libsec: sha256 support for thumbprint files, use it in ssh as well

initThumbprints() now takes an application tag argument
so x509 and ssh can coexist.

the thumbprint entries can now hold both sha1 and sha256
hashes. okThumbprint() now takes a len argument for the
hash length used.

the new function okCertificate() hashes the certificate
with both and checks for any matches.

on failure, okCertificate() returns 0 and sets error string.

we also check for include loops now in thumbfiles, limiting
the number of includes to 8.

2 files changed, 5 insertions, 8 deletions

diff --git a/sys/src/ape/lib/sec/mkfile b/sys/src/ape/lib/sec/mkfile
index 89d464885..abd5813c9 100644
--- a/sys/src/ape/lib/sec/mkfile
+++ b/sys/src/ape/lib/sec/mkfile
@@ -12,6 +12,7 @@ install all:V:
 	}
 
 clean:V:
+	rm -f [$OS].* *.[$OS]
 	for(i in $DIRS)@{
 		echo $i
 		cd $i
@@ -34,5 +35,6 @@ everything:V:
 
 APE=/sys/src/ape
 <$APE/config
+
 $O.tlsclient: tlsclient.c
 	$CC -o $target $CFLAGS -D_POSIX_SOURCE -D_PLAN9_SOURCE -D_NET_EXTENSION tlsclient.c
diff --git a/sys/src/ape/lib/sec/tlsclient.c b/sys/src/ape/lib/sec/tlsclient.c
index 37095a6ab..3fd412486 100644
--- a/sys/src/ape/lib/sec/tlsclient.c
+++ b/sys/src/ape/lib/sec/tlsclient.c
@@ -107,7 +107,7 @@ main(int argc, char **argv)
 		sysfatal("specifying -x without -t is useless");
 
 	if(file){
-		thumb = initThumbprints(file, filex);
+		thumb = initThumbprints(file, filex, "x509");
 		if(thumb == nil)
 			sysfatal("initThumbprints: %r");
 	} else
@@ -144,13 +144,8 @@ main(int argc, char **argv)
 		sysfatal("tlsclient: %r");
 
 	if(thumb){
-		uchar digest[20];
-
-		if(conn->cert==nil || conn->certlen<=0)
-			sysfatal("server did not provide TLS certificate");
-		sha1(conn->cert, conn->certlen, digest, nil);
-		if(!okThumbprint(digest, thumb))
-			sysfatal("server certificate %.*H not recognized", SHA1dlen, digest);
+		if(!okCertificate(conn->cert, conn->certlen, thumb))
+			sysfatal("cert for %s not recognized: %r", servername ? servername : addr);
 		freeThumbprints(thumb);
 	}