src/common/ssl_certificate.c

   1 /*
   2  * Claws Mail -- a GTK+ based, lightweight, and fast e-mail client
   3  * Copyright (C) 1999-2011 Colin Leroy <colin@colino.net>
   4  * and the Claws Mail team
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 3 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program. If not, see <http://www.gnu.org/licenses/>.
  18  *
  19  */
  20
  21 #ifdef HAVE_CONFIG_H
  22 #  include "config.h"
  23 #endif
  24
  25 #ifdef USE_GNUTLS
  26 #include <gnutls/gnutls.h>
  27 #include <gnutls/x509.h>
  28 #include <gnutls/pkcs12.h>
  29 #include <sys/stat.h>
  30 #include <unistd.h>
  31 #include <string.h>
  32 #include <sys/types.h>
  33 #include <stdio.h>
  34 #include <glib.h>
  35 #include <glib/gi18n.h>
  36 #ifdef G_OS_WIN32
  37 #  include <winsock2.h>
  38 #else
  39 #  include <sys/socket.h>
  40 #  include <netinet/in.h>
  41 #  include <netdb.h>
  42 #endif /* G_OS_WIN32 */
  43 #include "ssl_certificate.h"
  44 #include "utils.h"
  45 #include "log.h"
  46 #include "socket.h"
  47 #include "hooks.h"
  48 #include "defs.h"
  49
  50 static GHashTable *warned_expired = NULL;
  51
  52 gboolean prefs_common_unsafe_ssl_certs(void);
  53
  54 static gchar *get_certificate_path(const gchar *host, const gchar *port, const gchar *fp)
  55 {
  56         if (fp != NULL && prefs_common_unsafe_ssl_certs())
  57                 return g_strconcat(get_rc_dir(), G_DIR_SEPARATOR_S,
  58                           "certs", G_DIR_SEPARATOR_S,
  59                           host, ".", port, ".", fp, ".cert", NULL);
  60         else
  61                 return g_strconcat(get_rc_dir(), G_DIR_SEPARATOR_S,
  62                           "certs", G_DIR_SEPARATOR_S,
  63                           host, ".", port, ".cert", NULL);
  64 }
  65
  66 static SSLCertificate *ssl_certificate_new_lookup(gnutls_x509_crt x509_cert, gchar *host, gushort port, gboolean lookup);
  67 static char * get_fqdn(char *host)
  68 {
  69 #ifdef INET6
  70         gint gai_err;
  71         struct addrinfo hints, *res;
  72 #else
  73         struct hostent *hp;
  74 #endif
  75
  76         if (host == NULL || strlen(host) == 0)
  77                 return g_strdup("");
  78 #ifdef INET6
  79         memset(&hints, 0, sizeof(hints));
  80         hints.ai_flags = AI_CANONNAME;
  81         hints.ai_family = AF_UNSPEC;
  82         hints.ai_socktype = SOCK_STREAM;
  83         hints.ai_protocol = IPPROTO_TCP;
  84
  85         gai_err = getaddrinfo(host, NULL, &hints, &res);
  86         if (gai_err != 0) {
  87                 g_warning("getaddrinfo for %s failed: %s\n",
  88                           host, gai_strerror(gai_err));
  89                 return g_strdup(host);
  90         }
  91         if (res != NULL) {
  92                 if (res->ai_canonname && strlen(res->ai_canonname)) {
  93                         gchar *fqdn = g_strdup(res->ai_canonname);
  94                         freeaddrinfo(res);
  95                         return fqdn;
  96                 } else {
  97                         freeaddrinfo(res);
  98                         return g_strdup(host);
  99                 }
 100         } else {
 101                 return g_strdup(host);
 102         }
 103 #else
 104         hp = my_gethostbyname(host);
 105         if (hp == NULL)
 106                 return g_strdup(host); /*caller should free*/
 107         else
 108                 return g_strdup(hp->h_name);
 109 #endif
 110 }
 111
 112 char * readable_fingerprint(unsigned char *src, int len)
 113 {
 114         int i=0;
 115         char * ret;
 116
 117         if (src == NULL)
 118                 return NULL;
 119         ret = g_strdup("");
 120         while (i < len) {
