static
int trust_list_get_issuer(gnutls_x509_trust_list_t list,
gnutls_x509_crt_t cert,
gnutls_x509_crt_t * issuer,
unsigned int flags)
{
int ret;
unsigned int i;
uint32_t hash;
hash =
hash_pjw_bare(cert->raw_issuer_dn.data,
cert->raw_issuer_dn.size);
hash %= list->size;
for (i = 0; i < list->node[hash].trusted_ca_size; i++) {
ret =
gnutls_x509_crt_check_issuer(cert,
list->node[hash].
trusted_cas[i]);
if (ret != 0) {
if (flags & GNUTLS_TL_GET_COPY) {
*issuer = crt_cpy(list->node[hash].trusted_cas[i]);
} else {
*issuer = list->node[hash].trusted_cas[i];
}
return 0;
}
}
return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
}
/**
* gnutls_x509_trust_list_get_issuer:
* @list: The structure of the list
* @cert: is the certificate to find issuer for
* @issuer: Will hold the issuer if any. Should be treated as constant.
* @flags: Use (0).
*
* This function will attempt to find the issuer of the
* given certificate.
*
* Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
* negative error value.
*
* Since: 3.0.0
**/
int gnutls_x509_trust_list_get_issuer(gnutls_x509_trust_list_t list,
gnutls_x509_crt_t cert,
gnutls_x509_crt_t * issuer,
unsigned int flags)
{
gnutls_datum_t dn;
int ret, i;
uint32_t hash;
ret = gnutls_x509_crt_get_raw_issuer_dn(cert, &dn);
if (ret < 0) {
gnutls_assert();
return ret;
}
hash = _gnutls_bhash(dn.data, dn.size, INIT_HASH);
hash %= list->size;
_gnutls_free_datum(&dn);
for (i = 0; i < list->node[hash].trusted_ca_size; i++) {
ret =
gnutls_x509_crt_check_issuer(cert,
list->node[hash].trusted_cas[i]);
if (ret > 0) {
*issuer = list->node[hash].trusted_cas[i];
return 0;
}
}
return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
}
bool X509Certificate_GnuTLS::checkIssuer(shared_ptr <const X509Certificate> issuer_) const
{
shared_ptr <const X509Certificate_GnuTLS> issuer =
dynamicCast <const X509Certificate_GnuTLS>(issuer_);
return (gnutls_x509_crt_check_issuer
(m_data->cert, issuer->m_data->cert) >= 1);
}
RD_BOOL
crypto_cert_verify(CryptoCert server_cert, CryptoCert cacert)
{
/* FIXME: check more here ... */
unsigned int verify; /* What is this? */
return gnutls_x509_crt_check_issuer(server_cert->cert,cacert->cert) &&
gnutls_x509_crt_verify(server_cert->cert, &cacert->cert, 1, 0, &verify) == GNUTLS_E_SUCCESS;
}
bool X509Certificate_GnuTLS::checkIssuer(ref <const X509Certificate> issuer_) const
{
ref <const X509Certificate_GnuTLS> issuer =
issuer_.dynamicCast <const X509Certificate_GnuTLS>();
return (gnutls_x509_crt_check_issuer
(m_data->cert, issuer->m_data->cert) >= 1);
}
/* This function will try to verify the peer's certificate chain, and
* also check if the hostname matches, and the activation, expiration dates.
*/
void
verify_certificate_chain (gnutls_session_t session,
const char *hostname,
const gnutls_datum_t * cert_chain,
int cert_chain_length)
{
int i;
gnutls_x509_crt_t *cert;
cert = malloc (sizeof (*cert) * cert_chain_length);
/* Import all the certificates in the chain to
* native certificate format.
*/
for (i = 0; i < cert_chain_length; i++)
{
gnutls_x509_crt_init (&cert[i]);
gnutls_x509_crt_import (cert[i], &cert_chain[i], GNUTLS_X509_FMT_DER);
}
/* If the last certificate in the chain is self signed ignore it.
* That is because we want to check against our trusted certificate
* list.
*/
if (gnutls_x509_crt_check_issuer (cert[cert_chain_length - 1],
cert[cert_chain_length - 1]) > 0
&& cert_chain_length > 0)
{
cert_chain_length--;
}
/* Now verify the certificates against their issuers
* in the chain.
*/
for (i = 1; i < cert_chain_length; i++)
{
verify_cert2 (cert[i - 1], cert[i], crl_list, crl_list_size);
}
/* Here we must verify the last certificate in the chain against
* our trusted CA list.
*/
verify_last_cert (cert[cert_chain_length - 1],
ca_list, ca_list_size, crl_list, crl_list_size);
/* Check if the name in the first certificate matches our destination!
*/
if (!gnutls_x509_crt_check_hostname (cert[0], hostname))
{
printf ("The certificate's owner does not match hostname '%s'\n",
hostname);
}
for (i = 0; i < cert_chain_length; i++)
gnutls_x509_crt_deinit (cert[i]);
return;
}
/* Takes a certificate list and shortens it if there are
* intermedia certificates already trusted by us.
*
* FIXME: This is very similar to _gnutls_x509_verify_certificate().
*
* Returns the new size of the list or a negative number on error.
*/
static int shorten_clist(gnutls_x509_trust_list_t list,
gnutls_x509_crt_t * certificate_list,
int clist_size)
{
int i, ret;
uint32_t hash;
gnutls_datum_t dn;
if (clist_size > 1) {
/* Check if the last certificate in the path is self signed.
* In that case ignore it (a certificate is trusted only if it
* leads to a trusted party by us, not the server's).
*
* This prevents from verifying self signed certificates against
* themselves. This (although not bad) caused verification
* failures on some root self signed certificates that use the
* MD2 algorithm.
*/
if (gnutls_x509_crt_check_issuer(certificate_list[clist_size - 1],
certificate_list[clist_size -
1]) > 0) {
clist_size--;
}
}
/* We want to shorten the chain by removing the cert that matches
* one of the certs we trust and all the certs after that i.e. if
* cert chain is A signed-by B signed-by C signed-by D (signed-by
* self-signed E but already removed above), and we trust B, remove
* B, C and D. */
for (i = 1; i < clist_size; i++) {
int j;
ret = gnutls_x509_crt_get_raw_issuer_dn(certificate_list[i], &dn);
if (ret < 0) {
gnutls_assert();
return ret;
}
hash = _gnutls_bhash(dn.data, dn.size, INIT_HASH);
hash %= list->size;
_gnutls_free_datum(&dn);
for (j = 0; j < list->node[hash].trusted_ca_size; j++) {
if (check_if_same_cert
(certificate_list[i],
list->node[hash].trusted_cas[j]) == 0) {
/* cut the list at the point of first the trusted certificate */
clist_size = i + 1;
break;
}
}
/* clist_size may have been changed which gets out of loop */
}
return clist_size;
}
/* Checks if the extra_certs contain certificates that may form a chain
* with the first certificate in chain (it is expected that chain_len==1)
* and appends those in the chain.
*/
static int make_chain(gnutls_x509_crt_t ** chain, unsigned int *chain_len,
gnutls_x509_crt_t ** extra_certs,
unsigned int *extra_certs_len, unsigned int flags)
{
unsigned int i;
if (*chain_len != 1)
return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
i = 0;
while (i < *extra_certs_len) {
/* if it is an issuer but not a self-signed one */
if (gnutls_x509_crt_check_issuer
((*chain)[*chain_len - 1], (*extra_certs)[i]) != 0) {
if (!(flags & GNUTLS_PKCS12_SP_INCLUDE_SELF_SIGNED)
&&
gnutls_x509_crt_check_issuer((*extra_certs)[i],
(*extra_certs)[i])
!= 0)
goto skip;
*chain =
gnutls_realloc_fast(*chain,
sizeof((*chain)[0]) *
++(*chain_len));
if (*chain == NULL) {
gnutls_assert();
return GNUTLS_E_MEMORY_ERROR;
}
(*chain)[*chain_len - 1] = (*extra_certs)[i];
(*extra_certs)[i] =
(*extra_certs)[*extra_certs_len - 1];
(*extra_certs_len)--;
i = 0;
continue;
}
skip:
i++;
}
return 0;
}
/* Return the issuer of the given certificate, or NULL if none can be
* found. */
static gnutls_x509_crt find_issuer(gnutls_x509_crt *ca_list,
unsigned int num_cas,
gnutls_x509_crt cert)
{
unsigned int n;
for (n = 0; n < num_cas; n++) {
if (gnutls_x509_crt_check_issuer(cert, ca_list[n]) == 1)
return ca_list[n];
}
return NULL;
}
int crypto_verify_chain(crypto_ctx *ctx,
const char *ca_file,
const char *ca_dir,
crypto_error **error)
{
int err, i, ret = 1, start = 0;
gnutls_x509_crt_t *ca_list = NULL;
size_t ca_list_size = 0;
if (!ctx)
return 1;
if (ctx->num == 0)
return 0;
if (ca_file) {
ca_list = load_ca_list_file(ca_file, &ca_list_size, error);
if (!ca_list)
return 1;
} else if (ca_dir) {
/* FIXME: Try to load all files in the directory I guess... */
crypto_error_set(error, 1, 0, "ca_dir not yet supported");
return 1;
}
/* If the server cert is self-signed, ignore it in the issuers check */
err = gnutls_x509_crt_check_issuer(ctx->stack[0], ctx->stack[0]);
if (err > 0)
start++;
/* Check each certificate against its issuer */
for (i = start; i < ctx->num - 1; i++) {
if (verify_issuer(ctx->stack[i], ctx->stack[i + 1], error))
goto out;
}
/* Verify the last certificate */
if (verify_last(ctx->stack[ctx->num - 1], ca_list, ca_list_size, error))
goto out;
ret = 0;
out:
if (ca_list) {
for (i = 0; i < (int) ca_list_size; i++)
gnutls_x509_crt_deinit(ca_list[i]);
gnutls_free(ca_list);
}
return ret;
}
/* Checks if the extra_certs contain certificates that may form a chain
* with the first certificate in chain (it is expected that chain_len==1)
* and appends those in the chain.
