src/connection.c: Use "invalid" certificate when the server certificate changes.

[tlsproxy/tlsproxy.git] / src / tlsproxy.c

diff --git a/src/tlsproxy.c b/src/tlsproxy.c
index 0e095689374b7cae7e4ce51546491d1e9ade25d4..17c49e971b6a27d1e7c096c2a85977256265d1de 100644 (file)
--- a/src/tlsproxy.c
+++ b/src/tlsproxy.c
@@ -1,5 +1,7 @@
 /*
- * tlsproxy is a transparent TLS proxy for HTTPS connections.
+ * tlsproxy is a TLS proxy for HTTPS which intercepts the connections and
+ * ensures the server certificate doesn't change. Normally this isn't detected
+ * if a trusted CA for the new server certificate is installed.
  *
  * Copyright (C) 2011  Simon Ruderich
  *
@@ -48,6 +50,14 @@ GCRY_THREAD_OPTION_PTHREAD_IMPL;
 #define DH_SIZE 1024
 
 
+/* For gnutls_*() functions. */
+#define GNUTLS_ERROR_EXIT(error, message) \
+    if (GNUTLS_E_SUCCESS != error) { \
+        fprintf(stderr, "%s: %s\n", message, gnutls_strerror(error)); \
+        exit(EXIT_FAILURE); \
+    }
+
+
 /* Server should shut down. Set by SIGINT handler. */
 static volatile int done;