* src/tls/tls_drv.c: Added a flag to avoid certificate validation

* src/tls/tls.erl: Likewise
* src/ejabberd_c2s.erl: Likewise

SVN Revision: 1775

diff --git a/ChangeLog b/ChangeLog
index 55c50d8913e2ec49332b021a32e50bd26d2c658e..5d5400245ce866b5af6efcfa5b417007c2ced809 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2009-01-05  Alexey Shchepin  <alexey@process-one.net>
+
+       * src/tls/tls_drv.c: Added a flag to avoid certificate validation
+       * src/tls/tls.erl: Likewise
+       * src/ejabberd_c2s.erl: Likewise
+
 2009-01-03  Badlop  <badlop@process-one.net>
 
        * src/*.erl: Fix EDoc comments

diff --git a/src/ejabberd_c2s.erl b/src/ejabberd_c2s.erl
index 3c5ea534f69f6a6879cb0a1ab61b19e7e4fc0004..c81df6149cd7cc94bd36ce805073b222e7af89ca 100644 (file)
--- a/src/ejabberd_c2s.erl
+++ b/src/ejabberd_c2s.erl
@@ -176,9 +176,11 @@ init([{SockMod, Socket}, Opts]) ->
     StartTLSRequired = lists:member(starttls_required, Opts),
     TLSEnabled = lists:member(tls, Opts),
     TLS = StartTLS orelse StartTLSRequired orelse TLSEnabled,
-    TLSOpts = lists:filter(fun({certfile, _}) -> true;
-                             (_) -> false
-                          end, Opts),
+    TLSOpts1 =
+       lists:filter(fun({certfile, _}) -> true;
+                       (_) -> false
+                    end, Opts),
+    TLSOpts = [verify_none | TLSOpts1],
     IP = peerip(SockMod, Socket),
     %% Check if IP is blacklisted:
     case is_ip_blacklisted(IP) of

diff --git a/src/tls/tls.erl b/src/tls/tls.erl
index 1c1fef47cfa165215dd41a42eac62360a7be0f76..b10fb893e98b619fffa5a95b490a8f9b5afbb6db 100644 (file)
--- a/src/tls/tls.erl
+++ b/src/tls/tls.erl
@@ -59,6 +59,7 @@
 -define(GET_DECRYPTED_INPUT,  6).
 -define(GET_PEER_CERTIFICATE, 7).
 -define(GET_VERIFY_RESULT,    8).
+-define(VERIFY_NONE, 16#10000).
 
 -record(tlssock, {tcpsock, tlsport}).
 
@@ -120,13 +121,20 @@ tcp_to_tls(TCPSocket, Options) ->
                {error, already_loaded} -> ok
            end,
            Port = open_port({spawn, tls_drv}, [binary]),
+           Flags =
+               case lists:member(verify_none, Options) of
+                   true ->
+                       ?VERIFY_NONE;
+                   false ->
+                       0
+               end,
            Command = case lists:member(connect, Options) of
                          true ->
                              ?SET_CERTIFICATE_FILE_CONNECT;
                          false ->
                              ?SET_CERTIFICATE_FILE_ACCEPT
                      end,
-           case port_control(Port, Command, CertFile ++ [0]) of
+           case port_control(Port, Command bor Flags, CertFile ++ [0]) of
                <<0>> ->
                    {ok, #tlssock{tcpsock = TCPSocket, tlsport = Port}};
                <<1, Error/binary>> ->

diff --git a/src/tls/tls_drv.c b/src/tls/tls_drv.c
index b90cab87c6d6cc66012242461fb0b8153302eb64..2f8e56150cac448456e08252fbdfd58cba346db1 100644 (file)
--- a/src/tls/tls_drv.c
+++ b/src/tls/tls_drv.c
@@ -272,6 +272,7 @@ static int verify_callback(int preverify_ok, X509_STORE_CTX *ctx)
 #define GET_DECRYPTED_INPUT  6
 #define GET_PEER_CERTIFICATE 7
 #define GET_VERIFY_RESULT    8
+#define VERIFY_NONE 0x10000
 
 
 #define die_unless(cond, errstr)                               \
@@ -312,6 +313,9 @@ static int tls_drv_control(ErlDrvData handle,
    int size;
    ErlDrvBinary *b;
    X509 *cert;
+   unsigned int flags = command;
+
+   command &= 0xffff;
 
    ERR_clear_error();
    switch (command)
@@ -354,6 +358,9 @@ static int tls_drv_control(ErlDrvData handle,
         d->ssl = SSL_new(ssl_ctx);
         die_unless(d->ssl, "SSL_new failed");
 
+        if (flags & VERIFY_NONE)
+           SSL_set_verify(d->ssl, SSL_VERIFY_NONE, verify_callback);
+
         d->bio_read = BIO_new(BIO_s_mem());
         d->bio_write = BIO_new(BIO_s_mem());