Commit: 193bc37b9f55b9a1dd24a72e06203cb1503eab15 - ffftp (git)

FFFTPのソースコードです。

Commit MetaInfo

• Revision: 193bc37b9f55b9a1dd24a72e06203cb1503eab15 (tree)
• Zeit: 2011-10-14 23:02:53
• Autor: s_kawamoto <s_kawamoto@user...>
• Commiter: s_kawamoto

Log Message

Add dialog to confirm certificate for SSL (experimental).
Prepare member variables for IPv6.

Ändern Zusammenfassung

• modified: FFFTP_Eng_Release/FFFTP.exe
• modified: Release/FFFTP.exe
• modified: common.h
• modified: connect.c
• modified: history.c
• modified: hostman.c
• modified: main.c
• modified: mesg-eng.h
• modified: mesg-eng.old.h
• modified: mesg-jpn.h
• modified: mesg-jpn.old.h
• modified: registory.c
• modified: socketwrapper.c
• modified: socketwrapper.h

Diff

Binary files a/FFFTP_Eng_Release/FFFTP.exe and b/FFFTP_Eng_Release/FFFTP.exe differ

Binary files a/Release/FFFTP.exe and b/Release/FFFTP.exe differ

--- a/common.h
+++ b/common.h
@@ -875,6 +875,9 @@ LIST_UNIX_70
 #define FEATURE_UTF8		0x00000001
 // MLSD対応
 #define FEATURE_MLSD		0x00000002
+// IPv6対応
+#define FEATURE_EPRT		0x00000004
+#define FEATURE_EPSV		0x00000008
 
 
 /*=================================================
@@ -931,6 +934,8 @@ typedef struct {
 	int Feature;						/* 利用可能な機能のフラグ (FEATURE_xxx) */
 	// MLSD対応
 	int UseMLSD;						/* "MLSD"コマンドを使用する */
+	// IPv6対応
+	int UseIPv6;						/* IPv6接続を許可しEPRT/EPSVコマンドを使用する */
 } HOSTDATA;
 
 
@@ -985,6 +990,8 @@ typedef struct historydata {
 	int MaxThreadCount;					/* 同時接続数 */
 	// MLSD対応
 	int UseMLSD;						/* "MLSD"コマンドを使用する */
+	// IPv6対応
+	int UseIPv6;						/* IPv6接続を許可しEPRT/EPSVコマンドを使用する */
 	struct historydata *Next;
 } HISTORYDATA;
 
@@ -1219,6 +1226,7 @@ void ResetAutoExitFlg(void);
 int AskAutoExit(void);
 // 暗号化通信対応
 BOOL __stdcall SSLTimeoutCallback();
+BOOL __stdcall SSLConfirmCallback(BOOL bVerified, LPCSTR Certificate, LPCSTR CommonName);
 
 /*===== filelist.c =====*/
 
@@ -1402,6 +1410,8 @@ int AskMaxThreadCount(void);
 int AskHostFeature(void);
 // MLSD対応
 int AskUseMLSD(void);
+// IPv6対応
+int AskUseIPv6(void);
 
 /*===== cache.c =====*/
 

--- a/connect.c
+++ b/connect.c
@@ -1542,6 +1542,9 @@ static SOCKET DoConnectCrypt(int CryptMode, HOSTDATA* HostData, char *Host, char
 				// MLST対応
 				if(strstr(Reply, " MLST ") || strstr(Reply, " MLSD "))
 					HostData->Feature |= FEATURE_MLSD;
+				// IPv6対応
+				if(strstr(Reply, " EPRT ") || strstr(Reply, " EPSV "))
+					HostData->Feature |= FEATURE_EPRT | FEATURE_EPSV;
 			}
 			// UTF-8対応
 			if(HostData->NameKanjiCode == KANJI_AUTO && (HostData->Feature & FEATURE_UTF8))
@@ -2366,3 +2369,9 @@ int AskUseMLSD(void)
 	return(CurHost.UseMLSD);
 }
 
+// IPv6対応
+int AskUseIPv6(void)
+{
+	return(CurHost.UseIPv6);
+}
+

--- a/history.c
+++ b/history.c
@@ -231,6 +231,8 @@ static void CopyHostToHistory(HOSTDATA *Host, HISTORYDATA *New)
 	New->MaxThreadCount = Host->MaxThreadCount;
 	// MLSD対応
 	New->UseMLSD = Host->UseMLSD;
+	// IPv6対応
+	New->UseIPv6 = Host->UseIPv6;
 	return;
 }
 
