Ticket #720: ssl_cert_verif.diff

src/gajim.py

@@ -2166 +2166 @@
                 instance = data[1]
                 instance.unique_room_id_error(data[0])
 
+        def handle_event_ssl_error(self, account, data):
+                # ('SSL_ERROR', account, (text, cert))
+                server = gajim.config.get_per('accounts', account, 'hostname')
+                def on_ok(is_checked):
+                        if is_checked:
+                                f = open(gajim.MY_CACERTS, 'a')
+                                f.write(server + '\n')
+                                f.write(data[1] + '\n\n')
+                                f.close()
+                        gajim.connections[account].ssl_certificate_accepted()
+                def on_cancel():
+                        pass
+                pritext = _('Error verifying SSL certificate')
+                sectext = _('There was an error verifying the SSL certificate of your jabber server %(server)s: %(error)s\nDo you still want to connect to this server?') % {'server': server, 'error': data[0]}
+                checktext = _('Add this certificate to the list of trusted certificates.')
+                dialogs.ConfirmationDialogCheck(pritext, sectext, checktext,
+                        on_response_ok=on_ok, on_response_cancel=on_cancel)
+
         def read_sleepy(self):
                 '''Check idle status and change that status if needed'''
                 if not self.sleeper.poll():
@@ -2502 +2520 @@
                         'UNIQUE_ROOM_ID_SUPPORTED': self.handle_event_unique_room_id_supported,
                         'SESSION_NEG': self.handle_session_negotiation,
                         'GPG_PASSWORD_REQUIRED': self.handle_event_gpg_password_required,
+                        'SSL_ERROR': self.handle_event_ssl_error,
                 }
                 gajim.handlers = self.handlers
 

src/common/xmpp/transports_nb.py

@@ -745 +745 @@
                 #tcpsock._sslContext = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD)
                 tcpsock.ssl_errnum = 0
                 tcpsock._sslContext.set_verify(OpenSSL.SSL.VERIFY_PEER, self._ssl_verify_callback)
+                cacerts = os.path.join(gajim.DATA_DIR, 'other', 'cacerts.pem')
                 try:
-                        tcpsock._sslContext.load_verify_locations(os.path.join(gajim.DATA_DIR, 'other', 'cacerts.pem'))
+                        tcpsock._sslContext.load_verify_locations(cacerts)
                 except:
-                        log.warning(_("Unable to load SSL certificats from file %s" % os.path.abspath(os.path.join(gajim.DATA_DIR,'other','ca.crt'))))
+                        log.warning('Unable to load SSL certificats from file %s' % \
+                                os.path.abspath(cacerts))
+                # load users certs
+                if os.path.isfile(gajim.MY_CACERTS):
+                        store = tcpsock._sslContext.get_cert_store()
+                        f = open(gajim.MY_CACERTS)
+                        lines = f.readlines()
+                        i = 0
+                        begin = -1
+                        for line in lines:
+                                if 'BEGIN CERTIFICATE' in line:
+                                        begin = i
+                                        continue
+                                elif 'END CERTIFICATE' in line and begin > -1:
+                                        cert = ''.join(lines[begin:i+2])
+                                        try:
+                                                X509cert = OpenSSL.crypto.load_certificate(
+                                                        OpenSSL.crypto.FILETYPE_PEM, cert)
+                                                store.add_cert(X509cert)
+                                        except:
+                                                log.warning('Unable to load a certificate from file %s' % \
+                                                        gajim.MY_CACERTS)
+                                        begin = -1
+                                i += 1
                 tcpsock._sslObj = OpenSSL.SSL.Connection(tcpsock._sslContext, tcpsock._sock)
                 tcpsock._sslObj.set_connect_state() # set to client mode
 
@@ -791 +815 @@
                         if errnum == 0:
                                 return True
                         self._owner.Connection.ssl_errnum = errnum
+                        self._owner.Connection.ssl_cert = OpenSSL.crypto.dump_certificate(
+                                OpenSSL.crypto.FILETYPE_PEM, cert)
                         return True
                 except:
                         log.error("Exception caught in _ssl_info_callback:", exc_info=True)

src/common/configpaths.py

@@ -79 +79 @@
 
                 # LOG is deprecated
                 k = ( 'LOG',   'LOG_DB',   'VCARD',   'AVATAR',   'MY_EMOTS',
-                        'MY_ICONSETS' )
+                        'MY_ICONSETS', 'MY_CACERTS')
                 v = (u'logs', u'logs.db', u'vcards', u'avatars', u'emoticons',
-                        u'iconsets')
+                        u'iconsets',  u'cacerts.pem')
 
                 if os.name == 'nt':
                         v = map(lambda x: x.capitalize(), v)

src/common/gajim.py

@@ -77 +77 @@
 AVATAR_PATH = gajimpaths['AVATAR']
 MY_EMOTS_PATH = gajimpaths['MY_EMOTS']
 MY_ICONSETS_PATH = gajimpaths['MY_ICONSETS']
+MY_CACERTS =  gajimpaths['MY_CACERTS']
 TMP = gajimpaths['TMP']
 DATA_DIR = gajimpaths['DATA']
 HOME_DIR = gajimpaths['HOME']

src/common/connection.py

@@ -488 +488 @@
                         errnum = -1 # we don't have an errnum
                 if errnum > 0:
                         # FIXME: tell the user that the certificat is untrusted, and ask him what to do
-                        try:
-                                log.warning("The authenticity of the "+hostname+" certificate could be invalid.\nSSL Error: "+ssl_error[errnum])
-                        except KeyError:
-                                log.warning("Unknown SSL error: %d" % errnum)
-                con.auth(name, self.password, self.server_resource, 1, self.__on_auth)
+                        text = _('The authenticity of the %s certificate could be invalid.') %\
+                                hostname
+                        if errnum in ssl_error:
+                                text += _('\nSSL Error: %s') % ssl_error[errnum]
+                        else:
+                                text += _('\nUnknown SSL error: %d') % errnum
+                        self.dispatch('SSL_ERROR', (text, con.Connection.ssl_cert))
+                else:
+                        con.auth(name, self.password, self.server_resource, 1, self.__on_auth)
 
                 return True
 
+        def ssl_certificate_accepted(self):
+                name = gajim.config.get_per('accounts', self.name, 'name')
+                self.connection.auth(name, self.password, self.server_resource, 1, self.__on_auth)
+
         def _register_handlers(self, con, con_type):
                 self.peerhost = con.get_peerhost()
                 # notify the gui about con_type