void doit(void)
{
int ret;
gnutls_datum_t data;
gnutls_x509_crt_t *crts;
unsigned int crts_size, i;
gnutls_x509_trust_list_t tl;
unsigned int status, flags = GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN;
unsigned int not_flags = GNUTLS_VERIFY_DO_NOT_ALLOW_UNSORTED_CHAIN;
/* this must be called once in the program
*/
global_init();
gnutls_global_set_time_function(mytime);
gnutls_global_set_log_function(tls_log_func);
if (debug)
gnutls_global_set_log_level(6);
/* test for gnutls_certificate_get_issuer() */
gnutls_x509_trust_list_init(&tl, 0);
ret =
gnutls_x509_trust_list_add_trust_mem(tl, &ca, NULL,
GNUTLS_X509_FMT_PEM, 0,
0);
if (ret < 0) {
fail("gnutls_x509_trust_list_add_trust_mem\n");
exit(1);
}
/* Chain 1 */
data.data = (void *) chain1;
data.size = sizeof(chain1);
ret =
gnutls_x509_crt_list_import2(&crts, &crts_size, &data,
GNUTLS_X509_FMT_PEM, 0);
if (ret < 0) {
fail("gnutls_x509_crt_list_import2: %s\n",
gnutls_strerror(ret));
exit(1);
}
ret =
gnutls_x509_trust_list_verify_crt(tl, crts, crts_size, flags,
&status, NULL);
if (ret < 0 || status != 0) {
fail("gnutls_x509_trust_list_verify_crt - 1\n");
exit(1);
}
for (i = 0; i < crts_size; i++)
gnutls_x509_crt_deinit(crts[i]);
gnutls_free(crts);
/* Chain 2 */
data.data = (void *) chain2;
data.size = sizeof(chain2);
/* verify whether the GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED flag is
* considered by gnutls_x509_crt_list_import2() */
ret =
gnutls_x509_crt_list_import2(&crts, &crts_size, &data,
GNUTLS_X509_FMT_PEM, GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED);
if (ret != GNUTLS_E_CERTIFICATE_LIST_UNSORTED) {
fail("gnutls_x509_crt_list_import2 with flag GNUTLS_E_CERTIFICATE_LIST_UNSORTED on unsorted chain didn't fail: %s\n", gnutls_strerror(ret));
exit(1);
}
ret =
gnutls_x509_crt_list_import2(&crts, &crts_size, &data,
GNUTLS_X509_FMT_PEM, 0);
if (ret < 0) {
fail("gnutls_x509_crt_list_import2: %s\n",
gnutls_strerror(ret));
exit(1);
}
ret =
gnutls_x509_trust_list_verify_crt(tl, crts, crts_size, flags,
&status, NULL);
if (ret < 0 || status != 0) {
fail("gnutls_x509_trust_list_verify_crt - 2\n");
exit(1);
}
for (i = 0; i < crts_size; i++)
gnutls_x509_crt_deinit(crts[i]);
gnutls_free(crts);
/* Chain 3 */
data.data = (void *) chain3;
data.size = sizeof(chain3);
ret =
gnutls_x509_crt_list_import2(&crts, &crts_size, &data,
GNUTLS_X509_FMT_PEM, 0);
if (ret < 0) {
fail("gnutls_x509_crt_list_import2: %s\n",
gnutls_strerror(ret));
exit(1);
}
ret =
gnutls_x509_trust_list_verify_crt(tl, crts, crts_size, flags,
&status, NULL);
if (ret < 0 || status != 0) {
fail("gnutls_x509_trust_list_verify_crt - 3\n");
exit(1);
}
for (i = 0; i < crts_size; i++)
gnutls_x509_crt_deinit(crts[i]);
gnutls_free(crts);
/* Chain 4 */
data.data = (void *) chain4;
data.size = sizeof(chain4);
ret =
gnutls_x509_crt_list_import2(&crts, &crts_size, &data,
GNUTLS_X509_FMT_PEM, 0);
if (ret < 0) {
fail("gnutls_x509_crt_list_import2: %s\n",
gnutls_strerror(ret));
exit(1);
}
ret =
gnutls_x509_trust_list_verify_crt(tl, crts, crts_size, flags,
&status, NULL);
if (ret < 0 || status != 0) {
fail("gnutls_x509_trust_list_verify_crt - 4\n");
exit(1);
}
for (i = 0; i < crts_size; i++)
gnutls_x509_crt_deinit(crts[i]);
gnutls_free(crts);
/* Check if an unsorted list would fail if the unsorted flag is not given */
data.data = (void *) chain2;
data.size = sizeof(chain2);
ret =
gnutls_x509_crt_list_import2(&crts, &crts_size, &data,
GNUTLS_X509_FMT_PEM, 0);
if (ret < 0) {
fail("gnutls_x509_crt_list_import2: %s\n",
gnutls_strerror(ret));
exit(1);
}
ret =
gnutls_x509_trust_list_verify_crt(tl, crts, crts_size,
not_flags, &status, NULL);
if (ret < 0 || status == 0) {
fail("gnutls_x509_trust_list_verify_crt - 5\n");
exit(1);
}
for (i = 0; i < crts_size; i++)
gnutls_x509_crt_deinit(crts[i]);
gnutls_free(crts);
gnutls_x509_trust_list_deinit(tl, 1);
gnutls_global_deinit();
if (debug)
success("success");
}
/* This function will try to verify the peer's certificate chain, and
* also check if the hostname matches.