@@ -288,6 +290,8 @@ void CopyHistoryToHost(HISTORYDATA *Hist, HOSTDATA *Host)
 	Host->MaxThreadCount = Hist->MaxThreadCount;
 	// MLSD対応
 	Host->UseMLSD = Hist->UseMLSD;
+	// IPv6対応
+	Host->UseIPv6 = Hist->UseIPv6;
 	return;
 }
 

--- a/hostman.c
+++ b/hostman.c
@@ -1037,6 +1037,8 @@ int CopyHostFromListInConnect(int Num, HOSTDATA *Set)
 		Set->MaxThreadCount = Pos->Set.MaxThreadCount;
 		// MLSD対応
 		Set->UseMLSD = Pos->Set.UseMLSD;
+		// IPv6対応
+		Set->UseIPv6 = Pos->Set.UseIPv6;
 		Sts = FFFTP_SUCCESS;
 	}
 	return(Sts);
@@ -1321,6 +1323,8 @@ void CopyDefaultHost(HOSTDATA *Set)
 	// MLSD対応
 	Set->Feature = 0;
 	Set->UseMLSD = YES;
+	// IPv6対応
+	Set->UseIPv6 = YES;
 	return;
 }
 

--- a/main.c
+++ b/main.c
@@ -458,6 +458,7 @@ static int InitApp(LPSTR lpszCmdLine, int cmdShow)
 
 			// 暗号化通信対応
 			SetSSLTimeoutCallback(TimeOut * 1000, SSLTimeoutCallback);
+			SetSSLConfirmCallback(SSLConfirmCallback);
 
 			LoadJre();
 			if(NoRasControl == NO)
@@ -2824,3 +2825,19 @@ BOOL __stdcall SSLTimeoutCallback()
 	return FALSE;
 }
 
+BOOL __stdcall SSLConfirmCallback(BOOL bVerified, LPCSTR Certificate, LPCSTR CommonName)
+{
+	BOOL bResult;
+	char* pm0;
+	bResult = FALSE;
+	pm0 = NULL;
+	if(pm0 = AllocateStringM(strlen(Certificate) + 1024))
+	{
+		sprintf(pm0, MSGJPN326, IsHostNameMatched(AskHostAdrs(), CommonName) ? MSGJPN327 : MSGJPN328, bVerified ? MSGJPN327 : MSGJPN328, Certificate);
+		if(MessageBox(GetMainHwnd(), pm0, "FFFTP", MB_YESNO) == IDYES)
+			bResult = TRUE;
+	}
+	FreeDuplicatedString(pm0);
+	return bResult;
+}
+

--- a/mesg-eng.h
+++ b/mesg-eng.h
@@ -323,3 +323,6 @@
 #define MSGJPN323		"Failed to unload untrustworthy DLLs."
 #define MSGJPN324		"Failed to hook required functions to protect the process."
 #define MSGJPN325		"New master passwords are not identical."
+#define MSGJPN326		"Choose 'Yes' if you trust this certificate and continue.\r\nCN is identical: %s\r\nVerified successfully: %s\r\n\r\n%s"
+#define MSGJPN327		"Yes"
+#define MSGJPN328		"No"

--- a/mesg-eng.old.h
+++ b/mesg-eng.old.h
@@ -323,3 +323,6 @@
 #define MSGJPN323		"Failed to unload untrustworthy DLLs."
 #define MSGJPN324		"Failed to hook required functions to protect the process."
 #define MSGJPN325		"New master passwords are not identical."
+#define MSGJPN326		"Choose 'Yes' if you trust this certificate and continue.\r\nCN is identical: %s\r\nVerified successfully: %s\r\n\r\n%s"
+#define MSGJPN327		"Yes"
+#define MSGJPN328		"No"

