1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
package gui
import (
"crypto/x509"
"errors"
"github.com/twstrike/coyim/config"
"github.com/twstrike/coyim/digests"
ourtls "github.com/twstrike/coyim/tls"
)
func (u *gtkUI) verifierFor(account *account) ourtls.Verifier {
conf := account.session.GetConfig()
return &ourtls.BasicVerifier{
OnNoPeerCertificates: func() { account.session.SetWantToBeOnline(false) },
OnPinDeny: func() { account.session.SetWantToBeOnline(false) },
HasPinned: func(certs []*x509.Certificate) bool { return checkPinned(conf, certs) },
VerifyFailure: func(certs []*x509.Certificate, err error) error {
if <-u.certificateFailedToVerify(account, certs) {
return nil
}
return errors.New("tls: failed to verify TLS certificate: " + err.Error())
},
VerifyHostnameFailure: func(certs []*x509.Certificate, origin string, err error) error {
if <-u.certificateFailedToVerifyHostname(account, certs, origin) {
return nil
}
return errors.New("tls: failed to match TLS certificate to name: " + err.Error())
},
AddCert: func(cert *x509.Certificate) {
conf.SaveCert(cert.Subject.CommonName, cert.Issuer.CommonName, digests.Sha3_256(cert.Raw))
u.SaveConfig()
},
AskPinning: func(certs []*x509.Certificate) error {
if <-u.validCertificateShouldBePinned(account, certs) {
return nil
}
account.session.SetWantToBeOnline(false)
return errors.New("tls: you manually denied the possibility of connecting using this certificate")
},
HasCertificates: func() bool { return len(conf.Certificates) > 0 },
NeedToCheckPins: conf.PinningPolicy != "none",
PinningPolicy: conf.PinningPolicy,
}
}
func (u *gtkUI) unassociatedVerifier() ourtls.Verifier {
return &ourtls.BasicVerifier{
OnNoPeerCertificates: func() {},
OnPinDeny: func() {},
HasPinned: func(certs []*x509.Certificate) bool { return false },
VerifyFailure: func(certs []*x509.Certificate, err error) error {
if <-u.certificateFailedToVerify(nil, certs) {
return nil
}
return errors.New("tls: failed to verify TLS certificate: " + err.Error())
},
VerifyHostnameFailure: func(certs []*x509.Certificate, origin string, err error) error {
if <-u.certificateFailedToVerifyHostname(nil, certs, origin) {
return nil
}
return errors.New("tls: failed to match TLS certificate to name: " + err.Error())
},
AddCert: func(cert *x509.Certificate) {},
AskPinning: func(certs []*x509.Certificate) error {
if <-u.validCertificateShouldBePinned(nil, certs) {
return nil
}
return errors.New("tls: you manually denied the possibility of connecting using this certificate")
},
HasCertificates: func() bool { return false },
NeedToCheckPins: false,
PinningPolicy: "",
}
}
func checkPinned(c *config.Account, certs []*x509.Certificate) bool {
if c != nil {
for _, pin := range c.Certificates {
if pin.Matches(certs[0]) {
return true
}
}
}
return false
}
|
