X-Git-Url: http://www.privoxy.org/gitweb/?p=privoxy.git;a=blobdiff_plain;f=ssl_common.c;h=6ed067f946e79348c2c81ad889c421b0bef9ef90;hp=c7bd538aab8b8fc9c05ed33ce0676f4210e60e1c;hb=23445442f4bf0aa0bcf6e35df09daf8ef0d69d99;hpb=afa231b8e31bbf0489303df30d103db2d737cd18 diff --git a/ssl_common.c b/ssl_common.c index c7bd538a..6ed067f9 100644 --- a/ssl_common.c +++ b/ssl_common.c @@ -7,7 +7,7 @@ * not depend on particular TLS/SSL library. * * Copyright : Written by and Copyright (c) 2017 Vaclav Svec. FIT CVUT. - * Copyright (C) 2018-2020 by Fabian Keil + * Copyright (C) 2018-2021 by Fabian Keil * * This program is free software; you can redistribute it * and/or modify it under the terms of the GNU General @@ -31,6 +31,7 @@ #include #include +#include #include "config.h" #include "project.h" #include "miscutil.h" @@ -327,7 +328,7 @@ extern void ssl_send_certificate_error(struct client_state *csp) /* Header of message with certificate information */ const char message_begin[] = - "HTTP/1.1 200 OK\r\n" + "HTTP/1.1 403 Certificate validation failed\r\n" "Content-Type: text/html\r\n" "Connection: close\r\n\r\n" "\n" @@ -407,7 +408,7 @@ extern void ssl_send_certificate_error(struct client_state *csp) /* * Sending final message to client */ - ssl_send_data(ssl_attr, (const unsigned char *)message, strlen(message)); + (void)ssl_send_data(ssl_attr, (const unsigned char *)message, strlen(message)); free_certificate_chain(csp); @@ -698,3 +699,52 @@ extern int host_is_ip_address(const char *host) return 1; } + + +/********************************************************************* + * + * Function : enforce_sane_certificate_state + * + * Description : Makes sure the certificate state is sane. + * + * Parameters : + * 1 : certificate = Path to the potentionally existing certifcate. + * 2 : key = Path to the potentionally existing key. + * + * Returns : -1 => Error + * 0 => Certificate state is sane + * + *********************************************************************/ +extern int enforce_sane_certificate_state(const char *certificate, const char *key) +{ + const int certificate_exists = file_exists(certificate); + const int key_exists = file_exists(key); + + if (!certificate_exists && key_exists) + { + log_error(LOG_LEVEL_ERROR, + "A website key already exists but there's no matching certificate. " + "Removing %s before creating a new key and certificate.", key); + if (unlink(key)) + { + log_error(LOG_LEVEL_ERROR, "Failed to unlink %s: %E", key); + + return -1; + } + } + if (certificate_exists && !key_exists) + { + log_error(LOG_LEVEL_ERROR, + "A certificate exists but there's no matching key. " + "Removing %s before creating a new key and certificate.", certificate); + if (unlink(certificate)) + { + log_error(LOG_LEVEL_ERROR, "Failed to unlink %s: %E", certificate); + + return -1; + } + } + + return 0; + +}