src/common/ssl.c

   1 /*
   2  * Sylpheed -- a GTK+ based, lightweight, and fast e-mail client
   3  * Copyright (C) 1999-2007 Hiroyuki Yamamoto and the Claws Mail team
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 3 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  17  *
  18  */
  19
  20 #ifdef HAVE_CONFIG_H
  21 #  include "config.h"
  22 #endif
  23
  24 #ifdef USE_GNUTLS
  25 #include "defs.h"
  26
  27 #include <glib.h>
  28 #include <glib/gi18n.h>
  29
  30 #include "claws.h"
  31 #include "utils.h"
  32 #include "ssl.h"
  33 #include "ssl_certificate.h"
  34 #include "hooks.h"
  35
  36 #ifdef HAVE_LIBETPAN
  37 #include <libetpan/mailstream_ssl.h>
  38 #endif
  39
  40 #ifdef USE_PTHREAD
  41 #include <pthread.h>
  42 #endif
  43
  44 #ifdef USE_PTHREAD
  45 typedef struct _thread_data {
  46         gnutls_session ssl;
  47         gboolean done;
  48 } thread_data;
  49 #endif
  50
  51 static int gnutls_client_cert_cb(gnutls_session session,
  52                                const gnutls_datum *req_ca_rdn, int nreqs,
  53                                const gnutls_pk_algorithm *sign_algos,
  54                                int sign_algos_length, gnutls_retr_st *st)
  55 {
  56         SSLClientCertHookData hookdata;
  57         SockInfo *sockinfo = (SockInfo *)gnutls_session_get_ptr(session);
  58         gnutls_certificate_type type = gnutls_certificate_type_get(session);
  59         gnutls_x509_crt crt;
  60         gnutls_x509_privkey key;
  61
  62         st->ncerts = 0;
  63
  64         hookdata.account = sockinfo->account;
  65         hookdata.cert_path = NULL;
  66         hookdata.password = NULL;
  67         hookdata.is_smtp = sockinfo->is_smtp;
  68         hooks_invoke(SSLCERT_GET_CLIENT_CERT_HOOKLIST, &hookdata);
  69
  70         if (hookdata.cert_path == NULL)
  71                 return 0;
  72
  73         sockinfo->client_crt = ssl_certificate_get_x509_from_pem_file(hookdata.cert_path);
  74         sockinfo->client_key = ssl_certificate_get_pkey_from_pem_file(hookdata.cert_path);
  75         if (!(sockinfo->client_crt && sockinfo->client_key)) {
  76                 /* try pkcs12 format */
  77                 ssl_certificate_get_x509_and_pkey_from_p12_file(hookdata.cert_path, hookdata.password,
  78                         &crt, &key);
  79                 sockinfo->client_crt = crt;
  80                 sockinfo->client_key = key;
  81         }
  82
  83         if (type == GNUTLS_CRT_X509 && sockinfo->client_crt && sockinfo->client_key) {
  84                 st->ncerts = 1;
  85                 st->type = type;
  86                 st->cert.x509 = &(sockinfo->client_crt);
  87                 st->key.x509 = sockinfo->client_key;
  88                 st->deinit_all = 0;
  89                 return 0;
  90         }
  91         return 0;
  92 }
  93
  94 const gchar *claws_ssl_get_cert_file(void)
  95 {
  96         const char *cert_files[]={
  97                 "/etc/pki/tls/certs/ca-bundle.crt",
  98                 "/etc/certs/ca-bundle.crt",
  99                 "/usr/share/ssl/certs/ca-bundle.crt",
 100                 "/etc/ssl/certs/ca-certificates.crt",
 101                 "/usr/local/ssl/certs/ca-bundle.crt",
 102                 "/etc/apache/ssl.crt/ca-bundle.crt",
 103                 "/usr/share/curl/curl-ca-bundle.crt",
 104                 "/usr/share/curl/curl-ca-bundle.crt",
 105                 "/usr/lib/ssl/cert.pem",
 106                 NULL};
 107         int i;
 108
 109         if (g_getenv("SSL_CERT_FILE"))
 110                 return g_getenv("SSL_CERT_FILE");
 111 #ifndef G_OS_WIN32
 112         for (i = 0; cert_files[i]; i++) {
 113                 if (is_file_exist(cert_files[i]))
 114                         return cert_files[i];
 115         }
 116         return NULL;
 117 #else
 118         return "put_what_s_needed_here";
 119 #endif
 120 }
 121
 122 const gchar *claws_ssl_get_cert_dir(void)
 123 {
 124         const char *cert_dirs[]={
 125                 "/etc/pki/tls/certs",
 126                 "/etc/certs",
 127                 "/usr/share/ssl/certs",
 128                 "/etc/ssl/certs",
 129                 "/usr/local/ssl/certs",