*/
static int make_chain(gnutls_x509_crt_t **chain, unsigned int *chain_len,
gnutls_x509_crt_t **extra_certs, unsigned int *extra_certs_len)
{
unsigned int i;
if (*chain_len != 1)
return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
i = 0;
while(i<*extra_certs_len)
{
/* if it is an issuer but not a self-signed one */
if (gnutls_x509_crt_check_issuer((*chain)[*chain_len - 1], (*extra_certs)[i]) != 0 &&
gnutls_x509_crt_check_issuer((*extra_certs)[i], (*extra_certs)[i]) == 0)
{
void *tmp = *chain;
*chain = gnutls_realloc (*chain, sizeof((*chain)[0]) *
++(*chain_len));
if (*chain == NULL)
{
gnutls_assert();
gnutls_free(tmp);
return GNUTLS_E_MEMORY_ERROR;
}
(*chain)[*chain_len - 1] = (*extra_certs)[i];
(*extra_certs)[i] = (*extra_certs)[*extra_certs_len-1];
(*extra_certs_len)--;
i=0;
continue;
}
i++;
}
return 0;
}
/* Verify X.509 certificate chain using a PKCS #11 token.
*
* Note that the return value is an OR of GNUTLS_CERT_* elements.
*
* Unlike the non-PKCS#11 version, this function accepts a key purpose
* (from GNUTLS_KP_...). That is because in the p11-kit trust modules
* anchors are mixed and get assigned a purpose.
*
* This function verifies a X.509 certificate list. The certificate
* list should lead to a trusted certificate in order to be trusted.
*/
unsigned int
_gnutls_pkcs11_verify_crt_status(const char* url,
const gnutls_x509_crt_t * certificate_list,
unsigned clist_size,
const char *purpose,
unsigned int flags,
gnutls_verify_output_function func)
{
int ret;
unsigned int status = 0, i;
gnutls_x509_crt_t issuer = NULL;
gnutls_datum_t raw_issuer = {NULL, 0};
time_t now = gnutls_time(0);
if (clist_size > 1) {
/* Check if the last certificate in the path is self signed.
* In that case ignore it (a certificate is trusted only if it
* leads to a trusted party by us, not the server's).
*
* This prevents from verifying self signed certificates against
* themselves. This (although not bad) caused verification
* failures on some root self signed certificates that use the
* MD2 algorithm.
*/
if (gnutls_x509_crt_check_issuer
(certificate_list[clist_size - 1],
certificate_list[clist_size - 1]) != 0) {
clist_size--;
}
}
/* We want to shorten the chain by removing the cert that matches
* one of the certs we trust and all the certs after that i.e. if
* cert chain is A signed-by B signed-by C signed-by D (signed-by
* self-signed E but already removed above), and we trust B, remove
* B, C and D. */
if (!(flags & GNUTLS_VERIFY_DO_NOT_ALLOW_SAME))
i = 0; /* also replace the first one */
else
i = 1; /* do not replace the first one */
for (; i < clist_size; i++) {
unsigned vflags;
if (i == 0) /* in the end certificate do full comparison */
vflags = GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE|
GNUTLS_PKCS11_OBJ_FLAG_COMPARE|GNUTLS_PKCS11_OBJ_FLAG_RETRIEVE_TRUSTED;
else
vflags = GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE|
GNUTLS_PKCS11_OBJ_FLAG_COMPARE_KEY|GNUTLS_PKCS11_OBJ_FLAG_RETRIEVE_TRUSTED;
if (gnutls_pkcs11_crt_is_known (url, certificate_list[i], vflags) != 0) {
if (!(flags & GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS) &&
!(flags & GNUTLS_VERIFY_DISABLE_TIME_CHECKS)) {
status |=
check_time_status(certificate_list[i], now);
if (status != 0) {
if (func)
func(certificate_list[i], certificate_list[i], NULL, status);
return status;
}
}
if (func)
func(certificate_list[i],
certificate_list[i], NULL, status);
clist_size = i;
break;
}
/* clist_size may have been changed which gets out of loop */
}
if (clist_size == 0) {
/* The certificate is already present in the trusted certificate list.
* Nothing to verify. */
return status;
}
/* check for blacklists */
for (i = 0; i < clist_size; i++) {
if (gnutls_pkcs11_crt_is_known (url, certificate_list[i],
GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE|
GNUTLS_PKCS11_OBJ_FLAG_RETRIEVE_DISTRUSTED) != 0) {
status |= GNUTLS_CERT_INVALID;
status |= GNUTLS_CERT_REVOKED;
if (func)
func(certificate_list[i], certificate_list[i], NULL, status);
goto cleanup;
}
}
/* check against issuer */
ret = gnutls_pkcs11_get_raw_issuer(url, certificate_list[clist_size - 1],
&raw_issuer, GNUTLS_X509_FMT_DER,
GNUTLS_PKCS11_OBJ_FLAG_OVERWRITE_TRUSTMOD_EXT|GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE);
if (ret < 0) {
gnutls_assert();
if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE && clist_size > 2) {
/* check if the last certificate in the chain is present
* in our trusted list, and if yes, verify against it. */
ret = gnutls_pkcs11_crt_is_known(url, certificate_list[clist_size - 1],
GNUTLS_PKCS11_OBJ_FLAG_RETRIEVE_TRUSTED|GNUTLS_PKCS11_OBJ_FLAG_COMPARE);
if (ret != 0) {
return _gnutls_verify_crt_status(certificate_list, clist_size,
&certificate_list[clist_size - 1], 1, flags,
purpose, func);
}
}
status |= GNUTLS_CERT_INVALID;
status |= GNUTLS_CERT_SIGNER_NOT_FOUND;
/* verify the certificate list against 0 trusted CAs in order
* to get, any additional flags from the certificate list (e.g.,
* insecure algorithms or expired */
status |= _gnutls_verify_crt_status(certificate_list, clist_size,
NULL, 0, flags, purpose, func);
goto cleanup;
}
ret = gnutls_x509_crt_init(&issuer);
if (ret < 0) {
gnutls_assert();
status |= GNUTLS_CERT_INVALID;
status |= GNUTLS_CERT_SIGNER_NOT_FOUND;
goto cleanup;
}
ret = gnutls_x509_crt_import(issuer, &raw_issuer, GNUTLS_X509_FMT_DER);
if (ret < 0) {
gnutls_assert();
status |= GNUTLS_CERT_INVALID;
status |= GNUTLS_CERT_SIGNER_NOT_FOUND;
goto cleanup;
}
/* check if the raw issuer is blacklisted (it can happen if
* the issuer is both in the trusted list and the blacklisted)
*/
if (gnutls_pkcs11_crt_is_known (url, issuer,
GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE|
GNUTLS_PKCS11_OBJ_FLAG_RETRIEVE_DISTRUSTED) != 0) {
status |= GNUTLS_CERT_INVALID;
status |= GNUTLS_CERT_SIGNER_NOT_FOUND; /* if the signer is revoked - it is as if it doesn't exist */
goto cleanup;
}
/* security modules that provide trust, bundle all certificates (of all purposes)
* together. In software that doesn't specify any purpose assume the default to
* be www-server. */
ret = _gnutls_check_key_purpose(issuer, purpose==NULL?GNUTLS_KP_TLS_WWW_SERVER:purpose, 0);
if (ret != 1) {
gnutls_assert();
status |= GNUTLS_CERT_INVALID;
status |= GNUTLS_CERT_SIGNER_NOT_FOUND;
goto cleanup;
}
status = _gnutls_verify_crt_status(certificate_list, clist_size,
&issuer, 1, flags, purpose, func);
cleanup:
gnutls_free(raw_issuer.data);
if (issuer != NULL)
gnutls_x509_crt_deinit(issuer);
return status;
}
static CURLcode
gtls_connect_step3(struct connectdata *conn,
int sockindex)
{
unsigned int cert_list_size;
const gnutls_datum *chainp;
unsigned int verify_status;
gnutls_x509_crt x509_cert,x509_issuer;
gnutls_datum issuerp;
char certbuf[256]; /* big enough? */
size_t size;
unsigned int algo;
unsigned int bits;
time_t certclock;
const char *ptr;
struct SessionHandle *data = conn->data;
gnutls_session session = conn->ssl[sockindex].session;
int rc;
int incache;
void *ssl_sessionid;
CURLcode result = CURLE_OK;
/* This function will return the peer's raw certificate (chain) as sent by
the peer. These certificates are in raw format (DER encoded for
X.509). In case of a X.509 then a certificate list may be present. The
first certificate in the list is the peer's certificate, following the
issuer's certificate, then the issuer's issuer etc. */
chainp = gnutls_certificate_get_peers(session, &cert_list_size);
if(!chainp) {
if(data->set.ssl.verifypeer ||
data->set.ssl.verifyhost ||
data->set.ssl.issuercert) {
#ifdef USE_TLS_SRP
if(data->set.ssl.authtype == CURL_TLSAUTH_SRP
&& data->set.ssl.username != NULL
&& !data->set.ssl.verifypeer
&& gnutls_cipher_get(session)) {
/* no peer cert, but auth is ok if we have SRP user and cipher and no
peer verify */
}
else {
#endif
failf(data, "failed to get server cert");
return CURLE_PEER_FAILED_VERIFICATION;
#ifdef USE_TLS_SRP
}
#endif
}
infof(data, "\t common name: WARNING couldn't obtain\n");
}
if(data->set.ssl.verifypeer) {
/* This function will try to verify the peer's certificate and return its
status (trusted, invalid etc.). The value of status should be one or
more of the gnutls_certificate_status_t enumerated elements bitwise
or'd. To avoid denial of service attacks some default upper limits
regarding the certificate key size and chain size are set. To override
them use gnutls_certificate_set_verify_limits(). */
rc = gnutls_certificate_verify_peers2(session, &verify_status);
if(rc < 0) {
failf(data, "server cert verify failed: %d", rc);
return CURLE_SSL_CONNECT_ERROR;
}
/* verify_status is a bitmask of gnutls_certificate_status bits */
if(verify_status & GNUTLS_CERT_INVALID) {
if(data->set.ssl.verifypeer) {