 121                 char *tmp2;
 122                 if(i>0)
 123                         tmp2 = g_strdup_printf("%s:%02X", ret, src[i]);
 124                 else
 125                         tmp2 = g_strdup_printf("%02X", src[i]);
 126                 g_free(ret);
 127                 ret = g_strdup(tmp2);
 128                 g_free(tmp2);
 129                 i++;
 130         }
 131         return ret;
 132 }
 133
 134 #if USE_GNUTLS
 135 static gnutls_x509_crt x509_crt_copy(gnutls_x509_crt src)
 136 {
 137     int ret;
 138     size_t size;
 139     gnutls_datum tmp;
 140     gnutls_x509_crt dest;
 141
 142     if (gnutls_x509_crt_init(&dest) != 0) {
 143         g_warning("couldn't gnutls_x509_crt_init\n");
 144         return NULL;
 145     }
 146
 147     if (gnutls_x509_crt_export(src, GNUTLS_X509_FMT_DER, NULL, &size)
 148         != GNUTLS_E_SHORT_MEMORY_BUFFER) {
 149         g_warning("couldn't gnutls_x509_crt_export to get size\n");
 150         gnutls_x509_crt_deinit(dest);
 151         return NULL;
 152     }
 153
 154     tmp.data = malloc(size);
 155     memset(tmp.data, 0, size);
 156     ret = gnutls_x509_crt_export(src, GNUTLS_X509_FMT_DER, tmp.data, &size);
 157     if (ret == 0) {
 158         tmp.size = size;
 159         ret = gnutls_x509_crt_import(dest, &tmp, GNUTLS_X509_FMT_DER);
 160         if (ret) {
 161                 g_warning("couldn't gnutls_x509_crt_import for real (%d %s)\n", ret, gnutls_strerror(ret));
 162                 gnutls_x509_crt_deinit(dest);
 163                 dest = NULL;
 164         }
 165     } else {
 166         g_warning("couldn't gnutls_x509_crt_export for real (%d %s)\n", ret, gnutls_strerror(ret));
 167         gnutls_x509_crt_deinit(dest);
 168         dest = NULL;
 169     }
 170
 171     free(tmp.data);
 172     return dest;
 173 }
 174 #endif
 175
 176 static SSLCertificate *ssl_certificate_new_lookup(gnutls_x509_crt x509_cert, gchar *host, gushort port, gboolean lookup)
 177 {
 178         SSLCertificate *cert = g_new0(SSLCertificate, 1);
 179         size_t n;
 180         unsigned char md[128];
 181
 182         if (host == NULL || x509_cert == NULL) {
 183                 ssl_certificate_destroy(cert);
 184                 return NULL;
 185         }
 186         cert->x509_cert = x509_crt_copy(x509_cert);
 187         cert->status = (guint)-1;
 188         if (lookup)
 189                 cert->host = get_fqdn(host);
 190         else
 191                 cert->host = g_strdup(host);
 192         cert->port = port;
 193
 194         /* fingerprint */
 195         n = 128;
 196         gnutls_x509_crt_get_fingerprint(cert->x509_cert, GNUTLS_DIG_MD5, md, &n);
 197         cert->fingerprint = readable_fingerprint(md, (int)n);
 198         return cert;
 199 }
 200
 201 #ifdef USE_GNUTLS
 202 static void gnutls_i2d_X509_fp(FILE *fp, gnutls_x509_crt x509_cert)
 203 {
 204         char output[10*1024];
 205         size_t cert_size = 10*1024;
 206         int r;
 207
 208         if ((r = gnutls_x509_crt_export(x509_cert, GNUTLS_X509_FMT_DER, output, &cert_size)) < 0) {
 209                 g_warning("couldn't export cert %s (%zd)\n", gnutls_strerror(r), cert_size);
 210                 return;
 211         }
 212         debug_print("writing %zd bytes\n",cert_size);
 213         if (fwrite(&output, 1, cert_size, fp) < cert_size) {
 214                 g_warning("failed to write cert\n");
 215         }
 216 }
 217
 218 size_t gnutls_i2d_X509(gnutls_x509_crt x509_cert, unsigned char **output)
 219 {
 220         size_t cert_size = 10*1024;
 221         int r;
 222
 223         if (output == NULL)
 224                 return 0;
 225
 226         *output = malloc(cert_size);
 227
 228         if ((r = gnutls_x509_crt_export(x509_cert, GNUTLS_X509_FMT_DER, *output, &cert_size)) < 0) {
