Profanity: SSL: Check FQDN matches TLS cert

[boothj5]

As per the comment by @PMaynard at #280

[pasis]

I think, the next libstrophe's pull request is related: strophe/libstrophe#104

[jubalh]

@pasis do you maybe have time for this?

[AdrianVollmer]

The certs expiration date is also not checked. Profanity will connect without question even if the TLS cert is expired.

[pasis]

@AdrianVollmer , old libstrophe accepted all certs, but recent versions implement cert verification and disable insecure ssl/tls versions. Please, check your libstrophe version and upgrade it to 0.9.2. Also check Profanity configuration. There are options to "trust" cert, which means that libstrophe disables verification. Try to "force" TLS for the test.

[AdrianVollmer]

I built it against libmesode (tag 0.9.2). Using libstrophe does indeed validate the cert. However, none of the /tls options appear to work when using libstrophe (I wish at least the certpath option worked...)

[pasis]

@AdrianVollmer , originally, libmesode was a copy of libstrophe with TLS checks. After libstrophe implemented cert verification, the only significant difference between the libraries is that with libmesode you can see info about TLS cert before you trust or reject it.

Regarding the commands: there are two different TLS groups of commands/options. It can confuse people. First, /tls controls libmesode features (if I remember correctly). Second, /connect ... tls ... or /account ... tls ... - this option controls connection process and is common for libstrophe/libmesode.

[jubalh]

After libstrophe implemented cert verification, the only significant difference between the libraries is that with libmesode you can see info about TLS cert before you trust or reject it.

Do you know why libmesode was created instead of adding that functionality into libstrophe? Could we maybe upstream it there and then remove libmesode?

Another difference is as far as I know that libmesode removed Windows support, right?

[pasis]

Do you know why libmesode was created instead of adding that functionality into libstrophe? Could we maybe upstream it there and then remove libmesode?

Because it adds new interface which was not designed for libstrophe. Plus proper implementation requires much more effort: add the interface to all tls implementations, code quality rework, etc.

Another difference is as far as I know that libmesode removed Windows support, right?

Yes, but the removed code wouldn't build on the target systems anyway. So, users don't see this difference in any way.

In conclusion, I guess we can close this ticket, since openssl does all the verification job, including domain name checks.