failf(data, "server certificate verification failed. CAfile: %s "
"CRLfile: %s", data->set.ssl.CAfile?data->set.ssl.CAfile:"none",
data->set.ssl.CRLfile?data->set.ssl.CRLfile:"none");
return CURLE_SSL_CACERT;
}
else
infof(data, "\t server certificate verification FAILED\n");
}
else
infof(data, "\t server certificate verification OK\n");
}
else {
infof(data, "\t server certificate verification SKIPPED\n");
goto after_server_cert_verification;
}
/* initialize an X.509 certificate structure. */
gnutls_x509_crt_init(&x509_cert);
/* convert the given DER or PEM encoded Certificate to the native
gnutls_x509_crt_t format */
gnutls_x509_crt_import(x509_cert, chainp, GNUTLS_X509_FMT_DER);
if(data->set.ssl.issuercert) {
gnutls_x509_crt_init(&x509_issuer);
issuerp = load_file(data->set.ssl.issuercert);
gnutls_x509_crt_import(x509_issuer, &issuerp, GNUTLS_X509_FMT_PEM);
rc = gnutls_x509_crt_check_issuer(x509_cert,x509_issuer);
unload_file(issuerp);
if(rc <= 0) {
failf(data, "server certificate issuer check failed (IssuerCert: %s)",
data->set.ssl.issuercert?data->set.ssl.issuercert:"none");
return CURLE_SSL_ISSUER_ERROR;
}
infof(data,"\t server certificate issuer check OK (Issuer Cert: %s)\n",
data->set.ssl.issuercert?data->set.ssl.issuercert:"none");
}
size=sizeof(certbuf);
rc = gnutls_x509_crt_get_dn_by_oid(x509_cert, GNUTLS_OID_X520_COMMON_NAME,
0, /* the first and only one */
FALSE,
certbuf,
&size);
if(rc) {
infof(data, "error fetching CN from cert:%s\n",
gnutls_strerror(rc));
}
/* This function will check if the given certificate's subject matches the
given hostname. This is a basic implementation of the matching described
in RFC2818 (HTTPS), which takes into account wildcards, and the subject
alternative name PKIX extension. Returns non zero on success, and zero on
failure. */
rc = gnutls_x509_crt_check_hostname(x509_cert, conn->host.name);
if(!rc) {
if(data->set.ssl.verifyhost) {
failf(data, "SSL: certificate subject name (%s) does not match "
"target host name '%s'", certbuf, conn->host.dispname);
gnutls_x509_crt_deinit(x509_cert);
return CURLE_PEER_FAILED_VERIFICATION;
}
else
infof(data, "\t common name: %s (does not match '%s')\n",
certbuf, conn->host.dispname);
}
else
infof(data, "\t common name: %s (matched)\n", certbuf);
/* Check for time-based validity */
certclock = gnutls_x509_crt_get_expiration_time(x509_cert);
if(certclock == (time_t)-1) {
failf(data, "server cert expiration date verify failed");
return CURLE_SSL_CONNECT_ERROR;
}
if(certclock < time(NULL)) {
if(data->set.ssl.verifypeer) {
failf(data, "server certificate expiration date has passed.");
return CURLE_PEER_FAILED_VERIFICATION;
}
else
infof(data, "\t server certificate expiration date FAILED\n");
}
else
infof(data, "\t server certificate expiration date OK\n");
certclock = gnutls_x509_crt_get_activation_time(x509_cert);
if(certclock == (time_t)-1) {
failf(data, "server cert activation date verify failed");
return CURLE_SSL_CONNECT_ERROR;
}
if(certclock > time(NULL)) {
if(data->set.ssl.verifypeer) {
failf(data, "server certificate not activated yet.");
return CURLE_PEER_FAILED_VERIFICATION;
}
else
infof(data, "\t server certificate activation date FAILED\n");
}
else
infof(data, "\t server certificate activation date OK\n");
/* Show:
- ciphers used
- subject
- start date
- expire date
- common name
- issuer
*/
/* public key algorithm's parameters */
algo = gnutls_x509_crt_get_pk_algorithm(x509_cert, &bits);
infof(data, "\t certificate public key: %s\n",
gnutls_pk_algorithm_get_name(algo));
/* version of the X.509 certificate. */
infof(data, "\t certificate version: #%d\n",
gnutls_x509_crt_get_version(x509_cert));
size = sizeof(certbuf);
gnutls_x509_crt_get_dn(x509_cert, certbuf, &size);
infof(data, "\t subject: %s\n", certbuf);
certclock = gnutls_x509_crt_get_activation_time(x509_cert);
showtime(data, "start date", certclock);
certclock = gnutls_x509_crt_get_expiration_time(x509_cert);
showtime(data, "expire date", certclock);
size = sizeof(certbuf);
gnutls_x509_crt_get_issuer_dn(x509_cert, certbuf, &size);
infof(data, "\t issuer: %s\n", certbuf);
gnutls_x509_crt_deinit(x509_cert);
after_server_cert_verification:
/* compression algorithm (if any) */
ptr = gnutls_compression_get_name(gnutls_compression_get(session));
/* the *_get_name() says "NULL" if GNUTLS_COMP_NULL is returned */
infof(data, "\t compression: %s\n", ptr);
/* the name of the cipher used. ie 3DES. */
ptr = gnutls_cipher_get_name(gnutls_cipher_get(session));
infof(data, "\t cipher: %s\n", ptr);
/* the MAC algorithms name. ie SHA1 */
ptr = gnutls_mac_get_name(gnutls_mac_get(session));
infof(data, "\t MAC: %s\n", ptr);
conn->ssl[sockindex].state = ssl_connection_complete;
conn->recv[sockindex] = gtls_recv;
conn->send[sockindex] = gtls_send;
{
/* we always unconditionally get the session id here, as even if we
already got it from the cache and asked to use it in the connection, it
might've been rejected and then a new one is in use now and we need to
detect that. */
void *connect_sessionid;
size_t connect_idsize;
/* get the session ID data size */
gnutls_session_get_data(session, NULL, &connect_idsize);
connect_sessionid = malloc(connect_idsize); /* get a buffer for it */
if(connect_sessionid) {
/* extract session ID to the allocated buffer */
gnutls_session_get_data(session, connect_sessionid, &connect_idsize);
incache = !(Curl_ssl_getsessionid(conn, &ssl_sessionid, NULL));
if(incache) {
/* there was one before in the cache, so instead of risking that the
previous one was rejected, we just kill that and store the new */
Curl_ssl_delsessionid(conn, ssl_sessionid);
}
/* store this session id */
result = Curl_ssl_addsessionid(conn, connect_sessionid, connect_idsize);
if(result) {
free(connect_sessionid);
result = CURLE_OUT_OF_MEMORY;
}
}
else
result = CURLE_OUT_OF_MEMORY;
}
return result;
}
bool X509Certificate::checkIssuer(ref <const X509Certificate> issuer) const
{
return (gnutls_x509_crt_check_issuer
(m_data->cert, issuer->m_data->cert) >= 1);
}
/*
* initialize a new TLS context
*/
static int
tlsg_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server )
{
tlsg_ctx *ctx = lo->ldo_tls_ctx;
int rc;
if ( lo->ldo_tls_ciphersuite &&
tlsg_parse_ciphers( ctx, lt->lt_ciphersuite )) {
Debug( LDAP_DEBUG_ANY,
"TLS: could not set cipher list %s.\n",
lo->ldo_tls_ciphersuite, 0, 0 );
return -1;
}
if (lo->ldo_tls_cacertdir != NULL) {
Debug( LDAP_DEBUG_ANY,
"TLS: warning: cacertdir not implemented for gnutls\n",
NULL, NULL, NULL );
}
if (lo->ldo_tls_cacertfile != NULL) {
rc = gnutls_certificate_set_x509_trust_file(
ctx->cred,
lt->lt_cacertfile,
GNUTLS_X509_FMT_PEM );
if ( rc < 0 ) return -1;
}
if ( lo->ldo_tls_certfile && lo->ldo_tls_keyfile ) {
gnutls_x509_privkey_t key;
gnutls_datum_t buf;
gnutls_x509_crt_t certs[VERIFY_DEPTH];
unsigned int max = VERIFY_DEPTH;
rc = gnutls_x509_privkey_init( &key );
if ( rc ) return -1;
/* OpenSSL builds the cert chain for us, but GnuTLS
* expects it to be present in the certfile. If it's
* not, we have to build it ourselves. So we have to
* do some special checks here...
*/
rc = tlsg_getfile( lt->lt_keyfile, &buf );
if ( rc ) return -1;
rc = gnutls_x509_privkey_import( key, &buf,
GNUTLS_X509_FMT_PEM );
LDAP_FREE( buf.data );
if ( rc < 0 ) return rc;
rc = tlsg_getfile( lt->lt_certfile, &buf );
if ( rc ) return -1;
rc = gnutls_x509_crt_list_import( certs, &max, &buf,
GNUTLS_X509_FMT_PEM, 0 );
LDAP_FREE( buf.data );
if ( rc < 0 ) return rc;
/* If there's only one cert and it's not self-signed,
* then we have to build the cert chain.
*/
if ( max == 1 && !gnutls_x509_crt_check_issuer( certs[0], certs[0] )) {
gnutls_x509_crt_t *cas;
unsigned int i, j, ncas;
gnutls_certificate_get_x509_cas( ctx->cred, &cas, &ncas );
for ( i = 1; i<VERIFY_DEPTH; i++ ) {
for ( j = 0; j<ncas; j++ ) {
if ( gnutls_x509_crt_check_issuer( certs[i-1], cas[j] )) {
certs[i] = cas[j];
max++;
/* If this CA is self-signed, we're done */
if ( gnutls_x509_crt_check_issuer( cas[j], cas[j] ))
j = ncas;
break;
}
}
/* only continue if we found a CA and it was not self-signed */
if ( j == ncas )
break;
}
}
rc = gnutls_certificate_set_x509_key( ctx->cred, certs, max, key );
if ( rc ) return -1;
} else if ( lo->ldo_tls_certfile || lo->ldo_tls_keyfile ) {
Debug( LDAP_DEBUG_ANY,
"TLS: only one of certfile and keyfile specified\n",
NULL, NULL, NULL );
return -1;
}
if ( lo->ldo_tls_dhfile ) {
Debug( LDAP_DEBUG_ANY,
"TLS: warning: ignoring dhfile\n",
NULL, NULL, NULL );
}
if ( lo->ldo_tls_crlfile ) {
rc = gnutls_certificate_set_x509_crl_file(
ctx->cred,
lt->lt_crlfile,
GNUTLS_X509_FMT_PEM );
if ( rc < 0 ) return -1;
rc = 0;
}
/* FIXME: ITS#5992 - this should go be configurable,
* and V1 CA certs should be phased out ASAP.
