2006-04-06 [mones] 2.1.0cvs7
[claws.git] / src / common / ssl_certificate.c
1 /*
2  * Sylpheed -- a GTK+ based, lightweight, and fast e-mail client
3  * Copyright (C) 1999-2006 Hiroyuki Yamamoto
4  * This file Copyright (C) 2002-2005 Colin Leroy <colin@colino.net>
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License as published by
8  * the Free Software Foundation; either version 2 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program; if not, write to the Free Software
18  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
19  */
20
21 #ifdef HAVE_CONFIG_H
22 #  include "config.h"
23 #endif
24
25 #if USE_OPENSSL
26
27 #include <openssl/ssl.h>
28 #include <glib.h>
29 #include <glib/gi18n.h>
30
31 #include "ssl_certificate.h"
32 #include "utils.h"
33 #include "log.h"
34 #include "socket.h"
35 #include "hooks.h"
36
37 static SSLCertificate *ssl_certificate_new_lookup(X509 *x509_cert, gchar *host, gushort port, gboolean lookup);
38
39 static char * get_fqdn(char *host)
40 {
41         struct hostent *hp;
42
43         if (host == NULL || strlen(host) == 0)
44                 return g_strdup("");
45
46         hp = my_gethostbyname(host);
47         if (hp == NULL)
48                 return g_strdup(host); /*caller should free*/
49         else 
50                 return g_strdup(hp->h_name);
51 }
52
53 char * readable_fingerprint(unsigned char *src, int len) 
54 {
55         int i=0;
56         char * ret;
57         
58         if (src == NULL)
59                 return NULL;
60         ret = g_strdup("");
61         while (i < len) {
62                 char *tmp2;
63                 if(i>0)
64                         tmp2 = g_strdup_printf("%s:%02X", ret, src[i]);
65                 else
66                         tmp2 = g_strdup_printf("%02X", src[i]);
67                 g_free(ret);
68                 ret = g_strdup(tmp2);
69                 g_free(tmp2);
70                 i++;
71         }
72         return ret;
73 }
74
75 SSLCertificate *ssl_certificate_new(X509 *x509_cert, gchar *host, gushort port)
76 {
77         return ssl_certificate_new_lookup(x509_cert, host, port, TRUE);
78 }
79
80 static SSLCertificate *ssl_certificate_new_lookup(X509 *x509_cert, gchar *host, gushort port, gboolean lookup)
81 {
82         SSLCertificate *cert = g_new0(SSLCertificate, 1);
83         
84         if (host == NULL || x509_cert == NULL) {
85                 ssl_certificate_destroy(cert);
86                 return NULL;
87         }
88         cert->x509_cert = X509_dup(x509_cert);
89         if (lookup)
90                 cert->host = get_fqdn(host);
91         else
92                 cert->host = g_strdup(host);
93         cert->port = port;
94         return cert;
95 }
96
97 static void ssl_certificate_save (SSLCertificate *cert)
98 {
99         gchar *file, *port;
100         FILE *fp;
101
102         file = g_strconcat(get_rc_dir(), G_DIR_SEPARATOR_S, 
103                           "certs", G_DIR_SEPARATOR_S, NULL);
104         
105         if (!is_dir_exist(file))
106                 make_dir_hier(file);
107         g_free(file);
108
109         port = g_strdup_printf("%d", cert->port);
110         file = g_strconcat(get_rc_dir(), G_DIR_SEPARATOR_S, 
111                           "certs", G_DIR_SEPARATOR_S,
112                           cert->host, ".", port, ".cert", NULL);
113
114         g_free(port);
115         fp = g_fopen(file, "wb");
116         if (fp == NULL) {
117                 g_free(file);
118                 debug_print("Can't save certificate !\n");
119                 return;
120         }
121         i2d_X509_fp(fp, cert->x509_cert);
122         g_free(file);
123         fclose(fp);
124
125 }
126
127 char* ssl_certificate_to_string(SSLCertificate *cert)
128 {
129         char *ret, buf[100];
130         char *issuer_commonname, *issuer_location, *issuer_organization;
131         char *subject_commonname, *subject_location, *subject_organization;
132         char *fingerprint, *sig_status;
133         unsigned int n;
134         unsigned char md[EVP_MAX_MD_SIZE];      
135         
136         /* issuer */    
137         if (X509_NAME_get_text_by_NID(X509_get_issuer_name(cert->x509_cert), 
138                                        NID_commonName, buf, 100) >= 0)
139                 issuer_commonname = g_strdup(buf);
140         else
141                 issuer_commonname = g_strdup(_("<not in certificate>"));
142         if (X509_NAME_get_text_by_NID(X509_get_issuer_name(cert->x509_cert), 
143                                        NID_localityName, buf, 100) >= 0) {
144                 issuer_location = g_strdup(buf);
145                 if (X509_NAME_get_text_by_NID(X509_get_issuer_name(cert->x509_cert), 
146                                        NID_countryName, buf, 100) >= 0)
147                         issuer_location = g_strconcat(issuer_location,", ",buf, NULL);
148         } else if (X509_NAME_get_text_by_NID(X509_get_issuer_name(cert->x509_cert), 
149                                        NID_countryName, buf, 100) >= 0)
150                 issuer_location = g_strdup(buf);
