moparisthebest/wget
1
0
Fork 0
mirror of https://github.com/moparisthebest/wget synced 2024-07-03 16:38:41 -04:00
Code Issues Releases Wiki Activity

[svn] Print certificate subject and issuer.

Browse Source
This commit is contained in:
hniksic 2005-05-10 14:16:00 -07:00
parent 5322ad1924
commit 159a1a923d
2 changed files with 40 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/ChangeLog
View File

@ -1,3 +1,8 @@
2005-05-10 Hrvoje Niksic <hniksic@xemacs.org>
* openssl.c (ssl_check_server_identity): Print certificate subject
and issuer.
2005-05-10 Hrvoje Niksic <hniksic@xemacs.org> 2005-05-10 Hrvoje Niksic <hniksic@xemacs.org>
* res.c (res_register_specs): Correctly pass pointers to * res.c (res_register_specs): Correctly pass pointers to

49
src/openssl.c
View File

@ -41,12 +41,9 @@ so, delete this exception statement from your version. */
# include <strings.h> # include <strings.h>
#endif #endif
#include <openssl/bio.h>
#include <openssl/crypto.h>
#include <openssl/x509.h>
#include <openssl/ssl.h> #include <openssl/ssl.h>
#include <openssl/x509.h>
#include <openssl/err.h> #include <openssl/err.h>
#include <openssl/pem.h>
#include <openssl/rand.h> #include <openssl/rand.h>
#include "wget.h" #include "wget.h"
@ -361,7 +358,7 @@ ssl_connect (int fd)
int int
ssl_check_server_identity (int fd, const char *host) ssl_check_server_identity (int fd, const char *host)
{ {
X509 *peer = NULL; X509 *peer_cert = NULL;
char peer_CN[256]; char peer_CN[256];
long vresult; long vresult;
int retval; int retval;
@ -373,8 +370,8 @@ ssl_check_server_identity (int fd, const char *host)
SSL *ssl = (SSL *) fd_transport_context (fd); SSL *ssl = (SSL *) fd_transport_context (fd);
assert (ssl != NULL); assert (ssl != NULL);
peer = SSL_get_peer_certificate (ssl); peer_cert = SSL_get_peer_certificate (ssl);
if (!peer) if (!peer_cert)
{ {
logprintf (LOG_NOTQUIET, _("%s: No certificate presented by %s.\n"), logprintf (LOG_NOTQUIET, _("%s: No certificate presented by %s.\n"),
severity, escnonprint (host)); severity, escnonprint (host));
@ -382,6 +379,18 @@ ssl_check_server_identity (int fd, const char *host)
goto out; goto out;
} }
#ifdef ENABLE_DEBUG
if (opt.debug)
{
char *subject = X509_NAME_oneline (X509_get_subject_name (peer_cert), 0, 0);
char *issuer = X509_NAME_oneline (X509_get_issuer_name (peer_cert), 0, 0);
DEBUGP (("certificate:\n subject: %s\n issuer: %s\n",
escnonprint (subject), escnonprint (issuer)));
OPENSSL_free (subject);
OPENSSL_free (issuer);
}
#endif
vresult = SSL_get_verify_result (ssl); vresult = SSL_get_verify_result (ssl);
if (vresult != X509_V_OK) if (vresult != X509_V_OK)
{ {
@ -393,14 +402,26 @@ ssl_check_server_identity (int fd, const char *host)
goto out; goto out;
} }
/* Check that the common name matches HOST. /* Check that the common name in the presented certificate matches
HOST. This is a very simple implementation that should be
improved in the following ways:
#### This should use dNSName if available; according to rfc2818: 1. It should use dNSName if available; according to rfc2818: "If
"If a subjectAltName extension of type dNSName is present, that a subjectAltName extension of type dNSName is present, that
MUST be used as the identity." */ MUST be used as the identity." Ditto for iPAddress.
2. It should support the wildcard character "*". Quoting
rfc2818, "Names may contain the wildcard character * which is
considered to match any single domain name component or
component fragment. E.g., *.a.com matches foo.a.com but not
bar.foo.a.com. f*.com matches foo.com but not bar.com."
3. When matching against common names, it should loop over all
common names and choose the most specific (apparently the last
one). */
peer_CN[0] = '\0'; peer_CN[0] = '\0';
X509_NAME_get_text_by_NID (X509_get_subject_name (peer), X509_NAME_get_text_by_NID (X509_get_subject_name (peer_cert),
NID_commonName, peer_CN, sizeof (peer_CN)); NID_commonName, peer_CN, sizeof (peer_CN));
if (0 != strcasecmp (peer_CN, host)) if (0 != strcasecmp (peer_CN, host))
{ {
@ -415,8 +436,8 @@ ssl_check_server_identity (int fd, const char *host)
retval = 1; retval = 1;
out: out:
if (peer) if (peer_cert)
X509_free (peer); X509_free (peer_cert);
/* Allow --no-check-cert to disable certificate checking. */ /* Allow --no-check-cert to disable certificate checking. */
return opt.check_cert ? retval : 1; return opt.check_cert ? retval : 1;