*/
gnutls_certificate_set_verify_flags( ctx->cred,
GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT );
if ( is_server ) {
gnutls_dh_params_init(&ctx->dh_params);
gnutls_dh_params_generate2(ctx->dh_params, DH_BITS);
}
return 0;
}
/* Takes a certificate list and orders it with subject, issuer order.
*
* *clist_size contains the size of the ordered list (which is always less or
* equal to the original).
* @func: the function to call to elements outside the sort.
*
* This function is intentionally kept simple to be easily verified
* so that it can be used with untrusted chains. The introduction
* of the func parameter added significant complexity in that aspect.
* If more demanding use-cases need to be handled, consider splitting
* that function.
*
* Returns the sorted list which may be the original clist.
*
*/
gnutls_x509_crt_t *_gnutls_sort_clist(gnutls_x509_crt_t
sorted[DEFAULT_MAX_VERIFY_DEPTH],
gnutls_x509_crt_t *clist,
unsigned int *clist_size,
gnutls_cert_vfunc func)
{
int prev;
unsigned int j, i;
int issuer[DEFAULT_MAX_VERIFY_DEPTH]; /* contain the index of the issuers */
bool insorted[DEFAULT_MAX_VERIFY_DEPTH]; /* non zero if clist[i] used in sorted list */
unsigned orig_size = *clist_size;
/* Do not bother sorting if too many certificates are given.
* Prevent any DoS attacks.
*/
if (*clist_size > DEFAULT_MAX_VERIFY_DEPTH)
return clist;
for (i = 0; i < DEFAULT_MAX_VERIFY_DEPTH; i++) {
issuer[i] = -1;
insorted[i] = 0;
}
/* Find the issuer of each certificate and store it
* in issuer array. O(n^2) so consider that before
* increasing DEFAULT_MAX_VERIFY_DEPTH.
*/
for (i = 0; i < *clist_size; i++) {
for (j = 1; j < *clist_size; j++) {
if (i == j)
continue;
if (gnutls_x509_crt_check_issuer(clist[i],
clist[j]) != 0) {
issuer[i] = j;
break;
}
}
}
/* the first element is always included */
sorted[0] = clist[0];
insorted[0] = 1;
if (issuer[0] == -1) {
*clist_size = 1;
goto exit;
}
prev = 0;
for (i = 1; i < *clist_size; i++) {
prev = issuer[prev];
if (prev < 0) { /* no issuer */
*clist_size = i;
break;
}
sorted[i] = clist[prev];
insorted[prev] = 1;
}
exit:
if (func) {
/* call func() on all the elements that were
* not used in the sorted list */
for (i = 1; i < orig_size; i++) {
if (insorted[i] == 0) {
func(clist[i]);
}
}
}
return sorted;
}
static unsigned int
CVE_2009_1417_gnutls1_4_3__gnutls_x509_verify_certificate (const gnutls_x509_crt_t * certificate_list,
int clist_size,
const gnutls_x509_crt_t * trusted_cas,
int tcas_size,
const gnutls_x509_crl_t * CRLs,
int crls_size, unsigned int flags)
{
int i = 0, ret;
unsigned int status = 0, output;
/* Verify the last certificate in the certificate path
* against the trusted CA certificate list.
*
* If no CAs are present returns CERT_INVALID. Thus works
* in self signed etc certificates.
*/
ret =
_gnutls_verify_certificate2 (certificate_list[clist_size - 1],
trusted_cas, tcas_size, flags, &output);
if (ret == 0)
{
/* if the last certificate in the certificate
* list is invalid, then the certificate is not
* trusted.
*/
gnutls_assert ();
status |= output;
status |= GNUTLS_CERT_INVALID;
return status;
}
/* Check for revoked certificates in the chain
*/
#ifdef ENABLE_PKI
for (i = 0; i < clist_size; i++)
{
ret = gnutls_x509_crt_check_revocation (certificate_list[i],
CRLs, crls_size);
if (ret == 1)
{ /* revoked */
status |= GNUTLS_CERT_REVOKED;
status |= GNUTLS_CERT_INVALID;
return status;
}
}
#endif
/* Check if the last certificate in the path is self signed.
* In that case ignore it (a certificate is trusted only if it
* leads to a trusted party by us, not the server's).
*/
if (gnutls_x509_crt_check_issuer (certificate_list[clist_size - 1],
certificate_list[clist_size - 1]) > 0
&& clist_size > 0)
{
clist_size--;
}
/* Verify the certificate path (chain)
*/
for (i = clist_size - 1; i > 0; i--)
{
if (i - 1 < 0)
break;
/* note that here we disable this V1 CA flag. So that no version 1
* certificates can exist in a supplied chain.
*/
if (!(flags & GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT))
flags ^= GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT;
if ((ret =
_gnutls_verify_certificate2 (certificate_list[i - 1],
&certificate_list[i], 1, flags,
NULL)) == 0)
{
status |= GNUTLS_CERT_INVALID;
return status;
}
}
return 0;
}
/* Verify X.509 certificate chain.
*
* Note that the return value is an OR of GNUTLS_CERT_* elements.
*
* This function verifies a X.509 certificate list. The certificate
* list should lead to a trusted certificate in order to be trusted.
*/
unsigned int
_gnutls_x509_verify_certificate (const gnutls_x509_crt_t * certificate_list,
int clist_size,
const gnutls_x509_crt_t * trusted_cas,
int tcas_size,
unsigned int flags,
gnutls_verify_output_function func)
{
int i = 0, ret;
unsigned int status = 0, output;
time_t now = gnutls_time (0);
gnutls_x509_crt_t issuer = NULL;
if (clist_size > 1)
{
/* Check if the last certificate in the path is self signed.
* In that case ignore it (a certificate is trusted only if it
* leads to a trusted party by us, not the server's).
*
* This prevents from verifying self signed certificates against
* themselves. This (although not bad) caused verification
* failures on some root self signed certificates that use the
* MD2 algorithm.
*/
if (gnutls_x509_crt_check_issuer (certificate_list[clist_size - 1],
certificate_list[clist_size - 1]) > 0)
{
clist_size--;
}
}
/* We want to shorten the chain by removing the cert that matches
* one of the certs we trust and all the certs after that i.e. if
* cert chain is A signed-by B signed-by C signed-by D (signed-by
* self-signed E but already removed above), and we trust B, remove
* B, C and D. */
if (!(flags & GNUTLS_VERIFY_DO_NOT_ALLOW_SAME))
i = 0; /* also replace the first one */
else
i = 1; /* do not replace the first one */
for (; i < clist_size; i++)
{
int j;
for (j = 0; j < tcas_size; j++)
{
if (check_if_same_cert (certificate_list[i], trusted_cas[j]) == 0)
{
/* explicity time check for trusted CA that we remove from
* list. GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS
*/
if (!(flags & GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS)
&& !(flags & GNUTLS_VERIFY_DISABLE_TIME_CHECKS))
{
status |= check_time (trusted_cas[j], now);
if (status != 0)
{
if (func) func(certificate_list[i], trusted_cas[j], NULL, status);
return status;
}
}
if (func) func(certificate_list[i], trusted_cas[j], NULL, status);
clist_size = i;
break;
}
}
/* clist_size may have been changed which gets out of loop */
}
if (clist_size == 0)
{
/* The certificate is already present in the trusted certificate list.
* Nothing to verify. */
return status;
}
/* Verify the last certificate in the certificate path
* against the trusted CA certificate list.
*
* If no CAs are present returns CERT_INVALID. Thus works
* in self signed etc certificates.
*/
output = 0;
ret = _gnutls_verify_certificate2 (certificate_list[clist_size - 1],
trusted_cas, tcas_size, flags, &output,
&issuer, now, func);
if (ret == 0)
{
/* if the last certificate in the certificate
* list is invalid, then the certificate is not
* trusted.
*/
gnutls_assert ();
status |= output;
status |= GNUTLS_CERT_INVALID;
return status;
}
/* Verify the certificate path (chain)
*/
for (i = clist_size - 1; i > 0; i--)
{
output = 0;
if (i - 1 < 0)
break;
/* note that here we disable this V1 CA flag. So that no version 1
* certificates can exist in a supplied chain.
*/
if (!(flags & GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT))
flags &= ~(GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT);
if ((ret =
_gnutls_verify_certificate2 (certificate_list[i - 1],
&certificate_list[i], 1, flags,
&output, NULL, now, func)) == 0)
{
status |= output;
status |= GNUTLS_CERT_INVALID;
return status;
}
}
return 0;
}
void
pkcs11_export_chain(FILE * outfile, const char *url, unsigned int flags,
common_info_st * info)
{
gnutls_pkcs11_obj_t obj;
gnutls_x509_crt_t xcrt;
gnutls_datum_t t;
int ret;
unsigned int obj_flags = flags;
pkcs11_common(info);
FIX(url, outfile, 0, info);
ret = gnutls_pkcs11_obj_init(&obj);
if (ret < 0) {
fprintf(stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
gnutls_strerror(ret));
exit(1);
}
ret = gnutls_pkcs11_obj_import_url(obj, url, obj_flags);
if (ret < 0) {
fprintf(stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
gnutls_strerror(ret));
exit(1);
}
/* make a crt */
ret = gnutls_x509_crt_init(&xcrt);
if (ret < 0) {
fprintf(stderr, "Error in %s:%d: %s\n", __func__, __LINE__,
gnutls_strerror(ret));
exit(1);
}
ret = gnutls_x509_crt_import_pkcs11(xcrt, obj);
if (ret < 0) {
fprintf(stderr, "Error in %s:%d: %s\n", __func__,
__LINE__, gnutls_strerror(ret));
exit(1);
}
ret = gnutls_pkcs11_obj_export3(obj, GNUTLS_X509_FMT_PEM, &t);
if (ret < 0) {
fprintf(stderr, "Error in %s:%d: %s\n", __func__,
__LINE__, gnutls_strerror(ret));
exit(1);
}
fwrite(t.data, 1, t.size, outfile);
fputs("\n\n", outfile);
gnutls_free(t.data);
gnutls_pkcs11_obj_deinit(obj);
do {
ret = gnutls_pkcs11_get_raw_issuer(url, xcrt, &t, GNUTLS_X509_FMT_PEM, 0);
if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
break;
if (ret < 0) {
fprintf(stderr, "Error in %s:%d: %s\n", __func__,
__LINE__, gnutls_strerror(ret));
exit(1);
}
fwrite(t.data, 1, t.size, outfile);
fputs("\n\n", outfile);
gnutls_x509_crt_deinit(xcrt);
ret = gnutls_x509_crt_init(&xcrt);
if (ret < 0) {
fprintf(stderr, "Error in %s:%d: %s\n", __func__,
__LINE__, gnutls_strerror(ret));
exit(1);
}
ret = gnutls_x509_crt_import(xcrt, &t, GNUTLS_X509_FMT_PEM);
if (ret < 0) {
fprintf(stderr, "Error in %s:%d: %s\n", __func__,
__LINE__, gnutls_strerror(ret));
exit(1);
}
gnutls_free(t.data);
ret = gnutls_x509_crt_check_issuer(xcrt, xcrt);
if (ret != 0) {
/* self signed */
break;
}
} while(1);
UNFIX;
return;
}
/* Verify X.509 certificate chain.
