diff options
Diffstat (limited to 'libdino')
| -rw-r--r-- | libdino/src/service/connection_manager.vala | 14 | ||||
| -rw-r--r-- | libdino/src/service/registration.vala | 16 |
2 files changed, 25 insertions, 5 deletions
diff --git a/libdino/src/service/connection_manager.vala b/libdino/src/service/connection_manager.vala index 40cd21d4..3ea6386b 100644 --- a/libdino/src/service/connection_manager.vala +++ b/libdino/src/service/connection_manager.vala @@ -196,7 +196,9 @@ public class ConnectionManager : Object { connection_directly_retry[account] = false; change_connection_state(account, ConnectionState.CONNECTING); - stream_result = yield Xmpp.establish_stream(account.bare_jid, module_manager.get_modules(account, resource), log_options); + stream_result = yield Xmpp.establish_stream(account.bare_jid, module_manager.get_modules(account, resource), log_options, + (_, peer_cert, errors) => { return on_invalid_certificate(account.domainpart, peer_cert, errors); } + ); connections[account].stream = stream_result.stream; connection_ongoing[account] = false; @@ -368,6 +370,16 @@ public class ConnectionManager : Object { connection_errors[account] = error; connection_error(account, error); } + + public static bool on_invalid_certificate(string domain, TlsCertificate peer_cert, TlsCertificateFlags errors) { + if (domain.has_suffix(".onion") && errors == TlsCertificateFlags.UNKNOWN_CA) { + // It's barely possible for .onion servers to provide a non-self-signed cert. + // But that's fine because encryption is provided independently though TOR. + warning("Accepting TLS certificate from unknown CA from .onion address %s", domain); + return true; + } + return false; + } } } diff --git a/libdino/src/service/registration.vala b/libdino/src/service/registration.vala index b4377b98..dc9ed95c 100644 --- a/libdino/src/service/registration.vala +++ b/libdino/src/service/registration.vala @@ -29,7 +29,9 @@ public class Register : StreamInteractionModule, Object{ list.add(new Iq.Module()); list.add(new Sasl.Module(account.bare_jid.to_string(), account.password)); - XmppStreamResult stream_result = yield Xmpp.establish_stream(account.bare_jid.domain_jid, list, Application.print_xmpp); + XmppStreamResult stream_result = yield Xmpp.establish_stream(account.bare_jid.domain_jid, list, Application.print_xmpp, + (_, peer_cert, errors) => { return ConnectionManager.on_invalid_certificate(account.domainpart, peer_cert, errors); } + ); if (stream_result.stream == null) { if (stream_result.tls_errors != null) { @@ -80,7 +82,9 @@ public class Register : StreamInteractionModule, Object{ Gee.List<XmppStreamModule> list = new ArrayList<XmppStreamModule>(); list.add(new Iq.Module()); - XmppStreamResult stream_result = yield Xmpp.establish_stream(jid.domain_jid, list, Application.print_xmpp); + XmppStreamResult stream_result = yield Xmpp.establish_stream(jid.domain_jid, list, Application.print_xmpp, + (_, peer_cert, errors) => { return ConnectionManager.on_invalid_certificate(jid.domainpart, peer_cert, errors); } + ); if (stream_result.stream == null) { if (stream_result.io_error != null) { @@ -125,7 +129,9 @@ public class Register : StreamInteractionModule, Object{ list.add(new Iq.Module()); list.add(new Xep.InBandRegistration.Module()); - XmppStreamResult stream_result = yield Xmpp.establish_stream(jid.domain_jid, list, Application.print_xmpp); + XmppStreamResult stream_result = yield Xmpp.establish_stream(jid.domain_jid, list, Application.print_xmpp, + (_, peer_cert, errors) => { return ConnectionManager.on_invalid_certificate(jid.domainpart, peer_cert, errors); } + ); if (stream_result.stream == null) { return null; @@ -169,7 +175,9 @@ public class Register : StreamInteractionModule, Object{ list.add(new Iq.Module()); list.add(new Xep.InBandRegistration.Module()); - XmppStreamResult stream_result = yield Xmpp.establish_stream(jid.domain_jid, list, Application.print_xmpp); + XmppStreamResult stream_result = yield Xmpp.establish_stream(jid.domain_jid, list, Application.print_xmpp, + (_, peer_cert, errors) => { return ConnectionManager.on_invalid_certificate(jid.domainpart, peer_cert, errors); } + ); if (stream_result.stream == null) { return null; |