comparison libpurple/plugins/ssl/ssl-gnutls.c @ 19212:2c7c934bfb4e

- Fix x509_signed_by. Apparently I can't read documentation.

19211:8b2b9765fe64

x509_certificate_signed_by(PurpleCertificate * crt,
			   PurpleCertificate * issuer)
{
	gnutls_x509_crt_t crt_dat;
	gnutls_x509_crt_t issuer_dat;
	unsigned int verify; /* used to store details from GnuTLS verifier */
	int ret;
	
	/* TODO: Change this error checking? */
	g_return_val_if_fail(crt, FALSE);
	g_return_val_if_fail(issuer, FALSE);

		if (ret < 0) {
			purple_debug_error("gnutls/x509",
					   "GnuTLS error %d while checking certificate issuer match.",
					   ret);
		}

		/* The issuer is not correct, or there were errors */
		return FALSE;
	}

	/* Now, check the signature */
	/* The second argument is a ptr to an array of "trusted" issuer certs,
	   but we're only using one trusted one */
	ret = gnutls_x509_crt_verify(crt_dat, &issuer_dat, 1, 0, &verify);
	
	if (ret > 0) {
		/* The certificate is good. */
		return TRUE;
	}
	else if (ret < 0) {
		purple_debug_error("gnutls/x509",
				   "Attempted certificate verification caused a GnuTLS error code %d. I will just say the signature is bad, but you should look into this.\n", ret);
		return FALSE;
	}
	else {
		/* Signature didn't check out, but at least
		   there were no errors*/
		return FALSE;
	} /* if (ret, etc.) */

	/* Control does not reach this point */
}

static GByteArray *
x509_sha1sum(PurpleCertificate *crt)
{

19212:2c7c934bfb4e

x509_certificate_signed_by(PurpleCertificate * crt,
			   PurpleCertificate * issuer)
{
	gnutls_x509_crt_t crt_dat;
	gnutls_x509_crt_t issuer_dat;
	unsigned int verify; /* used to store result from GnuTLS verifier */
	int ret;
	
	/* TODO: Change this error checking? */
	g_return_val_if_fail(crt, FALSE);
	g_return_val_if_fail(issuer, FALSE);

		if (ret < 0) {
			purple_debug_error("gnutls/x509",
					   "GnuTLS error %d while checking certificate issuer match.",
					   ret);
		} else {
			gchar *crt_id, *issuer_id, *crt_issuer_id;
			crt_id = purple_certificate_get_unique_id(crt);
			issuer_id = purple_certificate_get_unique_id(issuer);
			crt_issuer_id =
				purple_certificate_get_issuer_unique_id(crt);
			purple_debug_info("gnutls/x509",
					  "Certificate for %s claims to be "
					  "issued by %s, but the certificate "
					  "for %s does not match. A strcmp "
					  "says %d\n",
					  crt_id, crt_issuer_id, issuer_id,
					  strcmp(crt_issuer_id, issuer_id));
			g_free(crt_id);
			g_free(issuer_id);
			g_free(crt_issuer_id);
		}

		/* The issuer is not correct, or there were errors */
		return FALSE;
	}

	/* Now, check the signature */
	/* The second argument is a ptr to an array of "trusted" issuer certs,
	   but we're only using one trusted one */
	ret = gnutls_x509_crt_verify(crt_dat, &issuer_dat, 1, 0, &verify);
	
	if (ret != 0) {
		purple_debug_error("gnutls/x509",
				   "Attempted certificate verification caused a GnuTLS error code %d. I will just say the signature is bad, but you should look into this.\n", ret);
		return FALSE;
	}

	if (verify & GNUTLS_CERT_INVALID) {
		/* Signature didn't check out, but at least
		   there were no errors*/
		gchar *crt_id = purple_certificate_get_unique_id(crt);
		gchar *issuer_id = purple_certificate_get_issuer_unique_id(crt);
		purple_debug_info("gnutls/x509",
				  "Bad signature for %s on %s\n",
				  issuer_id, crt_id);
		g_free(crt_id);
		g_free(issuer_id);
		
		return FALSE;
	} /* if (ret, etc.) */

	/* If we got here, the signature is good */
	return TRUE;
}

static GByteArray *
x509_sha1sum(PurpleCertificate *crt)
{