Mercurial > pidgin3 / changeset

--- a/libpurple/plugins/ssl/ssl-gnutls.c	Tue Jul 21 06:16:43 2009 +0000
+++ b/libpurple/plugins/ssl/ssl-gnutls.c	Tue Jul 21 06:48:31 2009 +0000
@@ -668,6 +668,8 @@
 	gnutls_x509_crt issuer_dat;
 	unsigned int verify; /* used to store result from GnuTLS verifier */
 	int ret;
+	gchar *crt_id = NULL;
+	gchar *issuer_id = NULL;
 
 	g_return_val_if_fail(crt, FALSE);
 	g_return_val_if_fail(issuer, FALSE);
@@ -728,13 +730,29 @@
 		return FALSE;
 	}
 
+	if (verify & GNUTLS_CERT_INSECURE_ALGORITHM) {
+		/*
+		 * A certificate in the chain is signed with an insecure
+		 * algorithm. Put a warning into the log to make this error
+		 * perfectly clear as soon as someone looks at the debug log is
+		 * generated.
+		 */
+		crt_id = purple_certificate_get_unique_id(crt);
+		issuer_id = purple_certificate_get_issuer_unique_id(crt);
+		purple_debug_warning("gnutls/x509",
+				"Insecure hash algorithm used by %s to sign %s\n",
+				issuer_id, crt_id);
+	}
+
 	if (verify & GNUTLS_CERT_INVALID) {
 		/* Signature didn't check out, but at least
 		   there were no errors*/
-		gchar *crt_id = purple_certificate_get_unique_id(crt);
-		gchar *issuer_id = purple_certificate_get_issuer_unique_id(crt);
-		purple_debug_info("gnutls/x509",
-				  "Bad signature for %s on %s\n",
+		if (!crt_id)
+			crt_id = purple_certificate_get_unique_id(crt);
+		if (!issuer_id)
+			issuer_id = purple_certificate_get_issuer_unique_id(crt);
+		purple_debug_error("gnutls/x509",
+				  "Bad signature from %s on %s\n",
 				  issuer_id, crt_id);
 		g_free(crt_id);
 		g_free(issuer_id);

--- a/libpurple/protocols/jabber/jabber.c	Tue Jul 21 06:16:43 2009 +0000
+++ b/libpurple/protocols/jabber/jabber.c	Tue Jul 21 06:48:31 2009 +0000
@@ -699,6 +699,8 @@
 	js->gc->inpa = 0;
 	js->gsc = purple_ssl_connect_with_host_fd(js->gc->account, js->fd,
 			jabber_login_callback_ssl, jabber_ssl_connect_failure, js->certificate_CN, js->gc);
+	/* The fd is no longer our concern */
+	js->fd = -1;
 }
 
 static gboolean jabber_login_connect(JabberStream *js, const char *domain, const char *host, int port,