iiiypuk
/
hexchat
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

WIP: Use GSocketClient for IRC connections 

TODO:
- Proxy support (some will be lost along the way)
- Remove all OpenSSL usage from fe-gtk?
- DCC support?
This commit is contained in:
Patrick Griffis 2021-07-13 22:09:26 -05:00
parent 91439f04c0
commit d68c3e7ead
14 changed files with 307 additions and 1614 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
meson.build
View File

@ -13,7 +13,7 @@ gnome = import('gnome')
cc = meson.get_compiler('c')
libgio_dep = dependency('gio-2.0', version: '>= 2.34.0')
libgio_dep = dependency('gio-2.0', version: '>= 2.44.0')
libgmodule_dep = dependency('gmodule-2.0')
libcanberra_dep = dependency('libcanberra', version: '>= 0.22',
@ -46,8 +46,8 @@ config_h.set('G_DISABLE_SINGLE_INCLUDES', true)
config_h.set('GTK_DISABLE_DEPRECATED', true)
config_h.set('GTK_DISABLE_SINGLE_INCLUDES', true)
config_h.set('GDK_PIXBUF_DISABLE_SINGLE_INCLUDES', true)
config_h.set('GLIB_VERSION_MAX_ALLOWED', 'GLIB_VERSION_2_34')
config_h.set('GLIB_VERSION_MIN_REQUIRED', 'GLIB_VERSION_2_34')
config_h.set('GLIB_VERSION_MAX_ALLOWED', 'GLIB_VERSION_2_44')
config_h.set('GLIB_VERSION_MIN_REQUIRED', 'GLIB_VERSION_2_44')
# Detected features
config_h.set('HAVE_MEMRCHR', cc.has_function('memrchr'))

18
src/common/dcc.c
View File

@ -487,6 +487,19 @@ dcc_notify_kill (struct server *serv)
}
}
static int
tcp_send_real (int sok, GIConv write_converter, char *buf, int len)
{
int ret;
gsize buf_encoded_len;
gchar *buf_encoded = text_convert_invalid (buf, len, write_converter, arbitrary_encoding_fallback_string, &buf_encoded_len);
ret = send (sok, buf_encoded, buf_encoded_len, 0);
g_free (buf_encoded);
return ret;
}
struct DCC *
dcc_write_chat (char *nick, char *text)
{
@ -499,7 +512,7 @@ dcc_write_chat (char *nick, char *text)
if (dcc && dcc->dccstat == STAT_ACTIVE)
{
len = strlen (text);
tcp_send_real (NULL, dcc->sok, dcc->serv->write_converter, text, len);
tcp_send_real (dcc->sok, dcc->serv->write_converter, text, len);
send (dcc->sok, "\n", 1, 0);
dcc->size += len;
fe_dcc_update (dcc);
@ -1656,7 +1669,8 @@ dcc_listen_init (struct DCC *dcc, session *sess)
memset (&SAddr, 0, sizeof (struct sockaddr_in));
len = sizeof (SAddr);
getsockname (dcc->serv->sok, (struct sockaddr *) &SAddr, &len);
/* TODO: Get rid of raw socket usage */
getsockname (g_socket_get_fd (dcc->serv->socket), (struct sockaddr *) &SAddr, &len);
SAddr.sin_family = AF_INET;

2
src/common/hexchat.c
View File

@ -266,7 +266,7 @@ lag_check (void)
EMIT_SIGNAL (XP_TE_PINGTIMEOUT, serv->server_session, tbuf, NULL,
NULL, NULL, 0);
if (prefs.hex_net_auto_reconnect)
serv->auto_reconnect (serv, FALSE, -1);
serv->auto_reconnect (serv, FALSE, NULL);
}
else
{

