ssl cient auth

Lucas Fisher lucas.fisher at gmail.com
Sat Sep 3 17:31:54 EDT 2011


I have a working implementation of SSL client authentication in 
im.pidgin.cpw.ljfisher.ssl_client_auth.  It required a number of API additions 
and some changes. Anyone want to look at it for suitability for merging?

Currently only supports gnutls and requires cyrus sasl be enabled.

Summary of changes:
- Added PurplePrivateKey
- Added PurplePrivateKeyScheme
- Added PurplePrivateKeyPool
- Added PurplePkcs12Scheme
- Added a certificate pool for user certificates
- Added optional function to PurplePluginProtocolInfo to get the account 
options. Previously this was a field that was access directly. This allow 
dynamic generation of protocol options so I could return a list of 
certifiicates in the pool. The field is still valid so other plugins will 
continue to work.
- Added drop-down box to XMPP advanced accoutt options (via the new dynamic 
account options function) for selecting the certificate to use for 
authentication
-Modified purple_ssl_connect_* to take a certificate id to use for client side 
authentication
- Added fields to PurpleSslConnection for client keys and certs used for 
authentication
- enabled SASL external in jabber plugin
- Added support to gnutls ssl plugin for sending client cert.
- Added support to gnutls ssl plugin for PurplePkcs12Scheme and 
PurplePrivateKeyScheme.
- Added extra tab to gtkcertmgr for user certificates

For convenience this will get you a diff of the heads of im.pidgin.pidgin and 
im.pidgin.cpw.ljfisher.ssl_client_auth:
mtn diff -r 21f078cdce656c60707d6518904262ee44ac648c -r 
53693144f7e43cd214437c3f7881863a45ae0f84

TODO:
- testing
- clean out some dead code if the API changes are acceptable
- Enable password caching for at least the session to the private key password 
dialogs.
- Support for NSS if  necessary. Might be required for building on Windows?




More information about the Devel mailing list