comparison libpurple/certificate.c @ 27567:199cf148cdf8

Continue verification when we can't find a *cached* peer. Fixes #9664. This should be a fatal condition and not finding a cached certificate is *not* the same as "the certificate changed".

27566:d677981cf97e

	/* Cleanup */
	g_free(primary);
}

static void
x509_tls_cached_peer_cert_changed(PurpleCertificateVerificationRequest *vrq)
{
	/* TODO: Prompt the user, etc. */

	purple_debug_info("certificate/x509/tls_cached",
			  "Certificate for %s does not match cached. "
			  "Auto-rejecting!\n",
			  vrq->subject_name);

	purple_certificate_verify_complete(vrq, PURPLE_CERTIFICATE_INVALID);
	return;
}

static void
x509_tls_cached_unknown_peer(PurpleCertificateVerificationRequest *vrq);

static void
x509_tls_cached_cert_in_cache(PurpleCertificateVerificationRequest *vrq)
{

	/* Load up the cached certificate */
	cached_crt = purple_certificate_pool_retrieve(
		tls_peers, vrq->subject_name);
	if ( !cached_crt ) {
		purple_debug_error("certificate/x509/tls_cached",
				   "Lookup failed on cached certificate!\n"
				   "It was here just a second ago. Forwarding "
				   "to cert_changed.\n");
		/* vrq now becomes the problem of cert_changed */
		x509_tls_cached_peer_cert_changed(vrq);
		return;
	}

	/* Now get SHA1 sums for both and compare them */
	/* TODO: This is not an elegant way to compare certs */

27567:199cf148cdf8

	/* Cleanup */
	g_free(primary);
}

static void
x509_tls_cached_unknown_peer(PurpleCertificateVerificationRequest *vrq);

static void
x509_tls_cached_cert_in_cache(PurpleCertificateVerificationRequest *vrq)
{

	/* Load up the cached certificate */
	cached_crt = purple_certificate_pool_retrieve(
		tls_peers, vrq->subject_name);
	if ( !cached_crt ) {
		purple_debug_warning("certificate/x509/tls_cached",
				   "Lookup failed on cached certificate!\n"
				   "Falling back to full verification.\n");
		/* vrq now becomes the problem of unknown_peer */
		x509_tls_cached_unknown_peer(vrq);
		return;
	}

	/* Now get SHA1 sums for both and compare them */
	/* TODO: This is not an elegant way to compare certs */