33
src/common/hexchat.h
View File

@ -39,10 +39,6 @@
#include "history.h"
#include "tree.h"
#ifdef USE_OPENSSL
#include <openssl/ssl.h> /* SSL_() */
#endif
#ifdef __EMX__ /* for o/s 2 */
#define OFLAGS O_BINARY
#define g_ascii_strcasecmp stricmp
@ -434,10 +430,10 @@ typedef struct server
{
/* server control operations (in server*.c) */
void (*connect)(struct server *, char *hostname, int port, int no_login);
void (*disconnect)(struct session *, int sendquit, int err);
void (*disconnect)(struct session *, int sendquit, GError *err);
int (*cleanup)(struct server *);
void (*flush_queue)(struct server *);
void (*auto_reconnect)(struct server *, int send_quit, int err);
void (*auto_reconnect)(struct server *, int send_quit, GError *err);
/* irc protocol functions (in proto*.c) */
void (*p_inline)(struct server *, char *buf, int len);
void (*p_invite)(struct server *, char *channel, char *nick);
@ -474,29 +470,18 @@ typedef struct server
int (*p_cmp)(const char *s1, const char *s2);
int port;
int sok; /* is equal to sok4 or sok6 (the one we are using) */
int sok4; /* tcp4 socket */
int sok6; /* tcp6 socket */
int proxy_type;
int proxy_sok; /* Additional information for MS Proxy beast */
int proxy_sok4;
int proxy_sok6;
int id; /* unique ID number (for plugin API) */
/* dcc_ip moved from hexchatprefs to make it per-server */
guint32 dcc_ip;
#ifdef USE_OPENSSL
SSL_CTX *ctx;
SSL *ssl;
int ssl_do_connect_tag;
#else
void *ssl;
#endif
int childread;
int childwrite;
int childpid;
int iotag;
GSocketClient *socket_client;
GSocketConnection *socket_conn;
GSocket *socket; /* Owned by socket_conn */
GCancellable *connection_cancellable;
GTlsCertificate *client_cert;
GSource *socket_read_source;
int recondelay_tag; /* reconnect delay timeout */
int joindelay_tag; /* waiting before we send JOIN */
char hostname[128]; /* real ip number */

1
src/common/meson.build
View File

@ -74,7 +74,6 @@ textevents = custom_target('textevents',
# HAVE_GTK_MAC
if libssl_dep.found()
common_sources += 'ssl.c'
common_deps += libssl_dep
endif

16
src/common/outbound.c
View File

@ -903,8 +903,8 @@ cmd_debug (struct session *sess, char *tbuf, char *word[], char *word_eol[])
while (list)
{
v = (struct server *) list->data;
sprintf (tbuf, "%p %-5d %s\n",
v, v->sok, v->servername);
sprintf (tbuf, "%p %s\n",
v, v->servername);
PrintText (sess, tbuf);
list = list->next;
}
@ -1414,7 +1414,7 @@ cmd_devoice (struct session *sess, char *tbuf, char *word[], char *word_eol[])
static int
cmd_discon (struct session *sess, char *tbuf, char *word[], char *word_eol[])
{
sess->server->disconnect (sess, TRUE, -1);
sess->server->disconnect (sess, TRUE, NULL);
return TRUE;
}
@ -1956,7 +1956,7 @@ cmd_quit (struct session *sess, char *tbuf, char *word[], char *word_eol[])
{
if (*word_eol[2])
sess->quitreason = word_eol[2];
sess->server->disconnect (sess, TRUE, -1);
sess->server->disconnect (sess, TRUE, NULL);
sess->quitreason = NULL;
return 2;
}
@ -3216,7 +3216,7 @@ cmd_reconnect (struct session *sess, char *tbuf, char *word[], char *word_eol[])
{
serv = list->data;
if (serv->connected)
serv->auto_reconnect (serv, TRUE, -1);
serv->auto_reconnect (serv, TRUE, NULL);
list = list->next;
}
}
@ -3249,11 +3249,11 @@ cmd_reconnect (struct session *sess, char *tbuf, char *word[], char *word_eol[])
if (*word[3+offset])
serv->port = atoi (word[3+offset]);
safe_strcpy (serv->hostname, word[2+offset], sizeof (serv->hostname));
serv->auto_reconnect (serv, TRUE, -1);
serv->auto_reconnect (serv, TRUE, NULL);
}
else
{
serv->auto_reconnect (serv, TRUE, -1);
serv->auto_reconnect (serv, TRUE, NULL);
}
prefs.hex_net_reconnect_delay = tmp;
@ -3294,6 +3294,7 @@ cmd_send (struct session *sess, char *tbuf, char *word[], char *word_eol[])
if (!word[2][0])
return FALSE;
#if 0
addr = dcc_get_my_address (sess);
if (addr == 0)
{
@ -3313,6 +3314,7 @@ cmd_send (struct session *sess, char *tbuf, char *word[], char *word_eol[])
g_snprintf (tbuf, 512, "DCC SEND %s", word_eol[2]);
handle_command (sess, tbuf, FALSE);
#endif
return TRUE;
}