 130                 "/etc/apache/ssl.crt",
 131                 "/usr/share/curl",
 132                 "/usr/lib/ssl/certs",
 133                 NULL};
 134         int i;
 135
 136         if (g_getenv("SSL_CERT_DIR"))
 137                 return g_getenv("SSL_CERT_DIR");
 138 #ifndef G_OS_WIN32
 139         for (i = 0; cert_dirs[i]; i++) {
 140                 if (is_dir_exist(cert_dirs[i]))
 141                         return cert_dirs[i];
 142         }
 143         return NULL;
 144 #else
 145         return "put_what_s_needed_here";
 146 #endif
 147 }
 148
 149 void ssl_init(void)
 150 {
 151 #ifdef HAVE_LIBETPAN
 152         mailstream_gnutls_init_not_required();
 153 #endif
 154         gnutls_global_init();
 155 }
 156
 157 void ssl_done(void)
 158 {
 159         gnutls_global_deinit();
 160 }
 161
 162 #ifdef USE_PTHREAD
 163 static void *SSL_connect_thread(void *data)
 164 {
 165         thread_data *td = (thread_data *)data;
 166         int result = -1;
 167
 168         pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, NULL);
 169         pthread_setcanceltype(PTHREAD_CANCEL_ASYNCHRONOUS, NULL);
 170
 171         do {
 172                 result = gnutls_handshake(td->ssl);
 173         } while (result == GNUTLS_E_AGAIN || result == GNUTLS_E_INTERRUPTED);
 174
 175         td->done = TRUE; /* let the caller thread join() */
 176         return GINT_TO_POINTER(result);
 177 }
 178 #endif
 179
 180 static gint SSL_connect_nb(gnutls_session ssl)
 181 {
 182         int result;
 183 #ifdef USE_PTHREAD
 184         thread_data *td = g_new0(thread_data, 1);
 185         pthread_t pt;
 186         pthread_attr_t pta;
 187         void *res = NULL;
 188         time_t start_time = time(NULL);
 189         gboolean killed = FALSE;
 190
 191         td->ssl  = ssl;
 192         td->done = FALSE;
 193
 194         /* try to create a thread to initialize the SSL connection,
 195          * fallback to blocking method in case of problem
 196          */
 197         if (pthread_attr_init(&pta) != 0 ||
 198             pthread_attr_setdetachstate(&pta, PTHREAD_CREATE_JOINABLE) != 0 ||
 199             pthread_create(&pt, &pta, SSL_connect_thread, td) != 0) {
 200                 do {
 201                         result = gnutls_handshake(td->ssl);
 202                 } while (result == GNUTLS_E_AGAIN || result == GNUTLS_E_INTERRUPTED);
 203                 return result;
 204         }
 205         debug_print("waiting for SSL_connect thread...\n");
 206         while(!td->done) {
 207                 /* don't let the interface freeze while waiting */
 208                 claws_do_idle();
 209                 if (time(NULL) - start_time > 30) {
 210                         pthread_cancel(pt);
 211                         td->done = TRUE;
 212                         killed = TRUE;
 213                 }
 214         }
 215
 216         /* get the thread's return value and clean its resources */
 217         pthread_join(pt, &res);
 218         g_free(td);
 219
 220         if (killed) {
 221                 res = GINT_TO_POINTER(-1);
 222         }
 223         debug_print("SSL_connect thread returned %d\n",
 224                         GPOINTER_TO_INT(res));
 225
 226         return GPOINTER_TO_INT(res);
 227 #else /* USE_PTHREAD */
 228         do {
 229                 result = gnutls_handshake(ssl);
 230         } while (result == GNUTLS_E_AGAIN || result == GNUTLS_E_INTERRUPTED);
 231 #endif
 232 }
 233
 234 gboolean ssl_init_socket(SockInfo *sockinfo)
 235 {
 236         return ssl_init_socket_with_method(sockinfo, SSL_METHOD_SSLv23);
 237 }
 238
 239 gboolean ssl_init_socket_with_method(SockInfo *sockinfo, SSLMethod method)
 240 {
 241         gnutls_session session;
 242         int r;
 243         const int cipher_prio[] = { GNUTLS_CIPHER_AES_128_CBC,
 244                                 GNUTLS_CIPHER_3DES_CBC,
 245                                 GNUTLS_CIPHER_AES_256_CBC,
 246                                 GNUTLS_CIPHER_ARCFOUR_128, 0 };
 247         const int kx_prio[] = { GNUTLS_KX_DHE_RSA,
 248                            GNUTLS_KX_RSA,
 249                            GNUTLS_KX_DHE_DSS, 0 };
