# HG changeset patch # User William Ehlhardt # Date 1180572046 0 # Node ID deb00aacc93c12b30c6dba495af893826eb50fee # Parent 393cf111f36667f58669e79bad2adf31874407b3# Parent 3ce170204ef004716798e27933024cf65e34e11d merge of '03ea20ce538dad585a5a2d40778f242a1fd85a4b' and '04e67ab53da79e8268e027ed9b4423c64c6b86ee' diff -r 393cf111f366 -r deb00aacc93c libpurple/plugins/ssl/ssl-gnutls.c --- a/libpurple/plugins/ssl/ssl-gnutls.c Thu May 31 00:40:36 2007 +0000 +++ b/libpurple/plugins/ssl/ssl-gnutls.c Thu May 31 00:40:46 2007 +0000 @@ -22,7 +22,6 @@ #include "internal.h" #include "debug.h" #include "plugin.h" -#include "request.h" #include "sslconn.h" #include "version.h" #include "util.h" @@ -50,8 +49,8 @@ gnutls_global_init(); gnutls_certificate_allocate_credentials(&xcred); - /*gnutls_certificate_set_x509_trust_file(xcred, "ca.pem", - GNUTLS_X509_FMT_PEM);*/ + gnutls_certificate_set_x509_trust_file(xcred, "ca.pem", + GNUTLS_X509_FMT_PEM); } static gboolean @@ -68,163 +67,6 @@ gnutls_certificate_free_credentials(xcred); } -/** Callback from the dialog in ssl_gnutls_authcheck_ask */ -static void ssl_gnutls_authcheck_cb(PurpleSslConnection * gsc, gint choice) -{ - if (NULL == gsc) - { - purple_debug_error("gnutls","Inappropriate NULL argument at %s:%d\n", - __FILE__, (int) __LINE__); - return; - } - - switch(choice) - { - case 1: /* "Accept" */ - /* TODO: Shoud PURPLE_INPUT_READ be hardcoded? */ - gsc->connect_cb(gsc->connect_cb_data, gsc, PURPLE_INPUT_READ); - break; - - default: /* "Cancel" or otherwise...? */ - purple_debug_info("gnutls", - "User rejected certificate from %s\n", - gsc->host); - if(gsc->error_cb != NULL) - gsc->error_cb(gsc, PURPLE_SSL_PEER_AUTH_FAILED, - gsc->connect_cb_data); - purple_ssl_close(gsc); - } -} - -/** Pop up a dialog asking for verification of the given certificate */ -static void ssl_gnutls_authcheck_ask(PurpleSslConnection * gsc) -{ - PurpleSslGnutlsData *gnutls_data = PURPLE_SSL_GNUTLS_DATA(gsc); - - const gnutls_datum_t *cert_list; - unsigned int cert_list_size = 0; - gnutls_session_t session=gnutls_data->session; - - cert_list = - gnutls_certificate_get_peers(session, &cert_list_size); - - if (0 == cert_list_size || NULL == cert_list) - { - /* Peer provided no certificates at all. - TODO: We should write a witty message here. - */ - gchar * primary = g_strdup_printf - ( - _("Peer %s provided no certificates.\n Connect anyway?"), - gsc->host - ); - - purple_request_accept_cancel - (gsc, - _("SSL Authorization Request"), - primary, - _("The server you are connecting to presented no certificates identifying itself. You have no assurance that you are not connecting to an imposter. Connect anyway?"), - 2, /* Default action is "Cancel" */ - NULL, NULL, /* There is no way to extract account data from - a connection handle, it seems. */ - NULL, /* Same goes for the conversation data */ - gsc, /* Pass connection ptr to callback */ - ssl_gnutls_authcheck_cb, /* Accept */ - ssl_gnutls_authcheck_cb /* Cancel */ - ); - g_free(primary); - } - else - { - /* Grab the first certificate and display some data about it */ - gchar fpr_bin[256]; /* Raw binary key fingerprint */ - gsize fpr_bin_sz = sizeof(fpr_bin); /* Size of above (used later) */ - gchar * fpr_asc = NULL; /* ASCII representation of key fingerprint */ - gchar ser_bin[256]; /* Certificate Serial Number field */ - gsize ser_bin_sz = sizeof(ser_bin); - gchar * ser_asc = NULL; - gchar