--- a/mesg-jpn.h
+++ b/mesg-jpn.h
@@ -323,3 +323,6 @@
 #define MSGJPN323		"\xE4\xBF\xA1\xE9\xA0\xBC\xE3\x81\xA7\xE3\x81\x8D\xE3\x81\xAA\xE3\x81\x84\x44LL\xE3\x82\x92\xE3\x82\xA2\xE3\x83\xB3\xE3\x83\xAD\xE3\x83\xBC\xE3\x83\x89\xE3\x81\xA7\xE3\x81\x8D\xE3\x81\xBE\xE3\x81\x9B\xE3\x82\x93\xE3\x81\xA7\xE3\x81\x97\xE3\x81\x9F."
 #define MSGJPN324		"\xE3\x83\x97\xE3\x83\xAD\xE3\x82\xBB\xE3\x82\xB9\xE3\x81\xAE\xE4\xBF\x9D\xE8\xAD\xB7\xE3\x81\xAB\xE5\xBF\x85\xE8\xA6\x81\xE3\x81\xAA\xE9\x96\xA2\xE6\x95\xB0\xE3\x82\x92\xE3\x83\x95\xE3\x83\x83\xE3\x82\xAF\xE3\x81\xA7\xE3\x81\x8D\xE3\x81\xBE\xE3\x81\x9B\xE3\x82\x93\xE3\x81\xA7\xE3\x81\x97\xE3\x81\x9F."
 #define MSGJPN325		"\xE6\x96\xB0\xE3\x81\x97\xE3\x81\x84\xE3\x83\x9E\xE3\x82\xB9\xE3\x82\xBF\xE3\x83\xBC\xE3\x83\x91\xE3\x82\xB9\xE3\x83\xAF\xE3\x83\xBC\xE3\x83\x89\xE3\x81\x8C\xE4\xB8\x80\xE8\x87\xB4\xE3\x81\x97\xE3\x81\xBE\xE3\x81\x9B\xE3\x82\x93."
+#define MSGJPN326		"\xE3\x81\x93\xE3\x81\xAE\xE8\xA8\xBC\xE6\x98\x8E\xE6\x9B\xB8\xE3\x82\x92\xE4\xBF\xA1\xE9\xA0\xBC\xE3\x81\x97,\xE9\x80\x9A\xE4\xBF\xA1\xE3\x82\x92\xE7\xB6\x9A\xE8\xA1\x8C\xE3\x81\x99\xE3\x82\x8B\xE3\x81\xAB\xE3\x81\xAF\xE3\x80\x8C\xE3\x81\xAF\xE3\x81\x84\xE3\x80\x8D\xE3\x82\x92\xE9\x81\xB8\xE6\x8A\x9E\xE3\x81\x97\xE3\x81\xA6\xE3\x81\x8F\xE3\x81\xA0\xE3\x81\x95\xE3\x81\x84.\r\nCN\xE3\x81\xAE\xE4\xB8\x80\xE8\x87\xB4: %s\r\n\xE6\xA4\x9C\xE8\xA8\xBC\xE3\x81\xAB\xE6\x88\x90\xE5\x8A\x9F: %s\r\n\r\n%s"
+#define MSGJPN327		"\xE3\x81\xAF\xE3\x81\x84"
+#define MSGJPN328		"\xE3\x81\x84\xE3\x81\x84\xE3\x81\x88"

--- a/mesg-jpn.old.h
+++ b/mesg-jpn.old.h
@@ -323,3 +323,6 @@
 #define MSGJPN323		"信頼できないDLLをアンロードできませんでした."
 #define MSGJPN324		"プロセスの保護に必要な関数をフックできませんでした."
 #define MSGJPN325		"新しいマスターパスワードが一致しません."
+#define MSGJPN326		"この証明書を信頼し,通信を続行するには「はい」を選択してください.\r\nCNの一致: %s\r\n検証に成功: %s\r\n\r\n%s"
+#define MSGJPN327		"はい"
+#define MSGJPN328		"いいえ"

--- a/registory.c
+++ b/registory.c
@@ -470,6 +470,8 @@ void SaveRegistory(void)
 							SaveIntNum(hKey5, "ThreadCount", Hist.MaxThreadCount, DefaultHist.MaxThreadCount);
 							// MLSD対応
 							SaveIntNum(hKey5, "MLSD", Hist.UseMLSD, DefaultHist.UseMLSD);
+							// IPv6対応
+							SaveIntNum(hKey5, "IPv6", Hist.UseIPv6, DefaultHist.UseIPv6);
 
 							CloseSubKey(hKey5);
 							n++;
@@ -546,6 +548,8 @@ void SaveRegistory(void)
 							SaveIntNum(hKey5, "ThreadCount", Host.MaxThreadCount, DefaultHost.MaxThreadCount);
 							// MLSD対応
 							SaveIntNum(hKey5, "MLSD", Host.UseMLSD, DefaultHost.UseMLSD);
+							// IPv6対応
+							SaveIntNum(hKey5, "IPv6", Host.UseIPv6, DefaultHost.UseIPv6);
 						}
 						CloseSubKey(hKey5);
 					}
@@ -804,6 +808,8 @@ int LoadRegistory(void)
 					ReadIntValueFromReg(hKey5, "ThreadCount", &Hist.MaxThreadCount);
 					// MLSD対応
 					ReadIntValueFromReg(hKey5, "MLSD", &Hist.UseMLSD);
+					// IPv6対応
+					ReadIntValueFromReg(hKey5, "IPv6", &Hist.UseIPv6);
 
