added fingerprintIsValid query to dcc.getSSLCertInfo()

git-svn-id: https://svn.kvirc.de/svn/trunk/kvirc@4847 17fca916-40b9-46aa-a4ea-0a15b648b75c

3 files changed, 23 insertions, 1 deletions

diff --git a/src/kvilib/net/kvi_ssl.cpp b/src/kvilib/net/kvi_ssl.cpp
index c42e3b32c..8ac69a6ab 100644
--- a/src/kvilib/net/kvi_ssl.cpp
+++ b/src/kvilib/net/kvi_ssl.cpp
@@ -593,6 +593,20 @@ void KviSSLCertificate::setX509(X509 * x509)
 	extractSignature();
 }
 
+bool KviSSLCertificate::fingerprintIsValid()
+{
+	if(!m_pX509)
+		return false;
+
+	EVP_PKEY * pkey = X509_get_pubkey(m_pX509);
+	int rv = X509_verify(m_pX509, pkey);
+	
+	// careful: https://support.ntp.org/bugs/show_bug.cgi?id=1127
+	// quote: X509_verify is a call to ASN1_item_verify which can return both 0 and -1 for error cases.
+	// In particular it can return -1 when the message digest type is not known, or memory allocation failed.
+	return rv > 0 ? true : false;
+}
+
 void KviSSLCertificate::extractSubject()
 {
 	char buffer[1024];
diff --git a/src/kvilib/net/kvi_ssl.h b/src/kvilib/net/kvi_ssl.h
index 05b526651..d52b4ce61 100644
--- a/src/kvilib/net/kvi_ssl.h
+++ b/src/kvilib/net/kvi_ssl.h
@@ -87,6 +87,8 @@ public:
 	int serialNumber(){ return m_iSerialNumber; };
 
 	int version(){ return m_iVersion; };
+	
+	bool fingerprintIsValid();
 #ifdef COMPILE_ON_WINDOWS
 	// On windows we need to override new and delete operators
 	// to ensure that always the right new/delete pair is called for an object instance
diff --git a/src/modules/dcc/libkvidcc.cpp b/src/modules/dcc/libkvidcc.cpp
index 8696b636c..015e4f7d6 100644
--- a/src/modules/dcc/libkvidcc.cpp
+++ b/src/modules/dcc/libkvidcc.cpp
@@ -2699,7 +2699,7 @@ static bool dcc_kvs_fnc_sessionList(KviKvsModuleFunctionCall * c)
 
 
 /*
-	@doc: dcc.getSSLPeerCertInfo
+	@doc: dcc.getSSLCertInfo
 	@type:
 		function
 	@title:
@@ -2737,6 +2737,7 @@ static bool dcc_kvs_fnc_sessionList(KviKvsModuleFunctionCall * c)
 		[li]serialNumber[/li]
 		[li]pemBase64[/li]
 		[li]version[/li]
+		[li]fingerprintIsValid[/li]
 		[/ul]
 		See the [module:dcc]dcc module[/module] documentation for more information.[br]
 */
@@ -2909,6 +2910,11 @@ static bool dcc_kvs_fnc_getSSLCertInfo(KviKvsModuleFunctionCall * c)
 			c->returnValue()->setInteger(pCert->version());
 			return true;
 		}
+		if(szQuery.compare("fingerprintIsValid")==0)
+		{
+			c->returnValue()->setBoolean(pCert->fingerprintIsValid());
+			return true;
+		}
 
 		c->warning(__tr2qs_ctx("Unable to get SSL informations: query not recognized","dcc"));
 		c->returnValue()->setString("");