X-Git-Url: http://git.code-monkey.de/?a=blobdiff_plain;f=src%2Fssli_gnutls.c;h=e8b4609a052cf9bc7b5d8357c92557fb6bce21fd;hb=2785848e2d632108a2f61aaa41ccca97f5443284;hp=b2e149e719d399b77b82a9d3c3aa470c12f73a25;hpb=21d88cde9cf17f177e506badeaf0e512290e09e0;p=umurmur.git

diff --git a/src/ssli_gnutls.c b/src/ssli_gnutls.c
index b2e149e..e8b4609 100644
--- a/src/ssli_gnutls.c
+++ b/src/ssli_gnutls.c
@@ -2,10 +2,12 @@
 #include "conf.h"
 #include "log.h"
 
+#include <stdlib.h>
+
 static gnutls_dh_params_t dhParameters;
 static gnutls_certificate_credentials_t certificate;
 
-static const char * ciphers = "SECURE128:-VERS-DTLS-ALL:-VERS-SSL3.0:-VERS-TLS1.0:+COMP_ALL";
+static const char * ciphers = "NORMAL";
 static gnutls_priority_t cipherCache;
 
 void initializeCertificate()
@@ -60,7 +62,7 @@ void SSLi_deinit()
 
 SSL_handle_t * SSLi_newconnection( int * fileDescriptor, bool_t * isSSLReady )
   {
-  gnutls_session_t * session; // Maybe we need to calloc here
+  gnutls_session_t * session = calloc(1, sizeof(gnutls_session_t));
 
   gnutls_init(session, GNUTLS_SERVER);
   gnutls_priority_set(*session, cipherCache);
@@ -70,28 +72,35 @@ SSL_handle_t * SSLi_newconnection( int * fileDescriptor, bool_t * isSSLReady )
 
   gnutls_transport_set_int(*session, *fileDescriptor);
 
-  *isSSLReady = true;
+  if(isSSLReady && SSLi_nonblockaccept(session, isSSLReady))
+    *isSSLReady = true;
 
   return session;
   }
 
-bool_t SSLi_getSHA1Hash(SSL_handle_t *ssl, uint8_t *hash)
+bool_t SSLi_getSHA1Hash(SSL_handle_t *session, uint8_t *hash)
   {
-  *hash = 0;
-  return true;
+	gnutls_datum_t const * certificateData = gnutls_certificate_get_peers(*session, NULL);
+
+	size_t resultSize = 0;
+	int error = gnutls_fingerprint( GNUTLS_DIG_SHA1, certificateData, hash, &resultSize);
+	return error == GNUTLS_E_SUCCESS && resultSize == 20;
   }
 
 int SSLi_nonblockaccept( SSL_handle_t *session, bool_t * isSSLReady )
   {
   int error;
   do {
-    gnutls_handshake(*session);
+    error = gnutls_handshake(*session);
   } while(error < GNUTLS_E_SUCCESS && !gnutls_error_is_fatal(error));
 
   if ( error < GNUTLS_E_SUCCESS ) {
-    Log_fatal("TLS handshake failed with error %i (%s).", error, gnutls_strerror(error));
+    Log_warn("TLS handshake failed with error %i (%s).", error, gnutls_strerror(error));
   }
 
+  if(isSSLReady)
+    *isSSLReady = true;
+
   return error;
   }
 
@@ -115,8 +124,12 @@ bool_t SSLi_data_pending(SSL_handle_t *session)
   return gnutls_record_check_pending(*session);
   }
 
-void SSLi_shutdown(SSL_handle_t *ssl)
+void SSLi_shutdown(SSL_handle_t *session)
   {
+  gnutls_bye(*session, GNUTLS_SHUT_WR);
   }
 
-void SSLi_free(SSL_handle_t *ssl) {}
+void SSLi_free(SSL_handle_t *session)
+  {
+  gnutls_deinit(*session);
+  }