Feature request: SSL over AIM/ICQ/.Mac with server slogin.oscar.aol.com being supported

[akin]

The latest iChat from Apple supports SSL over AIM/ICQ/.Mac using port 5190 and server slogin.oscar.aol.com . According to the people over at http://trac.adiumx.com/ticket/9474 Adium, it seems that libpurple presently disallows user specification to use SSL (does not offer the option) nor does it offer using a custom port. This would be more secure so can the appropriate option(s) please be made available? Thank you.

[akin]

More info from the Adium side of this is at http://trac.adiumx.com/ticket/9553 .

[darkrain42]

I've attached a set of patches that implement this (against i.p.p head). The single-big-one is simply all three rolled into one.

This code should work just like iChat w/ SSL enabled. The one problem is that validation doesn't fully work because there's an intermediate certificate missing from the trusted stores:

O=VeriSign Trust Network, OU=VeriSign, Inc., OU=VeriSign International Server CA - Class 3, OU=www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign

[darkrain42]

Forgot to mention: I'd love for this patch to get some more testing beyond mey testing (It works with my ICQ and AIM accounts and I could join a chat room and talk and all that)

[darkrain42]

Errr, last updated before I sleep: as-is, the code for figuring out what server to connect to is wonky/broken/bad. You must hard-code it to slogin.oscar.aol.com on the advanced account settings page.

I guess the logic for that should probably go something like:

if (ssl is enabled && account setting is one of the ones that have been default in Pidgin [login.messaging.aol.com, login.oscar.aol.com])
    connect_host = use slogin.oscar.aol.com
    update the account setting to reflect slogin.oscar.aol.com (maybe?)
else
    connect_host = account setting

(hopefully that means something to someone else, too)

[darkrain42]

Intermediate CA that signs the AOL server certs

[darkrain42]

Attached the intermediate CA cert needed for the AOL servers. It is signed by the Verisign_Class3_Primary_CA (included w/ Pidgin already).

$ openssl verify -CApath /nonexistent -CAfile Verisign_Class3_Primary_CA.pem VeriSign_International_Server_Class_3_CA.pem 
VeriSign_International_Server_Class_3_CA.pem: OK
$

(the nonexistent path part is in there because openssl will otherwise verify against /etc/openssl/certs and the requisite verisign cert is already there)

[darkrain42]

Fix the 'user must manually change the connect server' issue

[darkrain42]

Implement a sane mechanism for switching an OSCAR account to SSL.

The user checks the box and, if their login server is one of the default ones used in libpurple, change it to the SSL server. If the user unchecks the box, change it back.

I'm not happy with this, but it works. It might be sensible to adjust our connecting server and not change the account option.

[lid]

Thanks for contributing this patch darkrain42; I look forward to seeing it in a release soon.

[darkrain42]

This is committed to monotone on the im.pidgin.cpw.darkrain42.oscar.ssl branch. Closing since monotone-trac integration doesn't like me.

[paul@…]

(In [e94a3f67048ab9654d2e9cd4edaa60f5aa023f62]):
Provide the intermediate certificate needed to verify AOL's server certificates since the servers don't return a full chain.

Closes #5366

[darkrain42]

Mark merged the branch into im.pidgin.pidgin.