 229                 g_warning("couldn't export cert %s (%zd)\n", gnutls_strerror(r), cert_size);
 230                 free(*output);
 231                 *output = NULL;
 232                 return 0;
 233         }
 234         return cert_size;
 235 }
 236
 237 size_t gnutls_i2d_PrivateKey(gnutls_x509_privkey pkey, unsigned char **output)
 238 {
 239         size_t key_size = 10*1024;
 240         int r;
 241
 242         if (output == NULL)
 243                 return 0;
 244
 245         *output = malloc(key_size);
 246
 247         if ((r = gnutls_x509_privkey_export(pkey, GNUTLS_X509_FMT_DER, *output, &key_size)) < 0) {
 248                 g_warning("couldn't export key %s (%zd)\n", gnutls_strerror(r), key_size);
 249                 free(*output);
 250                 *output = NULL;
 251                 return 0;
 252         }
 253         return key_size;
 254 }
 255
 256 static gnutls_x509_crt gnutls_d2i_X509_fp(FILE *fp, int format)
 257 {
 258         gnutls_x509_crt cert = NULL;
 259         gnutls_datum tmp;
 260         struct stat s;
 261         int r;
 262         if (fstat(fileno(fp), &s) < 0) {
 263                 perror("fstat");
 264                 return NULL;
 265         }
 266         tmp.data = malloc(s.st_size);
 267         memset(tmp.data, 0, s.st_size);
 268         tmp.size = s.st_size;
 269         if (fread (tmp.data, 1, s.st_size, fp) < s.st_size) {
 270                 perror("fread");
 271                 free(tmp.data);
 272                 return NULL;
 273         }
 274
 275         gnutls_x509_crt_init(&cert);
 276         if ((r = gnutls_x509_crt_import(cert, &tmp, (format == 0)?GNUTLS_X509_FMT_DER:GNUTLS_X509_FMT_PEM)) < 0) {
 277                 debug_print("cert import failed: %s\n", gnutls_strerror(r));
 278                 gnutls_x509_crt_deinit(cert);
 279                 cert = NULL;
 280         }
 281         free(tmp.data);
 282         debug_print("got cert! %p\n", cert);
 283         return cert;
 284 }
 285
 286 static gnutls_x509_privkey gnutls_d2i_key_fp(FILE *fp, int format)
 287 {
 288         gnutls_x509_privkey key = NULL;
 289         gnutls_datum tmp;
 290         struct stat s;
 291         int r;
 292         if (fstat(fileno(fp), &s) < 0) {
 293                 perror("fstat");
 294                 return NULL;
 295         }
 296         tmp.data = malloc(s.st_size);
 297         memset(tmp.data, 0, s.st_size);
 298         tmp.size = s.st_size;
 299         if (fread (tmp.data, 1, s.st_size, fp) < s.st_size) {
 300                 perror("fread");
 301                 free(tmp.data);
 302                 return NULL;
 303         }
 304
 305         gnutls_x509_privkey_init(&key);
 306         if ((r = gnutls_x509_privkey_import(key, &tmp, (format == 0)?GNUTLS_X509_FMT_DER:GNUTLS_X509_FMT_PEM)) < 0) {
 307                 debug_print("key import failed: %s\n", gnutls_strerror(r));
 308                 gnutls_x509_privkey_deinit(key);
 309                 key = NULL;
 310         }
 311         free(tmp.data);
 312         debug_print("got key! %p\n", key);
 313         return key;
 314 }
 315
 316 static gnutls_pkcs12_t gnutls_d2i_PKCS12_fp(FILE *fp, int format)
 317 {
 318         gnutls_pkcs12_t p12 = NULL;
 319         gnutls_datum tmp;
 320         struct stat s;
 321         int r;
 322         if (fstat(fileno(fp), &s) < 0) {
 323                 perror("fstat");
 324                 return NULL;
 325         }
 326         tmp.data = malloc(s.st_size);
 327         memset(tmp.data, 0, s.st_size);
 328         tmp.size = s.st_size;
 329         if (fread (tmp.data, 1, s.st_size, fp) < s.st_size) {
 330                 perror("fread");
 331                 free(tmp.data);
