devs/libstrophe-gh
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tls/openssl: enable cert verification for openssl older then 1.0.2

Browse Source 
TODO: add flag to trust certificate even if verification fails.
This commit is contained in:
Dmitry Podgorny
2017-07-01 15:51:49 +03:00
parent cc297eff45
commit cc53012cfa
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/tls_openssl.c
View File

@@ -101,8 +101,9 @@ tls_t *tls_new(xmpp_conn_t *conn)
if (tls->ssl == NULL) if (tls->ssl == NULL)
goto err_free_ctx; goto err_free_ctx;
#if OPENSSL_VERSION_NUMBER >= 0x10002000L
SSL_set_verify(tls->ssl, SSL_VERIFY_PEER, 0); SSL_set_verify(tls->ssl, SSL_VERIFY_PEER, 0);
#if OPENSSL_VERSION_NUMBER >= 0x10002000L
/* Hostname verification is supported in OpenSSL 1.0.2 and newer. */
X509_VERIFY_PARAM *param = SSL_get0_param(tls->ssl); X509_VERIFY_PARAM *param = SSL_get0_param(tls->ssl);
/* /*
@@ -113,9 +114,6 @@ tls_t *tls_new(xmpp_conn_t *conn)
*/ */
X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS); X509_VERIFY_PARAM_set_hostflags(param, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
X509_VERIFY_PARAM_set1_host(param, conn->domain, 0); X509_VERIFY_PARAM_set1_host(param, conn->domain, 0);
#else
/* Hostname verification is not supported before OpenSSL 1.0.2. */
SSL_set_verify(tls->ssl, SSL_VERIFY_NONE, 0);
#endif #endif
ret = SSL_set_fd(tls->ssl, conn->sock); ret = SSL_set_fd(tls->ssl, conn->sock);
@@ -151,6 +149,7 @@ int tls_start(tls_t *tls)
{ {
int error; int error;
int ret; int ret;
long x509_res;
/* Since we're non-blocking, loop the connect call until it /* Since we're non-blocking, loop the connect call until it
succeeds or fails */ succeeds or fails */
@@ -167,8 +166,12 @@ int tls_start(tls_t *tls)
/* success or fatal error */ /* success or fatal error */
break; break;
} }
_tls_set_error(tls, error);
x509_res = SSL_get_verify_result(tls->ssl);
xmpp_debug(tls->ctx, "tls", "Certificate verification %s",
x509_res == X509_V_OK ? "passed" : "FAILED");
_tls_set_error(tls, error);
return ret <= 0 ? 0 : 1; return ret <= 0 ? 0 : 1;
} }