| Age | Commit message (Collapse) | Author |
|---|
|
Change-Id: I1ffb6d9eabfb36c0101ee19c0cd618736d8a8bb8
|
|
This patch reflects a change to Stroke, which is described as follows:
If a TLS connection results in the server choosing an anonymous cipher
suite, then no server certificate will be returned by the server.
This ought not to happen, since XMPP clients are expected only to
propose non-anonymous cipher suites, but it could be that a client is
coded to propose anonymous suites, or that a bug in the server means
that it fails to return a server certificate.
This change updates the ServerIdentityVerifier to make it resilient
against these situations, treating this situation as equivalent to
"certificate presented by server does not verify".
Test-information:
Tested in Stroke. Untested in Swiften
Change-Id: Iec815b09b6be675edad1d479d1a0a9d6b0b91bf3
|
|
- Use boost::filesystem::path consistently for referring to files.
- Use boost::filesystem streams for I/O, such that paths are always handled
correctly.
- Use stringToPath and pathToString for conversion between strings and
boost::filesystem::path, to ensure we have consistent unicode handling
across platforms and environments. The default constructor and string
conversion uses platform-dependent encoding, depending on the global
locale set in the application, which causes problems. So, unless you are
in platform dependent code, the default constructor and string() function
should not be used. When constructing paths from other paths (e.g. using
operator/), also use stringToPath (instead of string arguments) if the path
can contain unicode characters.
Change-Id: If286bd9e71c8414afc0b24ba67e26ab7608ef6ea
|
|
Using library/platform implementation instead.
Change-Id: I2457c2dad80e6fdda023a7f31c3906ff10fe09ed
|
|
Change-Id: I4c64f954ddeca7147d729b8be07237baa15c1795
|
|
Fix sign conversion warnings.
Removing heavy unnecessary includes.
Change-Id: I992f43065498823098a875badb020c7c84fc4797
|
|
Change-Id: I70109624b4bd7aab9ba679a3eaabc225dd64a03a
|
|
Change-Id: If349586fd131f1661485acdea573f97d1726c731
|
|
Change-Id: I339364406d92226203af876f558bc07686d75cbf
|
|
It used to be disabled for Mac OS X 10.5 or greater but it turns out system's OpenSSL doesn't add those on Mac OS X 10.8.
License: This patch is BSD-licensed, see http://www.opensource.org/licenses/bsd-license.php
|
|
Added missing SWIFTEN_API declarations.
Changed test infrastructure to extend path before running
tests.
|
|
All applications succesfully link against Swiften.dll.
|
|
The peer certificate chain contains the peer certificate, so this was
redundant.
|
|
|
|
certificate viewers on click.
Native viewers for Windows and Mac OS X are implemented.
Added TODOs to OpenSSL based TLS interface related to CRL and OCSP.
Resolves: #167
License: This patch is BSD-licensed, see http://www.opensource.org/licenses/bsd-license.php
|
|
|
|
|
|
|
|
checking.
License: This patch is BSD-licensed, see http://www.opensource.org/licenses/bsd-license.php
|
|
revocation checking."
This reverts commit e33b7a309e0424450ab00bc6180df95c6c049195.
|
|
This reverts commit 856f970d14c5c32b80fc5ea359d4e567b51578a0.
|
|
Resolves: #1012
|
|
|
|
Added a method on TLSContextFactory to disable revocation checks if
wanted.
|
|
checking.
|
|
Resolves: #1099
|
|
Makes Swift disconnect if a smartcard used for auth is removed.
Fixes compilation.
Changes code style in a few places.
|
|
(if any)
This patch implements monitoring for SmartCard ejection. This is done by
periodically (currently every second) polling smart card reader for
the smart card status. If the smart card status becomes "absent" or "unknown"
(an error to query the smartcard), the TLS session is aborted.
This usually results in an attempt to reestablish TLS which will pop up
"please insert the smart card" dialog.
License: This patch is BSD-licensed, see Documentation/Licenses/BSD-simplified.txt for details.
|
|
|
|
|
|
revocation.
License: This patch is BSD-licensed, see http://www.opensource.org/licenses/bsd-license.php
|
|
This patch includes the following fixes:
1) Correctly hex encode SHA1 hashes when generating certstore: URIs
2) Use the newly parsed certificate store reference, not the old value
3) Need to call findCertificateInStore() when finding the selected TLS
certificate in Schannel code. Without that "sha1:XXXX" URIs don't
work
Also minor optimization of string operations.
License: This patch is BSD-licensed, see Documentation/Licenses/BSD-simplified.txt for details.
|
|
Resolves: #903
|
|
Value of the certificate's subject DN leftmost RDN is not necessarily unique.
This change switches to using SHA1 hash of DER certificates,
which should guaranty uniqueness.
License: This patch is BSD-licensed, see Documentation/Licenses/BSD-simplified.txt for details.
|
|
|
|
Now connects successfully with or without TLS(with cert)
|
|
Introduced a new parent class for all certificates with keys
(class CertificateWithKey is the new parent for PKCS12Certificate.)
Switched to using "CertificateWithKey *" instead of "const CertificateWithKey&"
Added calling of a Windows dialog for certificate selection when Schannel
TLS implementation is used.
This compiles, but is not tested.
License: This patch is BSD-licensed, see Documentation/Licenses/BSD-simplified.txt for details.
|
|
Includes:
Initial cleanup of SChannel code; compiling on non-Windows
Be willing to compile Swift with SChannel
Undo some (presumably accidental) OpenSSL changes
Where TLS doesn't support finish messages (SChannel), don't try -PLUS
|
|
License: This patch is BSD-licensed, see http://www.opensource.org/licenses/bsd-license.php
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Resolves: #798
|
|
|
|
|
Swift