int ufwissl_ssl_context_trustcert(ufwissl_ssl_context * ctx,
const ufwissl_ssl_certificate * cert)
{
gnutls_x509_crt certs = cert->subject;
return (gnutls_certificate_set_x509_trust(ctx->cred, &certs, 1) ==
0) ? UFWISSL_OK : UFWISSL_ERROR;
}
void Gobby::CertificateManager::make_credentials()
{
InfCertificateCredentials* creds = inf_certificate_credentials_new();
gnutls_certificate_credentials_t gnutls_creds =
inf_certificate_credentials_get(creds);
if(m_preferences.security.authentication_enabled &&
m_key != NULL && m_certificates != NULL)
{
gnutls_certificate_set_x509_key(
gnutls_creds,
inf_certificate_chain_get_raw(m_certificates),
inf_certificate_chain_get_n_certificates(m_certificates),
m_key
);
}
if(m_preferences.security.use_system_trust)
{
const int n_cas = gnutls_certificate_set_x509_system_trust(
gnutls_creds);
if(n_cas < 0)
{
g_warning("Failed to add system CAs: %s\n",
gnutls_strerror(n_cas));
}
}
if(!m_trust.empty())
{
gnutls_certificate_set_x509_trust(
gnutls_creds,
&m_trust[0],
m_trust.size()
);
}
if(m_dh_params != NULL)
gnutls_certificate_set_dh_params(gnutls_creds, m_dh_params);
gnutls_certificate_set_verify_flags(
gnutls_creds, GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT);
InfCertificateCredentials* old_creds = m_credentials;
m_credentials = creds;
m_signal_credentials_changed.emit();
if(old_creds != NULL)
inf_certificate_credentials_unref(old_creds);
}
/** Sets the trusted CA and the certificate revocation list
* to use when verifying certificates
*/
void SetCA(std::auto_ptr<X509CertList>& certlist, std::auto_ptr<X509CRL>& CRL)
{
// Do nothing if certlist is NULL
if (certlist.get())
{
int ret = gnutls_certificate_set_x509_trust(cred, certlist->raw(), certlist->size());
ThrowOnError(ret, "gnutls_certificate_set_x509_trust() failed");
if (CRL.get())
{
ret = gnutls_certificate_set_x509_crl(cred, &CRL->get(), 1);
ThrowOnError(ret, "gnutls_certificate_set_x509_crl() failed");
}
trustedca = certlist;
crl = CRL;
}
}
static InfXmppConnection*
inf_test_certificate_validate_setup_client(InfIo* io,
const gchar* ca_file,
const gchar* remote_hostname,
GError** error)
{
InfIpAddress* addr;
InfTcpConnection* conn;
InfXmppConnection* xmpp;
InfCertificateCredentials* creds;
GPtrArray* cas;
int res;
guint i;
creds = inf_certificate_credentials_new();
if(ca_file != NULL)
{
cas = inf_cert_util_read_certificate(ca_file, NULL, error);
if(cas == NULL)
{
inf_certificate_credentials_unref(creds);
return NULL;
}
res = gnutls_certificate_set_x509_trust(
inf_certificate_credentials_get(creds),
(gnutls_x509_crt_t*)cas->pdata,
cas->len
);
for(i = 0; i < cas->len; ++i)
gnutls_x509_crt_deinit(cas->pdata[i]);
g_ptr_array_free(cas, TRUE);
}
addr = inf_ip_address_new_loopback4();
conn = inf_tcp_connection_new(io, addr, 6524);
inf_ip_address_free(addr);
xmpp = inf_xmpp_connection_new(
conn,
INF_XMPP_CONNECTION_CLIENT,
g_get_host_name(),
remote_hostname,
INF_XMPP_CONNECTION_SECURITY_ONLY_TLS,
creds,
NULL,
NULL
);
inf_certificate_credentials_unref(creds);
if(inf_tcp_connection_open(conn, error) == FALSE)
{
g_object_unref(conn);
g_object_unref(xmpp);
return NULL;
}
g_object_unref(conn);
return xmpp;
}
bool load_p12(gnutls_certificate_credentials_t xcred,
const char *const p12_file,
const char *const password)
{
FILE*p12file;
gnutls_datum_t p12blob;
gnutls_pkcs12_t p12 = NULL;
gnutls_x509_privkey_t key = NULL;
gnutls_x509_crt_t certs[MAX_CERTS];
int certs_nr;
int id_cert;
uint8_t key_id[20];
size_t key_id_size;
bool is_success = false;
int ret;
int i;
assert(p12_file != NULL);
/* Read file */
p12file = fopen(p12_file, "rb");
if(p12file == NULL)
{
trace(LOG_ERR, "failed to open PKCS#12 file '%s': %s (%d)", p12_file,
strerror(errno), errno);
