projects / claws.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
2012-08-09 [colin] 3.8.1cvs27
[claws.git] / src / gtk / sslcertwindow.c
diff --git a/src/gtk/sslcertwindow.c b/src/gtk/sslcertwindow.c
index e3eb94f509de023916e3d3bedc3e9a363b4d3026..f064765290bda412f13b3ac198806e133bf3b9a7 100644 (file)
--- a/src/gtk/sslcertwindow.c
+++ b/src/gtk/sslcertwindow.c
@@ -1,6 +1,6 @@
 /*
  * Claws Mail -- a GTK+ based, lightweight, and fast e-mail client
- * Copyright (C) 1999-2009 Colin Leroy <colin@colino.net> 
+ * Copyright (C) 1999-2012 Colin Leroy <colin@colino.net> 
  * and the Claws Mail team
  *
  * This program is free software; you can redistribute it and/or modify
@@ -20,6 +20,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include "config.h"
+#include "claws-features.h"
 #endif
 
 #ifdef USE_GNUTLS
@@ -94,8 +95,8 @@ static GtkWidget *cert_presenter(SSLCertificate *cert)
                tmp = g_malloc(BUFFSIZE);
                if (gnutls_x509_crt_get_issuer_dn_by_oid(cert->x509_cert, 
                        GNUTLS_OID_X520_COUNTRY_NAME, 0, 0, tmp, &n) == 0) {
-                       strncat(issuer_location, ", ", BUFFSIZE-strlen(issuer_location));
-                       strncat(issuer_location, tmp, BUFFSIZE-strlen(issuer_location));
+                       strncat(issuer_location, ", ", BUFFSIZE-strlen(issuer_location)-1);
+                       strncat(issuer_location, tmp, BUFFSIZE-strlen(issuer_location)-1);
                }
                g_free(tmp);
        }
@@ -121,8 +122,8 @@ static GtkWidget *cert_presenter(SSLCertificate *cert)
                tmp = g_malloc(BUFFSIZE);
                if (gnutls_x509_crt_get_dn_by_oid(cert->x509_cert, 
                        GNUTLS_OID_X520_COUNTRY_NAME, 0, 0, tmp, &n) == 0) {
-                       strncat(subject_location, ", ", BUFFSIZE-strlen(subject_location));
-                       strncat(subject_location, tmp, BUFFSIZE-strlen(subject_location));
+                       strncat(subject_location, ", ", BUFFSIZE-strlen(subject_location)-1);
+                       strncat(subject_location, tmp, BUFFSIZE-strlen(subject_location)-1);
                }
                g_free(tmp);
        }
@@ -267,14 +268,15 @@ static gboolean sslcert_ask_hook(gpointer source, gpointer data)
 {
        SSLCertHookData *hookdata = (SSLCertHookData *)source;
 
+       if (hookdata == NULL) {
+               return FALSE;
+       }
+       
        if (prefs_common.skip_ssl_cert_check) {
                hookdata->accept = TRUE;
                return TRUE;
        }
 
-       if (hookdata == NULL) {
-               return FALSE;
-       }
        if (hookdata->old_cert == NULL) {
                if (hookdata->expired)
                        hookdata->accept = sslcertwindow_ask_expired_cert(hookdata->cert);
@@ -283,6 +285,7 @@ static gboolean sslcert_ask_hook(gpointer source, gpointer data)
        } else {
                hookdata->accept = sslcertwindow_ask_changed_cert(hookdata->old_cert, hookdata->cert);
        }
+
        return TRUE;
 }
 
@@ -302,6 +305,24 @@ void sslcertwindow_show_cert(SSLCertificate *cert)
        g_free(buf);
 }
 
+static gchar *sslcertwindow_get_invalid_str(SSLCertificate *cert)
+{
+       gchar *subject_cn = NULL;
+       gchar *str = NULL;
+
+       if (ssl_certificate_check_subject_cn(cert))
+               return g_strdup("");
+       
+       subject_cn = ssl_certificate_get_subject_cn(cert);
+       
+       str = g_strdup_printf(_("Certificate is for %s, but connection is to %s.\n"
+                               "You may be connecting to a rogue server.\n\n"), 
+                               subject_cn, cert->host);
+       g_free(subject_cn);
+       
+       return str;
+}
+
 static gboolean sslcertwindow_ask_new_cert(SSLCertificate *cert)
 {
        gchar *buf, *sig_status;
@@ -310,9 +331,13 @@ static gboolean sslcertwindow_ask_new_cert(SSLCertificate *cert)
        GtkWidget *label;
        GtkWidget *button;
        GtkWidget *cert_widget;
-       
+       gchar *invalid_str = sslcertwindow_get_invalid_str(cert);
+       const gchar *title;
+
        vbox = gtk_vbox_new(FALSE, 5);
-       buf = g_strdup_printf(_("Certificate for %s is unknown.\nDo you want to accept it?"), cert->host);
+       buf = g_strdup_printf(_("Certificate for %s is unknown.\n%sDo you want to accept it?"), cert->host, invalid_str);
+       g_free(invalid_str);
+
        label = gtk_label_new(buf);
        gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
        gtk_box_pack_start(GTK_BOX(vbox), label, TRUE, TRUE, 0);
@@ -335,7 +360,12 @@ static gboolean sslcertwindow_ask_new_cert(SSLCertificate *cert)
        cert_widget = cert_presenter(cert);
        gtk_container_add(GTK_CONTAINER(button), cert_widget);
 