 					CloseSubKey(hKey5);
 					AddHistoryToHistory(&Hist);
@@ -882,6 +888,8 @@ int LoadRegistory(void)
 					ReadIntValueFromReg(hKey5, "ThreadCount", &Host.MaxThreadCount);
 					// MLSD対応
 					ReadIntValueFromReg(hKey5, "MLSD", &Host.UseMLSD);
+					// IPv6対応
+					ReadIntValueFromReg(hKey5, "IPv6", &Host.UseIPv6);
 
 					CloseSubKey(hKey5);
 

--- a/socketwrapper.c
+++ b/socketwrapper.c
@@ -28,31 +28,55 @@ typedef int (__cdecl* _SSL_write)(SSL*, const void*, int);
 typedef int (__cdecl* _SSL_peek)(SSL*, void*, int);
 typedef int (__cdecl* _SSL_read)(SSL*, void*, int);
 typedef int (__cdecl* _SSL_get_error)(SSL*, int);
+typedef X509* (__cdecl* _SSL_get_peer_certificate)(const SSL*);
+typedef long (__cdecl* _SSL_get_verify_result)(const SSL*);
+typedef BIO_METHOD* (__cdecl* _BIO_s_mem)();
+typedef BIO* (__cdecl* _BIO_new)(BIO_METHOD*);
+typedef int (__cdecl* _BIO_free)(BIO*);
+typedef long (__cdecl* _BIO_ctrl)(BIO*, int, long, void*);
+typedef void (__cdecl* _X509_free)(X509*);
+typedef int (__cdecl* _X509_print_ex)(BIO*, X509*, unsigned long, unsigned long);
+typedef X509_NAME* (__cdecl* _X509_get_subject_name)(X509*);
+typedef X509_NAME* (__cdecl* _X509_get_issuer_name)(X509*);
+typedef int (__cdecl* _X509_NAME_print_ex)(BIO*, X509_NAME*, int, unsigned long);
 
-_SSL_load_error_strings pSSL_load_error_strings;
-_SSL_library_init pSSL_library_init;
-_SSLv23_method pSSLv23_method;
-_SSL_CTX_new pSSL_CTX_new;
-_SSL_CTX_free pSSL_CTX_free;
-_SSL_new pSSL_new;
-_SSL_free pSSL_free;
-_SSL_shutdown pSSL_shutdown;
-_SSL_get_fd pSSL_get_fd;
-_SSL_set_fd pSSL_set_fd;
-_SSL_accept pSSL_accept;
-_SSL_connect pSSL_connect;
-_SSL_write pSSL_write;
-_SSL_peek pSSL_peek;
-_SSL_read pSSL_read;
-_SSL_get_error pSSL_get_error;
+_SSL_load_error_strings p_SSL_load_error_strings;
+_SSL_library_init p_SSL_library_init;
+_SSLv23_method p_SSLv23_method;
+_SSL_CTX_new p_SSL_CTX_new;
+_SSL_CTX_free p_SSL_CTX_free;
+_SSL_new p_SSL_new;
+_SSL_free p_SSL_free;
+_SSL_shutdown p_SSL_shutdown;
+_SSL_get_fd p_SSL_get_fd;
+_SSL_set_fd p_SSL_set_fd;
+_SSL_accept p_SSL_accept;
+_SSL_connect p_SSL_connect;
+_SSL_write p_SSL_write;
+_SSL_peek p_SSL_peek;
+_SSL_read p_SSL_read;
+_SSL_get_error p_SSL_get_error;
+_SSL_get_peer_certificate p_SSL_get_peer_certificate;
+_SSL_get_verify_result p_SSL_get_verify_result;
+_BIO_s_mem p_BIO_s_mem;
+_BIO_new p_BIO_new;
+_BIO_free p_BIO_free;
+_BIO_ctrl p_BIO_ctrl;
+_X509_free p_X509_free;
+_X509_print_ex p_X509_print_ex;
+_X509_get_subject_name p_X509_get_subject_name;
+_X509_get_issuer_name p_X509_get_issuer_name;
+_X509_NAME_print_ex p_X509_NAME_print_ex;
 