 250         const int mac_prio[] = { GNUTLS_MAC_SHA1,
 251                                 GNUTLS_MAC_MD5, 0 };
 252         const int proto_prio[] = { GNUTLS_TLS1,
 253                                   GNUTLS_SSL3, 0 };
 254         const gnutls_datum *raw_cert_list;
 255         unsigned int raw_cert_list_length;
 256         gnutls_x509_crt cert = NULL;
 257         guint status;
 258         gnutls_certificate_credentials_t xcred;
 259
 260         if (gnutls_certificate_allocate_credentials (&xcred) != 0)
 261                 return FALSE;
 262
 263         r = gnutls_init(&session, GNUTLS_CLIENT);
 264         if (session == NULL || r != 0)
 265                 return FALSE;
 266
 267         gnutls_set_default_priority(session);
 268         gnutls_protocol_set_priority (session, proto_prio);
 269         gnutls_cipher_set_priority (session, cipher_prio);
 270         gnutls_kx_set_priority (session, kx_prio);
 271         gnutls_mac_set_priority (session, mac_prio);
 272
 273         gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, xcred);
 274
 275         if (claws_ssl_get_cert_file()) {
 276                 r = gnutls_certificate_set_x509_trust_file(xcred, claws_ssl_get_cert_file(),  GNUTLS_X509_FMT_PEM);
 277                 if (r < 0)
 278                         g_warning("Can't read SSL_CERT_FILE %s: %s\n",
 279                                 claws_ssl_get_cert_file(),
 280                                 gnutls_strerror(r));
 281         } else {
 282                 debug_print("Can't find SSL ca-certificates file\n");
 283         }
 284         gnutls_certificate_set_verify_flags (xcred, GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT);
 285
 286         gnutls_transport_set_ptr(session, (gnutls_transport_ptr) sockinfo->sock);
 287         gnutls_session_set_ptr(session, sockinfo);
 288         gnutls_certificate_client_set_retrieve_function(xcred, gnutls_client_cert_cb);
 289
 290         gnutls_dh_set_prime_bits(session, 512);
 291
 292         if ((r = SSL_connect_nb(session)) < 0) {
 293                 g_warning("SSL connection failed (%s)", gnutls_strerror(r));
 294                 gnutls_certificate_free_credentials(xcred);
 295                 gnutls_deinit(session);
 296                 return FALSE;
 297         }
 298
 299         /* Get server's certificate (note: beware of dynamic allocation) */
 300         raw_cert_list = gnutls_certificate_get_peers(session, &raw_cert_list_length);
 301
 302         if (!raw_cert_list
 303         ||  gnutls_certificate_type_get(session) != GNUTLS_CRT_X509
 304         ||  (r = gnutls_x509_crt_init(&cert)) < 0
 305         ||  (r = gnutls_x509_crt_import(cert, &raw_cert_list[0], GNUTLS_X509_FMT_DER)) < 0) {
 306                 g_warning("cert get failure: %d %s\n", r, gnutls_strerror(r));
 307                 gnutls_certificate_free_credentials(xcred);
 308                 gnutls_deinit(session);
 309                 return FALSE;
 310         }
 311
 312         r = gnutls_certificate_verify_peers2(session, &status);
 313
 314         if (!ssl_certificate_check(cert, status, sockinfo->canonical_name, sockinfo->hostname, sockinfo->port)) {
 315                 gnutls_x509_crt_deinit(cert);
 316                 gnutls_certificate_free_credentials(xcred);
 317                 gnutls_deinit(session);
 318                 return FALSE;
 319         }
 320
 321         gnutls_x509_crt_deinit(cert);
 322
 323         sockinfo->ssl = session;
 324         sockinfo->xcred = xcred;
 325         return TRUE;
 326 }
 327
 328 void ssl_done_socket(SockInfo *sockinfo)
 329 {
 330         if (sockinfo && sockinfo->ssl) {
 331                 gnutls_certificate_free_credentials(sockinfo->xcred);
 332                 gnutls_deinit(sockinfo->ssl);
 333                 if (sockinfo->client_crt)
 334                         gnutls_x509_crt_deinit(sockinfo->client_crt);
 335                 if (sockinfo->client_key)
 336                         gnutls_x509_privkey_deinit(sockinfo->client_key);
 337                 sockinfo->client_key = NULL;
 338                 sockinfo->client_crt = NULL;
 339                 sockinfo->ssl = NULL;
 340         }
 341 }
 342
 343 #endif /* USE_GNUTLS */