summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTim Costen <tim.costen@isode.com>2019-10-04 14:51:06 (GMT)
committerKevin Smith <kevin.smith@isode.com>2019-10-07 09:30:04 (GMT)
commit2239cdae45b39e675877ae32c86c47bcadce3090 (patch)
tree5ee18af14ee9e9ee6f8616d352b4e808cfd95e4b /Swiften/TLS
parent2ad1938c50f9fe57fe3dd98eb9f4bb711ac52acd (diff)
downloadswift-2239cdae45b39e675877ae32c86c47bcadce3090.zip
swift-2239cdae45b39e675877ae32c86c47bcadce3090.tar.bz2
Add ability to set external Trust Anchors to Swift OpenSSL context
Add a new (optional) field to TLSContext, which allows a vector of Trust Anchor certificates to be specified. Inside OpenSSLContext::configure, pass the X509 components of these certificates into the OpenSSL context: these are now available for client certificate verification in any callback method set via TLSOptions.verifyCertificateCallback. JIRA: LINK-1765 Test-information: Tested via MLink unit tests. No leaks reported. Change-Id: Ie9cc2051ee212249a12a4bc71b62306b5bce3013
Diffstat (limited to 'Swiften/TLS')
-rw-r--r--Swiften/TLS/OpenSSL/OpenSSLContext.cpp15
-rw-r--r--Swiften/TLS/TLSOptions.h6
2 files changed, 21 insertions, 0 deletions
diff --git a/Swiften/TLS/OpenSSL/OpenSSLContext.cpp b/Swiften/TLS/OpenSSL/OpenSSLContext.cpp
index d9560de..6dd75d6 100644
--- a/Swiften/TLS/OpenSSL/OpenSSLContext.cpp
+++ b/Swiften/TLS/OpenSSL/OpenSSLContext.cpp
@@ -396,6 +396,21 @@ bool OpenSSLContext::configure(const TLSOptions &options)
updateOptionIfPresent(options.disableTLSRollBackBug, SSL_OP_TLS_ROLLBACK_BUG);
updateOptionIfPresent(options.singleDHUse, SSL_OP_SINGLE_DH_USE);
+ if (options.trustAnchors) {
+ // Add any additional Trust Anchors which are present in the TLSOptions
+ X509_STORE* store = SSL_CTX_get_cert_store(context_.get());
+
+ if (store) {
+ for (auto& certificate : *options.trustAnchors) {
+ auto openSSLCert = dynamic_cast<OpenSSLCertificate*>(certificate.get());
+ if (openSSLCert && openSSLCert->getInternalX509()) {
+ X509_STORE_add_cert(store, openSSLCert->getInternalX509().get());
+ // Don't need to increment reference count as X509_STORE_add_cert does thiS
+ }
+ }
+ }
+ }
+
return true;
}
diff --git a/Swiften/TLS/TLSOptions.h b/Swiften/TLS/TLSOptions.h
index 56648a3..4109096 100644
--- a/Swiften/TLS/TLSOptions.h
+++ b/Swiften/TLS/TLSOptions.h
@@ -8,6 +8,7 @@
namespace Swift {
class TLSContext;
+ class Certificate;
class TLSOptions {
public:
@@ -62,5 +63,10 @@ namespace Swift {
*/
boost::optional<std::function<int(const TLSContext *)>> verifyCertificateCallback;
+
+ /**
+ * Allows specification of application-specific Trust Anchors
+ */
+ boost::optional<std::vector<std::shared_ptr<Certificate>>> trustAnchors;
};
}