CVS: sylpheedclaws/sylpheed-claws/src/common ssl_certificate.c,1.4.2.13,1.4.2.14 ssl_certificate.h,1.1.4.5,1.1.4.6

Update of /pack/anoncvs/sylpheedclaws/sylpheed-claws/src/common
In directory sunsite.dk:/tmp/cvs-serv5089/src/common

Modified Files:
      Tag: gtk2
	ssl_certificate.c ssl_certificate.h 
Log Message:
2006-12-06 [colin]	2.6.1cvs8

	* src/ssl_manager.c
	* src/common/ssl_certificate.c
	* src/common/ssl_certificate.h
		Handle multiple certificates per host/port

Index: ssl_certificate.c
===================================================================
RCS file: /pack/anoncvs/sylpheedclaws/sylpheed-claws/src/common/ssl_certificate.c,v
retrieving revision 1.4.2.13
retrieving revision 1.4.2.14
diff -u -d -r1.4.2.13 -r1.4.2.14
--- ssl_certificate.c	2006/09/28 15:22:25	1.4.2.13
+++ ssl_certificate.c	2006/12/06 07:24:40	1.4.2.14
@@ -128,6 +128,8 @@
 static SSLCertificate *ssl_certificate_new_lookup(X509 *x509_cert, gchar *host, gushort port, gboolean lookup)
 {
 	SSLCertificate *cert = g_new0(SSLCertificate, 1);
+	unsigned int n;
+	unsigned char md[EVP_MAX_MD_SIZE];	
 	
 	if (host == NULL || x509_cert == NULL) {
 		ssl_certificate_destroy(cert);
@@ -139,6 +141,11 @@
 	else
 		cert->host = g_strdup(host);
 	cert->port = port;
+	
+	/* fingerprint */
+	X509_digest(cert->x509_cert, EVP_md5(), md, &n);
+	cert->fingerprint = readable_fingerprint(md, (int)n);
+
 	return cert;
 }
 
@@ -157,7 +164,7 @@
 	port = g_strdup_printf("%d", cert->port);
 	file = g_strconcat(get_rc_dir(), G_DIR_SEPARATOR_S, 
 			  "certs", G_DIR_SEPARATOR_S,
-			  cert->host, ".", port, ".cert", NULL);
+			  cert->host, ".", port, ".", cert->fingerprint, ".cert", NULL);
 
 	g_free(port);
 	fp = g_fopen(file, "wb");
@@ -261,6 +268,7 @@
 	if (cert->x509_cert)
 		X509_free(cert->x509_cert);
 	g_free(cert->host);
+	g_free(cert->fingerprint);
 	g_free(cert);
 	cert = NULL;
 }
@@ -272,25 +280,26 @@
 	buf = g_strdup_printf("%d", cert->port);
 	file = g_strconcat(get_rc_dir(), G_DIR_SEPARATOR_S, 
 			  "certs", G_DIR_SEPARATOR_S,
-			  cert->host, ".", buf, ".cert", NULL);
+			  cert->host, ".", buf, ".", cert->fingerprint, ".cert", NULL);
 	g_unlink (file);
-	g_free(buf);
 	g_free(file);
+	g_free(buf);
 }
 
-SSLCertificate *ssl_certificate_find (gchar *host, gushort port)
+SSLCertificate *ssl_certificate_find (gchar *host, gushort port, const gchar *fingerprint)
 {
-	return ssl_certificate_find_lookup (host, port, TRUE);
+	return ssl_certificate_find_lookup (host, port, fingerprint, TRUE);
 }
 
-SSLCertificate *ssl_certificate_find_lookup (gchar *host, gushort port, gboolean lookup)
+SSLCertificate *ssl_certificate_find_lookup (gchar *host, gushort port, const gchar *fingerprint, gboolean lookup)
 {
-	gchar *file;
+	gchar *file = NULL;
 	gchar *buf;
 	gchar *fqdn_host;
 	SSLCertificate *cert = NULL;
 	X509 *tmp_x509;
-	FILE *fp;
+	FILE *fp = NULL;
+	gboolean must_rename = FALSE;
 
 	if (lookup)
 		fqdn_host = get_fqdn(host);
@@ -298,27 +307,52 @@
 		fqdn_host = g_strdup(host);
 
