* src/mh.c

[claws.git] / src / ssl.c

diff --git a/src/ssl.c b/src/ssl.c
index d32e843ae2da9c18d16f336c32ba15cb418c3a46..6ec7051359b9deb796cf9d6030a2975139df7756 100644 (file)
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -23,83 +23,122 @@
 
 #if USE_SSL
 
+#include "defs.h"
+
+#include <glib.h>
+
 #include "intl.h"
 #include "utils.h"
 #include "ssl.h"
 
-SSL_CTX *ssl_ctx;
-
-void ssl_init() {
-    SSL_METHOD *meth;
-               
-    SSLeay_add_ssl_algorithms();
-    meth = SSLv2_client_method();
-    SSL_load_error_strings();
-    ssl_ctx = SSL_CTX_new(meth);
-    if(ssl_ctx == NULL) {
-       debug_print(_("SSL disabled\n"));
-    } else {
-       debug_print(_("SSL loaded\n"));
-    }
+static SSL_CTX *ssl_ctx_SSLv23;
+static SSL_CTX *ssl_ctx_TLSv1;
+
+void ssl_init(void)
+{
+       SSL_library_init();
+       SSL_load_error_strings();
+
+       ssl_ctx_SSLv23 = SSL_CTX_new(SSLv23_client_method());
+       if (ssl_ctx_SSLv23 == NULL) {
+               debug_print(_("SSLv23 not available\n"));
+       } else {
+               debug_print(_("SSLv23 available\n"));
+       }
+
+       ssl_ctx_TLSv1 = SSL_CTX_new(TLSv1_client_method());
+        if (ssl_ctx_TLSv1 == NULL) {
+               debug_print(_("TLSv1 not available\n"));
+       } else {
+               debug_print(_("TLSv1 available\n"));
+       }
 }
 
-void ssl_done() {
-    if(ssl_ctx) {
-       SSL_CTX_free(ssl_ctx);
-    }
+void ssl_done(void)
+{
+       if (ssl_ctx_SSLv23) {
+               SSL_CTX_free(ssl_ctx_SSLv23);
+       }
+
+       if (ssl_ctx_TLSv1) {
+               SSL_CTX_free(ssl_ctx_TLSv1);
+       }
 }
 
-gboolean ssl_init_socket(SockInfo *sockinfo) {
-    X509 *server_cert;
+gboolean ssl_init_socket(SockInfo *sockinfo)
+{
+       return ssl_init_socket_with_method(sockinfo, SSL_METHOD_SSLv23);
+}
 
-    if(ssl_ctx == NULL) {
-       log_warning(_("SSL not available\n"));
+gboolean ssl_init_socket_with_method(SockInfo *sockinfo, SSLMethod method)
+{
+       X509 *server_cert;
+       gint ret;
+
+       switch (method) {
+               case SSL_METHOD_SSLv23:
+                       if (!ssl_ctx_SSLv23) {
+                               log_warning(_("SSL method not available\n"));
+                               return FALSE;
+                       }
+                       sockinfo->ssl = SSL_new(ssl_ctx_SSLv23);
+                       break;
+               case SSL_METHOD_TLSv1:
+                       if (!ssl_ctx_TLSv1) {
+                               log_warning(_("SSL method not available\n"));
+                               return FALSE;
+                       }
+                       sockinfo->ssl = SSL_new(ssl_ctx_TLSv1);
+                       break;
+               default:
+                       log_warning(_("Unknown SSL method *PROGRAM BUG*\n"));
+                       return FALSE;
+                       break;
+       }
 
-       return FALSE;
-    }
+       if (sockinfo->ssl == NULL) {
+               log_warning(_("Error creating ssl context\n"));
+               return FALSE;
+       }
 
-    sockinfo->ssl = SSL_new(ssl_ctx);
-    if(sockinfo->ssl == NULL) {
-       log_warning(_("Error creating ssl context\n"));
+       SSL_set_fd(sockinfo->ssl, sockinfo->sock);
+       if ((ret = SSL_connect(sockinfo->ssl)) == -1) {
+               log_warning(_("SSL connect failed (%s)\n"),
+                           ERR_error_string(ERR_get_error(), NULL));
+               return FALSE;
+       }
 
-       return FALSE;
-    }
-    SSL_set_fd(sockinfo->ssl, sockinfo->sock);
-    if(SSL_connect(sockinfo->ssl) == -1) {
-       log_warning(_("SSL connect failed\n"));
+       /* Get the cipher */
+       log_print(_("SSL connection using %s\n"), SSL_get_cipher(sockinfo->ssl));
 
-       return FALSE;
-    }
+       /* Get server's certificate (note: beware of dynamic allocation) */
 
-    /* Get the cipher */
+       if ((server_cert = SSL_get_peer_certificate(sockinfo->ssl)) != NULL) {
+               gchar *str;
 
-    log_print(_("SSL connection using %s\n"), SSL_get_cipher(sockinfo->ssl));
+               log_print(_("Server certificate:\n"));
 
-    /* Get server's certificate (note: beware of dynamic allocation) */
+               if ((str = X509_NAME_oneline(X509_get_subject_name(server_cert), 0, 0)) != NULL) {
+                       log_print(_("  Subject: %s\n"), str);
+                       free(str);
+               }
 
-    if((server_cert = SSL_get_peer_certificate(sockinfo->ssl)) != NULL) {
-       char *str;
-       
-       log_print(_("Server certificate:\n"));
+               if ((str = X509_NAME_oneline(X509_get_issuer_name(server_cert), 0, 0)) != NULL) {
+                       log_print(_("  Issuer: %s\n"), str);
+                       free(str);
+               }
 
-       if((str = X509_NAME_oneline(X509_get_subject_name (server_cert),0,0)) != NULL) {
-               log_print(_("  Subject: %s\n"), str);
-               free(str);
-       }
-       
-       if((str = X509_NAME_oneline(X509_get_issuer_name  (server_cert),0,0)) != NULL) {
-               log_print(_("  Issuer: %s\n"), str);
-               free(str);
+               X509_free(server_cert);
        }
 
-       X509_free(server_cert);
-    }
+       return TRUE;
 }
 
-void ssl_done_socket(SockInfo *sockinfo) {
-    if(sockinfo->ssl) {
-       SSL_free(sockinfo->ssl);
-    }
+void ssl_done_socket(SockInfo *sockinfo)
+{
+       if (sockinfo->ssl) {
+               SSL_free(sockinfo->ssl);
+       }
 }
 
-#endif /* USE_SSL */
\ No newline at end of file
+#endif /* USE_SSL */