Display cipher in incoming logs

diff --git a/lib/devsoc.c b/lib/devsoc.c
index 2db032cbb57649f9a2a9f59f79150e96c8f7047e..17dc3fbeb62623a8230eea0ea9f9059078c45349 100644 (file)
--- a/lib/devsoc.c
+++ b/lib/devsoc.c
@@ -1448,6 +1448,31 @@ return iscrypted;
 */
 /********************************************************/
 /*                                                     */
+/*      Procedure to get the cipher name used in cypted */
+/*      mode.                                           */
+/*                                                     */
+/********************************************************/
+PUBLIC const char *soc_get_cipher_name(SOCPTR *socptr)
+
+{
+const char *cipher;
+SOCTYP *soc;
+
+cipher="Unknown";
+soc=(SOCTYP *)socptr;
+if (soc!=(SOCTYP *)0) {
+  const char *ptr;
+
+  if ((ptr=SSL_get_cipher_name(soc->tls->ssl))!=(const char *)0)
+    cipher=ptr;
+  }
+return cipher;
+}
+/*
+^L
+*/
+/********************************************************/
+/*                                                     */
 /*      Procedure to return the socket mode as a string */
 /*                                                     */
 /********************************************************/

diff --git a/lib/devsoc.h b/lib/devsoc.h
index 5090b3029c360425ee791fff2466e57d30a77b78..14b202e22651f31a7908384c9d47e129eed115f3 100644 (file)
--- a/lib/devsoc.h
+++ b/lib/devsoc.h
@@ -81,9 +81,12 @@ extern SOCPTR *soc_release(SOCPTR *socptr);
 //procedure to initiate crypted mode on plain channel
 extern _Bool soc_starttls(SOCPTR *socptr,_Bool server,const char *certs[3]);
 
-//return flag true if socet is in crypted mode
+//return flag true if socket is in crypted mode
 extern _Bool soc_iscrypted(SOCPTR *socptr);
 
+//return the cipher mame used on the crypted link
+extern const char *soc_get_cipher_name(SOCPTR *socptr);
+
 //return line socket mode (cleartext, crypted)
 extern const char *soc_getstrmode(SOCPTR *socptr);
 

diff --git a/lib/lvleml.c b/lib/lvleml.c
index 7837edd7c4586a0e8fc91640aa54397182cc6577..d7a2e07760ebe1ff1504094edb005a06aaa63d73 100644 (file)
--- a/lib/lvleml.c
+++ b/lib/lvleml.c
@@ -418,7 +418,8 @@ while (proceed==true) {
     case c_starttls     :       //EHLO start encrypted link in server mode
       switch (soc_starttls(contact->socptr,true,srvr_certs)) {
         case true       :       //link now in TLS crypted mode
-          (void) transmit(contact,"%d Link now encrypted",CMDOK);
+          (void) transmit(contact,"%d Link now encrypted (cipher=<%s>)",
+                                   CMDOK,soc_get_cipher_name(contact->socptr));
           break;
         case false      :       //unable to establish link
           (void) transmit(contact,"%d 5.3.3 command starttls not successful",

diff --git a/lib/unitls.c b/lib/unitls.c
index 901b47d3a31026d4af64c7a50857c76ea7a18a2f..ffe6bfabefbcad54c546945a1d2c06bd253ccf9d 100644 (file)
--- a/lib/unitls.c
+++ b/lib/unitls.c
@@ -327,7 +327,11 @@ phase=0;
 proceed=true;
 while (proceed==true) {
   switch (phase) {
-    case 0      :       //get remote certificate
+    case 0      :       //do we need to check peer
+      if (tls->checkpeer==false)
+        phase=999;      //No need to check certificate
+      break;
+    case 1      :       //get remote certificate
       if ((peer=SSL_get_peer_certificate(tls->ssl))==(X509 *)0) {
         char msg[200];
 
@@ -338,7 +342,7 @@ while (proceed==true) {
         phase=999;      //no need to go furter
         }
       break;
-    case 1      :       //displaying certificate
+    case 2      :       //displaying certificate
       if (peer!=(X509 *)0) {    //always
         char *line;
 
@@ -350,7 +354,11 @@ while (proceed==true) {
         (void) free(line);
         }
       break;
-    case 3      :  {     //verifying certificate
+    case 3      :       //everything is fine
+      (void) X509_free(peer);
+      ok=true;
+      break;
+    case 4      :  {     //verifying certificate
       int verif;
 
       verif=SSL_get_verify_result(tls->ssl);
@@ -364,9 +372,7 @@ while (proceed==true) {
         }
       }
       break;
-    case 2      :       //everything is fine
-      (void) X509_free(peer);
-      ok=true;
+    case 5      :       //display cipher used
       break;
     default     :       //SAFE Guard
       proceed=false;

diff --git a/lib/unitls.h b/lib/unitls.h
index 681d107a832b772fa2630273950c1aebe03448a7..726626d7493bcce760d51777e1015648ebc69d36 100644 (file)
--- a/lib/unitls.h
+++ b/lib/unitls.h
@@ -13,6 +13,7 @@
 
 typedef struct  {
         _Bool server;   //SSL server/client mode
+        _Bool checkpeer;//Check peer certificate
         _Bool goteof;   //SSL End Of File
         _Bool tls;      //link in TLS (crypted) mode
         BIO *bio;       //SSL Basic IO