X-Git-Url: http://www.privoxy.org/gitweb/?a=blobdiff_plain;ds=inline;f=ssl.c;h=e2389f0800ff057285f183f116f0f30246d21de6;hb=416fb84eaeaeaef12a88f4cc5885cf0ec7f74dd7;hp=acd9f903db3c348c2a25d196e8c33c7c751729a4;hpb=b765c85f842fb50171fff08b87e6b0400559a476;p=privoxy.git diff --git a/ssl.c b/ssl.c index acd9f903..e2389f08 100644 --- a/ssl.c +++ b/ssl.c @@ -28,6 +28,7 @@ * *********************************************************************/ +#include #include #include @@ -1336,33 +1337,17 @@ static int ssl_certificate_is_invalid(const char *cert_file) static int generate_certificate_valid_date(time_t time_spec, char *buffer, size_t buffer_size) { -#ifdef HAVE_GMTIME_R struct tm valid_date; -#endif struct tm *timeptr; size_t ret; -#ifdef HAVE_GMTIME_R - timeptr = gmtime_r(&time_spec, &valid_date); -#elif defined(MUTEX_LOCKS_AVAILABLE) - privoxy_mutex_lock(&gmtime_mutex); - timeptr = gmtime(&time_spec); -#else -#warning Using unlocked gmtime() - timeptr = gmtime(&time_spec); -#endif + timeptr = privoxy_gmtime_r(&time_spec, &valid_date); if (NULL == timeptr) { -#if !defined(HAVE_GMTIME_R) && defined(MUTEX_LOCKS_AVAILABLE) - privoxy_mutex_unlock(&gmtime_mutex); -#endif return 1; } ret = strftime(buffer, buffer_size, "%Y%m%d%H%M%S", timeptr); -#if !defined(HAVE_GMTIME_R) && defined(MUTEX_LOCKS_AVAILABLE) - privoxy_mutex_unlock(&gmtime_mutex); -#endif if (ret != 14) { return 1; @@ -1535,6 +1520,53 @@ exit: } + +/********************************************************************* + * + * Function : host_is_ip_address + * + * Description : Checks whether or not a host is specified by + * IP address. Does not actually validate the + * address. + * + * Parameters : + * 1 : host = The host name to check + * + * Returns : 1 => Yes + * 0 => No + * + *********************************************************************/ +static int host_is_ip_address(const char *host) +{ + const char *p; + + if (NULL != strstr(host, ":")) + { + /* Assume an IPv6 address. */ + return 1; + } + + for (p = host; *p; p++) + { + if (*p != '.') + { + if (!privoxy_isdigit(*p)) + { + /* Not a dot or digit so it can't be an IPv4 address. */ + return 0; + } + } + } + + /* + * Host only consists of dots and digits so + * assume that is an IPv4 address. + */ + return 1; + +} + + /********************************************************************* * * Function : generate_webpage_certificate @@ -1910,7 +1942,8 @@ static int generate_webpage_certificate(struct client_state *csp) } #endif /* MBEDTLS_SHA1_C */ - if (set_subject_alternative_name(&cert, csp->http->host)) + if (!host_is_ip_address(csp->http->host) && + set_subject_alternative_name(&cert, csp->http->host)) { /* Errors are already logged by set_subject_alternative_name() */ ret = -1; @@ -2080,7 +2113,12 @@ extern void ssl_send_certificate_error(struct client_state *csp) "HTTP/1.1 200 OK\r\n" "Content-Type: text/html\r\n" "Connection: close\r\n\r\n" - "

Server certificate verification failed

Reason: "; + "\n" + "Server certificate verification failed\n" + "

Server certificate verification failed

\n" + "

Privoxy was unable " + "to securely connnect to the destination server.

" + "

Reason: "; const char message_end[] = "\r\n\r\n"; char reason[INVALID_CERT_INFO_BUF_SIZE]; memset(reason, 0, sizeof(reason));