 #define MAX_SSL_SOCKET 64
 
 BOOL g_bOpenSSLLoaded;
 HMODULE g_hOpenSSL;
+HMODULE g_hOpenSSLCommon;
 CRITICAL_SECTION g_OpenSSLLock;
 DWORD g_OpenSSLTimeout;
 LPSSLTIMEOUTCALLBACK g_pOpenSSLTimeoutCallback;
+LPSSLCONFIRMCALLBACK g_pOpenSSLConfirmCallback;
 SSL_CTX* g_pOpenSSLCTX;
 SSL* g_pOpenSSLHandle[MAX_SSL_SOCKET];
 
@@ -62,6 +86,11 @@ BOOL __stdcall DefaultSSLTimeoutCallback()
 	return FALSE;
 }
 
+BOOL __stdcall DefaultSSLConfirmCallback(BOOL bVerified, LPCSTR Certificate, LPCSTR CommonName)
+{
+	return bVerified;
+}
+
 BOOL LoadOpenSSL()
 {
 	if(g_bOpenSSLLoaded)
@@ -78,32 +107,55 @@ BOOL LoadOpenSSL()
 	if(!g_hOpenSSL)
 		g_hOpenSSL = LoadLibrary("libssl32.dll");
 	if(!g_hOpenSSL
-		|| !(pSSL_load_error_strings = (_SSL_load_error_strings)GetProcAddress(g_hOpenSSL, "SSL_load_error_strings"))
-		|| !(pSSL_library_init = (_SSL_library_init)GetProcAddress(g_hOpenSSL, "SSL_library_init"))
-		|| !(pSSLv23_method = (_SSLv23_method)GetProcAddress(g_hOpenSSL, "SSLv23_method"))
-		|| !(pSSL_CTX_new = (_SSL_CTX_new)GetProcAddress(g_hOpenSSL, "SSL_CTX_new"))
-		|| !(pSSL_CTX_free = (_SSL_CTX_free)GetProcAddress(g_hOpenSSL, "SSL_CTX_free"))
-		|| !(pSSL_new = (_SSL_new)GetProcAddress(g_hOpenSSL, "SSL_new"))
-		|| !(pSSL_free = (_SSL_free)GetProcAddress(g_hOpenSSL, "SSL_free"))
-		|| !(pSSL_shutdown = (_SSL_shutdown)GetProcAddress(g_hOpenSSL, "SSL_shutdown"))
-		|| !(pSSL_get_fd = (_SSL_get_fd)GetProcAddress(g_hOpenSSL, "SSL_get_fd"))
-		|| !(pSSL_set_fd = (_SSL_set_fd)GetProcAddress(g_hOpenSSL, "SSL_set_fd"))
-		|| !(pSSL_accept = (_SSL_accept)GetProcAddress(g_hOpenSSL, "SSL_accept"))
-		|| !(pSSL_connect = (_SSL_connect)GetProcAddress(g_hOpenSSL, "SSL_connect"))
-		|| !(pSSL_write = (_SSL_write)GetProcAddress(g_hOpenSSL, "SSL_write"))
-		|| !(pSSL_peek = (_SSL_peek)GetProcAddress(g_hOpenSSL, "SSL_peek"))
-		|| !(pSSL_read = (_SSL_read)GetProcAddress(g_hOpenSSL, "SSL_read"))
-		|| !(pSSL_get_error = (_SSL_get_error)GetProcAddress(g_hOpenSSL, "SSL_get_error")))
+		|| !(p_SSL_load_error_strings = (_SSL_load_error_strings)GetProcAddress(g_hOpenSSL, "SSL_load_error_strings"))
+		|| !(p_SSL_library_init = (_SSL_library_init)GetProcAddress(g_hOpenSSL, "SSL_library_init"))
+		|| !(p_SSLv23_method = (_SSLv23_method)GetProcAddress(g_hOpenSSL, "SSLv23_method"))
+		|| !(p_SSL_CTX_new = (_SSL_CTX_new)GetProcAddress(g_hOpenSSL, "SSL_CTX_new"))
+		|| !(p_SSL_CTX_free = (_SSL_CTX_free)GetProcAddress(g_hOpenSSL, "SSL_CTX_free"))
+		|| !(p_SSL_new = (_SSL_new)GetProcAddress(g_hOpenSSL, "SSL_new"))
+		|| !(p_SSL_free = (_SSL_free)GetProcAddress(g_hOpenSSL, "SSL_free"))
+		|| !(p_SSL_shutdown = (_SSL_shutdown)GetProcAddress(g_hOpenSSL, "SSL_shutdown"))
+		|| !(p_SSL_get_fd = (_SSL_get_fd)GetProcAddress(g_hOpenSSL, "SSL_get_fd"))
+		|| !(p_SSL_set_fd = (_SSL_set_fd)GetProcAddress(g_hOpenSSL, "SSL_set_fd"))
+		|| !(p_SSL_accept = (_SSL_accept)GetProcAddress(g_hOpenSSL, "SSL_accept"))