 332                 return NULL;
 333         }
 334
 335         gnutls_pkcs12_init(&p12);
 336
 337         if ((r = gnutls_pkcs12_import(p12, &tmp, (format == 0)?GNUTLS_X509_FMT_DER:GNUTLS_X509_FMT_PEM,0)) < 0) {
 338                 g_warning("p12 import failed: %s\n", gnutls_strerror(r));
 339                 gnutls_pkcs12_deinit(p12);
 340                 p12 = NULL;
 341         }
 342         free(tmp.data);
 343         debug_print("got p12! %p\n", p12);
 344         return p12;
 345 }
 346
 347 #endif
 348
 349 static void ssl_certificate_save (SSLCertificate *cert)
 350 {
 351         gchar *file, *port;
 352         FILE *fp;
 353
 354         file = g_strconcat(get_rc_dir(), G_DIR_SEPARATOR_S,
 355                           "certs", G_DIR_SEPARATOR_S, NULL);
 356
 357         if (!is_dir_exist(file))
 358                 make_dir_hier(file);
 359         g_free(file);
 360
 361         port = g_strdup_printf("%d", cert->port);
 362         file = get_certificate_path(cert->host, port, cert->fingerprint);
 363
 364         g_free(port);
 365         fp = g_fopen(file, "wb");
 366         if (fp == NULL) {
 367                 g_free(file);
 368                 debug_print("Can't save certificate !\n");
 369                 return;
 370         }
 371 #ifdef USE_GNUTLS
 372         gnutls_i2d_X509_fp(fp, cert->x509_cert);
 373 #else
 374         i2d_X509_fp(fp, cert->x509_cert);
 375 #endif
 376         g_free(file);
 377         fclose(fp);
 378
 379 }
 380
 381 void ssl_certificate_destroy(SSLCertificate *cert)
 382 {
 383         if (cert == NULL)
 384                 return;
 385
 386         if (cert->x509_cert)
 387                 gnutls_x509_crt_deinit(cert->x509_cert);
 388         g_free(cert->host);
 389         g_free(cert->fingerprint);
 390         g_free(cert);
 391         cert = NULL;
 392 }
 393
 394 void ssl_certificate_delete_from_disk(SSLCertificate *cert)
 395 {
 396         gchar *buf;
 397         gchar *file;
 398         buf = g_strdup_printf("%d", cert->port);
 399         file = get_certificate_path(cert->host, buf, cert->fingerprint);
 400         claws_unlink (file);
 401         g_free(file);
 402         g_free(buf);
 403 }
 404
 405 SSLCertificate *ssl_certificate_find (gchar *host, gushort port, const gchar *fingerprint)
 406 {
 407         return ssl_certificate_find_lookup (host, port, fingerprint, TRUE);
 408 }
 409
 410 SSLCertificate *ssl_certificate_find_lookup (gchar *host, gushort port, const gchar *fingerprint, gboolean lookup)
 411 {
 412         gchar *file = NULL;
 413         gchar *buf;
 414         gchar *fqdn_host;
 415         SSLCertificate *cert = NULL;
 416         gnutls_x509_crt tmp_x509;
 417         FILE *fp = NULL;
 418         gboolean must_rename = FALSE;
 419
 420         if (lookup)
 421                 fqdn_host = get_fqdn(host);
 422         else
 423                 fqdn_host = g_strdup(host);
 424
 425         buf = g_strdup_printf("%d", port);
 426
 427         if (fingerprint != NULL) {
 428                 file = get_certificate_path(fqdn_host, buf, fingerprint);
 429                 fp = g_fopen(file, "rb");
 430         }
 431         if (fp == NULL) {
 432                 /* see if we have the old one */
 433                 debug_print("didn't get %s\n", file);
 434                 g_free(file);
 435                 file = get_certificate_path(fqdn_host, buf, NULL);
 436                 fp = g_fopen(file, "rb");
 437
 438                 if (fp) {
 439                         debug_print("got %s\n", file);
 440                         must_rename = (fingerprint != NULL);
 441                 }
 442         } else {
 443                 debug_print("got %s first try\n", file);
 444         }