1131
src/common/server.c
View File

File diff suppressed because it is too large Load Diff

3
src/common/server.h
View File

@ -25,7 +25,6 @@ extern GSList *serv_list;
/* eventually need to keep the tcp_* functions isolated to server.c */
int tcp_send_len (server *serv, char *buf, int len);
void tcp_sendf (server *serv, const char *fmt, ...) G_GNUC_PRINTF (2, 3);
int tcp_send_real (void *ssl, int sok, GIConv write_converter, char *buf, int len);
server *server_new (void);
int is_server (server *serv);
@ -39,6 +38,4 @@ void server_free (server *serv);
void server_away_save_message (server *serv, char *nick, char *msg);
struct away_msg *server_away_find_message (server *serv, char *nick);
void base64_encode (char *to, char *from, unsigned int len);
#endif

567
src/common/ssl.c
View File

@ -1,567 +0,0 @@
/*
* ssl.c v0.0.3
* Copyright (C) 2000 -- DaP <profeta@freemail.c3.hu>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
*/
#ifdef __APPLE__
#define __AVAILABILITYMACROS__
#define DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER
#endif
#include "inet.h" /* make it first to avoid macro redefinitions */
#include <openssl/ssl.h> /* SSL_() */
#include <openssl/err.h> /* ERR_() */
#include <openssl/x509v3.h>
#ifdef WIN32
#include <openssl/rand.h> /* RAND_seed() */
#endif
#include "config.h"
#include <time.h> /* asctime() */
#include <string.h> /* strncpy() */
#include "ssl.h" /* struct cert_info */
#include <glib.h>
#include <glib/gprintf.h>
#include <gio/gio.h>
#include "util.h"
/* If openssl was built without ec */
#ifndef SSL_OP_SINGLE_ECDH_USE
#define SSL_OP_SINGLE_ECDH_USE 0
#endif
#ifndef SSL_OP_NO_COMPRESSION
#define SSL_OP_NO_COMPRESSION 0
#endif
/* globals */
static struct chiper_info chiper_info; /* static buffer for _SSL_get_cipher_info() */
static char err_buf[256]; /* generic error buffer */
/* +++++ Internal functions +++++ */
static void
__SSL_fill_err_buf (char *funcname)
{
int err;
char buf[256];
err = ERR_get_error ();
ERR_error_string (err, buf);
g_snprintf (err_buf, sizeof (err_buf), "%s: %s (%d)\n", funcname, buf, err);
}
static void
__SSL_critical_error (char *funcname)
{
__SSL_fill_err_buf (funcname);
fprintf (stderr, "%s\n", err_buf);
exit (1);
}
/* +++++ SSL functions +++++ */
SSL_CTX *
_SSL_context_init (void (*info_cb_func))
{
SSL_CTX *ctx;
SSLeay_add_ssl_algorithms ();
SSL_load_error_strings ();
ctx = SSL_CTX_new (SSLv23_client_method ());
SSL_CTX_set_session_cache_mode (ctx, SSL_SESS_CACHE_BOTH);
SSL_CTX_set_timeout (ctx, 300);
SSL_CTX_set_options (ctx, SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3
|SSL_OP_NO_COMPRESSION
|SSL_OP_SINGLE_DH_USE|SSL_OP_SINGLE_ECDH_USE
|SSL_OP_NO_TICKET
|SSL_OP_CIPHER_SERVER_PREFERENCE);
#if OPENSSL_VERSION_NUMBER >= 0x00908000L && !defined (OPENSSL_NO_COMP) /* workaround for OpenSSL 0.9.8 */
sk_SSL_COMP_zero(SSL_COMP_get_compression_methods());
#endif
/* used in SSL_connect(), SSL_accept() */
SSL_CTX_set_info_callback (ctx, info_cb_func);
return(ctx);
}
static void
ASN1_TIME_snprintf (char *buf, int buf_len, ASN1_TIME * tm)
{
char *expires = NULL;
