zynk/irssi
2
0
Fork 0
mirror of https://github.com/irssi/irssi.git synced 2026-08-18 16:12:30 +02:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #627 from LemonBoy/ssl-expiry

Browse source 
Check whether the client certificate is expired.
This commit is contained in:
ailin-nemui 2017-02-15 15:49:00 +01:00 • committed by GitHub
commit 540639e0fa
1 changed files with 29 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

36
src/core/network-openssl.c
View file

@ -438,16 +438,38 @@ static GIOChannel *irssi_ssl_get_iochannel(GIOChannel *handle, int port, SERVER_
if (mycert && *mycert) { if (mycert && *mycert) {
char *scert = NULL, *spkey = NULL; char *scert = NULL, *spkey = NULL;
FILE *fp;
scert = convert_home(mycert); scert = convert_home(mycert);
if (mypkey && *mypkey) if (mypkey && *mypkey)
spkey = convert_home(mypkey); spkey = convert_home(mypkey);
ERR_clear_error();
if (! SSL_CTX_use_certificate_file(ctx, scert, SSL_FILETYPE_PEM)) if ((fp = fopen(scert, "r"))) {
g_warning("Loading of client certificate '%s' failed: %s", mycert, ERR_reason_error_string(ERR_get_error())); X509 *cert;
else if (! SSL_CTX_use_PrivateKey_file(ctx, spkey ? spkey : scert, SSL_FILETYPE_PEM)) /* Let's parse the certificate by hand instead of using
g_warning("Loading of private key '%s' failed: %s", mypkey ? mypkey : mycert, ERR_reason_error_string(ERR_get_error())); * SSL_CTX_use_certificate_file so that we can validate
else if (! SSL_CTX_check_private_key(ctx)) * some parts of it. */
g_warning("Private key does not match the certificate"); cert = PEM_read_X509(fp, NULL, get_pem_password_callback, (void *)mypass);
if (cert != NULL) {
/* Only the expiration date is checked right now */
if (X509_cmp_current_time(X509_get_notAfter(cert)) <= 0 ||
X509_cmp_current_time(X509_get_notBefore(cert)) >= 0)
g_warning("The client certificate is expired");
ERR_clear_error();
if (! SSL_CTX_use_certificate(ctx, cert))
g_warning("Loading of client certificate '%s' failed: %s", mycert, ERR_reason_error_string(ERR_get_error()));
else if (! SSL_CTX_use_PrivateKey_file(ctx, spkey ? spkey : scert, SSL_FILETYPE_PEM))
g_warning("Loading of private key '%s' failed: %s", mypkey ? mypkey : mycert, ERR_reason_error_string(ERR_get_error()));
else if (! SSL_CTX_check_private_key(ctx))
g_warning("Private key does not match the certificate");
X509_free(cert);
} else
g_warning("Loading of client certificate '%s' failed: %s", mycert, ERR_reason_error_string(ERR_get_error()));
fclose(fp);
} else
g_warning("Could not find client certificate '%s'", scert);
g_free(scert); g_free(scert);
g_free(spkey); g_free(spkey);
} }