Implement pinned public key in GSKit backend

1 files changed, 19 insertions, 1 deletions

diff --git a/lib/vtls/gskit.c b/lib/vtls/gskit.c
index 0f8b08f2c..ae878c7bc 100644
--- a/lib/vtls/gskit.c
+++ b/lib/vtls/gskit.c
@@ -5,7 +5,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2013, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2014, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -804,6 +804,7 @@ static CURLcode gskit_connect_step3(struct connectdata *conn, int sockindex)
   const gsk_cert_data_elem *p;
   const char *cert = (const char *) NULL;
   const char *certend;
+  const char *ptr;
   int i;
   CURLcode cc;
 
@@ -857,6 +858,23 @@ static CURLcode gskit_connect_step3(struct connectdata *conn, int sockindex)
     }
   }
 
+  /* Check pinned public key. */
+  ptr = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
+  if(cc == CURLE_OK && ptr) {
+    curl_X509certificate x509;
+    curl_asn1Element *p;
+
+    if(!cert)
+      return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
+    Curl_parseX509(&x509, cert, certend);
+    p = &x509.subjectPublicKeyInfo;
+    cc = Curl_pin_peer_pubkey(ptr, p->header, p->end - p->header);
+    if(cc != CURLE_OK) {
+      failf(data, "SSL: public key does not match pinned public key!");
+      return cc;
+    }
+  }
+
   connssl->connecting_state = ssl_connect_done;
   return CURLE_OK;
 }