Changeset 200e151

Timestamp:

2011-12-23T22:40:17Z (13 years ago)

Author:

Wilmer van der Gaast <wilmer@…>

Branches:

master

Children:

5513f3e

Parents:

792a93b

Message:

tls_verify correction: Don't fail cert verification in non-GnuTLS modules
unless "cafile" setting is enabled.

Location:

lib

Files:

• ssl_client.h (modified) (1 diff)
• ssl_nss.c (modified) (2 diffs)
• ssl_openssl.c (modified) (2 diffs)

lib/ssl_client.h

@@ -37 +37 @@
 /* Some generic error codes. Especially SSL_AGAIN is important if you
    want to do asynchronous I/O. */
-#define NSS_VERIFY_ERROR -2
-#define OPENSSL_VERIFY_ERROR -1
 #define SSL_OK            0
 #define SSL_NOHANDSHAKE   1

lib/ssl_nss.c

@@ -140 +140 @@
         conn->func = func;
         conn->data = data;
-        conn->verify = verify;
+        conn->verify = verify && global.conf->cafile;
 
         /* This function should be called via a (short) timeout instead of
@@ -160 +160 @@
         struct scd *conn = data;
         
-        /* Right now we don't have any verification functionality for nss so we 
-           fail in case verification has been requested by the user. */
+        /* Right now we don't have any verification functionality for NSS. */
 
         if( conn->verify )
         {
-                conn->func( conn->data, NSS_VERIFY_ERROR, NULL, cond );
+                conn->func( conn->data, 1, NULL, cond );
                 if( source >= 0 ) closesocket( source );
                 g_free( conn );

lib/ssl_openssl.c

@@ -91 +91 @@
         conn->data = data;
         conn->inpa = -1;
-        conn->verify = verify;
+        conn->verify = verify && global.conf->cafile;
         
         /* This function should be called via a (short) timeout instead of
@@ -119 +119 @@
         SSL_METHOD *meth;
         
-        /* Right now we don't have any verification functionality for openssl so we 
-           fail in case verification has been requested by the user. */
+        /* Right now we don't have any verification functionality for OpenSSL. */
 
         if( conn->verify )
         {
-                conn->func( conn->data, OPENSSL_VERIFY_ERROR, NULL, cond );
+                conn->func( conn->data, 1, NULL, cond );
                 if( source >= 0 ) closesocket( source );
                 g_free( conn );