From 02c53c4da99525521b8ded94271f54266948cec4 Mon Sep 17 00:00:00 2001
From: Perry Werneck <perry.werneck@gmail.com>
Date: Fri, 19 Oct 2018 13:15:18 -0300
Subject: [PATCH] Incluindo opção para validação da lista de certificados SSL revogados (CRL).

---
 configure.ac            | 16 ++++++++++++++--
 pw3270.cbp              |  9 +--------
 src/include/config.h.in |  3 ++-
 src/lib3270/ssl.c       |  8 ++++----
 4 files changed, 21 insertions(+), 15 deletions(-)

diff --git a/configure.ac b/configure.ac
index 0a07891..45bebfa 100644
--- a/configure.ac
+++ b/configure.ac
@@ -325,7 +325,7 @@ if test $app_cv_fvisibility_ok = yes; then
 fi
 
 dnl ---------------------------------------------------------------------------
-dnl Allow self signed certificates in SSL connections?
+dnl SSL Security options
 dnl ---------------------------------------------------------------------------
 
 AC_ARG_ENABLE([self-signed-certs],
@@ -336,8 +336,20 @@ AC_ARG_ENABLE([self-signed-certs],
 	app_cv_self_signed_certs="yes"
 ])
 
+AC_ARG_WITH([ssl-crl-check],
+	[AS_HELP_STRING([--with-ssl-crl-check], [enable validation of the certificate revogation list in TN3270S connections])],
+[
+	app_cv_enable_crl_check="$withval"
+],[
+	app_cv_enable_crl_check="no"
+])
+
 if test "$app_cv_self_signed_certs" == "yes"; then
-	AC_DEFINE(ENABLE_SELF_SIGNED_CERT)
+	AC_DEFINE(SSL_ALLOW_SELF_SIGNED_CERT)
+fi
+
+if test "$app_cv_enable_crl_check" == "yes"; then
+	AC_DEFINE(SSL_ENABLE_CRL_CHECK)
 fi
 
 
diff --git a/pw3270.cbp b/pw3270.cbp
index d21d364..e0ddc56 100644
--- a/pw3270.cbp
+++ b/pw3270.cbp
@@ -62,24 +62,17 @@
 		<Unit filename="android/src/br/com/bb/pw3270/PW3270Activity.java" />
 		<Unit filename="android/src/br/com/bb/pw3270/lib3270.java" />
 		<Unit filename="autogen.sh" />
-		<Unit filename="colors.conf" />
 		<Unit filename="configure.ac" />
-		<Unit filename="debian.changelog" />
-		<Unit filename="debian.control" />
-		<Unit filename="debian.rules" />
-		<Unit filename="makedeb.sh" />
-		<Unit filename="makegtkruntime.sh.in" />
 		<Unit filename="man/man1/pw3270.1" />
-		<Unit filename="pw3270.spec.in" />
 		<Unit filename="src/classlib/Makefile.in" />
 		<Unit filename="src/classlib/class.mak.in" />
 		<Unit filename="src/classlib/private.h" />
+		<Unit filename="src/include/config.h.in" />
 		<Unit filename="src/include/lib3270.h" />
 		<Unit filename="src/include/lib3270/X11keysym.h" />
 		<Unit filename="src/include/lib3270/action_table.h" />
 		<Unit filename="src/include/lib3270/actions.h" />
 		<Unit filename="src/include/lib3270/charset.h" />
-		<Unit filename="src/include/lib3270/config.h.in" />
 		<Unit filename="src/include/lib3270/filetransfer.h" />
 		<Unit filename="src/include/lib3270/html.h" />
 		<Unit filename="src/include/lib3270/internals.h" />
diff --git a/src/include/config.h.in b/src/include/config.h.in
index af83bc4..c99be6e 100644
--- a/src/include/config.h.in
+++ b/src/include/config.h.in
@@ -49,7 +49,8 @@
 	#undef HAVE_ICONV
 	#undef ICONV_CONST
 
-	#undef ENABLE_SELF_SIGNED_CERT
+	#undef SSL_ALLOW_SELF_SIGNED_CERT
+	#undef SSL_ENABLE_CRL_CHECK
 
 #ifdef WIN32
 	#undef HAVE_WIN_REGISTRY
diff --git a/src/lib3270/ssl.c b/src/lib3270/ssl.c
index 6db23c7..d1ef5c8 100644
--- a/src/lib3270/ssl.c
+++ b/src/lib3270/ssl.c
@@ -139,7 +139,7 @@ int ssl_negotiate(H3270 *hSession)
 		peer = SSL_get_peer_certificate(hSession->ssl_con);
 		trace_dsn(hSession,"%s","TLS/SSL negotiated connection complete with self signed certificate in certificate chain\n" );
 
-#ifdef ENABLE_SELF_SIGNED_CERT
+#ifdef SSL_ALLOW_SELF_SIGNED_CERT
 		break;
 #else
 		lib3270_disconnect(hSession);
@@ -151,7 +151,7 @@ int ssl_negotiate(H3270 *hSession)
 							);
 
 		return -1;
-#endif // ENABLE_SELF_SIGNED_CERT
+#endif // SSL_ALLOW_SELF_SIGNED_CERT
 
 	default:
 		trace_dsn(hSession,"Unexpected or invalid TLS/SSL verify result %d\n",rv);
@@ -255,7 +255,7 @@ int ssl_init(H3270 *hSession)
 		SSL_CTX_set_info_callback(ssl_ctx, ssl_info_callback);
 		SSL_CTX_set_default_verify_paths(ssl_ctx);
 
-		/*
+#if defined(SSL_ENABLE_CRL_CHECK)
 		// Set up CRL validation
 		// https://stackoverflow.com/questions/4389954/does-openssl-automatically-handle-crls-certificate-revocation-lists-now
 		X509_STORE *store = SSL_CTX_get_cert_store(ssl_ctx);
@@ -265,9 +265,9 @@ int ssl_init(H3270 *hSession)
 		X509_VERIFY_PARAM_set_flags(param, X509_V_FLAG_CRL_CHECK);
 		X509_STORE_set1_param(store, param);
 		X509_VERIFY_PARAM_free(param);
-		*/
 
 		// X509_STORE_free(store);
+#endif // SSL_ENABLE_CRL_CHECK
 
 #if defined(_WIN32)
 		{
--
libgit2 0.21.2