/[hydra]/hydra/src/ssl.c
ViewVC logotype

Diff of /hydra/src/ssl.c

Parent Directory Parent Directory | Revision Log Revision Log | View Patch Patch

revision 1.7 by nmav, Sat Oct 5 08:32:52 2002 UTC revision 1.8 by nmav, Sat Oct 5 09:39:36 2002 UTC
# Line 44  extern char* ssl_comp; Line 44  extern char* ssl_comp;
44  extern char* ssl_protocol;  extern char* ssl_protocol;
45  extern int ssl_verify; /* 0 no verify, 1 request certificate, and validate  extern int ssl_verify; /* 0 no verify, 1 request certificate, and validate
46                          * if sent, 2 require certificate and validate.                          * if sent, 2 require certificate and validate.
47                            * 3 is request one, and try to verify it. Does not fail in
48                            * any case.
49                          */                          */
50    
51  static void wrap_db_init(void);  static void wrap_db_init(void);
# Line 200  gnutls_session initialize_ssl_session(vo Line 202  gnutls_session initialize_ssl_session(vo
202    
203      gnutls_handshake_set_private_extensions( state, 1);      gnutls_handshake_set_private_extensions( state, 1);
204    
205      if (ssl_verify == 1) {      if (ssl_verify == 1 || ssl_verify == 3) {
206         gnutls_certificate_server_set_request( state, GNUTLS_CERT_REQUEST);         gnutls_certificate_server_set_request( state, GNUTLS_CERT_REQUEST);
207      } else if (ssl_verify == 2) {      } else if (ssl_verify == 2) {
208         gnutls_certificate_server_set_request( state, GNUTLS_CERT_REQUIRE);         gnutls_certificate_server_set_request( state, GNUTLS_CERT_REQUIRE);
# Line 552  int finish_handshake(request * current) Line 554  int finish_handshake(request * current)
554          }          }
555      } else if (retval == 0) {      } else if (retval == 0) {
556                    
557          if (ssl_verify == 2 || ssl_verify == 1) {          if (ssl_verify >= 1) {
558             int verify;             int verify;
559             char name[128];             char name[128];
560             const gnutls_datum *cert_list;             const gnutls_datum *cert_list;
# Line 560  int finish_handshake(request * current) Line 562  int finish_handshake(request * current)
562                        
563    
564             verify = gnutls_certificate_verify_peers( current->ssl_state);             verify = gnutls_certificate_verify_peers( current->ssl_state);
565                         current->certificate_verified = "NONE";
566             if (verify != GNUTLS_E_NO_CERTIFICATE_FOUND || ssl_verify != 1) {  
567               if (verify != GNUTLS_E_NO_CERTIFICATE_FOUND || ssl_verify == 2) {
568                cert_list =                cert_list =
569                  gnutls_certificate_get_peers(current->ssl_state, &cert_list_size);                  gnutls_certificate_get_peers(current->ssl_state, &cert_list_size);
570                                
571                if (cert_list)                if (cert_list)
572                   generate_x509_dn( name, sizeof(name), &cert_list[0]);                   generate_x509_dn( name, sizeof(name), &cert_list[0], 0);
573    
574                log_error_time();                log_error_time();
575                if (verify & GNUTLS_CERT_NOT_TRUSTED || verify & GNUTLS_CERT_INVALID ||                if (verify & GNUTLS_CERT_NOT_TRUSTED || verify & GNUTLS_CERT_INVALID ||
576                   verify & GNUTLS_CERT_CORRUPTED || verify & GNUTLS_CERT_REVOKED)                   verify & GNUTLS_CERT_CORRUPTED || verify & GNUTLS_CERT_REVOKED)
577                {                {
578                   fprintf( stderr, "tls: X.509 Certificate by '%s' is NOT trusted. Rejecting connection.\n", name);                   current->certificate_verified = "FAILED";
579                   current->alert_to_send = GNUTLS_A_BAD_CERTIFICATE;                   fprintf( stderr, "tls: X.509 Certificate by '%s' is NOT trusted.\n", name);
580                   current->status = SEND_ALERT;  
581                   return 1;                   if (ssl_verify == 2 || ssl_verify == 1) {
582                         current->alert_to_send = GNUTLS_A_BAD_CERTIFICATE;
583                         current->status = SEND_ALERT;
584                         return 1;
585                     }
586                  } else {
587                     current->certificate_verified = "SUCCESS";
588                     fprintf( stderr, "tls: X.509 Certificate by '%s' was verified.\n", name);
589                }                }
               fprintf( stderr, "tls: X.509 Certificate by '%s' was verified.\n", name);  
590             }             }
591                    
592          }          }
Legend:
Removed from v.1.7  
changed lines
  Added in v.1.8
webmaster@linux.gr
 ViewVC Help
Powered by ViewVC 1.1.26