diff options
author | Rémi Verschelde <rverschelde@gmail.com> | 2018-06-07 10:46:05 +0200 |
---|---|---|
committer | Rémi Verschelde <rverschelde@gmail.com> | 2018-06-07 10:46:05 +0200 |
commit | d0811ed3f9604b2dab755ab6df0a2950fd1ccede (patch) | |
tree | ebb74de9c5c8c2b9eecb898121307755ca5ba0a7 /thirdparty/lws/mbedtls_verify.diff | |
parent | 7d392cd6f496374aea98e8f5c85792acb6f8bc7a (diff) |
Thirdparty: Fill copyright for lws, miniupnpc, clipper
Rename `lws` to `libwebsockets` which is its library name.
Add missing license file for mbedtls.
Diffstat (limited to 'thirdparty/lws/mbedtls_verify.diff')
-rw-r--r-- | thirdparty/lws/mbedtls_verify.diff | 74 |
1 files changed, 0 insertions, 74 deletions
diff --git a/thirdparty/lws/mbedtls_verify.diff b/thirdparty/lws/mbedtls_verify.diff deleted file mode 100644 index d320645d67..0000000000 --- a/thirdparty/lws/mbedtls_verify.diff +++ /dev/null @@ -1,74 +0,0 @@ -diff --git a/thirdparty/lws/client/ssl-client.c b/thirdparty/lws/client/ssl-client.c -index 6626e0844..962c6e3cb 100644 ---- a/thirdparty/lws/client/ssl-client.c -+++ b/thirdparty/lws/client/ssl-client.c -@@ -176,11 +176,7 @@ lws_ssl_client_bio_create(struct lws *wsi) - #endif - #else - #if defined(LWS_WITH_MBEDTLS) -- if (wsi->vhost->x509_client_CA) -- SSL_set_verify(wsi->ssl, SSL_VERIFY_PEER, OpenSSL_client_verify_callback); -- else -- SSL_set_verify(wsi->ssl, SSL_VERIFY_NONE, OpenSSL_client_verify_callback); -- -+ SSL_set_verify(wsi->ssl, SSL_VERIFY_PEER, OpenSSL_client_verify_callback); - #else - #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME - SSL_set_tlsext_host_name(wsi->ssl, hostname); -diff --git a/thirdparty/lws/mbedtls_wrapper/platform/ssl_pm.c b/thirdparty/lws/mbedtls_wrapper/platform/ssl_pm.c -index 63504919c..4e3d61109 100644 ---- a/thirdparty/lws/mbedtls_wrapper/platform/ssl_pm.c -+++ b/thirdparty/lws/mbedtls_wrapper/platform/ssl_pm.c -@@ -218,7 +218,7 @@ static int ssl_pm_reload_crt(SSL *ssl) - struct x509_pm *crt_pm = (struct x509_pm *)ssl->cert->x509->x509_pm; - - if (ssl->verify_mode == SSL_VERIFY_PEER) -- mode = MBEDTLS_SSL_VERIFY_REQUIRED; -+ mode = MBEDTLS_SSL_VERIFY_OPTIONAL; - else if (ssl->verify_mode == SSL_VERIFY_FAIL_IF_NO_PEER_CERT) - mode = MBEDTLS_SSL_VERIFY_OPTIONAL; - else if (ssl->verify_mode == SSL_VERIFY_CLIENT_ONCE) -@@ -712,11 +712,39 @@ long ssl_pm_get_verify_result(const SSL *ssl) - struct ssl_pm *ssl_pm = (struct ssl_pm *)ssl->ssl_pm; - - ret = mbedtls_ssl_get_verify_result(&ssl_pm->ssl); -- if (ret) { -- SSL_DEBUG(SSL_PLATFORM_ERROR_LEVEL, "mbedtls_ssl_get_verify_result() return 0x%x", ret); -+ -+ if (!ret) -+ return X509_V_OK; -+ -+ if (ret & MBEDTLS_X509_BADCERT_NOT_TRUSTED || -+ (ret & MBEDTLS_X509_BADCRL_NOT_TRUSTED)) -+ // Allows us to use LCCSCF_ALLOW_SELFSIGNED to skip verification -+ verify_result = X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN; -+ -+ else if (ret & MBEDTLS_X509_BADCERT_CN_MISMATCH) -+ verify_result = X509_V_ERR_HOSTNAME_MISMATCH; -+ -+ else if ((ret & MBEDTLS_X509_BADCERT_BAD_KEY) || -+ (ret & MBEDTLS_X509_BADCRL_BAD_KEY)) -+ verify_result = X509_V_ERR_CA_KEY_TOO_SMALL; -+ -+ else if ((ret & MBEDTLS_X509_BADCERT_BAD_MD) || -+ (ret & MBEDTLS_X509_BADCRL_BAD_MD)) -+ verify_result = X509_V_ERR_CA_MD_TOO_WEAK; -+ -+ else if ((ret & MBEDTLS_X509_BADCERT_FUTURE) || -+ (ret & MBEDTLS_X509_BADCRL_FUTURE)) -+ verify_result = X509_V_ERR_CERT_NOT_YET_VALID; -+ -+ else if ((ret & MBEDTLS_X509_BADCERT_EXPIRED) || -+ (ret & MBEDTLS_X509_BADCRL_EXPIRED)) -+ verify_result = X509_V_ERR_CERT_HAS_EXPIRED; -+ -+ else - verify_result = X509_V_ERR_UNSPECIFIED; -- } else -- verify_result = X509_V_OK; -+ -+ SSL_DEBUG(SSL_PLATFORM_ERROR_LEVEL, -+ "mbedtls_ssl_get_verify_result() return 0x%x", ret); - - return verify_result; - } |