Merging SSL certificate verification for GnuTLS, with help from AopicieR.

3 files changed, 32 insertions, 7 deletions

diff --git a/protocols/jabber/io.c b/protocols/jabber/io.c
index d3383375..385c45c4 100644
--- a/protocols/jabber/io.c
+++ b/protocols/jabber/io.c
@@ -278,7 +278,7 @@ gboolean jabber_connected_plain( gpointer data, gint source, b_input_condition c
 	return jabber_start_stream( ic );
 }
 
-gboolean jabber_connected_ssl( gpointer data, void *source, b_input_condition cond )
+gboolean jabber_connected_ssl( gpointer data, int returncode, void *source, b_input_condition cond )
 {
 	struct im_connection *ic = data;
 	struct jabber_data *jd;
@@ -294,8 +294,20 @@ gboolean jabber_connected_ssl( gpointer data, void *source, b_input_condition co
 		   already, set it to NULL here to prevent a double cleanup: */
 		jd->ssl = NULL;
 		
-		imcb_error( ic, "Could not connect to server" );
-		imc_logout( ic, TRUE );
+		if( returncode != 0 )
+		{
+			char *err = ssl_verify_strerror( returncode );
+			imcb_error( ic, "Certificate verification problem 0x%x: %s",
+			            returncode, err ? err : "Unknown" );
+			g_free( err );
+			imc_logout( ic, FALSE );
+		}
+		else
+		{
+			imcb_error( ic, "Could not connect to server" );
+			imc_logout( ic, TRUE );
+		}
+		
 		return FALSE;
 	}
 	
@@ -399,7 +411,7 @@ static xt_status jabber_pkt_proceed_tls( struct xt_node *node, gpointer data )
 {
 	struct im_connection *ic = data;
 	struct jabber_data *jd = ic->proto_data;
-	char *xmlns;
+	char *xmlns, *tlsname;
 	
 	xmlns = xt_find_attr( node, "xmlns" );
 	
@@ -425,7 +437,17 @@ static xt_status jabber_pkt_proceed_tls( struct xt_node *node, gpointer data )
 	imcb_log( ic, "Converting stream to TLS" );
 	
 	jd->flags |= JFLAG_STARTTLS_DONE;
-	jd->ssl = ssl_starttls( jd->fd, jabber_connected_ssl, ic );
+
+	/* If the user specified a server for the account, use this server as the 
+	 * hostname in the certificate verification. Else we use the domain from 
+	 * the username. */
+	if( ic->acc->server && *ic->acc->server )
+		tlsname = ic->acc->server;
+	else
+		tlsname = jd->server;
+	
+	jd->ssl = ssl_starttls( jd->fd, tlsname, set_getbool( &ic->acc->set, "tls_verify" ),
+	                        jabber_connected_ssl, ic );
 	
 	return XT_HANDLED;
 }
diff --git a/protocols/jabber/jabber.c b/protocols/jabber/jabber.c
index fae55ffe..2856f1b6 100644
--- a/protocols/jabber/jabber.c
+++ b/protocols/jabber/jabber.c
@@ -81,6 +81,9 @@ static void jabber_init( account_t *acc )
 	s = set_add( &acc->set, "tls", "try", set_eval_tls, acc );
 	s->flags |= ACC_SET_OFFLINE_ONLY;
 	
+	s = set_add( &acc->set, "tls_verify", "true", set_eval_bool, acc );
+	s->flags |= ACC_SET_OFFLINE_ONLY;
+	
 	s = set_add( &acc->set, "sasl", "true", set_eval_bool, acc );
 	s->flags |= ACC_SET_OFFLINE_ONLY | SET_HIDDEN_DEFAULT;
 
@@ -232,7 +235,7 @@ static void jabber_login( account_t *acc )
 	   non-standard ports... */
 	if( set_getbool( &acc->set, "ssl" ) )
 	{
-		jd->ssl = ssl_connect( connect_to, set_getint( &acc->set, "port" ), jabber_connected_ssl, ic );
+		jd->ssl = ssl_connect( connect_to, set_getint( &acc->set, "port" ), FALSE, jabber_connected_ssl, ic );
 		jd->fd = jd->ssl ? ssl_getfd( jd->ssl ) : -1;
 	}
 	else
diff --git a/protocols/jabber/jabber.h b/protocols/jabber/jabber.h
index 364d561c..aa552558 100644
--- a/protocols/jabber/jabber.h
+++ b/protocols/jabber/jabber.h
@@ -308,7 +308,7 @@ extern const struct jabber_away_state jabber_away_state_list[];
 int jabber_write_packet( struct im_connection *ic, struct xt_node *node );
 int jabber_write( struct im_connection *ic, char *buf, int len );
 gboolean jabber_connected_plain( gpointer data, gint source, b_input_condition cond );
-gboolean jabber_connected_ssl( gpointer data, void *source, b_input_condition cond );
+gboolean jabber_connected_ssl( gpointer data, int returncode, void *source, b_input_condition cond );
 gboolean jabber_start_stream( struct im_connection *ic );
 void jabber_end_stream( struct im_connection *ic );