+		|| !(p_SSL_connect = (_SSL_connect)GetProcAddress(g_hOpenSSL, "SSL_connect"))
+		|| !(p_SSL_write = (_SSL_write)GetProcAddress(g_hOpenSSL, "SSL_write"))
+		|| !(p_SSL_peek = (_SSL_peek)GetProcAddress(g_hOpenSSL, "SSL_peek"))
+		|| !(p_SSL_read = (_SSL_read)GetProcAddress(g_hOpenSSL, "SSL_read"))
+		|| !(p_SSL_get_error = (_SSL_get_error)GetProcAddress(g_hOpenSSL, "SSL_get_error"))
+		|| !(p_SSL_get_peer_certificate = (_SSL_get_peer_certificate)GetProcAddress(g_hOpenSSL, "SSL_get_peer_certificate"))
+		|| !(p_SSL_get_verify_result = (_SSL_get_verify_result)GetProcAddress(g_hOpenSSL, "SSL_get_verify_result")))
+	{
+		if(g_hOpenSSL)
+			FreeLibrary(g_hOpenSSL);
+		g_hOpenSSL = NULL;
+		return FALSE;
+	}
+	g_hOpenSSLCommon = LoadLibrary("libeay32.dll");
+	if(!g_hOpenSSLCommon
+		|| !(p_BIO_s_mem = (_BIO_s_mem)GetProcAddress(g_hOpenSSLCommon, "BIO_s_mem"))
+		|| !(p_BIO_new = (_BIO_new)GetProcAddress(g_hOpenSSLCommon, "BIO_new"))
+		|| !(p_BIO_free = (_BIO_free)GetProcAddress(g_hOpenSSLCommon, "BIO_free"))
+		|| !(p_BIO_ctrl = (_BIO_ctrl)GetProcAddress(g_hOpenSSLCommon, "BIO_ctrl"))
+		|| !(p_X509_free = (_X509_free)GetProcAddress(g_hOpenSSLCommon, "X509_free"))
+		|| !(p_X509_print_ex = (_X509_print_ex)GetProcAddress(g_hOpenSSLCommon, "X509_print_ex"))
+		|| !(p_X509_get_subject_name = (_X509_get_subject_name)GetProcAddress(g_hOpenSSLCommon, "X509_get_subject_name"))
+		|| !(p_X509_get_issuer_name = (_X509_get_issuer_name)GetProcAddress(g_hOpenSSLCommon, "X509_get_issuer_name"))
+		|| !(p_X509_NAME_print_ex = (_X509_NAME_print_ex)GetProcAddress(g_hOpenSSLCommon, "X509_NAME_print_ex")))
 	{
 		if(g_hOpenSSL)
 			FreeLibrary(g_hOpenSSL);
 		g_hOpenSSL = NULL;
+		if(g_hOpenSSLCommon)
+			FreeLibrary(g_hOpenSSLCommon);
+		g_hOpenSSLCommon = NULL;
 		return FALSE;
 	}
 	InitializeCriticalSection(&g_OpenSSLLock);
-	pSSL_load_error_strings();
-	pSSL_library_init();
+	p_SSL_load_error_strings();
+	p_SSL_library_init();
 	SetSSLTimeoutCallback(60000, DefaultSSLTimeoutCallback);
+	SetSSLConfirmCallback(DefaultSSLConfirmCallback);
 	g_bOpenSSLLoaded = TRUE;
 	return TRUE;
 }
@@ -118,16 +170,18 @@ void FreeOpenSSL()
 	{
 		if(g_pOpenSSLHandle[i])
 		{
-			pSSL_shutdown(g_pOpenSSLHandle[i]);
-			pSSL_free(g_pOpenSSLHandle[i]);
+			p_SSL_shutdown(g_pOpenSSLHandle[i]);
+			p_SSL_free(g_pOpenSSLHandle[i]);
 			g_pOpenSSLHandle[i] = NULL;
 		}
 	}
 	if(g_pOpenSSLCTX)
-		pSSL_CTX_free(g_pOpenSSLCTX);
+		p_SSL_CTX_free(g_pOpenSSLCTX);
 	g_pOpenSSLCTX = NULL;
 	FreeLibrary(g_hOpenSSL);
 	g_hOpenSSL = NULL;
+	FreeLibrary(g_hOpenSSLCommon);
+	g_hOpenSSLCommon = NULL;
 	LeaveCriticalSection(&g_OpenSSLLock);
 	DeleteCriticalSection(&g_OpenSSLLock);
 	g_bOpenSSLLoaded = FALSE;
@@ -156,13 +210,82 @@ SSL** FindSSLPointerFromSocket(SOCKET s)
 	{
 		if(g_pOpenSSLHandle[i])
 		{
-			if(pSSL_get_fd(g_pOpenSSLHandle[i]) == s)
+			if(p_SSL_get_fd(g_pOpenSSLHandle[i]) == s)
 				return &g_pOpenSSLHandle[i];
 		}
 	}
 	return NULL;
 }
 
