From: Simon Ruderich Date: Thu, 8 Aug 2013 19:32:41 +0000 (+0200) Subject: verify.c: Perform additional checks on server certificate. X-Git-Url: https://ruderich.org/simon/gitweb/?a=commitdiff_plain;h=8f9459308e695a30874a6cdcd53aa26441b87131;p=tlsproxy%2Ftlsproxy.git verify.c: Perform additional checks on server certificate. --- diff --git a/src/verify.c b/src/verify.c index b6f1ff8..f68d1bb 100644 --- a/src/verify.c +++ b/src/verify.c @@ -26,6 +26,31 @@ #include +/* Compatibility for older GnuTLS versions. Define the constants in a way + * which doesn't affect the status check below. */ +#ifndef GNUTLS_CERT_SIGNER_NOT_CA +# define GNUTLS_CERT_SIGNER_NOT_CA 0 +#endif +#ifndef GNUTLS_CERT_SIGNATURE_FAILURE +# define GNUTLS_CERT_SIGNATURE_FAILURE 0 +#endif +#ifndef GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED +# define GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED 0 +#endif +#ifndef GNUTLS_CERT_UNEXPECTED_OWNER +# define GNUTLS_CERT_UNEXPECTED_OWNER 0 +#endif +#ifndef GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE +# define GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE 0 +#endif +#ifndef GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE +# define GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE 0 +#endif +#ifndef GNUTLS_CERT_MISMATCH +# define GNUTLS_CERT_MISMATCH 0 +#endif + + static int get_certificate_path(const char *format, const char *hostname, char *buffer, size_t size); @@ -56,10 +81,16 @@ int verify_tls_connection(gnutls_session_t session, const char *hostname) { } /* Definitely an invalid certificate, abort. */ if (status & GNUTLS_CERT_REVOKED + || status & GNUTLS_CERT_SIGNER_NOT_CA || status & GNUTLS_CERT_INSECURE_ALGORITHM || status & GNUTLS_CERT_NOT_ACTIVATED || status & GNUTLS_CERT_EXPIRED - ) { + || status & GNUTLS_CERT_SIGNATURE_FAILURE + || status & GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED + || status & GNUTLS_CERT_UNEXPECTED_OWNER + || status & GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE + || status & GNUTLS_CERT_SIGNER_CONSTRAINTS_FAILURE + || status & GNUTLS_CERT_MISMATCH) { LOG(WARNING, "verify_tls_connection(): invalid server certificate"); return -1; }