BIO *inMem = BIO_new (BIO_s_mem ());
ASN1_TIME_print (inMem, tm);
BIO_get_mem_data (inMem, &expires);
buf[0] = 0;
if (expires != NULL)
{
/* expires is not \0 terminated */
safe_strcpy (buf, expires, MIN(24, buf_len));
}
BIO_free (inMem);
}
static void
broke_oneline (char *oneline, char *parray[])
{
char *pt, *ppt;
int i;
i = 0;
ppt = pt = oneline + 1;
while ((pt = strchr (pt, '/')))
{
*pt = 0;
parray[i++] = ppt;
ppt = ++pt;
}
parray[i++] = ppt;
parray[i] = NULL;
}
/*
FIXME: Master-Key, Extensions, CA bits
(openssl x509 -text -in servcert.pem)
*/
int
_SSL_get_cert_info (struct cert_info *cert_info, SSL * ssl)
{
X509 *peer_cert;
X509_PUBKEY *key;
X509_ALGOR *algor = NULL;
EVP_PKEY *peer_pkey;
char notBefore[64];
char notAfter[64];
int alg;
int sign_alg;
if (!(peer_cert = SSL_get_peer_certificate (ssl)))
return (1); /* FATAL? */
X509_NAME_oneline (X509_get_subject_name (peer_cert), cert_info->subject,
sizeof (cert_info->subject));
X509_NAME_oneline (X509_get_issuer_name (peer_cert), cert_info->issuer,
sizeof (cert_info->issuer));
broke_oneline (cert_info->subject, cert_info->subject_word);
broke_oneline (cert_info->issuer, cert_info->issuer_word);
key = X509_get_X509_PUBKEY(peer_cert);
if (!X509_PUBKEY_get0_param(NULL, NULL, 0, &algor, key))
return 1;
alg = OBJ_obj2nid (algor->algorithm);
#ifndef HAVE_X509_GET_SIGNATURE_NID
sign_alg = OBJ_obj2nid (peer_cert->sig_alg->algorithm);
#else
sign_alg = X509_get_signature_nid (peer_cert);
#endif
ASN1_TIME_snprintf (notBefore, sizeof (notBefore),
X509_get_notBefore (peer_cert));
ASN1_TIME_snprintf (notAfter, sizeof (notAfter),
X509_get_notAfter (peer_cert));
peer_pkey = X509_get_pubkey (peer_cert);
safe_strcpy (cert_info->algorithm,
(alg == NID_undef) ? "Unknown" : OBJ_nid2ln (alg),
sizeof (cert_info->algorithm));
cert_info->algorithm_bits = EVP_PKEY_bits (peer_pkey);
safe_strcpy (cert_info->sign_algorithm,
(sign_alg == NID_undef) ? "Unknown" : OBJ_nid2ln (sign_alg),
sizeof (cert_info->sign_algorithm));
/* EVP_PKEY_bits(ca_pkey)); */
cert_info->sign_algorithm_bits = 0;
safe_strcpy (cert_info->notbefore, notBefore, sizeof (cert_info->notbefore));
safe_strcpy (cert_info->notafter, notAfter, sizeof (cert_info->notafter));
EVP_PKEY_free (peer_pkey);
/* SSL_SESSION_print_fp(stdout, SSL_get_session(ssl)); */
/*
if (ssl->session->sess_cert->peer_rsa_tmp) {
tmp_pkey = EVP_PKEY_new();
EVP_PKEY_assign_RSA(tmp_pkey, ssl->session->sess_cert->peer_rsa_tmp);
cert_info->rsa_tmp_bits = EVP_PKEY_bits (tmp_pkey);
EVP_PKEY_free(tmp_pkey);
} else
fprintf(stderr, "REMOTE SIDE DOESN'T PROVIDES ->peer_rsa_tmp\n");
*/
cert_info->rsa_tmp_bits = 0;
X509_free (peer_cert);
return (0);
}
struct chiper_info *
_SSL_get_cipher_info (SSL * ssl)
{
const SSL_CIPHER *c;
c = SSL_get_current_cipher (ssl);
safe_strcpy (chiper_info.version, SSL_CIPHER_get_version (c),
sizeof (chiper_info.version));
safe_strcpy (chiper_info.chiper, SSL_CIPHER_get_name (c),
sizeof (chiper_info.chiper));
SSL_CIPHER_get_bits (c, &chiper_info.chiper_bits);
return (&chiper_info);
}
int
_SSL_send (SSL * ssl, char *buf, int len)
{
int num;
