X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=ssl.c;h=85701ce03a47fe6b1b88b8d0700fa18b4365e230;hp=852a9ce5304256a56700b8f9291736269a19c2bc;hb=be8e2be29e4afd88288c3b14a374d24b61e4d28d;hpb=c0ee8dc3a526fc3090a50e9559a3ceab938dbfb2 diff --git a/ssl.c b/ssl.c index 852a9ce5..85701ce0 100644 --- a/ssl.c +++ b/ssl.c @@ -28,6 +28,7 @@ * *********************************************************************/ +#include #include #include @@ -1337,17 +1338,16 @@ static int generate_certificate_valid_date(time_t time_spec, char *buffer, size_t buffer_size) { struct tm valid_date; + struct tm *timeptr; size_t ret; -#ifndef HAVE_GMTIME_R -#error HTTP inspection currently requires gmtime_r() which seems to be missing -#endif - if (NULL == gmtime_r(&time_spec, &valid_date)) + timeptr = privoxy_gmtime_r(&time_spec, &valid_date); + if (NULL == timeptr) { return 1; } - ret = strftime(buffer, buffer_size, "%Y%m%d%H%M%S", &valid_date); + ret = strftime(buffer, buffer_size, "%Y%m%d%H%M%S", timeptr); if (ret != 14) { return 1; @@ -1520,6 +1520,50 @@ exit: } + +/********************************************************************* + * + * Function : host_is_ip_address + * + * Description : Checks whether or not a host is specified by + * IP address. Does not actually validate the + * address. + * + * Parameters : + * 1 : host = The host name to check + * + * Returns : 1 => Yes + * 0 => No + * + *********************************************************************/ +static int host_is_ip_address(const char *host) +{ + const char *p; + + if (NULL != strstr(host, ":")) + { + /* Assume an IPv6 address. */ + return 1; + } + + for (p = host; *p; p++) + { + if ((*p != '.') && !privoxy_isdigit(*p)) + { + /* Not a dot or digit so it can't be an IPv4 address. */ + return 0; + } + } + + /* + * Host only consists of dots and digits so + * assume that is an IPv4 address. + */ + return 1; + +} + + /********************************************************************* * * Function : generate_webpage_certificate @@ -1895,7 +1939,8 @@ static int generate_webpage_certificate(struct client_state *csp) } #endif /* MBEDTLS_SHA1_C */ - if (set_subject_alternative_name(&cert, csp->http->host)) + if (!host_is_ip_address(csp->http->host) && + set_subject_alternative_name(&cert, csp->http->host)) { /* Errors are already logged by set_subject_alternative_name() */ ret = -1; @@ -2065,7 +2110,12 @@ extern void ssl_send_certificate_error(struct client_state *csp) "HTTP/1.1 200 OK\r\n" "Content-Type: text/html\r\n" "Connection: close\r\n\r\n" - "

Server certificate verification failed

Reason: "; + "\n" + "Server certificate verification failed\n" + "

Server certificate verification failed

\n" + "

Privoxy was unable " + "to securely connnect to the destination server.

" + "

Reason: "; const char message_end[] = "\r\n\r\n"; char reason[INVALID_CERT_INFO_BUF_SIZE]; memset(reason, 0, sizeof(reason));