+BOOL ConfirmSSLCertificate(SSL* pSSL)
+{
+	BOOL bResult;
+	BOOL bVerified;
+	char* pData;
+	char* pSubject;
+	X509* pX509;
+	BIO* pBIO;
+	long Length;
+	char* pBuffer;
+	char* pCN;
+	char* p;
+	bResult = FALSE;
+	bVerified = FALSE;
+	pData = NULL;
+	pSubject = NULL;
+	if(pX509 = p_SSL_get_peer_certificate(pSSL))
+	{
+		if(pBIO = p_BIO_new(p_BIO_s_mem()))
+		{
+			p_X509_print_ex(pBIO, pX509, 0, XN_FLAG_RFC2253);
+			if((Length = p_BIO_ctrl(pBIO, BIO_CTRL_INFO, 0, &pBuffer)) > 0)
+			{
+				if(pData = (char*)malloc(Length + sizeof(char)))
+				{
+					memcpy(pData, pBuffer, Length);
+					*(char*)((size_t)pData + Length) = '\0';
+				}
+			}
+			p_BIO_free(pBIO);
+		}
+		if(pBIO = p_BIO_new(p_BIO_s_mem()))
+		{
+			p_X509_NAME_print_ex(pBIO, p_X509_get_subject_name(pX509), 0, XN_FLAG_RFC2253);
+			if((Length = p_BIO_ctrl(pBIO, BIO_CTRL_INFO, 0, &pBuffer)) > 0)
+			{
+				if(pSubject = (char*)malloc(Length + sizeof(char)))
+				{
+					memcpy(pSubject, pBuffer, Length);
+					*(char*)((size_t)pSubject + Length) = '\0';
+				}
+			}
+			p_BIO_free(pBIO);
+		}
+		p_X509_free(pX509);
+	}
+	if(p_SSL_get_verify_result(pSSL) == X509_V_OK)
+		bVerified = TRUE;
+	pCN = pSubject;
+	while(pCN)
+	{
+		if(strncmp(pCN, "CN=", strlen("CN=")) == 0)
+		{
+			pCN += strlen("CN=");
+			if(p = strchr(pCN, ','))
+				*p = '\0';
+			break;
+		}
+		if(pCN = strchr(pCN, ','))
+			pCN++;
+	}
+	bResult = g_pOpenSSLConfirmCallback(bVerified, pData, pCN);
+	if(pData)
+		free(pData);
+	if(pSubject)
+		free(pSubject);
+	return bResult;
+}
+
 void SetSSLTimeoutCallback(DWORD Timeout, LPSSLTIMEOUTCALLBACK pCallback)
 {
 	if(!g_bOpenSSLLoaded)
@@ -173,6 +296,40 @@ void SetSSLTimeoutCallback(DWORD Timeout, LPSSLTIMEOUTCALLBACK pCallback)
 	LeaveCriticalSection(&g_OpenSSLLock);
 }
 