ret = GNUTLS_E_FILE_ERROR;
goto error;
}
p12blob.data = malloc(32768 * sizeof(char));
p12blob.size = fread((void*) p12blob.data, sizeof(char), 32768, p12file);
fclose(p12file);
/* Init structure and import P12 */
ret = gnutls_pkcs12_init(&p12);
if(ret < 0)
{
trace(LOG_ERR, "failed to init PKCS#12 object (%d)", ret);
goto free_blob;
}
ret = gnutls_pkcs12_import(p12, &p12blob, GNUTLS_X509_FMT_DER, 0);
if(ret < 0)
{
trace(LOG_ERR, "failed to import PKCS#12 data (%d)", ret);
goto deinit_pkcs12;
}
if(password)
{
ret = gnutls_pkcs12_verify_mac(p12, password);
if(ret < 0)
{
trace(LOG_ERR, "failed to verify PKCS#12 MAC (%d)", ret);
goto deinit_pkcs12;
}
}
/* extract the private key and the certificates from PKCS#12 */
if(!tls_parse_pkcs12(&p12, password, &key, certs, &certs_nr))
{
trace(LOG_ERR, "failed to parse PKCS#12 file '%s'", p12_file);
goto deinit_pkcs12;
}
if(certs_nr < 2)
{
trace(LOG_ERR, "too few certificates in PKCS#12 file '%s'", p12_file);
goto free_certs_key;
}
/* get the ID of private key */
key_id_size = sizeof(key_id);
ret = gnutls_x509_privkey_get_key_id(key, 0, key_id, &key_id_size);
if(ret < 0)
{
trace(LOG_ERR, "failed to get key ID");
goto free_certs_key;
}
id_cert = -1;
for(i = 0; i < certs_nr; i++)
{
uint8_t cert_id[20];
size_t cert_id_size;
cert_id_size = sizeof(cert_id);
ret = gnutls_x509_crt_get_key_id(certs[i], 0, cert_id, &cert_id_size);
if(ret < 0)
{
trace(LOG_ERR, "failed to get key ID for certificate #%d (%d)", i, ret);
goto free_certs_key;
}
if(key_id_size == cert_id_size &&
memcmp(cert_id, key_id, cert_id_size) == 0)
{
/* it's the key certificate ! */
if(id_cert != -1)
{
ret = GNUTLS_E_INTERRUPTED;
trace(LOG_ERR, "Duplicate key certificate !\n");
goto free_certs_key;
}
id_cert = i;
}
}
if(id_cert == -1)
{
ret = GNUTLS_E_INTERRUPTED;
trace(LOG_ERR, "Unable to find key certificate !\n");
goto free_certs_key;
}
/* Now have fun with the key and certs ! */
ret = gnutls_certificate_set_x509_key(xcred, &certs[id_cert], 1, key);
if(ret < 0)
{
trace(LOG_ERR, "failed to set key for main certificate");
goto free_certs_key;
}
for(i = 0; i < certs_nr; i++)
{
if(i != id_cert)
{
ret = gnutls_certificate_set_x509_trust(xcred, &certs[i], 1);
if(ret < 0)
{
trace(LOG_ERR, "failed to trust certificate #%d", i + 1);
goto free_certs_key;
}
}
}
is_success = true;
free_certs_key:
gnutls_x509_privkey_deinit(key);
for(i = 0; i < certs_nr; i++)
{
gnutls_x509_crt_deinit(certs[i]);
}
deinit_pkcs12:
gnutls_pkcs12_deinit(p12);
free_blob:
free(p12blob.data);
error:
return is_success;
}
void ne_ssl_context_trustcert(ne_ssl_context *ctx, const ne_ssl_certificate *cert)
{
gnutls_x509_crt certs = cert->subject;
gnutls_certificate_set_x509_trust(ctx->cred, &certs, 1);
}
static gboolean
infinoted_plugin_certificate_auth_initialize(InfinotedPluginManager* manager,
gpointer plugin_info,
GError** error)
{
InfinotedPluginCertificateAuth* plugin;
InfCertificateCredentials* creds;
GPtrArray* read_certs;
int res;
guint i;
gnutls_x509_crt_t* sign_certs;
InfCertificateChain* sign_chain;
gnutls_x509_privkey_t super_key;
InfCertUtilDescription desc;
gnutls_x509_crt_t super_cert;
InfAclAccountId super_id;
gnutls_x509_crt_t chain[2];
gboolean written;
InfdDirectory* directory;
InfBrowserIter iter;
InfAclSheetSet sheet_set;
InfAclSheet sheet;
InfRequest* request;
plugin = (InfinotedPluginCertificateAuth*)plugin_info;
plugin->manager = manager;
creds = infinoted_plugin_manager_get_credentials(manager);
if(creds == NULL)
{
g_set_error(
error,
infinoted_plugin_certificate_auth_error_quark(),
INFINOTED_PLUGIN_CERTIFICATE_AUTH_ERROR_NO_CREDENTIALS,
"%s",
_("The certificate-auth plugin can only be used when TLS is enabled "
"and a server certificate has been set.")
