e731
Load system certs only if user doesn't specify trusted certs
Frank Zschockelt <lm@freakysoft.de>
parents:
690
diff
changeset
|
437 |
SSL_CTX_set_default_verify_paths (ssl->ssl_ctx); |
651
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
438 |
} |
2990ee03cfa3
Implemented lm_ssl_set_ca
Frank Zschockelt <lm@freakysoft.de>
parents:
650
diff
changeset
|
439 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
440 |
ssl->ssl = SSL_new(ssl->ssl_ctx); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
441 |
if (ssl->ssl == NULL) { |
614
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
442 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, "SSL_new() == NULL"); |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
443 |
g_set_error(error, LM_ERROR, LM_ERROR_CONNECTION_OPEN, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
444 |
"SSL_new()"); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
445 |
return FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
446 |
} |
213
27567fb5d37b
Use g_warning and g_log for warnings and debug printouts in OpenSSL backend.
Mikael Hallendal <micke@imendio.com>
parents:
209
diff
changeset
|
447 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
448 |
if (!SSL_set_fd (ssl->ssl, fd)) { |
614
773201ca404c
Replaced every g_warning() with g_log()
Mikael Berthe <mikael@lilotux.net>
parents:
607
diff
changeset
|
449 |
g_log (LM_LOG_DOMAIN, LM_LOG_LEVEL_SSL, "SSL_set_fd() failed"); |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
450 |
g_set_error(error, LM_ERROR, LM_ERROR_CONNECTION_OPEN, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
451 |
"SSL_set_fd()"); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
452 |
return FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
453 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
454 |
/*ssl->bio = BIO_new_socket (fd, BIO_NOCLOSE); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
455 |
if (ssl->bio == NULL) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
456 |
g_warning("BIO_new_socket() failed"); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
457 |
g_set_error(error, LM_ERROR, LM_ERROR_CONNECTION_OPEN, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
458 |
"BIO_new_socket()"); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
459 |
return FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
460 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
461 |
SSL_set_bio(ssl->ssl, ssl->bio, ssl->bio);*/ |
209
1fd5e3004816
Added SSL changes from Senko on SSL branch
Mikael Hallendal <micke@imendio.com>
parents:
169
diff
changeset
|
462 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
463 |
do { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
464 |
ssl_ret = SSL_connect(ssl->ssl); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
465 |
if (ssl_ret <= 0) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
466 |
status = ssl_io_status_from_return(ssl, ssl_ret); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
467 |
if (status != G_IO_STATUS_AGAIN) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
468 |
ssl_print_state(ssl, "SSL_connect", |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
469 |
ssl_ret); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
470 |
g_set_error(error, LM_ERROR, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
471 |
LM_ERROR_CONNECTION_OPEN, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
472 |
"SSL_connect()"); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
473 |
return FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
474 |
} |
139
2d0dcbb757b3
2006-04-18 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
138
diff
changeset
|
475 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
476 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
477 |
} while (ssl_ret <= 0); |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
478 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
479 |
if (!ssl_verify_certificate (ssl, server)) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
480 |
g_set_error (error, LM_ERROR, LM_ERROR_CONNECTION_OPEN, |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
481 |
"*** SSL certificate verification failed"); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
482 |
return FALSE; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
483 |
} |
607 | 484 |
|
485 |
return TRUE; |
|
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
486 |
} |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
487 |
|
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
488 |
GIOStatus |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
489 |
_lm_ssl_read (LmSSL *ssl, gchar *buf, gint len, gsize *bytes_read) |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
490 |
{ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
491 |
GIOStatus status; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
492 |
gint ssl_ret; |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
493 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
494 |
*bytes_read = 0; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
495 |
ssl_ret = SSL_read(ssl->ssl, buf, len); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
496 |
status = ssl_io_status_from_return(ssl, ssl_ret); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
497 |
if (status == G_IO_STATUS_NORMAL) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
498 |
*bytes_read = ssl_ret; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
499 |
} |
607 | 500 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
501 |
return status; |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
502 |
} |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
503 |
|
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
504 |
gint |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
505 |
_lm_ssl_send (LmSSL *ssl, const gchar *str, gint len) |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
506 |
{ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
507 |
GIOStatus status; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
508 |
gint ssl_ret; |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
509 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
510 |
do { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
511 |
ssl_ret = SSL_write(ssl->ssl, str, len); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
512 |
if (ssl_ret <= 0) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
513 |
status = ssl_io_status_from_return(ssl, ssl_ret); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
514 |
if (status != G_IO_STATUS_AGAIN) |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
515 |
return -1; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
516 |
} |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
517 |
} while (ssl_ret <= 0); |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
518 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
519 |
return ssl_ret; |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
520 |
} |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
521 |
|
607 | 522 |
void |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
523 |
_lm_ssl_close (LmSSL *ssl) |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
524 |
{ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
525 |
if (ssl->ssl != NULL) { |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
526 |
SSL_shutdown(ssl->ssl); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
527 |
SSL_free(ssl->ssl); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
528 |
ssl->ssl = NULL; |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
529 |
} |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
530 |
} |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
531 |
|
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
532 |
void |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
533 |
_lm_ssl_free (LmSSL *ssl) |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
534 |
{ |
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
535 |
SSL_CTX_free(ssl->ssl_ctx); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
536 |
ssl->ssl_ctx = NULL; |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
537 |
|
518
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
538 |
_lm_ssl_base_free_fields (LM_SSL_BASE(ssl)); |
cdd6a0c5b439
Went over all of the files and made sure they all were indented the same way.
Mikael Hallendal <micke@imendio.com>
parents:
516
diff
changeset
|
539 |
g_free (ssl); |
138
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
540 |
} |
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
541 |
|
210cf8993393
2006-04-12 Mikael Hallendal <micke@imendio.com>
hallski <hallski>
parents:
diff
changeset
|
542 |
#endif /* HAVE_GNUTLS */ |