num = SSL_write (ssl, buf, len);
switch (SSL_get_error (ssl, num))
{
case SSL_ERROR_SSL: /* setup errno! */
/* ??? */
__SSL_fill_err_buf ("SSL_write");
fprintf (stderr, "%s\n", err_buf);
break;
case SSL_ERROR_SYSCALL:
/* ??? */
perror ("SSL_write/write");
break;
case SSL_ERROR_ZERO_RETURN:
/* fprintf(stderr, "SSL closed on write\n"); */
break;
}
return (num);
}
int
_SSL_recv (SSL * ssl, char *buf, int len)
{
int num;
num = SSL_read (ssl, buf, len);
switch (SSL_get_error (ssl, num))
{
case SSL_ERROR_SSL:
/* ??? */
__SSL_fill_err_buf ("SSL_read");
fprintf (stderr, "%s\n", err_buf);
break;
case SSL_ERROR_SYSCALL:
/* ??? */
if (!would_block ())
perror ("SSL_read/read");
break;
case SSL_ERROR_ZERO_RETURN:
/* fprintf(stdeerr, "SSL closed on read\n"); */
break;
}
return (num);
}
SSL *
_SSL_socket (SSL_CTX *ctx, int sd)
{
SSL *ssl;
const SSL_METHOD *method;
if (!(ssl = SSL_new (ctx)))
/* FATAL */
__SSL_critical_error ("SSL_new");
SSL_set_fd (ssl, sd);
#ifndef HAVE_SSL_CTX_GET_SSL_METHOD
method = ctx->method;
#else
method = SSL_CTX_get_ssl_method (ctx);
#endif
if (method == SSLv23_client_method())
SSL_set_connect_state (ssl);
else
SSL_set_accept_state(ssl);
return (ssl);
}
char *
_SSL_set_verify (SSL_CTX *ctx, void *verify_callback, char *cacert)
{
if (!SSL_CTX_set_default_verify_paths (ctx))
{
__SSL_fill_err_buf ("SSL_CTX_set_default_verify_paths");
return (err_buf);
}
/*
if (cacert)
{
if (!SSL_CTX_load_verify_locations (ctx, cacert, NULL))
{
__SSL_fill_err_buf ("SSL_CTX_load_verify_locations");
return (err_buf);
}
}
*/
SSL_CTX_set_verify (ctx, SSL_VERIFY_PEER, verify_callback);
return (NULL);
}
void
_SSL_close (SSL * ssl)
{
SSL_set_shutdown (ssl, SSL_SENT_SHUTDOWN | SSL_RECEIVED_SHUTDOWN);
SSL_free (ssl);
#ifdef HAVE_ERR_REMOVE_THREAD_STATE
#if OPENSSL_VERSION_NUMBER >= 0x10000000L && OPENSSL_VERSION_NUMBER < 0x10100000L
/* OpenSSL handles this itself in 1.1+ and this is a no-op */
ERR_remove_thread_state (NULL);
#endif
#else
ERR_remove_state (0);
#endif
}
/* Hostname validation code based on OpenBSD's libtls. */
static int
_SSL_match_hostname (const char *cert_hostname, const char *hostname)
{
const char *cert_domain, *domain, *next_dot;
if (g_ascii_strcasecmp (cert_hostname, hostname) == 0)
return 0;
/* Wildcard match? */
if (cert_hostname[0] == '*')
{
/*
* Valid wildcards:
* - "*.domain.tld"
* - "*.sub.domain.tld"
* - etc.
* Reject "*.tld".
* No attempt to prevent the use of eg. "*.co.uk".
*/
cert_domain = &cert_hostname[1];
/* Disallow "*" */
if (cert_domain[0] == '\0')
return -1;
/* Disallow "*foo" */
if (cert_domain[0] != '.')
return -1;
/* Disallow "*.." */
if (cert_domain[1] == '.')
return -1;
next_dot = strchr (&cert_domain[1], '.');
/* Disallow "*.bar" */
if (next_dot == NULL)
return -1;
/* Disallow "*.bar.." */
if (next_dot[1] == '.')
return -1;
domain = strchr (hostname, '.');
/* No wildcard match against a hostname with no domain part. */
if (domain == NULL || strlen(domain) == 1)
return -1;
if (g_ascii_strcasecmp (cert_domain, domain) == 0)
return 0;
}
return -1;
}
static int
_SSL_check_subject_altname (X509 *cert, const char *host)
