Merge branch 'ssl'

include/znc/IRCNetwork.h

@@ -121,6 +121,10 @@ public:
 	bool SetNextServer(const CServer* pServer);
 	bool IsLastServer() const;
 
+	const SCString& GetTrustedFingerprints() const { return m_ssTrustedFingerprints; }
+	void AddTrustedFingerprint(const CString& sFP) { m_ssTrustedFingerprints.insert(sFP); }
+	void DelTrustedFingerprint(const CString& sFP) { m_ssTrustedFingerprints.erase(sFP); }
+
 	void SetIRCConnectEnabled(bool b);
 	bool GetIRCConnectEnabled() const { return m_bIRCConnectEnabled; }
 
@@ -201,6 +205,7 @@ protected:
 	CString            m_sBindHost;
 	CString            m_sEncoding;
 	CString            m_sQuitMsg;
+	SCString           m_ssTrustedFingerprints;
 
 	CModules*          m_pModules;
 

include/znc/SSLVerifyHost.h

@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2004-2014 ZNC, see the NOTICE file for details.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#ifndef SSLVERIFYHOST_H
+#define SSLVERIFYHOST_H
+
+#ifdef HAVE_LIBSSL
+
+#include <znc/Csocket.h>
+#include <znc/ZNCString.h>
+
+bool ZNC_SSLVerifyHost(const CString& sHost, const X509* pCert, CString& sError);
+
+#endif /* HAVE_LIBSSL */
+
+#endif /* SSLVERIFYHOST_H */

include/znc/Socket.h

@@ -29,12 +29,30 @@ public:
 	CZNCSock(const CString& sHost, u_short port, int timeout = 60);
 	~CZNCSock() {}
 
-	virtual int ConvertAddress(const struct sockaddr_storage * pAddr, socklen_t iAddrLen, CS_STRING & sIP, u_short * piPort) const;
+	int ConvertAddress(const struct sockaddr_storage * pAddr, socklen_t iAddrLen, CS_STRING & sIP, u_short * piPort) const override;
+#ifdef HAVE_LIBSSL
+	int VerifyPeerCertificate(int iPreVerify, X509_STORE_CTX * pStoreCTX) override;
+	void SSLHandShakeFinished() override;
+#endif
+	void SetHostToVerifySSL(const CString& sHost) { m_HostToVerifySSL = sHost; }
+	CString GetSSLPeerFingerprint() const;
+	void SetSSLTrustedPeerFingerprints(const SCString& ssFPs) { m_ssTrustedFingerprints = ssFPs; }
 
 #ifndef HAVE_ICU
 	// Don't fail to compile when ICU is not enabled
 	void SetEncoding(const CString&) {}
 #endif
+
+protected:
+	// All existing errno codes seem to be in range 1-300
+	enum {
+		errnoBadSSLCert = 12569,
+	};
+
+private:
+	CString m_HostToVerifySSL;
+	SCString m_ssTrustedFingerprints;
+	SCString m_ssCertVerificationErrors;
 };
 
 enum EAddrType {