151         else
152                 issuer_location = g_strdup(_("<not in certificate>"));
153
154         if (X509_NAME_get_text_by_NID(X509_get_issuer_name(cert->x509_cert), 
155                                        NID_organizationName, buf, 100) >= 0)
156                 issuer_organization = g_strdup(buf);
157         else 
158                 issuer_organization = g_strdup(_("<not in certificate>"));
159          
160         /* subject */   
161         if (X509_NAME_get_text_by_NID(X509_get_subject_name(cert->x509_cert), 
162                                        NID_commonName, buf, 100) >= 0)
163                 subject_commonname = g_strdup(buf);
164         else
165                 subject_commonname = g_strdup(_("<not in certificate>"));
166         if (X509_NAME_get_text_by_NID(X509_get_subject_name(cert->x509_cert), 
167                                        NID_localityName, buf, 100) >= 0) {
168                 subject_location = g_strdup(buf);
169                 if (X509_NAME_get_text_by_NID(X509_get_subject_name(cert->x509_cert), 
170                                        NID_countryName, buf, 100) >= 0)
171                         subject_location = g_strconcat(subject_location,", ",buf, NULL);
172         } else if (X509_NAME_get_text_by_NID(X509_get_subject_name(cert->x509_cert), 
173                                        NID_countryName, buf, 100) >= 0)
174                 subject_location = g_strdup(buf);
175         else
176                 subject_location = g_strdup(_("<not in certificate>"));
177
178         if (X509_NAME_get_text_by_NID(X509_get_subject_name(cert->x509_cert), 
179                                        NID_organizationName, buf, 100) >= 0)
180                 subject_organization = g_strdup(buf);
181         else 
182                 subject_organization = g_strdup(_("<not in certificate>"));
183          
184         /* fingerprint */
185         X509_digest(cert->x509_cert, EVP_md5(), md, &n);
186         fingerprint = readable_fingerprint(md, (int)n);
187
188         /* signature */
189         sig_status = ssl_certificate_check_signer(cert->x509_cert);
190
191         ret = g_strdup_printf(_("  Owner: %s (%s) in %s\n  Signed by: %s (%s) in %s\n  Fingerprint: %s\n  Signature status: %s"),
192                                 subject_commonname, subject_organization, subject_location, 
193                                 issuer_commonname, issuer_organization, issuer_location, 
194                                 fingerprint,
195                                 (sig_status==NULL ? "correct":sig_status));
196
197         g_free(issuer_commonname);
198         g_free(issuer_location);
199         g_free(issuer_organization);
200         g_free(subject_commonname);
201         g_free(subject_location);
202         g_free(subject_organization);
203         g_free(fingerprint);
204         g_free(sig_status);
205         return ret;
206 }
207         
208 void ssl_certificate_destroy(SSLCertificate *cert) 
209 {
210         if (cert == NULL)
211                 return;
212
213         if (cert->x509_cert)
214                 X509_free(cert->x509_cert);
215         g_free(cert->host);
216         g_free(cert);
217         cert = NULL;
218 }
219
220 void ssl_certificate_delete_from_disk(SSLCertificate *cert)
221 {
222         gchar *buf;
223         gchar *file;
224         buf = g_strdup_printf("%d", cert->port);
225         file = g_strconcat(get_rc_dir(), G_DIR_SEPARATOR_S, 
226                           "certs", G_DIR_SEPARATOR_S,
227                           cert->host, ".", buf, ".cert", NULL);
228         g_unlink (file);
229         g_free(buf);
230         g_free(file);
231 }
232
233 SSLCertificate *ssl_certificate_find (gchar *host, gushort port)
234 {
235         return ssl_certificate_find_lookup (host, port, TRUE);
236 }
237
238 SSLCertificate *ssl_certificate_find_lookup (gchar *host, gushort port, gboolean lookup)
239 {
240         gchar *file;
241         gchar *buf;
242         gchar *fqdn_host;
243         SSLCertificate *cert = NULL;
244         X509 *tmp_x509;
245         FILE *fp;
246
247         if (lookup)
248                 fqdn_host = get_fqdn(host);
249         else
250                 fqdn_host = g_strdup(host);
251
252         buf = g_strdup_printf("%d", port);
253         file = g_strconcat(get_rc_dir(), G_DIR_SEPARATOR_S, 
254                           "certs", G_DIR_SEPARATOR_S,
255                           fqdn_host, ".", buf, ".cert", NULL);
256
257         g_free(buf);
258         fp = g_fopen(file, "rb");
259         if (fp == NULL) {
260                 g_free(file);
261                 g_free(fqdn_host);
262                 return NULL;
263         }
264         
265         
266         if ((tmp_x509 = d2i_X509_fp(fp, 0)) != NULL) {
267                 cert = ssl_certificate_new_lookup(tmp_x509, fqdn_host, port, lookup);
268                 X509_free(tmp_x509);
269         }
270         fclose(fp);
271         g_free(file);
272         g_free(fqdn_host);
273         
274         return cert;
275 }
276