{
STACK_OF(GENERAL_NAME) *altname_stack = NULL;
GInetAddress *addr;
GSocketFamily family;
int type = GEN_DNS;
int count, i;
int rv = -1;
altname_stack = X509_get_ext_d2i (cert, NID_subject_alt_name, NULL, NULL);
if (altname_stack == NULL)
return -1;
addr = g_inet_address_new_from_string (host);
if (addr != NULL)
{
family = g_inet_address_get_family (addr);
if (family == G_SOCKET_FAMILY_IPV4 || family == G_SOCKET_FAMILY_IPV6)
type = GEN_IPADD;
}
count = sk_GENERAL_NAME_num(altname_stack);
for (i = 0; i < count; i++)
{
GENERAL_NAME *altname;
altname = sk_GENERAL_NAME_value (altname_stack, i);
if (altname->type != type)
continue;
if (type == GEN_DNS)
{
const unsigned char *data;
int format;
format = ASN1_STRING_type (altname->d.dNSName);
if (format == V_ASN1_IA5STRING)
{
#ifdef HAVE_ASN1_STRING_GET0_DATA
data = ASN1_STRING_get0_data (altname->d.dNSName);
#else
data = ASN1_STRING_data (altname->d.dNSName);
#endif
if (ASN1_STRING_length (altname->d.dNSName) != (int)strlen(data))
{
g_warning("NUL byte in subjectAltName, probably a malicious certificate.\n");
rv = -2;
break;
}
if (_SSL_match_hostname (data, host) == 0)
{
rv = 0;
break;
}
}
else
g_warning ("unhandled subjectAltName dNSName encoding (%d)\n", format);
}
else if (type == GEN_IPADD)
{
const unsigned char *data;
const guint8 *addr_bytes;
int datalen, addr_len;
datalen = ASN1_STRING_length (altname->d.iPAddress);
#ifdef HAVE_ASN1_STRING_GET0_DATA
data = ASN1_STRING_get0_data (altname->d.iPAddress);
#else
data = ASN1_STRING_data (altname->d.iPAddress);
#endif
addr_bytes = g_inet_address_to_bytes (addr);
addr_len = (int)g_inet_address_get_native_size (addr);
if (datalen == addr_len && memcmp (data, addr_bytes, addr_len) == 0)
{
rv = 0;
break;
}
}
}
if (addr != NULL)
g_object_unref (addr);
sk_GENERAL_NAME_pop_free (altname_stack, GENERAL_NAME_free);
return rv;
}
static int
_SSL_check_common_name (X509 *cert, const char *host)
{
X509_NAME *name;
char *common_name = NULL;
int common_name_len;
int rv = -1;
GInetAddress *addr;
name = X509_get_subject_name (cert);
if (name == NULL)
return -1;
common_name_len = X509_NAME_get_text_by_NID (name, NID_commonName, NULL, 0);
if (common_name_len < 0)
return -1;
common_name = g_malloc0 (common_name_len + 1);
X509_NAME_get_text_by_NID (name, NID_commonName, common_name, common_name_len + 1);
/* NUL bytes in CN? */
if (common_name_len != (int)strlen(common_name))
{
g_warning ("NUL byte in Common Name field, probably a malicious certificate.\n");
rv = -2;
goto out;
}
if ((addr = g_inet_address_new_from_string (host)) != NULL)
{
/*
* We don't want to attempt wildcard matching against IP
* addresses, so perform a simple comparison here.
*/
if (g_strcmp0 (common_name, host) == 0)
rv = 0;
else
rv = -1;
g_object_unref (addr);
}
else if (_SSL_match_hostname (common_name, host) == 0)
rv = 0;
out:
g_free(common_name);
return rv;
}
int
_SSL_check_hostname (X509 *cert, const char *host)
{
int rv;
rv = _SSL_check_subject_altname (cert, host);
if (rv == 0 || rv == -2)
return rv;
return _SSL_check_common_name (cert, host);
}

