Mirrors/chatmail-core
1
0
Fork 0
mirror of https://github.com/chatmail/core.git synced 2026-05-17 05:46:30 +03:00
Code Issues Packages Projects Releases Wiki Activity

Enable strict TLS certificate checks by default

Browse Source
This commit is contained in:
Alexander Krotov
2020-06-05 08:33:55 +03:00
committed by holger krekel
parent d97d9980dd
commit 6d9ff3d248
4 changed files with 14 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
deltachat-ffi/deltachat.h
View File

@@ -3793,9 +3793,10 @@ int64_t dc_lot_get_timestamp (const dc_lot_t* lot);
*/ */
/** /**
* Configure certificate checks automatically. * Accept invalid certificates, including self-signed ones
* or having incorrect hostname.
*/ */
#define DC_CERTCK_AUTO 0 #define DC_CERTCK_ACCEPT_INVALID_CERTIFICATES 0
/** /**
* Strictly check TLS certificates; * Strictly check TLS certificates;
@@ -3803,12 +3804,6 @@ int64_t dc_lot_get_timestamp (const dc_lot_t* lot);
*/ */
#define DC_CERTCK_STRICT 1 #define DC_CERTCK_STRICT 1
/**
* Accept invalid certificates, including self-signed ones
* or having incorrect hostname.
*/
#define DC_CERTCK_ACCEPT_INVALID_CERTIFICATES 3
/** /**
* @} * @}
*/ */

3
python/src/deltachat/const.py
View File

@@ -68,9 +68,8 @@ DC_LP_IMAP_SOCKET_PLAIN = 0x400
DC_LP_SMTP_SOCKET_STARTTLS = 0x10000 DC_LP_SMTP_SOCKET_STARTTLS = 0x10000
DC_LP_SMTP_SOCKET_SSL = 0x20000 DC_LP_SMTP_SOCKET_SSL = 0x20000
DC_LP_SMTP_SOCKET_PLAIN = 0x40000 DC_LP_SMTP_SOCKET_PLAIN = 0x40000
DC_CERTCK_AUTO = 0 DC_CERTCK_ACCEPT_INVALID_CERTIFICATES = 0
DC_CERTCK_STRICT = 1 DC_CERTCK_STRICT = 1
DC_CERTCK_ACCEPT_INVALID_CERTIFICATES = 3
DC_EMPTY_MVBOX = 0x01 DC_EMPTY_MVBOX = 0x01
DC_EMPTY_INBOX = 0x02 DC_EMPTY_INBOX = 0x02
DC_EVENT_INFO = 100 DC_EVENT_INFO = 100

20
src/login_param.rs
View File

@@ -9,19 +9,21 @@ use crate::context::Context;
#[repr(i32)] #[repr(i32)]
#[strum(serialize_all = "snake_case")] #[strum(serialize_all = "snake_case")]
pub enum CertificateChecks { pub enum CertificateChecks {
Automatic = 0, AcceptInvalidCertificates = 0,
Strict = 1, Strict = 1,
/// Same as AcceptInvalidCertificates /// Same as AcceptInvalidCertificates
/// Previously known as AcceptInvalidHostnames, now deprecated. /// Previously known as AcceptInvalidHostnames, now deprecated.
AcceptInvalidCertificates2 = 2, AcceptInvalidCertificates2 = 2,
AcceptInvalidCertificates = 3, /// Same as AcceptInvalidCertificates
/// Deprecated.
AcceptInvalidCertificates3 = 3,
} }
impl Default for CertificateChecks { impl Default for CertificateChecks {
fn default() -> Self { fn default() -> Self {
Self::Automatic Self::Strict
} }
} }
@@ -280,16 +282,8 @@ fn get_readable_flags(flags: i32) -> String {
pub fn dc_build_tls(certificate_checks: CertificateChecks) -> async_native_tls::TlsConnector { pub fn dc_build_tls(certificate_checks: CertificateChecks) -> async_native_tls::TlsConnector {
let tls_builder = async_native_tls::TlsConnector::new(); let tls_builder = async_native_tls::TlsConnector::new();
match certificate_checks { match certificate_checks {
CertificateChecks::Automatic => {
// Same as AcceptInvalidCertificates for now.
// TODO: use provider database when it becomes available
tls_builder
.danger_accept_invalid_hostnames(true)
.danger_accept_invalid_certs(true)
}
CertificateChecks::Strict => tls_builder, CertificateChecks::Strict => tls_builder,
CertificateChecks::AcceptInvalidCertificates _ => tls_builder
| CertificateChecks::AcceptInvalidCertificates2 => tls_builder
.danger_accept_invalid_hostnames(true) .danger_accept_invalid_hostnames(true)
.danger_accept_invalid_certs(true), .danger_accept_invalid_certs(true),
} }
@@ -303,6 +297,8 @@ mod tests {
fn test_certificate_checks_display() { fn test_certificate_checks_display() {
use std::string::ToString; use std::string::ToString;
assert_eq!("strict".to_string(), CertificateChecks::Strict.to_string());
assert_eq!( assert_eq!(
"accept_invalid_certificates".to_string(), "accept_invalid_certificates".to_string(),
CertificateChecks::AcceptInvalidCertificates.to_string() CertificateChecks::AcceptInvalidCertificates.to_string()

2
src/provider/data.rs
View File

@@ -177,6 +177,8 @@ lazy_static::lazy_static! {
ConfigDefault { key: Config::MvboxMove, value: "0" }, ConfigDefault { key: Config::MvboxMove, value: "0" },
ConfigDefault { key: Config::E2eeEnabled, value: "0" }, ConfigDefault { key: Config::E2eeEnabled, value: "0" },
ConfigDefault { key: Config::MediaQuality, value: "1" }, ConfigDefault { key: Config::MediaQuality, value: "1" },
ConfigDefault { key: Config::ImapCertificateChecks, value: "0" },
ConfigDefault { key: Config::SmtpCertificateChecks, value: "0" },
]), ]),
}; };