277 static gboolean ssl_certificate_compare (SSLCertificate *cert_a, SSLCertificate *cert_b)
278 {
279         if (cert_a == NULL || cert_b == NULL)
280                 return FALSE;
281         else if (!X509_cmp(cert_a->x509_cert, cert_b->x509_cert))
282                 return TRUE;    
283         else
284                 return FALSE;
285 }
286
287 char *ssl_certificate_check_signer (X509 *cert) 
288 {
289         X509_STORE_CTX store_ctx;
290         X509_STORE *store;
291         char *err_msg = NULL;
292
293         store = X509_STORE_new();
294         if (store == NULL) {
295                 printf("Can't create X509_STORE\n");
296                 return NULL;
297         }
298         if (!X509_STORE_set_default_paths(store)) {
299                 X509_STORE_free (store);
300                 return g_strdup(_("Can't load X509 default paths"));
301         }
302         
303         X509_STORE_CTX_init (&store_ctx, store, cert, NULL);
304
305         if(!X509_verify_cert (&store_ctx)) {
306                 err_msg = g_strdup(X509_verify_cert_error_string(
307                                         X509_STORE_CTX_get_error(&store_ctx)));
308                 debug_print("Can't check signer: %s\n", err_msg);
309                 X509_STORE_CTX_cleanup (&store_ctx);
310                 X509_STORE_free (store);
311                 return err_msg;
312                         
313         }
314         X509_STORE_CTX_cleanup (&store_ctx);
315         X509_STORE_free (store);
316         return NULL;
317 }
318
319 gboolean ssl_certificate_check (X509 *x509_cert, gchar *host, gushort port)
320 {
321         SSLCertificate *current_cert = ssl_certificate_new(x509_cert, host, port);
322         SSLCertificate *known_cert;
323         SSLCertHookData cert_hook_data;
324         
325         if (current_cert == NULL) {
326                 debug_print("Buggy certificate !\n");
327                 return FALSE;
328         }
329
330         known_cert = ssl_certificate_find (host, port);
331
332         if (known_cert == NULL) {
333                 gchar *err_msg, *cur_cert_str, *sig_status;
334                 
335                 sig_status = ssl_certificate_check_signer(x509_cert);
336
337                 g_free(sig_status);
338
339                 cur_cert_str = ssl_certificate_to_string(current_cert);
340                 
341                 err_msg = g_strdup_printf(_("%s presented an unknown SSL certificate:\n%s"),
342                                           current_cert->host,
343                                           cur_cert_str);
344                 g_free (cur_cert_str);
345
346                 cert_hook_data.cert = current_cert;
347                 cert_hook_data.old_cert = NULL;
348                 cert_hook_data.accept = FALSE;
349                 
350                 hooks_invoke(SSLCERT_ASK_HOOKLIST, &cert_hook_data);
351                 
352                 g_free(err_msg);
353
354                 if (!cert_hook_data.accept) {
355                         ssl_certificate_destroy(current_cert);
356                         return FALSE;
357                 } else {
358                         ssl_certificate_save(current_cert);
359                         ssl_certificate_destroy(current_cert);
360                         return TRUE;
361                 }
362         }
363         else if (!ssl_certificate_compare (current_cert, known_cert)) {
364                 gchar *err_msg, *known_cert_str, *cur_cert_str;
365                 
366                 known_cert_str = ssl_certificate_to_string(known_cert);
367                 cur_cert_str = ssl_certificate_to_string(current_cert);
368                 err_msg = g_strdup_printf(_("%s's SSL certificate changed !\nWe have saved this one:\n%s\n\nIt is now:\n%s\n\nThis could mean the server answering is not the known one."),
369                                           current_cert->host,
370                                           known_cert_str,
371                                           cur_cert_str);
372                 g_free (cur_cert_str);
373                 g_free (known_cert_str);
374
375                 cert_hook_data.cert = current_cert;
376                 cert_hook_data.old_cert = known_cert;
377                 cert_hook_data.accept = FALSE;
378                 
379                 hooks_invoke(SSLCERT_ASK_HOOKLIST, &cert_hook_data);
380                 
381                 g_free(err_msg);
382
383                 if (!cert_hook_data.accept) {
384                         ssl_certificate_destroy(current_cert);
385                         ssl_certificate_destroy(known_cert);
386                         return FALSE;
387                 } else {
388                         ssl_certificate_save(current_cert);
389                         ssl_certificate_destroy(current_cert);
390                         ssl_certificate_destroy(known_cert);
391                         return TRUE;
392                 }
393         }
394
395         ssl_certificate_destroy(current_cert);
396         ssl_certificate_destroy(known_cert);
397         return TRUE;
398 }
399
400 #endif /* USE_OPENSSL */