Changeset 486ddb5 for protocols

Timestamp:

2011-12-19T14:50:58Z (13 years ago)

Author:

Wilmer van der Gaast <wilmer@…>

Branches:

master

Children:

78b8401

Parents:

5a48afd

Message:

Initial merge of tls_verify patch from AopicieR.

Location:

protocols

Files:

• jabber/io.c (modified) (4 diffs)
• jabber/jabber.c (modified) (1 diff)
• jabber/jabber.h (modified) (1 diff)
• skype/skype.c (modified) (1 diff)

protocols/jabber/io.c

@@ -276 +276 @@
 }
 
-gboolean jabber_connected_ssl( gpointer data, void *source, b_input_condition cond )
+gboolean jabber_connected_ssl( gpointer data, int returncode, void *source, b_input_condition cond )
 {
         struct im_connection *ic = data;
@@ -293 +293 @@
                 
                 imcb_error( ic, "Could not connect to server" );
+                if (returncode ==  OPENSSL_VERIFY_ERROR )
+                {
+                        imcb_error( ic, "This BitlBee server is built agains the OpenSSL library." );
+                        imcb_error( ic, "Unfortunately certificate verification is only supported when built against GnuTLS for now." );
+                        imc_logout( ic, FALSE );
+                }
+                else if (returncode ==  NSS_VERIFY_ERROR )
+                {
+                        imcb_error( ic, "This BitlBee server is built agains the NSS library." );
+                        imcb_error( ic, "Unfortunately certificate verification is only supported when built against GnuTLS for now." );
+                        imc_logout( ic, FALSE );
+                }
+                else if (returncode == VERIFY_CERT_ERROR )
+                {
+                        imcb_error( ic, "An error occured during the certificate verification." );
+                        imc_logout( ic, FALSE );
+                }
+                else if (returncode  & VERIFY_CERT_INVALID)
+                {
+                        imcb_error( ic, "Unable to verify peer's certificate." );
+                        if (returncode & VERIFY_CERT_REVOKED)
+                                imcb_error( ic, "The certificate has been revoked." );
+                        if (returncode & VERIFY_CERT_SIGNER_NOT_FOUND)
+                                imcb_error( ic, "The certificate hasn't got a known issuer." );
+                        if (returncode & VERIFY_CERT_SIGNER_NOT_CA)
+                                imcb_error( ic, "The certificate's issuer is not a CA." );
+                        if (returncode & VERIFY_CERT_INSECURE_ALGORITHM)
+                                imcb_error( ic, "The certificate uses an insecure algorithm." );
+                        if (returncode & VERIFY_CERT_NOT_ACTIVATED)
+                                imcb_error( ic, "The certificate has not been activated." );
+                        if (returncode & VERIFY_CERT_EXPIRED)
+                                imcb_error( ic, "The certificate has expired." );
+                        if (returncode & VERIFY_CERT_WRONG_HOSTNAME)
+                                imcb_error( ic, "The hostname specified in the certificate doesn't match the server name." );
+                        imc_logout( ic, FALSE );
+                }
+                else
                 imc_logout( ic, TRUE );
                 return FALSE;
@@ -397 +434 @@
         struct im_connection *ic = data;
         struct jabber_data *jd = ic->proto_data;
-        char *xmlns;
+        char *xmlns, *tlsname;
         
         xmlns = xt_find_attr( node, "xmlns" );
@@ -423 +460 @@
         
         jd->flags |= JFLAG_STARTTLS_DONE;
-        jd->ssl = ssl_starttls( jd->fd, jabber_connected_ssl, ic );
+
+        /* If the user specified a server for the account, use this server as the 
+         * hostname in the certificate verification. Else we use the domain from 
+         * the username. */
+        if( ic->acc->server && *ic->acc->server )
+                tlsname = ic->acc->server;
+        else
+                tlsname = jd->server;
+        
+        jd->ssl = ssl_starttls( jd->fd, tlsname, set_getbool( &ic->acc->set, "tls_verify" ),
+                                jabber_connected_ssl, ic );
         
         return XT_HANDLED;

protocols/jabber/jabber.c

@@ -80 +80 @@
         
         s = set_add( &acc->set, "tls", "try", set_eval_tls, acc );
+        s->flags |= ACC_SET_OFFLINE_ONLY;
+        
+        s = set_add( &acc->set, "tls_verify", "true", set_eval_bool, acc );
         s->flags |= ACC_SET_OFFLINE_ONLY;
         

protocols/jabber/jabber.h

@@ -307 +307 @@
 int jabber_write( struct im_connection *ic, char *buf, int len );
 gboolean jabber_connected_plain( gpointer data, gint source, b_input_condition cond );
-gboolean jabber_connected_ssl( gpointer data, void *source, b_input_condition cond );
+gboolean jabber_connected_ssl( gpointer data, int returncode, void *source, b_input_condition cond );
 gboolean jabber_start_stream( struct im_connection *ic );
 void jabber_end_stream( struct im_connection *ic );

protocols/skype/skype.c

@@ -1157 +1157 @@
 }
 
-gboolean skype_connected(gpointer data, void *source, b_input_condition cond)
+gboolean skype_connected(gpointer data, int returncode, void *source, b_input_condition cond)
 {
         struct im_connection *ic = data;