-       val = alertpanel_full(_("Unknown SSL Certificate"), NULL,
+       if (!ssl_certificate_check_subject_cn(cert))
+               title = _("SSL certificate is invalid");
+       else
+               title = _("SSL Certificate is unknown");
+
+       val = alertpanel_full(title, NULL,
                              _("_Cancel connection"), _("_Accept and save"), NULL,
                              FALSE, vbox, ALERT_QUESTION, G_ALERTDEFAULT);
        
@@ -350,9 +380,13 @@ static gboolean sslcertwindow_ask_expired_cert(SSLCertificate *cert)
        GtkWidget *label;
        GtkWidget *button;
        GtkWidget *cert_widget;
-       
+       gchar *invalid_str = sslcertwindow_get_invalid_str(cert);
+       const gchar *title;
+
        vbox = gtk_vbox_new(FALSE, 5);
-       buf = g_strdup_printf(_("Certificate for %s is expired.\nDo you want to continue?"), cert->host);
+       buf = g_strdup_printf(_("Certificate for %s is expired.\n%sDo you want to continue?"), cert->host, invalid_str);
+       g_free(invalid_str);
+
        label = gtk_label_new(buf);
        gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
        gtk_box_pack_start(GTK_BOX(vbox), label, TRUE, TRUE, 0);
@@ -376,7 +410,12 @@ static gboolean sslcertwindow_ask_expired_cert(SSLCertificate *cert)
        cert_widget = cert_presenter(cert);
        gtk_container_add(GTK_CONTAINER(button), cert_widget);
 
-       val = alertpanel_full(_("Expired SSL Certificate"), NULL,
+       if (!ssl_certificate_check_subject_cn(cert))
+               title = _("SSL certificate is invalid and expired");
+       else
+               title = _("SSL certificate is expired");
+
+       val = alertpanel_full(title, NULL,
                              _("_Cancel connection"), _("_Accept"), NULL,
                              FALSE, vbox, ALERT_QUESTION, G_ALERTDEFAULT);
        
@@ -393,7 +432,9 @@ static gboolean sslcertwindow_ask_changed_cert(SSLCertificate *old_cert, SSLCert
        GtkWidget *label;
        GtkWidget *button;
        AlertValue val;
-       
+       gchar *invalid_str = sslcertwindow_get_invalid_str(new_cert);
+       const gchar *title;
+
        vbox = gtk_vbox_new(FALSE, 5);
        label = gtk_label_new(_("New certificate:"));
        gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
@@ -407,7 +448,9 @@ static gboolean sslcertwindow_ask_changed_cert(SSLCertificate *old_cert, SSLCert
        gtk_widget_show_all(vbox);
        
        vbox2 = gtk_vbox_new(FALSE, 5);
-       buf = g_strdup_printf(_("Certificate for %s has changed. Do you want to accept it?"), new_cert->host);
+       buf = g_strdup_printf(_("Certificate for %s has changed.\n%sDo you want to accept it?"), new_cert->host, invalid_str);
+       g_free(invalid_str);
+
        label = gtk_label_new(buf);
        gtk_misc_set_alignment (GTK_MISC (label), 0, 0.5);
        gtk_box_pack_start(GTK_BOX(vbox2), label, TRUE, TRUE, 0);
@@ -430,7 +473,11 @@ static gboolean sslcertwindow_ask_changed_cert(SSLCertificate *old_cert, SSLCert
        gtk_box_pack_start(GTK_BOX(vbox2), button, FALSE, FALSE, 0);
        gtk_container_add(GTK_CONTAINER(button), vbox);
 
-       val = alertpanel_full(_("Changed SSL Certificate"), NULL,
+       if (!ssl_certificate_check_subject_cn(new_cert))
+               title = _("SSL certificate changed and is invalid");
+       else
+               title = _("SSL certificate changed");
+       val = alertpanel_full(title, NULL,
                              _("_Cancel connection"), _("_Accept and save"), NULL,
                              FALSE, vbox2, ALERT_WARNING, G_ALERTDEFAULT);
        
Claws Mail