+void SetSSLConfirmCallback(LPSSLCONFIRMCALLBACK pCallback)
+{
+	if(!g_bOpenSSLLoaded)
+		return;
+	EnterCriticalSection(&g_OpenSSLLock);
+	g_pOpenSSLConfirmCallback = pCallback;
+	LeaveCriticalSection(&g_OpenSSLLock);
+}
+
+BOOL IsHostNameMatched(LPCSTR HostName, LPCSTR CommonName)
+{
+	BOOL bResult;
+	char* pAsterisk;
+	bResult = FALSE;
+	if(HostName && CommonName)
+	{
+		if(pAsterisk = strchr(CommonName, '*'))
+		{
+			if(_strnicmp(HostName, CommonName, ((size_t)pAsterisk - (size_t)CommonName) / sizeof(char)) == 0)
+			{
+				while(*pAsterisk == '*')
+				{
+					pAsterisk++;
+				}
+				if(_stricmp(HostName + strlen(HostName) - strlen(pAsterisk), pAsterisk) == 0)
+					bResult = TRUE;
+			}
+		}
+		else if(_stricmp(HostName, CommonName) == 0)
+			bResult = TRUE;
+	}
+	return bResult;
+}
+
 BOOL AttachSSL(SOCKET s)
 {
 	BOOL r;
@@ -184,18 +341,18 @@ BOOL AttachSSL(SOCKET s)
 	Time = timeGetTime();
 	EnterCriticalSection(&g_OpenSSLLock);
 	if(!g_pOpenSSLCTX)
-		g_pOpenSSLCTX = pSSL_CTX_new(pSSLv23_method());
+		g_pOpenSSLCTX = p_SSL_CTX_new(p_SSLv23_method());
 	if(g_pOpenSSLCTX)
 	{
 		if(ppSSL = GetUnusedSSLPointer())
 		{
-			if(*ppSSL = pSSL_new(g_pOpenSSLCTX))
+			if(*ppSSL = p_SSL_new(g_pOpenSSLCTX))
 			{
-				if(pSSL_set_fd(*ppSSL, s) != 0)
+				if(p_SSL_set_fd(*ppSSL, s) != 0)
 				{
 					r = TRUE;
 					// SSLのネゴシエーションには時間がかかる場合がある
-					while(pSSL_connect(*ppSSL) != 1)
+					while(p_SSL_connect(*ppSSL) != 1)
 					{
 						LeaveCriticalSection(&g_OpenSSLLock);
 						if(g_pOpenSSLTimeoutCallback() || (g_OpenSSLTimeout > 0 && timeGetTime() - Time >= g_OpenSSLTimeout))
@@ -214,6 +371,14 @@ BOOL AttachSSL(SOCKET s)
 					DetachSSL(s);
 					EnterCriticalSection(&g_OpenSSLLock);
 				}
+				if(ConfirmSSLCertificate(*ppSSL))
+				{
+				}
+				else
+				{
+					DetachSSL(s);
+					r = FALSE;
+				}
 			}
 		}
 	}
@@ -231,8 +396,8 @@ BOOL DetachSSL(SOCKET s)
 	EnterCriticalSection(&g_OpenSSLLock);
 	if(ppSSL = FindSSLPointerFromSocket(s))
 	{
-		pSSL_shutdown(*ppSSL);
-		pSSL_free(*ppSSL);
+		p_SSL_shutdown(*ppSSL);
+		p_SSL_free(*ppSSL);
 		*ppSSL = NULL;
 		r = TRUE;
 	}
@@ -305,7 +470,7 @@ int sendS(SOCKET s, const char * buf, int len, int flags)
 	LeaveCriticalSection(&g_OpenSSLLock);
 	if(!ppSSL)
 		return send(s, buf, len, flags);
-	return pSSL_write(*ppSSL, buf, len);
+	return p_SSL_write(*ppSSL, buf, len);
 }
 
 int recvS(SOCKET s, char * buf, int len, int flags)
@@ -319,7 +484,7 @@ int recvS(SOCKET s, char * buf, int len, int flags)
 	if(!ppSSL)
 		return recv(s, buf, len, flags);
 	if(flags & MSG_PEEK)
-		return pSSL_peek(*ppSSL, buf, len);
-	return pSSL_read(*ppSSL, buf, len);
+		return p_SSL_peek(*ppSSL, buf, len);
+	return p_SSL_read(*ppSSL, buf, len);
 }
 

--- a/socketwrapper.h
+++ b/socketwrapper.h
@@ -8,11 +8,14 @@
 #define USE_OPENSSL
 
 typedef BOOL (__stdcall* LPSSLTIMEOUTCALLBACK)();
+typedef BOOL (__stdcall* LPSSLCONFIRMCALLBACK)(BOOL, LPCSTR, LPCSTR);
 
 BOOL LoadOpenSSL();
 void FreeOpenSSL();
 BOOL IsOpenSSLLoaded();
 void SetSSLTimeoutCallback(DWORD Timeout, LPSSLTIMEOUTCALLBACK pCallback);
+void SetSSLConfirmCallback(LPSSLCONFIRMCALLBACK pCallback);
+BOOL IsHostNameMatched(LPCSTR HostName, LPCSTR CommonName);
 BOOL AttachSSL(SOCKET s);
 BOOL DetachSSL(SOCKET s);
 BOOL IsSSLAttached(SOCKET s);