devs/libstrophe-gh
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

conn: add flag XMPP_CONN_FLAG_TRUST_TLS

Browse Source 
TLS modules accept invalid server's certificates when the flag is set.
This commit is contained in:
Dmitry Podgorny
2017-07-04 17:20:33 +03:00
parent c319ee6583
commit 9269d6b0d5
4 changed files with 18 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/common.h
View File

@@ -168,6 +168,7 @@ struct _xmpp_conn_t {
int tls_disabled; int tls_disabled;
int tls_mandatory; int tls_mandatory;
int tls_legacy_ssl; int tls_legacy_ssl;
int tls_trust;
int tls_failed; /* set when tls fails, so we don't try again */ int tls_failed; /* set when tls fails, so we don't try again */
int sasl_support; /* if true, field is a bitfield of supported int sasl_support; /* if true, field is a bitfield of supported
mechanisms */ mechanisms */

9
src/conn.c
View File

@@ -128,6 +128,7 @@ xmpp_conn_t *xmpp_conn_new(xmpp_ctx_t * const ctx)
conn->tls_disabled = 0; conn->tls_disabled = 0;
conn->tls_mandatory = 0; conn->tls_mandatory = 0;
conn->tls_legacy_ssl = 0; conn->tls_legacy_ssl = 0;
conn->tls_trust = 0;
conn->tls_failed = 0; conn->tls_failed = 0;
conn->sasl_support = 0; conn->sasl_support = 0;
conn->secured = 0; conn->secured = 0;
@@ -911,7 +912,8 @@ long xmpp_conn_get_flags(const xmpp_conn_t * const conn)
flags = XMPP_CONN_FLAG_DISABLE_TLS * conn->tls_disabled | flags = XMPP_CONN_FLAG_DISABLE_TLS * conn->tls_disabled |
XMPP_CONN_FLAG_MANDATORY_TLS * conn->tls_mandatory | XMPP_CONN_FLAG_MANDATORY_TLS * conn->tls_mandatory |
XMPP_CONN_FLAG_LEGACY_SSL * conn->tls_legacy_ssl; XMPP_CONN_FLAG_LEGACY_SSL * conn->tls_legacy_ssl |
XMPP_CONN_FLAG_TRUST_TLS * conn->tls_trust;
return flags; return flags;
} }
@@ -928,6 +930,7 @@ long xmpp_conn_get_flags(const xmpp_conn_t * const conn)
* - XMPP_CONN_FLAG_DISABLE_TLS * - XMPP_CONN_FLAG_DISABLE_TLS
* - XMPP_CONN_FLAG_MANDATORY_TLS * - XMPP_CONN_FLAG_MANDATORY_TLS
* - XMPP_CONN_FLAG_LEGACY_SSL * - XMPP_CONN_FLAG_LEGACY_SSL
* - XMPP_CONN_FLAG_TRUST_TLS
* *
* @param conn a Strophe connection object * @param conn a Strophe connection object
* @param flags ORed connection flags * @param flags ORed connection flags
@@ -944,7 +947,8 @@ int xmpp_conn_set_flags(xmpp_conn_t * const conn, long flags)
return XMPP_EINVOP; return XMPP_EINVOP;
} }
if (flags & XMPP_CONN_FLAG_DISABLE_TLS && if (flags & XMPP_CONN_FLAG_DISABLE_TLS &&
flags & (XMPP_CONN_FLAG_MANDATORY_TLS | XMPP_CONN_FLAG_LEGACY_SSL)) { flags & (XMPP_CONN_FLAG_MANDATORY_TLS | XMPP_CONN_FLAG_LEGACY_SSL |
XMPP_CONN_FLAG_TRUST_TLS)) {
xmpp_error(conn->ctx, "conn", "Flags 0x%04lx conflict", flags); xmpp_error(conn->ctx, "conn", "Flags 0x%04lx conflict", flags);
return XMPP_EINVOP; return XMPP_EINVOP;
} }
@@ -952,6 +956,7 @@ int xmpp_conn_set_flags(xmpp_conn_t * const conn, long flags)
conn->tls_disabled = (flags & XMPP_CONN_FLAG_DISABLE_TLS) ? 1 : 0; conn->tls_disabled = (flags & XMPP_CONN_FLAG_DISABLE_TLS) ? 1 : 0;
conn->tls_mandatory = (flags & XMPP_CONN_FLAG_MANDATORY_TLS) ? 1 : 0; conn->tls_mandatory = (flags & XMPP_CONN_FLAG_MANDATORY_TLS) ? 1 : 0;
conn->tls_legacy_ssl = (flags & XMPP_CONN_FLAG_LEGACY_SSL) ? 1 : 0; conn->tls_legacy_ssl = (flags & XMPP_CONN_FLAG_LEGACY_SSL) ? 1 : 0;
conn->tls_trust = (flags & XMPP_CONN_FLAG_TRUST_TLS) ? 1 : 0;
return 0; return 0;
} }

