Changeset 3106 for pjproject/trunk/pjlib/src/pj/ssl_sock_common.c

Timestamp:

Feb 24, 2010 5:43:34 AM (15 years ago)

Author:

nanang

Message:

Ticket #1032:

• Initial version of server domain name verification:
  • Updated SSL certificate info, especially identities info
  • Updated verification mechanism as in the specifications in ticket desc.
  • Added server domain name info in pjsip_tx_data.
  • Added alternative API for acquiring transport and creating transport of transport factory to include pjsip_tx_data param.
  • Server identity match criteria:
    • full host name match
    • wild card not accepted
    • if identity is URI, it must be SIP/SIPS URI
• Initial version of transport state notifications:
  • Added new API to set transport state callback in PJSIP and PJSUA.
  • Defined states: connected/disconnected, accepted/rejected, verification errors.
• Minors:
  • Updated SSL socket test: dump verification result, test of requiring client cert, and few minors.
  • Updated test cert to include subjectAltName extensions.
  • Added SSL certificate dump function.
  • Updated max number of socket async operations in Symbian sample apps (RSocketServ::Connect()) to 32 (was default 8).

File:

• pjproject/trunk/pjlib/src/pj/ssl_sock_common.c (modified) (3 diffs)

pjproject/trunk/pjlib/src/pj/ssl_sock_common.c

@@ -18 +18 @@
  */
 #include <pj/ssl_sock.h>
+#include <pj/assert.h>
 #include <pj/errno.h>
 #include <pj/string.h>
@@ -129 +130 @@
 
 
+/* Get cipher name string */
 PJ_DEF(const char*) pj_ssl_cipher_name(pj_ssl_cipher cipher)
 {
@@ -141 +143 @@
     return NULL;
 }
+
+
+
+
+PJ_DEF(pj_status_t) pj_ssl_cert_verify_error_st(pj_uint32_t verify_status, 
+                                                const char *error_strings[],
+                                                unsigned *count)
+{
+    unsigned i = 0, shift_idx = 0;
+    unsigned unknown = 0;
+    pj_uint32_t errs;
+
+    PJ_ASSERT_RETURN(error_strings && count, PJ_EINVAL);
+
+    if (verify_status == PJ_SSL_CERT_ESUCCESS && *count) {
+        error_strings[0] = "OK";
+        *count = 1;
+        return PJ_SUCCESS;
+    }
+
+    errs = verify_status;
+
+    while (errs && i < *count) {
+        pj_uint32_t err;
+        const char *p = NULL;
+
+        if ((errs & 1) == 0) {
+            shift_idx++;
+            errs >>= 1;
+            continue;
+        }
+
+        err = (1 << shift_idx);
+
+        switch (err) {
+        case PJ_SSL_CERT_EISSUER_NOT_FOUND:
+            p = "The issuer certificate cannot be found";
+            break;
+        case PJ_SSL_CERT_EUNTRUSTED:
+            p = "The certificate is untrusted";
+            break;
+        case PJ_SSL_CERT_EVALIDITY_PERIOD:
+            p = "The certificate has expired or not yet valid";
+            break;
+        case PJ_SSL_CERT_EINVALID_FORMAT:
+            p = "One or more fields of the certificate cannot be decoded "
+                "due to invalid format";
+            break;
+        case PJ_SSL_CERT_EISSUER_MISMATCH:
+            p = "The issuer info in the certificate does not match to the "
+                "(candidate) issuer certificate";
+            break;
+        case PJ_SSL_CERT_ECRL_FAILURE:
+            p = "The CRL certificate cannot be found or cannot be read "
+                "properly";
+            break;
+        case PJ_SSL_CERT_EREVOKED:
+            p = "The certificate has been revoked";
+            break;
+        case PJ_SSL_CERT_EINVALID_PURPOSE:
+            p = "The certificate or CA certificate cannot be used for the "
+                "specified purpose";
+            break;
+        case PJ_SSL_CERT_ECHAIN_TOO_LONG:
+            p = "The certificate chain length is too long";
+            break;
+        case PJ_SSL_CERT_EIDENTITY_NOT_MATCH:
+            p = "The server identity does not match to any identities "
+                "specified in the certificate";
+            break;
+        case PJ_SSL_CERT_EUNKNOWN:
+        default:
+            unknown++;
+            break;
+        }
+        
+        /* Set error string */
+        if (p)
+            error_strings[i++] = p;
+
+        /* Next */
+        shift_idx++;
+        errs >>= 1;
+    }
+
+    /* Unknown error */
+    if (unknown && i < *count)
+        error_strings[i++] = "Unknown verification error";
+
+    *count = i;
+
+    return PJ_SUCCESS;
+}