devs/libstrophe-gh
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

OpenSSL: Debug certificate chain

Browse Source
This commit is contained in:
James Booth
2015-09-14 00:57:44 +01:00
parent 450bbca8e7
commit 160a124619
1 changed files with 30 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
src/tls_openssl.c
View File

@@ -80,33 +80,54 @@ hex_encode(unsigned char* readbuf, void *writebuf, size_t len)
static xmpp_ctx_t *xmppctx;
static void
print_certificate(X509* cert) {
char subj[1024+1];
char issuer[1024+1];
X509_NAME_oneline(X509_get_subject_name(cert), subj, 1024);
X509_NAME_oneline(X509_get_issuer_name(cert), issuer, 1024);
xmpp_debug(xmppctx, "TLS", "SUBJECT : %s", subj);
xmpp_debug(xmppctx, "TLS", "ISSUER : %s", issuer);
}
static int
verify_callback(int preverify_ok, X509_STORE_CTX *x509_ctx)
{
X509 *cert = X509_STORE_CTX_get_current_cert(x509_ctx);
X509_NAME *issuer = X509_get_issuer_name(cert);
char *nameline = X509_NAME_oneline(issuer, NULL, 0);
xmpp_debug(xmppctx, "TLS", "ISSUER NAME: %s", nameline);
OPENSSL_free(nameline);
const STACK_OF(X509) *sk = X509_STORE_CTX_get1_chain(x509_ctx);
int slen = sk_num((const _STACK *)sk);
unsigned i;
X509 *certsk;
xmpp_debug(xmppctx, "TLS", "STACK");
for(i=0; i<slen; i++) {
certsk = (X509*) sk_value((const _STACK *)sk, i);
print_certificate(certsk);
}
xmpp_debug(xmppctx, "TLS", "ENDSTACK");
X509_NAME *subject = X509_get_subject_name(cert);
nameline = X509_NAME_oneline(subject, NULL, 0);
xmpp_debug(xmppctx, "TLS", "SUBJECT NAME: %s", nameline);
char *nameline = X509_NAME_oneline(subject, NULL, 0);
xmpp_debug(xmppctx, "TLS", "SUBJECT : %s", nameline);
OPENSSL_free(nameline);
X509_NAME *issuer = X509_get_issuer_name(cert);
nameline = X509_NAME_oneline(issuer, NULL, 0);
xmpp_debug(xmppctx, "TLS", "ISSUER : %s", nameline);
OPENSSL_free(nameline);
ASN1_TIME *not_before = X509_get_notBefore(cert);
char not_before_str[128];
int not_before_res = convert_ASN1TIME(not_before, not_before_str, 128);
if (not_before_res) {
xmpp_debug(xmppctx, "TLS", "NOT BEFORE: %s", not_before_str);
xmpp_debug(xmppctx, "TLS", "NOT BEFORE : %s", not_before_str);
}
ASN1_TIME *not_after = X509_get_notAfter(cert);
char not_after_str[128];
int not_after_res = convert_ASN1TIME(not_after, not_after_str, 128);
if (not_after_res) {
xmpp_debug(xmppctx, "TLS", "NOT AFTER: %s", not_after_str);
xmpp_debug(xmppctx, "TLS", "NOT AFTER : %s", not_after_str);
}
char buf[20];
@@ -117,7 +138,7 @@ verify_callback(int preverify_ok, X509_STORE_CTX *x509_ctx)
if (rc != 0 && len == 20) {
char strbuf[2*20+1];
hex_encode(buf, strbuf, 20);
xmpp_debug(xmppctx, "TLS", "FINGERPRINT: %s", strbuf);
xmpp_debug(xmppctx, "TLS", "FINGERPRINT : %s", strbuf);
}
if (preverify_ok) {
@@ -150,7 +171,6 @@ tls_t *tls_new(xmpp_ctx_t *ctx, sock_t sock)
SSL_CTX_set_client_cert_cb(tls->ssl_ctx, NULL);
SSL_CTX_set_mode (tls->ssl_ctx, SSL_MODE_ENABLE_PARTIAL_WRITE);
SSL_CTX_set_verify (tls->ssl_ctx, SSL_VERIFY_PEER, verify_callback);
tls->ssl = SSL_new(tls->ssl_ctx);
ret = SSL_set_fd(tls->ssl, sock);