*
* Note that the return value is an OR of GNUTLS_CERT_* elements.
*
* This function verifies a X.509 certificate list. The certificate
* list should lead to a trusted certificate in order to be trusted.
*/
unsigned int
_gnutls_verify_crt_status(const gnutls_x509_crt_t * certificate_list,
int clist_size,
const gnutls_x509_crt_t * trusted_cas,
int tcas_size,
unsigned int flags,
const char *purpose,
gnutls_verify_output_function func)
{
int i = 0, ret;
unsigned int status = 0, output;
time_t now = gnutls_time(0);
verify_state_st vparams;
if (clist_size > 1) {
/* Check if the last certificate in the path is self signed.
* In that case ignore it (a certificate is trusted only if it
* leads to a trusted party by us, not the server's).
*
* This prevents from verifying self signed certificates against
* themselves. This (although not bad) caused verification
* failures on some root self signed certificates that use the
* MD2 algorithm.
*/
if (gnutls_x509_crt_check_issuer
(certificate_list[clist_size - 1],
certificate_list[clist_size - 1]) != 0) {
clist_size--;
}
}
/* We want to shorten the chain by removing the cert that matches
* one of the certs we trust and all the certs after that i.e. if
* cert chain is A signed-by B signed-by C signed-by D (signed-by
* self-signed E but already removed above), and we trust B, remove
* B, C and D. */
if (!(flags & GNUTLS_VERIFY_DO_NOT_ALLOW_SAME))
i = 0; /* also replace the first one */
else
i = 1; /* do not replace the first one */
for (; i < clist_size; i++) {
int j;
for (j = 0; j < tcas_size; j++) {
/* we check for a certificate that may not be identical with the one
* sent by the client, but will have the same name and key. That is
* because it can happen that a CA certificate is upgraded from intermediate
* CA to self-signed CA at some point. */
if (_gnutls_check_if_same_key
(certificate_list[i], trusted_cas[j], i) != 0) {
/* explicit time check for trusted CA that we remove from
* list. GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS
*/
if (!(flags & GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS) &&
!(flags & GNUTLS_VERIFY_DISABLE_TIME_CHECKS)) {
status |=
check_time_status(trusted_cas[j],
now);
if (status != 0) {
if (func)
func(certificate_list[i], trusted_cas[j], NULL, status);
return status;
}
}
if (func)
func(certificate_list[i],
trusted_cas[j], NULL, status);
clist_size = i;
break;
}
}
/* clist_size may have been changed which gets out of loop */
}
if (clist_size == 0) {
/* The certificate is already present in the trusted certificate list.
* Nothing to verify. */
return status;
}
memset(&vparams, 0, sizeof(vparams));
vparams.now = now;
vparams.max_path = MAX_VERIFY_DEPTH;
vparams.func = func;
ret = gnutls_x509_name_constraints_init(&vparams.nc);
if (ret < 0) {
gnutls_assert();
status |= GNUTLS_CERT_INVALID;
return status;
}
ret = gnutls_x509_tlsfeatures_init(&vparams.tls_feat);
if (ret < 0) {
gnutls_assert();
status |= GNUTLS_CERT_INVALID;
goto cleanup;
}
/* Verify the last certificate in the certificate path
* against the trusted CA certificate list.
*
* If no CAs are present returns CERT_INVALID. Thus works
* in self signed etc certificates.
*/
output = 0;
ret = verify_crt(certificate_list[clist_size - 1],
trusted_cas, tcas_size, flags,
&output,
&vparams,
clist_size==1?1:0);
if (ret != 1) {
/* if the last certificate in the certificate
* list is invalid, then the certificate is not
* trusted.
*/
gnutls_assert();
status |= output;
status |= GNUTLS_CERT_INVALID;
goto cleanup;
}
/* Verify the certificate path (chain)
*/
for (i = clist_size - 1; i > 0; i--) {
output = 0;
if (i - 1 < 0)
break;
if (purpose != NULL) {
ret = _gnutls_check_key_purpose(certificate_list[i], purpose, 1);
if (ret != 1) {
gnutls_assert();
status |= GNUTLS_CERT_INVALID;
status |= GNUTLS_CERT_PURPOSE_MISMATCH;
if (func)
func(certificate_list[i-1],
certificate_list[i], NULL, status);
goto cleanup;
}
}
/* note that here we disable this V1 CA flag. So that no version 1
* certificates can exist in a supplied chain.
*/
if (!(flags & GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT)) {
flags |= GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT;
}
if ((ret =
verify_crt(certificate_list[i - 1],
&certificate_list[i], 1,
flags, &output,
&vparams,
i==1?1:0)) != 1) {
gnutls_assert();
status |= output;
status |= GNUTLS_CERT_INVALID;
goto cleanup;
}
}
cleanup:
gnutls_x509_name_constraints_deinit(vparams.nc);
gnutls_x509_tlsfeatures_deinit(vparams.tls_feat);
return status;
}
static CURLcode
gtls_connect_step3(struct connectdata *conn,
int sockindex)
{
unsigned int cert_list_size;
const gnutls_datum_t *chainp;
unsigned int verify_status = 0;
gnutls_x509_crt_t x509_cert, x509_issuer;
gnutls_datum_t issuerp;
char certbuf[256] = ""; /* big enough? */
size_t size;
unsigned int algo;
unsigned int bits;
time_t certclock;
const char *ptr;
struct SessionHandle *data = conn->data;
gnutls_session_t session = conn->ssl[sockindex].session;
int rc;
bool incache;
void *ssl_sessionid;
#ifdef HAS_ALPN
gnutls_datum_t proto;
#endif
CURLcode result = CURLE_OK;
gnutls_protocol_t version = gnutls_protocol_get_version(session);
/* the name of the cipher suite used, e.g. ECDHE_RSA_AES_256_GCM_SHA384. */
ptr = gnutls_cipher_suite_get_name(gnutls_kx_get(session),
gnutls_cipher_get(session),
gnutls_mac_get(session));
infof(data, "SSL connection using %s / %s\n",
gnutls_protocol_get_name(version), ptr);
/* This function will return the peer's raw certificate (chain) as sent by
the peer. These certificates are in raw format (DER encoded for
X.509). In case of a X.509 then a certificate list may be present. The
first certificate in the list is the peer's certificate, following the
issuer's certificate, then the issuer's issuer etc. */
chainp = gnutls_certificate_get_peers(session, &cert_list_size);
if(!chainp) {
if(data->set.ssl.verifypeer ||
data->set.ssl.verifyhost ||
data->set.ssl.issuercert) {
#ifdef USE_TLS_SRP
if(data->set.ssl.authtype == CURL_TLSAUTH_SRP
&& data->set.ssl.username != NULL
&& !data->set.ssl.verifypeer
&& gnutls_cipher_get(session)) {
/* no peer cert, but auth is ok if we have SRP user and cipher and no
peer verify */
}
else {
#endif
failf(data, "failed to get server cert");
return CURLE_PEER_FAILED_VERIFICATION;
#ifdef USE_TLS_SRP
}
#endif
}
infof(data, "\t common name: WARNING couldn't obtain\n");
}
if(data->set.ssl.certinfo && chainp) {
unsigned int i;
result = Curl_ssl_init_certinfo(data, cert_list_size);
if(result)
return result;
for(i = 0; i < cert_list_size; i++) {
const char *beg = (const char *) chainp[i].data;
const char *end = beg + chainp[i].size;
result = Curl_extract_certinfo(conn, i, beg, end);
if(result)
return result;
}
}
if(data->set.ssl.verifypeer) {
/* This function will try to verify the peer's certificate and return its
status (trusted, invalid etc.). The value of status should be one or
more of the gnutls_certificate_status_t enumerated elements bitwise
or'd. To avoid denial of service attacks some default upper limits
regarding the certificate key size and chain size are set. To override
them use gnutls_certificate_set_verify_limits(). */
rc = gnutls_certificate_verify_peers2(session, &verify_status);
if(rc < 0) {
failf(data, "server cert verify failed: %d", rc);
return CURLE_SSL_CONNECT_ERROR;
}
/* verify_status is a bitmask of gnutls_certificate_status bits */
if(verify_status & GNUTLS_CERT_INVALID) {
if(data->set.ssl.verifypeer) {
failf(data, "server certificate verification failed. CAfile: %s "
"CRLfile: %s", data->set.ssl.CAfile?data->set.ssl.CAfile:"none",
data->set.ssl.CRLfile?data->set.ssl.CRLfile:"none");
return CURLE_SSL_CACERT;
}
else
infof(data, "\t server certificate verification FAILED\n");
}
else
infof(data, "\t server certificate verification OK\n");
}
else
infof(data, "\t server certificate verification SKIPPED\n");
#ifdef HAS_OCSP
if(data->set.ssl.verifystatus) {
if(gnutls_ocsp_status_request_is_checked(session, 0) == 0) {
gnutls_datum_t status_request;
gnutls_ocsp_resp_t ocsp_resp;
gnutls_ocsp_cert_status_t status;
gnutls_x509_crl_reason_t reason;
rc = gnutls_ocsp_status_request_get(session, &status_request);
infof(data, "\t server certificate status verification FAILED\n");
if(rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
failf(data, "No OCSP response received");
return CURLE_SSL_INVALIDCERTSTATUS;
}
if(rc < 0) {
failf(data, "Invalid OCSP response received");
return CURLE_SSL_INVALIDCERTSTATUS;
}
gnutls_ocsp_resp_init(&ocsp_resp);
rc = gnutls_ocsp_resp_import(ocsp_resp, &status_request);
if(rc < 0) {
failf(data, "Invalid OCSP response received");
return CURLE_SSL_INVALIDCERTSTATUS;
}
rc = gnutls_ocsp_resp_get_single(ocsp_resp, 0, NULL, NULL, NULL, NULL,
&status, NULL, NULL, NULL, &reason);
switch(status) {
case GNUTLS_OCSP_CERT_GOOD:
break;
case GNUTLS_OCSP_CERT_REVOKED: {
const char *crl_reason;
switch(reason) {
