webdav SSL cerificate verification

Hi there,

using sitecopy with a secure webdav server, I noticed that there's no
possibility to ignore verification failures once the certificate is
saved locally (I'd like to backup a server directory on a computer in
the local network, addressing the server with it's local adress leads to
a NE_SSL_IDMISMATCH / ssl hostname verification failure).
A quick workaround is to remove the certificate in the ~/.sitecopy/ -
folder, because no verification is done the first time a certificate is
accepted (due to function verify_untrusted() in davdriver.c / line 184,
it always returns 0), this is not that good, either.
You can find a quick hack to ask for compliance to continue on
verification failures downwards. (Should be done for function
verify_untrusted either - I didn't add this.) Perhaps some
functionallity to ignore verification failures could be added to future
versions; I don't know wether my hack works for all use cases or wether
it messes up tools like xsitecopy.

with best  regards,

Jan


********************************
changes to src/webdav.c:
********************************

182a183,190
> /* get user input wether to continue, or not */
> static int check_ignore(){
>       printf("Continue? [Y|n] ");
>       char ch = getchar();
>       if(ch=='y' || ch == 'Y' || ch == '\n') return 1;
>       return 0;
> }
>
202a211,218
>       if(failures & NE_SSL_UNTRUSTED){
>               printf("WARNING: certificate not trusted!\n");
>               if(check_ignore()) failures ^= NE_SSL_UNTRUSTED;
>       }
>       if(failures & NE_SSL_IDMISMATCH){
>               printf("WARNING: hostname mismatch for given
certificate!\n");
>               if(check_ignore()) failures ^= NE_SSL_IDMISMATCH;
>       }
204c220
<     return failures != NE_SSL_UNTRUSTED || ne_ssl_cert_cmp(expected,
cert);
---
>     return (failures | ne_ssl_cert_cmp(expected, cert));

_______________________________________________
sitecopy maillist  -  [email protected]
http://dav.lyra.org/mailman/listinfo/sitecopy