8
src/tls_openssl.c
View File

@@ -75,6 +75,7 @@ int tls_error(tls_t *tls)
tls_t *tls_new(xmpp_conn_t *conn) tls_t *tls_new(xmpp_conn_t *conn)
{ {
tls_t *tls = xmpp_alloc(conn->ctx, sizeof(*tls)); tls_t *tls = xmpp_alloc(conn->ctx, sizeof(*tls));
int mode;
if (tls) { if (tls) {
int ret; int ret;
@@ -86,7 +87,8 @@ tls_t *tls_new(xmpp_conn_t *conn)
if (tls->ssl_ctx == NULL) if (tls->ssl_ctx == NULL)
goto err; goto err;
SSL_CTX_set_options(tls->ssl_ctx, SSL_OP_ALL); /* Enable bug workarounds. */ /* Enable bug workarounds. */
SSL_CTX_set_options(tls->ssl_ctx, SSL_OP_ALL);
/* Disable insecure SSL/TLS versions. */ /* Disable insecure SSL/TLS versions. */
SSL_CTX_set_options(tls->ssl_ctx, SSL_OP_NO_SSLv2); /* DROWN */ SSL_CTX_set_options(tls->ssl_ctx, SSL_OP_NO_SSLv2); /* DROWN */
@@ -101,7 +103,9 @@ tls_t *tls_new(xmpp_conn_t *conn)
if (tls->ssl == NULL) if (tls->ssl == NULL)
goto err_free_ctx; goto err_free_ctx;
SSL_set_verify(tls->ssl, SSL_VERIFY_PEER, 0); /* Trust server's certificate when user sets the flag explicitly. */
mode = conn->tls_trust ? SSL_VERIFY_NONE : SSL_VERIFY_PEER;
SSL_set_verify(tls->ssl, mode, 0);
#if OPENSSL_VERSION_NUMBER >= 0x10002000L #if OPENSSL_VERSION_NUMBER >= 0x10002000L
/* Hostname verification is supported in OpenSSL 1.0.2 and newer. */ /* Hostname verification is supported in OpenSSL 1.0.2 and newer. */
X509_VERIFY_PARAM *param = SSL_get0_param(tls->ssl); X509_VERIFY_PARAM *param = SSL_get0_param(tls->ssl);

4
strophe.h
View File

@@ -166,6 +166,10 @@ typedef struct _xmpp_stanza_t xmpp_stanza_t;
#define XMPP_CONN_FLAG_DISABLE_TLS (1UL << 0) #define XMPP_CONN_FLAG_DISABLE_TLS (1UL << 0)
#define XMPP_CONN_FLAG_MANDATORY_TLS (1UL << 1) #define XMPP_CONN_FLAG_MANDATORY_TLS (1UL << 1)
#define XMPP_CONN_FLAG_LEGACY_SSL (1UL << 2) #define XMPP_CONN_FLAG_LEGACY_SSL (1UL << 2)
/** @def XMPP_CONN_FLAG_TRUST_TLS
* Trust server's certificate even if it is invalid.
*/
#define XMPP_CONN_FLAG_TRUST_TLS (1UL << 3)
/* connect callback */ /* connect callback */
typedef enum { typedef enum {