85
src/common/ssl.h
View File

@ -1,85 +0,0 @@
/* HexChat
* Copyright (C) 1998-2010 Peter Zelezny.
* Copyright (C) 2009-2013 Berke Viktor.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
*/
#ifndef HEXCHAT_SSL_H
#define HEXCHAT_SSL_H
struct cert_info {
char subject[256];
char *subject_word[12];
char issuer[256];
char *issuer_word[12];
char algorithm[32];
int algorithm_bits;
char sign_algorithm[32];
int sign_algorithm_bits;
char notbefore[32];
char notafter[32];
int rsa_tmp_bits;
};
struct chiper_info {
char version[16];
char chiper[48];
int chiper_bits;
};
SSL_CTX *_SSL_context_init (void (*info_cb_func));
#define _SSL_context_free(a) SSL_CTX_free(a);
SSL *_SSL_socket (SSL_CTX *ctx, int sd);
char *_SSL_set_verify (SSL_CTX *ctx, void *(verify_callback), char *cacert);
/*
int SSL_connect(SSL *);
int SSL_accept(SSL *);
int SSL_get_fd(SSL *);
*/
void _SSL_close (SSL * ssl);
int _SSL_check_hostname(X509 *cert, const char *host);
int _SSL_get_cert_info (struct cert_info *cert_info, SSL * ssl);
struct chiper_info *_SSL_get_cipher_info (SSL * ssl);
/*char *_SSL_add_keypair (SSL_CTX *ctx, char *privkey, char *cert);*/
/*void _SSL_add_random_keypair(SSL_CTX *ctx, int bits);*/
int _SSL_send (SSL * ssl, char *buf, int len);
int _SSL_recv (SSL * ssl, char *buf, int len);
/* misc */
/*void broke_oneline (char *oneline, char *parray[]);*/
/*char *_SSL_do_cipher_base64(char *buf, int buf_len, char *key, int operation);*/ /* must be freed */
/*void *_SSL_get_sess_obj(SSL *ssl, int type);*/ /* NOT must be freed */
#define _SSL_get_sess_pkey(a) _SSL_get_sess_obj(a, 0)
#define _SSL_get_sess_prkey(a) _SSL_get_sess_obj(a, 1)
#define _SSL_get_sess_x509(a) _SSL_get_sess_obj(a, 2)
/*char *_SSL_get_obj_base64(void *s, int type);*/ /* must be freed */
#define _SSL_get_pkey_base64(a) _SSL_get_obj_base64(a, 0)
#define _SSL_get_prkey_base64(a) _SSL_get_obj_base64(a, 1)
#define _SSL_get_x509_base64(a) _SSL_get_obj_base64(a, 2)
/*char *_SSL_get_ctx_obj_base64(SSL_CTX *ctx, int type);*/ /* must be freed */
#define _SSL_get_ctx_pkey_base64(a) _SSL_get_ctx_obj_base64(a, 0)
#define _SSL_get_ctx_prkey_base64(a) _SSL_get_ctx_obj_base64(a, 1)
#define _SSL_get_ctx_x509_base64(a) _SSL_get_ctx_obj_base64(a, 2)
/*int _SSL_verify_x509(X509 *x509);*/
#endif