default:
case GNUTLS_X509_CRLREASON_UNSPECIFIED:
crl_reason = "unspecified reason";
break;
case GNUTLS_X509_CRLREASON_KEYCOMPROMISE:
crl_reason = "private key compromised";
break;
case GNUTLS_X509_CRLREASON_CACOMPROMISE:
crl_reason = "CA compromised";
break;
case GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED:
crl_reason = "affiliation has changed";
break;
case GNUTLS_X509_CRLREASON_SUPERSEDED:
crl_reason = "certificate superseded";
break;
case GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION:
crl_reason = "operation has ceased";
break;
case GNUTLS_X509_CRLREASON_CERTIFICATEHOLD:
crl_reason = "certificate is on hold";
break;
case GNUTLS_X509_CRLREASON_REMOVEFROMCRL:
crl_reason = "will be removed from delta CRL";
break;
case GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN:
crl_reason = "privilege withdrawn";
break;
case GNUTLS_X509_CRLREASON_AACOMPROMISE:
crl_reason = "AA compromised";
break;
}
failf(data, "Server certificate was revoked: %s", crl_reason);
break;
}
default:
case GNUTLS_OCSP_CERT_UNKNOWN:
failf(data, "Server certificate status is unknown");
break;
}
gnutls_ocsp_resp_deinit(ocsp_resp);
return CURLE_SSL_INVALIDCERTSTATUS;
}
else
infof(data, "\t server certificate status verification OK\n");
}
else
infof(data, "\t server certificate status verification SKIPPED\n");
#endif
/* initialize an X.509 certificate structure. */
gnutls_x509_crt_init(&x509_cert);
if(chainp)
/* convert the given DER or PEM encoded Certificate to the native
gnutls_x509_crt_t format */
gnutls_x509_crt_import(x509_cert, chainp, GNUTLS_X509_FMT_DER);
if(data->set.ssl.issuercert) {
gnutls_x509_crt_init(&x509_issuer);
issuerp = load_file(data->set.ssl.issuercert);
gnutls_x509_crt_import(x509_issuer, &issuerp, GNUTLS_X509_FMT_PEM);
rc = gnutls_x509_crt_check_issuer(x509_cert, x509_issuer);
gnutls_x509_crt_deinit(x509_issuer);
unload_file(issuerp);
if(rc <= 0) {
failf(data, "server certificate issuer check failed (IssuerCert: %s)",
data->set.ssl.issuercert?data->set.ssl.issuercert:"none");
gnutls_x509_crt_deinit(x509_cert);
return CURLE_SSL_ISSUER_ERROR;
}
infof(data, "\t server certificate issuer check OK (Issuer Cert: %s)\n",
data->set.ssl.issuercert?data->set.ssl.issuercert:"none");
}
size=sizeof(certbuf);
rc = gnutls_x509_crt_get_dn_by_oid(x509_cert, GNUTLS_OID_X520_COMMON_NAME,
0, /* the first and only one */
FALSE,
certbuf,
&size);
if(rc) {
infof(data, "error fetching CN from cert:%s\n",
gnutls_strerror(rc));
}
/* This function will check if the given certificate's subject matches the
given hostname. This is a basic implementation of the matching described
in RFC2818 (HTTPS), which takes into account wildcards, and the subject
alternative name PKIX extension. Returns non zero on success, and zero on
failure. */
rc = gnutls_x509_crt_check_hostname(x509_cert, conn->host.name);
#if GNUTLS_VERSION_NUMBER < 0x030306
/* Before 3.3.6, gnutls_x509_crt_check_hostname() didn't check IP
addresses. */
if(!rc) {
#ifdef ENABLE_IPV6
#define use_addr in6_addr
#else
#define use_addr in_addr
#endif
unsigned char addrbuf[sizeof(struct use_addr)];
unsigned char certaddr[sizeof(struct use_addr)];
size_t addrlen = 0, certaddrlen;
int i;
int ret = 0;
if(Curl_inet_pton(AF_INET, conn->host.name, addrbuf) > 0)
addrlen = 4;
#ifdef ENABLE_IPV6
else if(Curl_inet_pton(AF_INET6, conn->host.name, addrbuf) > 0)
addrlen = 16;
#endif
if(addrlen) {
for(i=0; ; i++) {
certaddrlen = sizeof(certaddr);
ret = gnutls_x509_crt_get_subject_alt_name(x509_cert, i, certaddr,
&certaddrlen, NULL);
/* If this happens, it wasn't an IP address. */
if(ret == GNUTLS_E_SHORT_MEMORY_BUFFER)
continue;
if(ret < 0)
break;
if(ret != GNUTLS_SAN_IPADDRESS)
continue;
if(certaddrlen == addrlen && !memcmp(addrbuf, certaddr, addrlen)) {
rc = 1;
break;
}
}
}
}
#endif
if(!rc) {
if(data->set.ssl.verifyhost) {
failf(data, "SSL: certificate subject name (%s) does not match "
"target host name '%s'", certbuf, conn->host.dispname);
gnutls_x509_crt_deinit(x509_cert);
return CURLE_PEER_FAILED_VERIFICATION;
}
else
infof(data, "\t common name: %s (does not match '%s')\n",
certbuf, conn->host.dispname);
}
else
infof(data, "\t common name: %s (matched)\n", certbuf);
/* Check for time-based validity */
certclock = gnutls_x509_crt_get_expiration_time(x509_cert);
if(certclock == (time_t)-1) {
if(data->set.ssl.verifypeer) {
failf(data, "server cert expiration date verify failed");
gnutls_x509_crt_deinit(x509_cert);
return CURLE_SSL_CONNECT_ERROR;
}
else
infof(data, "\t server certificate expiration date verify FAILED\n");
}
else {
if(certclock < time(NULL)) {
if(data->set.ssl.verifypeer) {
failf(data, "server certificate expiration date has passed.");
gnutls_x509_crt_deinit(x509_cert);
return CURLE_PEER_FAILED_VERIFICATION;
}
else
infof(data, "\t server certificate expiration date FAILED\n");
}
else
infof(data, "\t server certificate expiration date OK\n");
}
certclock = gnutls_x509_crt_get_activation_time(x509_cert);
if(certclock == (time_t)-1) {
if(data->set.ssl.verifypeer) {
failf(data, "server cert activation date verify failed");
gnutls_x509_crt_deinit(x509_cert);
return CURLE_SSL_CONNECT_ERROR;
}
else
infof(data, "\t server certificate activation date verify FAILED\n");
}
else {
if(certclock > time(NULL)) {
if(data->set.ssl.verifypeer) {
failf(data, "server certificate not activated yet.");
gnutls_x509_crt_deinit(x509_cert);
return CURLE_PEER_FAILED_VERIFICATION;
}
else
infof(data, "\t server certificate activation date FAILED\n");
}
else
infof(data, "\t server certificate activation date OK\n");
}
ptr = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
if(ptr) {
result = pkp_pin_peer_pubkey(data, x509_cert, ptr);
if(result != CURLE_OK) {
failf(data, "SSL: public key does not match pinned public key!");
gnutls_x509_crt_deinit(x509_cert);
return result;
}
}
/* Show:
- subject
- start date
- expire date
- common name
- issuer
*/
/* public key algorithm's parameters */
algo = gnutls_x509_crt_get_pk_algorithm(x509_cert, &bits);
infof(data, "\t certificate public key: %s\n",
gnutls_pk_algorithm_get_name(algo));
/* version of the X.509 certificate. */
infof(data, "\t certificate version: #%d\n",
gnutls_x509_crt_get_version(x509_cert));
size = sizeof(certbuf);
gnutls_x509_crt_get_dn(x509_cert, certbuf, &size);
infof(data, "\t subject: %s\n", certbuf);
certclock = gnutls_x509_crt_get_activation_time(x509_cert);
showtime(data, "start date", certclock);
certclock = gnutls_x509_crt_get_expiration_time(x509_cert);
showtime(data, "expire date", certclock);
size = sizeof(certbuf);
gnutls_x509_crt_get_issuer_dn(x509_cert, certbuf, &size);
infof(data, "\t issuer: %s\n", certbuf);
gnutls_x509_crt_deinit(x509_cert);
/* compression algorithm (if any) */
ptr = gnutls_compression_get_name(gnutls_compression_get(session));
/* the *_get_name() says "NULL" if GNUTLS_COMP_NULL is returned */
infof(data, "\t compression: %s\n", ptr);
#ifdef HAS_ALPN
if(data->set.ssl_enable_alpn) {
rc = gnutls_alpn_get_selected_protocol(session, &proto);
if(rc == 0) {
infof(data, "ALPN, server accepted to use %.*s\n", proto.size,
proto.data);
#ifdef USE_NGHTTP2
if(proto.size == NGHTTP2_PROTO_VERSION_ID_LEN &&
!memcmp(NGHTTP2_PROTO_VERSION_ID, proto.data,
NGHTTP2_PROTO_VERSION_ID_LEN)) {
conn->negnpn = CURL_HTTP_VERSION_2;
}
else
#endif
if(proto.size == ALPN_HTTP_1_1_LENGTH &&
!memcmp(ALPN_HTTP_1_1, proto.data, ALPN_HTTP_1_1_LENGTH)) {
conn->negnpn = CURL_HTTP_VERSION_1_1;
}
}
else
infof(data, "ALPN, server did not agree to a protocol\n");
}
#endif
conn->ssl[sockindex].state = ssl_connection_complete;
conn->recv[sockindex] = gtls_recv;
conn->send[sockindex] = gtls_send;
{
/* we always unconditionally get the session id here, as even if we
already got it from the cache and asked to use it in the connection, it
might've been rejected and then a new one is in use now and we need to
detect that. */
void *connect_sessionid;
size_t connect_idsize = 0;
/* get the session ID data size */
gnutls_session_get_data(session, NULL, &connect_idsize);
connect_sessionid = malloc(connect_idsize); /* get a buffer for it */
if(connect_sessionid) {
/* extract session ID to the allocated buffer */
gnutls_session_get_data(session, connect_sessionid, &connect_idsize);
incache = !(Curl_ssl_getsessionid(conn, &ssl_sessionid, NULL));
if(incache) {
/* there was one before in the cache, so instead of risking that the
previous one was rejected, we just kill that and store the new */
Curl_ssl_delsessionid(conn, ssl_sessionid);
}
/* store this session id */
result = Curl_ssl_addsessionid(conn, connect_sessionid, connect_idsize);
if(result) {
free(connect_sessionid);
result = CURLE_OUT_OF_MEMORY;
}
}
else
result = CURLE_OUT_OF_MEMORY;
}
return result;
}
/* Checks if the issuer of a certificate is a
* Certificate Authority, or if the certificate is the same
* as the issuer (and therefore it doesn't need to be a CA).