dn[1024]; /* Certificate Name field */ - gsize dn_sz = sizeof(dn); - /* TODO: Analyze certificate time/date stuff */ - gboolean CERT_OK = TRUE; /* Is the certificate "good"? */ - - gnutls_x509_crt_t cert; /* Certificate data itself */ - - /* Suck the certificate data into the structure */ - gnutls_x509_crt_init(&cert); - gnutls_x509_crt_import (cert, &cert_list[0], - GNUTLS_X509_FMT_DER); - - /* Read key fingerprint */ - gnutls_x509_crt_get_fingerprint(cert, GNUTLS_MAC_SHA, - fpr_bin, &fpr_bin_sz); - fpr_asc = purple_base16_encode_chunked(fpr_bin,fpr_bin_sz); - - /* Read serial number */ - gnutls_x509_crt_get_serial(cert, ser_bin, &ser_bin_sz); - ser_asc = purple_base16_encode_chunked(ser_bin,ser_bin_sz); - - /* Read the certificate DN field */ - gnutls_x509_crt_get_dn(cert, dn, &dn_sz); - - /* TODO: Certificate checking here */ - - - /* Build the dialog */ - { - gchar * primary = NULL; - gchar * secondary = NULL; - - if ( CERT_OK == TRUE ) - { - primary = g_strdup_printf - ( - _("Certificate from %s is valid. Accept?"), - gsc->host - ); - } - else - { - primary = g_strdup_printf - ( - _("Certificate from %s not valid! Accept anyway?"), - gsc->host - ); - } - - secondary = g_strdup_printf - ( - _("Certificate name: %s\nKey fingerprint (SHA1):%s\nSerial Number:%s\nTODO: Expiration dates, etc.\n"), - dn, fpr_asc, ser_asc - ); - - purple_request_accept_cancel - (gsc, - _("SSL Authorization Request"), - primary, - secondary, - (CERT_OK == TRUE ? 1:2), /* Default action depends on certificate - status. */ - NULL, NULL, /* There is no way to extract account data from - a connection handle, it seems. */ - NULL, /* Same goes for the conversation data */ - gsc, /* Pass connection ptr to callback */ - ssl_gnutls_authcheck_cb, /* Accept */ - ssl_gnutls_authcheck_cb /* Cancel */ - ); - - g_free(primary); - g_free(secondary); - } - - - /* Cleanup! */ - g_free(fpr_asc); - g_free(ser_asc); - - gnutls_x509_crt_deinit(cert); - } -} static void ssl_gnutls_handshake_cb(gpointer data, gint source, PurpleInputCondition cond) @@ -254,7 +96,6 @@ } else { purple_debug_info("gnutls", "Handshake complete\n"); - /* Spit some key info to debug */ { const gnutls_datum_t *cert_list; unsigned int cert_list_size = 0; @@ -292,12 +133,12 @@ i, fpr_asc); tsz=sizeof(tbuf); - int ret = gnutls_x509_crt_get_serial(cert,tbuf,&tsz); + gnutls_x509_crt_get_serial(cert,tbuf,&tsz); tasc= purple_base16_encode_chunked(tbuf, tsz); purple_debug_info("gnutls", - "Serial: %s(%d bytes, ret=%d)\n", - tasc, tsz, ret); + "Serial: %s\n", + tasc); g_free(tasc); tsz=sizeof(tbuf); @@ -311,21 +152,12 @@ "Cert Issuer DN: %s\n", tbuf); - tsz=sizeof(tbuf); - gnutls_x509_crt_get_key_id(cert,0, tbuf, &tsz); - tasc = purple_base16_encode_chunked(tbuf, tsz); - purple_debug_info("gnutls", - "Key ID: %s\n", - tasc); - g_free(tasc); - g_free(fpr_asc); fpr_asc = NULL; gnutls_x509_crt_deinit(cert); - } /* for */ + } - } /* End keydata spitting */ - - /* Ask for cert verification */ + } + gsc->connect_cb(gsc->connect_cb_data, gsc, cond); } } diff -r 393cf111f366 -r deb00aacc93c libpurple/sslconn.h --- a/libpurple/sslconn.h Thu May 31 00:40:36 2007 +0000 +++ b/libpurple/sslconn.h Thu May 31 00:40:46 2007 +0000 @@ -32,8 +32,7 @@ typedef enum { PURPLE_SSL_HANDSHAKE_FAILED = 1, - PURPLE_SSL_CONNECT_FAILED = 2, - PURPLE_SSL_PEER_AUTH_FAILED = 3 + PURPLE_SSL_CONNECT_FAILED = 2 } PurpleSslErrorType; typedef struct _PurpleSslConnection PurpleSslConnection;