);
return FALSE;
}
read_certs =
inf_cert_util_read_certificate(plugin->ca_list_file, NULL, error);
if(read_certs == NULL) return FALSE;
if(read_certs->len == 0)
{
g_set_error(
error,
infinoted_plugin_certificate_auth_error_quark(),
INFINOTED_PLUGIN_CERTIFICATE_AUTH_ERROR_NO_CAS,
_("File \"%s\" does not contain any CA certificates"),
plugin->ca_list_file
);
g_ptr_array_free(read_certs, TRUE);
return FALSE;
}
plugin->n_cas = read_certs->len;
plugin->cas = (gnutls_x509_crt_t*)g_ptr_array_free(read_certs, FALSE);
res = gnutls_certificate_set_x509_trust(
inf_certificate_credentials_get(creds),
plugin->cas,
plugin->n_cas
);
if(res < 0)
{
inf_gnutls_set_error(error, res);
return FALSE;
}
if(plugin->ca_key_file != NULL)
{
plugin->ca_key =
inf_cert_util_read_private_key(plugin->ca_key_file, error);
if(plugin->ca_key == NULL)
return FALSE;
/* Walk through certificates and find the certificate that the key
* belongs to. */
for(i = 0; i < plugin->n_cas; ++i)
if(inf_cert_util_check_certificate_key(plugin->cas[i], plugin->ca_key))
break;
if(i == plugin->n_cas)
{
gnutls_x509_privkey_deinit(plugin->ca_key);
plugin->ca_key = NULL;
g_set_error(
error,
infinoted_plugin_certificate_auth_error_quark(),
INFINOTED_PLUGIN_CERTIFICATE_AUTH_ERROR_NO_CA_FOR_KEY,
"%s",
_("The given CA key does not match with any of the CA certificates")
);
return FALSE;
}
plugin->ca_key_index = i;
/* Set the signing certificate of the directory, so that it can handle
* account creation requests. Note that this takes ownership of the
* certificate, so we take special care in the cleanup code in
* infinoted_plugin_certificate_auth_deinitialize(). */
sign_certs = g_malloc(sizeof(gnutls_x509_crt_t));
sign_certs[0] = plugin->cas[plugin->ca_key_index];
sign_chain = inf_certificate_chain_new(sign_certs, 1);
infd_directory_set_certificate(
infinoted_plugin_manager_get_directory(plugin->manager),
plugin->ca_key,
sign_chain
);
inf_certificate_chain_unref(sign_chain);
}
if(plugin->super_user != NULL)
{
if(plugin->ca_key == NULL)
{
g_set_error(
error,
infinoted_plugin_certificate_auth_error_quark(),
INFINOTED_PLUGIN_CERTIFICATE_AUTH_ERROR_NO_CA_KEY,
"%s",
_("Cannot generate a superuser certificate without CA key")
);
return FALSE;
}
/* Create a private key and certificate for the super user. */
infinoted_log_info(
infinoted_plugin_manager_get_log(plugin->manager),
_("Creating 4096-bit RSA private key for the super user account...")
);
super_key =
inf_cert_util_create_private_key(GNUTLS_PK_RSA, 4096, error);
if(super_key == NULL)
return FALSE;
desc.validity = 12 * 3600; /* 12 hours */
desc.dn_common_name = "Super User";
desc.san_dnsname = NULL;
super_cert = inf_cert_util_create_signed_certificate(
super_key,
&desc,
plugin->cas[plugin->ca_key_index],
plugin->ca_key,
error
);
if(super_cert == NULL)
{
gnutls_x509_privkey_deinit(super_key);
return FALSE;
}
super_id = infd_directory_create_acl_account(
infinoted_plugin_manager_get_directory(plugin->manager),
_("Super User"),
TRUE, /* transient */
&super_cert,
1,
error
);
if(super_id == 0)
{
gnutls_x509_crt_deinit(super_cert);
gnutls_x509_privkey_deinit(super_key);
return FALSE;
}
plugin->super_id = super_id;
chain[0] = super_cert;
chain[1] = plugin->cas[plugin->ca_key_index];
written = inf_cert_util_write_certificate_with_key(
super_key,
chain,
2,
plugin->super_user,
error
);
gnutls_x509_crt_deinit(super_cert);
gnutls_x509_privkey_deinit(super_key);
if(written == FALSE)
return FALSE;
inf_browser_get_root(
INF_BROWSER(infinoted_plugin_manager_get_directory(plugin->manager)),
&iter
);
directory = infinoted_plugin_manager_get_directory(plugin->manager);
sheet.account = super_id;
sheet.mask = INF_ACL_MASK_ALL;
infd_directory_get_support_mask(directory, &sheet.perms);
sheet_set.n_sheets = 1;
sheet_set.own_sheets = NULL;
sheet_set.sheets = &sheet;
request = inf_browser_set_acl(
INF_BROWSER(directory),
&iter,
&sheet_set,
infinoted_plugin_certificate_auth_set_acl_cb,
plugin
);
if(request != NULL)
{
plugin->set_acl_request = request;
g_object_ref(plugin->set_acl_request);
}
}
return TRUE;
}
void certificate_credentials::set_x509_trust (gnutls_x509_crt_t * ca_list,
int ca_list_size)
{
RETWRAP (gnutls_certificate_set_x509_trust (cred, ca_list, ca_list_size));
}