*
* Returns true or false, if the issuer is a CA,
* or not.
*/
static int
check_if_ca (gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer,
unsigned int flags)
{
gnutls_datum_t cert_signed_data = { NULL, 0 };
gnutls_datum_t issuer_signed_data = { NULL, 0 };
gnutls_datum_t cert_signature = { NULL, 0 };
gnutls_datum_t issuer_signature = { NULL, 0 };
int result;
/* Check if the issuer is the same with the
* certificate. This is added in order for trusted
* certificates to be able to verify themselves.
*/
result =
_gnutls_x509_get_signed_data (issuer->cert, "tbsCertificate",
&issuer_signed_data);
if (result < 0)
{
gnutls_assert ();
goto cleanup;
}
result =
_gnutls_x509_get_signed_data (cert->cert, "tbsCertificate",
&cert_signed_data);
if (result < 0)
{
gnutls_assert ();
goto cleanup;
}
result =
_gnutls_x509_get_signature (issuer->cert, "signature", &issuer_signature);
if (result < 0)
{
gnutls_assert ();
goto cleanup;
}
result =
_gnutls_x509_get_signature (cert->cert, "signature", &cert_signature);
if (result < 0)
{
gnutls_assert ();
goto cleanup;
}
/* If the subject certificate is the same as the issuer
* return true.
*/
if (!(flags & GNUTLS_VERIFY_DO_NOT_ALLOW_SAME))
if (cert_signed_data.size == issuer_signed_data.size)
{
if ((memcmp (cert_signed_data.data, issuer_signed_data.data,
cert_signed_data.size) == 0) &&
(cert_signature.size == issuer_signature.size) &&
(memcmp (cert_signature.data, issuer_signature.data,
cert_signature.size) == 0))
{
result = 1;
goto cleanup;
}
}
result = gnutls_x509_crt_get_ca_status (issuer, NULL);
if (result == 1)
{
result = 1;
goto cleanup;
}
/* Handle V1 CAs that do not have a basicConstraint, but accept
these certs only if the appropriate flags are set. */
else if ((result == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) &&
((flags & GNUTLS_VERIFY_ALLOW_ANY_X509_V1_CA_CRT) ||
(!(flags & GNUTLS_VERIFY_DO_NOT_ALLOW_X509_V1_CA_CRT) &&
(gnutls_x509_crt_check_issuer (issuer, issuer) == 1))))
{
gnutls_assert ();
result = 1;
goto cleanup;
}
else
gnutls_assert ();
result = 0;
cleanup:
_gnutls_free_datum (&cert_signed_data);
_gnutls_free_datum (&issuer_signed_data);
_gnutls_free_datum (&cert_signature);
_gnutls_free_datum (&issuer_signature);
return result;
}
/* Reads a certificate key from a token.
*/
static int
read_cert_url(gnutls_certificate_credentials_t res, gnutls_privkey_t key, const char *url)
{
int ret;
gnutls_x509_crt_t crt = NULL;
gnutls_pcert_st *ccert = NULL;
gnutls_str_array_t names;
gnutls_datum_t t = {NULL, 0};
unsigned i, count = 0;
_gnutls_str_array_init(&names);
ccert = gnutls_malloc(sizeof(*ccert)*MAX_PKCS11_CERT_CHAIN);
if (ccert == NULL) {
gnutls_assert();
ret = GNUTLS_E_MEMORY_ERROR;
goto cleanup;
}
ret = gnutls_x509_crt_init(&crt);
if (ret < 0) {
gnutls_assert();
goto cleanup;
}
if (res->pin.cb)
gnutls_x509_crt_set_pin_function(crt, res->pin.cb,
res->pin.data);
ret = gnutls_x509_crt_import_url(crt, url, 0);
if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
ret =
gnutls_x509_crt_import_url(crt, url,
GNUTLS_PKCS11_OBJ_FLAG_LOGIN);
if (ret < 0) {
gnutls_assert();
goto cleanup;
}
ret = _gnutls_get_x509_name(crt, &names);
if (ret < 0) {
gnutls_assert();
goto cleanup;
}
/* Try to load the whole certificate chain from the PKCS #11 token */
for (i=0;i<MAX_PKCS11_CERT_CHAIN;i++) {
ret = gnutls_x509_crt_check_issuer(crt, crt);
if (i > 0 && ret != 0) {
/* self signed */
break;
}
ret = gnutls_pcert_import_x509(&ccert[i], crt, 0);
if (ret < 0) {
gnutls_assert();
goto cleanup;
}
count++;
ret = _gnutls_get_raw_issuer(url, crt, &t, 0);
if (ret < 0)
break;
gnutls_x509_crt_deinit(crt);
crt = NULL;
ret = gnutls_x509_crt_init(&crt);
if (ret < 0) {
gnutls_assert();
goto cleanup;
}
ret = gnutls_x509_crt_import(crt, &t, GNUTLS_X509_FMT_DER);
if (ret < 0) {
gnutls_assert();
goto cleanup;
}
gnutls_free(t.data);
}
ret = _gnutls_certificate_credential_append_keypair(res, key, names, ccert, count);
if (ret < 0) {
gnutls_assert();
goto cleanup;
}
if (crt != NULL)
gnutls_x509_crt_deinit(crt);
return 0;
cleanup:
if (crt != NULL)
gnutls_x509_crt_deinit(crt);
gnutls_free(t.data);
_gnutls_str_array_clear(&names);
gnutls_free(ccert);
return ret;
}
static void real_start_verification(HevImpathyTLSVerifier *self)
{
HevImpathyTLSVerifierPrivate *priv =
HEV_IMPATHY_TLS_VERIFIER_GET_PRIVATE(self);
gnutls_x509_crt_t first_cert = 0, last_cert = 0;
gint idx = 0;
gboolean res = FALSE;
gint num_certs = 0;
TpTLSCertificateRejectReason reason =
TP_TLS_CERTIFICATE_REJECT_REASON_UNKNOWN;
g_debug("%s:%d[%s]", __FILE__, __LINE__, __FUNCTION__);
/* check if the certificate matches the hostname first. */
first_cert = g_ptr_array_index(priv->cert_chain, 0);
if(0 == gnutls_x509_crt_check_hostname(first_cert, priv->hostname))
{
gchar *certified_hostname = NULL;
reason = TP_TLS_CERTIFICATE_REJECT_REASON_HOSTNAME_MISMATCH;
certified_hostname =
(gchar *)hev_impathy_get_x509_certificate_hostname(first_cert);
tp_asv_set_string(priv->details,
"expected-hostname", priv->hostname);
tp_asv_set_string(priv->details,
"certificate-hostname", certified_hostname);
g_free(certified_hostname);
goto out;
}
num_certs = priv->cert_chain->len;
if(0 < priv->trusted_ca_list->len)
{
/* if the last certificate is self-signed, and we have a list of
* trusted CAs, ignore it, as we want to check the chain against our
* trusted CAs list first.
* if we have only one certificate in the chain, don't ignore it though,
* as it's the CA certificate itself.
*/
last_cert = g_ptr_array_index(priv->cert_chain, num_certs - 1);
if((0<gnutls_x509_crt_check_issuer(last_cert, last_cert)) &&
(1<num_certs))
num_certs --;
}
for (idx = 1; idx < num_certs; idx++)
{
res = verify_certificate(self,
g_ptr_array_index(priv->cert_chain, idx-1),
g_ptr_array_index(priv->cert_chain, idx), &reason);
if(!res)
{
abort_verification(self, reason);
return;
}
}
res = verify_last_certificate(self,
g_ptr_array_index(priv->cert_chain,
num_certs - 1), &reason);
out:
if(!res)
{
abort_verification(self, reason);
return;
}
complete_verification(self);
}
/** Determines whether one certificate has been issued and signed by another
*
* @param crt Certificate to check the signature of
* @param issuer Issuer's certificate
*
* @return TRUE if crt was signed and issued by issuer, otherwise FALSE
* @TODO Modify this function to return a reason for invalidity?
*/
static gboolean
x509_certificate_signed_by(PurpleCertificate * crt,
PurpleCertificate * issuer)
{
gnutls_x509_crt crt_dat;
gnutls_x509_crt issuer_dat;
unsigned int verify; /* used to store result from GnuTLS verifier */
int ret;
gchar *crt_id = NULL;
gchar *issuer_id = NULL;
g_return_val_if_fail(crt, FALSE);
g_return_val_if_fail(issuer, FALSE);
/* Verify that both certs are the correct scheme */
g_return_val_if_fail(crt->scheme == &x509_gnutls, FALSE);
g_return_val_if_fail(issuer->scheme == &x509_gnutls, FALSE);
/* TODO: check for more nullness? */
crt_dat = X509_GET_GNUTLS_DATA(crt);
issuer_dat = X509_GET_GNUTLS_DATA(issuer);
/* First, let's check that crt.issuer is actually issuer */
ret = gnutls_x509_crt_check_issuer(crt_dat, issuer_dat);
if (ret <= 0) {
if (ret < 0) {
purple_debug_error("gnutls/x509",
"GnuTLS error %d while checking certificate issuer match.",
ret);
} else {
gchar *crt_id, *issuer_id, *crt_issuer_id;
crt_id = purple_certificate_get_unique_id(crt);
issuer_id = purple_certificate_get_unique_id(issuer);
crt_issuer_id =
purple_certificate_get_issuer_unique_id(crt);
purple_debug_info("gnutls/x509",
"Certificate %s is issued by "
"%s, which does not match %s.\n",
crt_id ? crt_id : "(null)",
crt_issuer_id ? crt_issuer_id : "(null)",
issuer_id ? issuer_id : "(null)");
g_free(crt_id);
g_free(issuer_id);
g_free(crt_issuer_id);
}
/* The issuer is not correct, or there were errors */
return FALSE;
}
/* Now, check the signature */
/* The second argument is a ptr to an array of "trusted" issuer certs,
but we're only using one trusted one */
ret = gnutls_x509_crt_verify(crt_dat, &issuer_dat, 1,
/* Permit signings by X.509v1 certs
(Verisign and possibly others have
root certificates that predate the
current standard) */
GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT,
&verify);
if (ret != 0) {
purple_debug_error("gnutls/x509",
"Attempted certificate verification caused a GnuTLS error code %d. I will just say the signature is bad, but you should look into this.\n", ret);
return FALSE;
}
#ifdef HAVE_GNUTLS_CERT_INSECURE_ALGORITHM
if (verify & GNUTLS_CERT_INSECURE_ALGORITHM) {
/*
* A certificate in the chain is signed with an insecure
* algorithm. Put a warning into the log to make this error
* perfectly clear as soon as someone looks at the debug log is
* generated.
