lefcha/imapfilter — pull request #81 by Papafox (2014-11-04 05:05:48+00:00)
Title: Validate SSL certificates #56

I don't know what happened to the code for my last fix to verify certificates, but here is a new minimal version. It contains 34 new lines of code and 20 lines which have been indented but not otherwise changed. The aim is verify certificates which can be verified, but otherwise fall back to using `~/.imapfilter/certificates`

How it works:
* Every linux system should have a directory `/etc/ssl/certs` which links to CA certificates. The actual certicates are stored in differing directories, depending on the distro. I've tested this with Debian (and thus Ubuntu/Mint etc) and CentOs.
* OpenSSL always validates the certificate when a SSL connection occurs. If the `/etc/ssl/certs` directory exists, it's added to the SSL context `imapfilter.c` using `SSL_CTX_load_verify_locations()`. If the `/etc/ssl/certs` directory does not exist, then fall back to using `~/.imapfilter/certificates`
* In `get_cert()`, the result of the SSL handshake is checked. There are three possible outcomes
- The certificate validated correctly against `/etc/ssl/certs` and the `get_cert()` returns 0
- A self-signed certificate or a certificate with an unknown issuer (or where `/etc/ssl/certs` doesn't exist) has been presented, in which case validate the cert as usual against `~/.imapfilter/certificates`
- All other certificates will be rejected as invalid