*/
void
verify_certificate_chain(const char *hostname,
const gnutls_datum_t * cert_chain,
int cert_chain_length)
{
int i;
gnutls_x509_trust_list_t tlist;
gnutls_x509_crt_t *cert;
unsigned int output;
/* Initialize the trusted certificate list. This should be done
* once on initialization. gnutls_x509_crt_list_import2() and
* gnutls_x509_crl_list_import2() can be used to load them.
*/
gnutls_x509_trust_list_init(&tlist, 0);
gnutls_x509_trust_list_add_cas(tlist, ca_list, ca_list_size, 0);
gnutls_x509_trust_list_add_crls(tlist, crl_list, crl_list_size,
GNUTLS_TL_VERIFY_CRL, 0);
cert = malloc(sizeof(*cert) * cert_chain_length);
/* Import all the certificates in the chain to
* native certificate format.
*/
for (i = 0; i < cert_chain_length; i++) {
gnutls_x509_crt_init(&cert[i]);
gnutls_x509_crt_import(cert[i], &cert_chain[i],
GNUTLS_X509_FMT_DER);
}
gnutls_x509_trust_list_verify_named_crt(tlist, cert[0], hostname,
strlen(hostname),
GNUTLS_VERIFY_DISABLE_CRL_CHECKS,
&output,
print_details_func);
/* if this certificate is not explicitly trusted verify against CAs
*/
if (output != 0) {
gnutls_x509_trust_list_verify_crt(tlist, cert,
cert_chain_length, 0,
&output,
print_details_func);
}
if (output & GNUTLS_CERT_INVALID) {
fprintf(stderr, "Not trusted");
if (output & GNUTLS_CERT_SIGNER_NOT_FOUND)
fprintf(stderr, ": no issuer was found");
if (output & GNUTLS_CERT_SIGNER_NOT_CA)
fprintf(stderr, ": issuer is not a CA");
if (output & GNUTLS_CERT_NOT_ACTIVATED)
fprintf(stderr, ": not yet activated\n");
if (output & GNUTLS_CERT_EXPIRED)
fprintf(stderr, ": expired\n");
fprintf(stderr, "\n");
} else
fprintf(stderr, "Trusted\n");
/* Check if the name in the first certificate matches our destination!
*/
if (!gnutls_x509_crt_check_hostname(cert[0], hostname)) {
printf
("The certificate's owner does not match hostname '%s'\n",
hostname);
}
gnutls_x509_trust_list_deinit(tlist, 1);
return;
}
void
doit (void)
{
int ret;
gnutls_datum_t data;
gnutls_x509_crt_t server_crt, ca_crt;
gnutls_x509_trust_list_t tl;
unsigned int status;
/* this must be called once in the program
*/
gnutls_global_init ();
gnutls_global_set_time_function (mytime);
gnutls_global_set_log_function (tls_log_func);
if (debug)
gnutls_global_set_log_level (6);
/* test for gnutls_certificate_get_issuer() */
gnutls_x509_trust_list_init(&tl, 0);
gnutls_x509_crt_init(&server_crt);
gnutls_x509_crt_init(&ca_crt);
ret = gnutls_x509_crt_import(server_crt, &cert, GNUTLS_X509_FMT_PEM);
if (ret < 0)
fail("gnutls_x509_crt_import");
ret = gnutls_x509_crt_import(ca_crt, &ca, GNUTLS_X509_FMT_PEM);
if (ret < 0)
fail("gnutls_x509_crt_import");
ret = gnutls_x509_trust_list_add_cas(tl, &ca_crt, 1, 0);
if (ret < 0)
fail("gnutls_x509_trust_list_add_cas");
ret = gnutls_x509_trust_list_add_named_crt(tl, server_crt, NAME, NAME_SIZE, 0);
if (ret < 0)
fail("gnutls_x509_trust_list_add_named_crt");
ret = gnutls_x509_trust_list_verify_crt(tl, &server_crt, 1, 0, &status, NULL);
if (ret < 0 || status != 0)
fail("gnutls_x509_trust_list_verify_crt\n");
ret = gnutls_x509_trust_list_verify_named_crt(tl, server_crt, NAME, NAME_SIZE, 0, &status, NULL);
if (ret < 0 || status != 0)
fail("gnutls_x509_trust_list_verify_named_crt: %d\n", __LINE__);
ret = gnutls_x509_trust_list_verify_named_crt(tl, server_crt, NAME, NAME_SIZE-1, 0, &status, NULL);
if (ret < 0 || status == 0)
fail("gnutls_x509_trust_list_verify_named_crt: %d\n", __LINE__);
ret = gnutls_x509_trust_list_verify_named_crt(tl, server_crt, "other", 5, 0, &status, NULL);
if (ret < 0 || status == 0)
fail("gnutls_x509_trust_list_verify_named_crt: %d\n", __LINE__);
/* test convenience functions in verify-high2.c */
data.data = cert_pem;
data.size = strlen((char*)cert_pem);
ret = gnutls_x509_trust_list_add_trust_mem(tl, &data, NULL, GNUTLS_X509_FMT_PEM, 0, 0);
if (ret < 1)
fail("gnutls_x509_trust_list_add_trust_mem: %d (%s)\n", __LINE__, gnutls_strerror(ret));
data.data = cert_der;
data.size = sizeof(cert_der);
ret = gnutls_x509_trust_list_add_trust_mem(tl, &data, NULL, GNUTLS_X509_FMT_DER, 0, 0);
if (ret < 1)
fail("gnutls_x509_trust_list_add_trust_mem: %d (%s)\n", __LINE__, gnutls_strerror(ret));
gnutls_x509_trust_list_deinit(tl, 1);
gnutls_global_deinit();
if (debug) success("success");
}