*/
crt_id = purple_certificate_get_unique_id(crt);
issuer_id = purple_certificate_get_issuer_unique_id(crt);
purple_debug_warning("gnutls/x509",
"Insecure hash algorithm used by %s to sign %s\n",
issuer_id, crt_id);
}
#endif
if (verify & GNUTLS_CERT_INVALID) {
/* Signature didn't check out, but at least
there were no errors*/
if (!crt_id)
crt_id = purple_certificate_get_unique_id(crt);
if (!issuer_id)
issuer_id = purple_certificate_get_issuer_unique_id(crt);
purple_debug_error("gnutls/x509",
"Bad signature from %s on %s\n",
issuer_id, crt_id);
g_free(crt_id);
g_free(issuer_id);
return FALSE;
} /* if (ret, etc.) */
/* If we got here, the signature is good */
return TRUE;
}
/** Determines whether one certificate has been issued and signed by another
*
* @param crt Certificate to check the signature of
* @param issuer Issuer's certificate
*
* @return TRUE if crt was signed and issued by issuer, otherwise FALSE
* @TODO Modify this function to return a reason for invalidity?
*/
static gboolean
x509_certificate_signed_by(PurpleCertificate * crt,
PurpleCertificate * issuer)
{
gnutls_x509_crt_t crt_dat;
gnutls_x509_crt_t issuer_dat;
unsigned int verify; /* used to store result from GnuTLS verifier */
int ret;
gchar *crt_id = NULL;
gchar *issuer_id = NULL;
g_return_val_if_fail(crt, FALSE);
g_return_val_if_fail(issuer, FALSE);
/* Verify that both certs are the correct scheme */
g_return_val_if_fail(crt->scheme == &x509_gnutls, FALSE);
g_return_val_if_fail(issuer->scheme == &x509_gnutls, FALSE);
/* TODO: check for more nullness? */
crt_dat = X509_GET_GNUTLS_DATA(crt);
issuer_dat = X509_GET_GNUTLS_DATA(issuer);
/* Ensure crt issuer matches the name on the issuer cert. */
ret = gnutls_x509_crt_check_issuer(crt_dat, issuer_dat);
if (ret <= 0) {
if (ret < 0) {
purple_debug_error("gnutls/x509",
"GnuTLS error %d while checking certificate issuer match.",
ret);
} else {
gchar *crt_id, *issuer_id, *crt_issuer_id;
crt_id = purple_certificate_get_unique_id(crt);
issuer_id = purple_certificate_get_unique_id(issuer);
crt_issuer_id =
purple_certificate_get_issuer_unique_id(crt);
purple_debug_info("gnutls/x509",
"Certificate %s is issued by "
"%s, which does not match %s.\n",
crt_id ? crt_id : "(null)",
crt_issuer_id ? crt_issuer_id : "(null)",
issuer_id ? issuer_id : "(null)");
g_free(crt_id);
g_free(issuer_id);
g_free(crt_issuer_id);
}
/* The issuer is not correct, or there were errors */
return FALSE;
}
/* Check basic constraints extension (if it exists then the CA flag must
be set to true, and it must exist for certs with version 3 or higher. */
ret = gnutls_x509_crt_get_basic_constraints(issuer_dat, NULL, NULL, NULL);
if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
if (gnutls_x509_crt_get_version(issuer_dat) >= 3) {
/* Reject cert (no basic constraints and cert version is >= 3). */
gchar *issuer_id = purple_certificate_get_unique_id(issuer);
purple_debug_info("gnutls/x509", "Rejecting cert because the "
"basic constraints extension is missing from issuer cert "
"for %s. The basic constraints extension is required on "
"all version 3 or higher certs (this cert is version %d).",
issuer_id ? issuer_id : "(null)",
gnutls_x509_crt_get_version(issuer_dat));
g_free(issuer_id);
return FALSE;
} else {
/* Allow cert (no basic constraints and cert version is < 3). */
purple_debug_info("gnutls/x509", "Basic constraint extension is "
"missing from issuer cert for %s. Allowing this because "
"the cert is version %d and the basic constraints "
"extension is only required for version 3 or higher "
"certs.", issuer_id ? issuer_id : "(null)",
gnutls_x509_crt_get_version(issuer_dat));
}
} else if (ret <= 0) {
/* Reject cert (CA flag is false in basic constraints). */
gchar *issuer_id = purple_certificate_get_unique_id(issuer);
purple_debug_info("gnutls/x509", "Rejecting cert because the CA flag "
"is set to false in the basic constraints extension for "
"issuer cert %s. ret=%d\n",
issuer_id ? issuer_id : "(null)", ret);
g_free(issuer_id);
return FALSE;
}
/* Now, check the signature */
/* The second argument is a ptr to an array of "trusted" issuer certs,
but we're only using one trusted one */
ret = gnutls_x509_crt_verify(crt_dat, &issuer_dat, 1,
/* Permit signings by X.509v1 certs
(Verisign and possibly others have
root certificates that predate the
current standard) */
GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT,
&verify);
if (ret != 0) {
purple_debug_error("gnutls/x509",
"Attempted certificate verification caused a GnuTLS error code %d. I will just say the signature is bad, but you should look into this.\n", ret);
return FALSE;
}
#ifdef HAVE_GNUTLS_CERT_INSECURE_ALGORITHM
if (verify & GNUTLS_CERT_INSECURE_ALGORITHM) {
/*
* A certificate in the chain is signed with an insecure
* algorithm. Put a warning into the log to make this error
* perfectly clear as soon as someone looks at the debug log is
* generated.
*/
crt_id = purple_certificate_get_unique_id(crt);
issuer_id = purple_certificate_get_issuer_unique_id(crt);
purple_debug_warning("gnutls/x509",
"Insecure hash algorithm used by %s to sign %s\n",
issuer_id, crt_id);
}
#endif
if (verify & GNUTLS_CERT_INVALID) {
/* Signature didn't check out, but at least
there were no errors*/
if (!crt_id)
crt_id = purple_certificate_get_unique_id(crt);
if (!issuer_id)
issuer_id = purple_certificate_get_issuer_unique_id(crt);
purple_debug_error("gnutls/x509",
"Bad signature from %s on %s\n",
issuer_id, crt_id);
g_free(crt_id);
g_free(issuer_id);
return FALSE;
} /* if (ret, etc.) */
/* If we got here, the signature is good */
return TRUE;
}
void
empathy_tls_certificate_store_ca (EmpathyTLSCertificate *self)
{
GArray *last_cert;
gnutls_x509_crt_t cert;
gnutls_datum_t datum = { NULL, 0 };
gsize exported_len;
guchar *exported_cert = NULL;
gint res, offset;
gchar *user_certs_dir = NULL, *filename = NULL, *path = NULL;
gchar *hostname = NULL;
GError *error = NULL;
EmpathyTLSCertificatePriv *priv = GET_PRIV (self);
last_cert = g_ptr_array_index (priv->cert_data, priv->cert_data->len - 1);
datum.data = (guchar *) last_cert->data;
datum.size = last_cert->len;
gnutls_x509_crt_init (&cert);
gnutls_x509_crt_import (cert, &datum, GNUTLS_X509_FMT_DER);
/* make sure it's self-signed, otherwise it's not a CA */
if (gnutls_x509_crt_check_issuer (cert, cert) <= 0)
{
DEBUG ("Can't import the CA, as it's not self-signed");
gnutls_x509_crt_deinit (cert);
return;
}
if (gnutls_x509_crt_get_ca_status (cert, NULL) <= 0)
{
DEBUG ("Can't import the CA, it's not a valid CA certificate");
gnutls_x509_crt_deinit (cert);
goto out;
}
exported_len = get_exported_size (cert);
exported_cert = g_malloc (sizeof (guchar) * exported_len);
res = gnutls_x509_crt_export (cert, GNUTLS_X509_FMT_PEM,
exported_cert, &exported_len);
if (res < 0)
{
DEBUG ("Failed to export the CA certificate; GnuTLS returned %d,"
"and should be %lu bytes long", res, (gulong) exported_len);
gnutls_x509_crt_deinit (cert);
goto out;
}
hostname = empathy_get_x509_certificate_hostname (cert);
if (hostname == NULL)
hostname = g_strdup ("ca");
gnutls_x509_crt_deinit (cert);
/* write the file */
user_certs_dir = g_build_filename (g_get_user_config_dir (),
"telepathy", "certs", NULL);
res = g_mkdir_with_parents (user_certs_dir, S_IRWXU | S_IRWXG);
if (res < 0)
{
DEBUG ("Failed to create the user certificate directory: %s",
g_strerror (errno));
goto out;
}
offset = 0;
do
{
g_free (path);
if (offset == 0)
filename = g_strdup_printf ("cert-%s", hostname);
else
filename = g_strdup_printf ("cert-%s-%d", hostname, offset);
path = g_build_filename (user_certs_dir, filename, NULL);
offset++;
g_free (filename);
}
while (g_file_test (path, G_FILE_TEST_EXISTS));
DEBUG ("Will save to %s", path);
g_file_set_contents (path, (const gchar *) exported_cert, exported_len,
&error);
if (error != NULL)
{
DEBUG ("Can't save the CA certificate to %s: %s",
path, error->message);
g_error_free (error);
}
out:
g_free (path);
g_free (exported_cert);
g_free (user_certs_dir);
g_free (hostname);
}
