summaryrefslogtreecommitdiff
path: root/src/fe-common/irc/fe-irc-server.c
diff options
context:
space:
mode:
authorAlexander Færøy <ahf@0x90.dk>2016-10-16 14:39:00 +0200
committerAlexander Færøy <ahf@0x90.dk>2016-10-22 22:01:50 +0200
commit5146ce96318bc9a2513d104ea76ab3277a540074 (patch)
tree0a0e049374b482766f0503d221b6176feb7ccc62 /src/fe-common/irc/fe-irc-server.c
parentc6c2e795376e4659810360deaa3dd28475d0f7c7 (diff)
downloadirssi-5146ce96318bc9a2513d104ea76ab3277a540074.zip
Add x509 certificate and public key pinning support.
This patch adds two new options to /CONNECT and /SERVER to let the user pin either an x509 certificate and/or the public key of a given server. It is possible to fetch the certificate outside of Irssi itself to verify the checksum. To fetch the certificate call: $ openssl s_client -connect chat.freenode.net:6697 < /dev/null 2>/dev/null | \ openssl x509 > freenode.cert This will download chat.freenode.net:6697's TLS certificate and put it into the file freenode.cert. -tls_pinned_cert ---------------- This option allows you to specify the SHA-256 hash of the x509 certificate. When succesfully connected to the server, irssi will verify that the given server certificate matches the pin set by the user. The SHA-256 hash of a given certificate can be verified outside of irssi using the OpenSSL command line tool: $ openssl x509 -in freenode.cert -fingerprint -sha256 -noout -tls_pinned_pubkey ------------------ This option allows you to specify the SHA-256 hash of the subject public key information section of the server certificate. This section contains both the cryptographic parameters for the public key, but also information about the algorithm used together with the public key parameters. When succesfully connected to the server, irssi will verify that the given public key matches the pin set by the user. The SHA-256 hash of a public key can be verified outside of irssi using the OpenSSL command line tool: $ openssl x509 -in freenode.cert -pubkey -noout | \ openssl pkey -pubin -outform der | \ openssl dgst -sha256 -c | \ tr a-z A-Z It is possible to specify both -tls_pinned_cert and -tls_pinned_pubkey together.
Diffstat (limited to 'src/fe-common/irc/fe-irc-server.c')
-rw-r--r--src/fe-common/irc/fe-irc-server.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/src/fe-common/irc/fe-irc-server.c b/src/fe-common/irc/fe-irc-server.c
index 36ed2bdc..c4435d8f 100644
--- a/src/fe-common/irc/fe-irc-server.c
+++ b/src/fe-common/irc/fe-irc-server.c
@@ -125,6 +125,10 @@ static void cmd_server_list(const char *data)
g_string_append_printf(str, "tls_capath: %s, ", rec->tls_capath);
if (rec->tls_ciphers)
g_string_append_printf(str, "tls_ciphers: %s, ", rec->tls_ciphers);
+ if (rec->tls_pinned_cert)
+ g_string_append_printf(str, "tls_pinned_cert: %s, ", rec->tls_pinned_cert);
+ if (rec->tls_pinned_pubkey)
+ g_string_append_printf(str, "tls_pinned_pubkey: %s, ", rec->tls_pinned_pubkey);
}
if (rec->max_cmds_at_once > 0)