comparison libpurple/certificate.c @ 19090:5310b1294287

- Add HOSTNAME CHECKING to tls_cached unknown_peer mode, which is kind of important, I'd say. This is all still untested.

19089:c8962b52579e

/* For when we've never communicated with this party before */
static void
x509_tls_cached_unknown_peer(PurpleCertificateVerificationRequest *vrq)
{
	PurpleCertificatePool *ca, *tls_peers;
	PurpleCertificate *end_crt, *ca_crt;
	GList *chain = vrq->cert_chain;
	GList *last;
	gchar *ca_id;

	/* First, check that the certificate chain is valid */
	if ( ! purple_certificate_check_signature_chain(chain) ) {
		/* TODO: Tell the user where the chain broke? */
		/* TODO: This error will hopelessly confuse any
		   non-elite user. */
		gchar *secondary;

	/* Look up the local cache and store it there for future use */
	tls_peers = purple_certificate_find_pool(x509_tls_cached.scheme_name,
						 "tls_peers");

	if (tls_peers) {
		PurpleCertificate *peer_crt = (PurpleCertificate *)chain->data;
		g_assert(purple_certificate_pool_store(tls_peers,
						       vrq->subject_name,
						       peer_crt) );
	} else {
		purple_debug_error("certificate/x509/tls_cached",

19090:5310b1294287

/* For when we've never communicated with this party before */
static void
x509_tls_cached_unknown_peer(PurpleCertificateVerificationRequest *vrq)
{
	PurpleCertificatePool *ca, *tls_peers;
	PurpleCertificate *end_crt, *ca_crt, *peer_crt;
	GList *chain = vrq->cert_chain;
	GList *last;
	gchar *ca_id;

	peer_crt = (PurpleCertificate *) chain->data;

	/* First, check that the hostname matches */
	if ( ! purple_certificate_check_subject_name(peer_crt,
						     vrq->subject_name) ) {
		gchar *sn = purple_certificate_get_subject_name(peer_crt);
		
		purple_debug_info("certificate/x509/tls_cached",
				  "Name mismatch: Certificate given for %s "
				  "has a name of %s\n",
				  vrq->subject_name, sn);
		g_free(sn);

		/* Prompt the user to authenticate the certificate */
		/* TODO: Provide the user with more guidance about why he is
		   being prompted */
		/* vrq will be completed by user_auth */
		x509_tls_cached_user_auth(vrq);
		return;
	} /* if (name mismatch) */

			
	
	/* Next, check that the certificate chain is valid */
	if ( ! purple_certificate_check_signature_chain(chain) ) {
		/* TODO: Tell the user where the chain broke? */
		/* TODO: This error will hopelessly confuse any
		   non-elite user. */
		gchar *secondary;

	/* Look up the local cache and store it there for future use */
	tls_peers = purple_certificate_find_pool(x509_tls_cached.scheme_name,
						 "tls_peers");

	if (tls_peers) {
		g_assert(purple_certificate_pool_store(tls_peers,
						       vrq->subject_name,
						       peer_crt) );
	} else {
		purple_debug_error("certificate/x509/tls_cached",