diff options
| author | TingPing <tingping@tingping.se> | 2014-11-19 21:43:01 -0500 |
|---|---|---|
| committer | TingPing <tingping@tingping.se> | 2014-11-21 23:19:30 -0500 |
| commit | c9b63f7f9be01692b03fa15275135a4910a7e02d (patch) | |
| tree | 540e8b3ecc477a13b0557d344fbb87ca9fbd57e6 /src/common/server.c | |
| parent | ebaaf466bf42aec26f05e71f06c39a0b19e32e77 (diff) | |
ssl: Validate hostnames
Closes #524
Diffstat (limited to 'src/common/server.c')
| -rw-r--r-- | src/common/server.c | 16 |
1 files changed, 15 insertions, 1 deletions
diff --git a/src/common/server.c b/src/common/server.c index 8603f138..6432a2b9 100644 --- a/src/common/server.c +++ b/src/common/server.c @@ -723,9 +723,22 @@ ssl_do_connect (server * serv) switch (verify_error) { case X509_V_OK: + { + X509 *cert = SSL_get_peer_certificate (serv->ssl); + int hostname_err; + if ((hostname_err = _SSL_check_hostname(cert, serv->hostname)) != 0) + { + snprintf (buf, sizeof (buf), "* Verify E: Failed to validate hostname? (%d)%s", + hostname_err, serv->accept_invalid_cert ? " -- Ignored" : ""); + if (serv->accept_invalid_cert) + EMIT_SIGNAL (XP_TE_SSLMESSAGE, serv->server_session, buf, NULL, NULL, NULL, 0); + else + goto conn_fail; + } + break; + } /* snprintf (buf, sizeof (buf), "* Verify OK (?)"); */ /* EMIT_SIGNAL (XP_TE_SSLMESSAGE, serv->server_session, buf, NULL, NULL, NULL, 0); */ - break; case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY: case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE: case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT: @@ -744,6 +757,7 @@ ssl_do_connect (server * serv) snprintf (buf, sizeof (buf), "%s.? (%d)", X509_verify_cert_error_string (verify_error), verify_error); +conn_fail: EMIT_SIGNAL (XP_TE_CONNFAIL, serv->server_session, buf, NULL, NULL, NULL, 0); |