1
src/common/text.c
View File

@ -1323,7 +1323,6 @@ static char * const pevt_connect_help[] = {
};
static char * const pevt_sconnect_help[] = {
"PID"
};
static char * const pevt_generic_nick_help[] = {

4
src/common/textevents.in
View File

@ -787,8 +787,8 @@ n2
Stop Connection
XP_TE_STOPCONNECT
pevt_sconnect_help
%C23*%O$tStopped previous connection attempt (%C24$1%O)
1
%C23*%O$tStopped previous connection attempt
0
Topic
XP_TE_TOPIC

52
src/common/util.c
View File

@ -56,6 +56,9 @@
#ifdef USE_OPENSSL
#include <openssl/bn.h>
#include <openssl/rand.h>
#include <openssl/sha.h>
#include <openssl/evp.h>
#include <openssl/hmac.h>
#ifndef WIN32
#include <netinet/in.h>
#endif
@ -1550,3 +1553,52 @@ strftime_utf8 (char *dest, gsize destsize, const char *format, time_t time)
g_date_free (date);
return result;
}
static void
three_to_four (char *from, char *to)
{
static const char tab64[64]=
{
'A','B','C','D','E','F','G','H','I','J','K','L','M','N','O','P',
'Q','R','S','T','U','V','W','X','Y','Z','a','b','c','d','e','f',
'g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v',
'w','x','y','z','0','1','2','3','4','5','6','7','8','9','+','/'
};
to[0] = tab64 [ (from[0] >> 2) & 63 ];
to[1] = tab64 [ ((from[0] << 4) | (from[1] >> 4)) & 63 ];
to[2] = tab64 [ ((from[1] << 2) | (from[2] >> 6)) & 63 ];
to[3] = tab64 [ from[2] & 63 ];
};
void
base64_encode (char *to, char *from, unsigned int len)
{
while (len >= 3)
{
three_to_four (from, to);
len -= 3;
from += 3;
to += 4;
}
if (len)
{
char three[3] = {0,0,0};
unsigned int i;
for (i = 0; i < len; i++)
{
three[i] = *from++;
}
three_to_four (three, to);
if (len == 1)
{
to[2] = to[3] = '=';
}
else if (len == 2)
{
to[3] = '=';
}
to += 4;
};
to[0] = 0;
}

2
src/common/util.h
View File

@ -80,4 +80,6 @@ char *encode_sasl_pass_plain (char *user, char *pass);
char *challengeauth_response (const char *username, const char *password, const char *challenge);
size_t strftime_validated (char *dest, size_t destsize, const char *format, const struct tm *time);
gsize strftime_utf8 (char *dest, gsize destsize, const char *format, time_t time);
void base64_encode (char *to, char *from, unsigned int len);
#endif