 	buf = g_strdup_printf("%d", port);
-	file = g_strconcat(get_rc_dir(), G_DIR_SEPARATOR_S, 
+	
+	if (fingerprint != NULL) {
+		file = g_strconcat(get_rc_dir(), G_DIR_SEPARATOR_S, 
+			  "certs", G_DIR_SEPARATOR_S,
+			  fqdn_host, ".", buf, ".", fingerprint, ".cert", NULL);
+		fp = g_fopen(file, "rb");
+	}
+	if (fp == NULL) {
+		/* see if we have the old one */
+		g_free(file);
+		file = g_strconcat(get_rc_dir(), G_DIR_SEPARATOR_S, 
 			  "certs", G_DIR_SEPARATOR_S,
 			  fqdn_host, ".", buf, ".cert", NULL);
+		fp = g_fopen(file, "rb");
 
-	g_free(buf);
-	fp = g_fopen(file, "rb");
+		if (fp)
+			must_rename = (fingerprint != NULL);
+	}
 	if (fp == NULL) {
 		g_free(file);
 		g_free(fqdn_host);
+		g_free(buf);
 		return NULL;
 	}
 	
-	
 	if ((tmp_x509 = d2i_X509_fp(fp, 0)) != NULL) {
 		cert = ssl_certificate_new_lookup(tmp_x509, fqdn_host, port, lookup);
 		X509_free(tmp_x509);
 	}
 	fclose(fp);
 	g_free(file);
-	g_free(fqdn_host);
 	
+	if (must_rename) {
+		gchar *old = g_strconcat(get_rc_dir(), G_DIR_SEPARATOR_S, 
+			  "certs", G_DIR_SEPARATOR_S,
+			  fqdn_host, ".", buf, ".cert", NULL);
+		gchar *new = g_strconcat(get_rc_dir(), G_DIR_SEPARATOR_S, 
+			  "certs", G_DIR_SEPARATOR_S,
+			  fqdn_host, ".", buf, ".", fingerprint, ".cert", NULL);
+		move_file(old, new, TRUE);
+		g_free(old);
+		g_free(new);
+	}
+	g_free(buf);
+	g_free(fqdn_host);
+
 	return cert;
 }
 
@@ -370,7 +404,10 @@
 	SSLCertificate *known_cert;
 	SSLCertHookData cert_hook_data;
 	gchar *fqdn_host = NULL;	
-	
+	gchar *fingerprint;
+	unsigned int n;
+	unsigned char md[EVP_MAX_MD_SIZE];	
+
 	if (fqdn)
 		fqdn_host = g_strdup(fqdn);
 	else if (host)
@@ -388,8 +425,13 @@
 		return FALSE;
 	}
 
-	known_cert = ssl_certificate_find_lookup (fqdn_host, port, FALSE);
+	/* fingerprint */
+	X509_digest(x509_cert, EVP_md5(), md, &n);
+	fingerprint = readable_fingerprint(md, (int)n);
+
+	known_cert = ssl_certificate_find_lookup (fqdn_host, port, fingerprint, FALSE);
 
+	g_free(fingerprint);
 	g_free(fqdn_host);
 
 	if (known_cert == NULL) {

Index: ssl_certificate.h
===================================================================
RCS file: /pack/anoncvs/sylpheedclaws/sylpheed-claws/src/common/ssl_certificate.h,v
retrieving revision 1.1.4.5
retrieving revision 1.1.4.6
diff -u -d -r1.1.4.5 -r1.1.4.6
--- ssl_certificate.h	2006/09/14 16:32:49	1.1.4.5
+++ ssl_certificate.h	2006/12/06 07:24:40	1.1.4.6
@@ -40,6 +40,7 @@
 	X509 *x509_cert;
 	gchar *host;
 	gushort port;
+	gchar *fingerprint;
 };
 
 typedef struct _SSLCertHookData SSLCertHookData;
@@ -52,8 +53,8 @@
 	gboolean accept;
 };
 
-SSLCertificate *ssl_certificate_find (gchar *host, gushort port);
-SSLCertificate *ssl_certificate_find_lookup (gchar *host, gushort port, gboolean lookup);
+SSLCertificate *ssl_certificate_find (gchar *host, gushort port, const gchar *fingerprint);
+SSLCertificate *ssl_certificate_find_lookup (gchar *host, gushort port, const gchar *fingerprint, gboolean lookup);
 gboolean ssl_certificate_check (X509 *x509_cert, gchar *fqdn, gchar *host, gushort port);
 char* ssl_certificate_to_string(SSLCertificate *cert);
 void ssl_certificate_destroy(SSLCertificate *cert);