 445         if (fp == NULL) {
 446                 g_free(file);
 447                 g_free(fqdn_host);
 448                 g_free(buf);
 449                 return NULL;
 450         }
 451
 452         if ((tmp_x509 = gnutls_d2i_X509_fp(fp, 0)) != NULL) {
 453                 cert = ssl_certificate_new_lookup(tmp_x509, fqdn_host, port, lookup);
 454                 debug_print("got cert %p\n", cert);
 455                 gnutls_x509_crt_deinit(tmp_x509);
 456         }
 457         fclose(fp);
 458         g_free(file);
 459
 460         if (must_rename) {
 461                 gchar *old = get_certificate_path(fqdn_host, buf, NULL);
 462                 gchar *new = get_certificate_path(fqdn_host, buf, fingerprint);
 463                 if (strcmp(old, new))
 464                         move_file(old, new, TRUE);
 465                 g_free(old);
 466                 g_free(new);
 467         }
 468         g_free(buf);
 469         g_free(fqdn_host);
 470
 471         return cert;
 472 }
 473
 474 static gboolean ssl_certificate_compare (SSLCertificate *cert_a, SSLCertificate *cert_b)
 475 {
 476         char *output_a;
 477         char *output_b;
 478         size_t cert_size_a = 0, cert_size_b = 0;
 479         int r;
 480
 481         if (cert_a == NULL || cert_b == NULL)
 482                 return FALSE;
 483
 484         if ((r = gnutls_x509_crt_export(cert_a->x509_cert, GNUTLS_X509_FMT_DER, NULL, &cert_size_a))
 485             != GNUTLS_E_SHORT_MEMORY_BUFFER) {
 486                 g_warning("couldn't gnutls_x509_crt_export to get size a %s\n", gnutls_strerror(r));
 487                 return FALSE;
 488         }
 489
 490         if ((r = gnutls_x509_crt_export(cert_b->x509_cert, GNUTLS_X509_FMT_DER, NULL, &cert_size_b))
 491             != GNUTLS_E_SHORT_MEMORY_BUFFER) {
 492                 g_warning("couldn't gnutls_x509_crt_export to get size b %s\n", gnutls_strerror(r));
 493                 return FALSE;
 494         }
 495
 496         output_a = g_malloc(cert_size_a);
 497         output_b = g_malloc(cert_size_b);
 498         if ((r = gnutls_x509_crt_export(cert_a->x509_cert, GNUTLS_X509_FMT_DER, output_a, &cert_size_a)) < 0) {
 499                 g_warning("couldn't gnutls_x509_crt_export a %s\n", gnutls_strerror(r));
 500                 g_free(output_a);
 501                 g_free(output_b);
 502                 return FALSE;
 503         }
 504         if ((r = gnutls_x509_crt_export(cert_b->x509_cert, GNUTLS_X509_FMT_DER, output_b, &cert_size_b)) < 0) {
 505                 g_warning("couldn't gnutls_x509_crt_export b %s\n", gnutls_strerror(r));
 506                 g_free(output_a);
 507                 g_free(output_b);
 508                 return FALSE;
 509         }
 510         if (cert_size_a != cert_size_b) {
 511                 g_warning("size differ %zd %zd\n", cert_size_a, cert_size_b);
 512                 g_free(output_a);
 513                 g_free(output_b);
 514                 return FALSE;
 515         }
 516         if (memcmp(output_a, output_b, cert_size_a)) {
 517                 g_warning("contents differ\n");
 518                 g_free(output_a);
 519                 g_free(output_b);
 520                 return FALSE;
 521         }
 522         g_free(output_a);
 523         g_free(output_b);
 524
 525         return TRUE;
 526 }
 527
 528 static guint check_cert(gnutls_x509_crt cert)
 529 {
 530         gnutls_x509_crt *ca_list;
 531         unsigned int max = 512;
 532         unsigned int flags = 0;
 533         gnutls_datum tmp;
 534         struct stat s;
 535         int r, i;
 536         unsigned int status;
 537         FILE *fp;
 538
 539         if (claws_ssl_get_cert_file())
 540                 fp = g_fopen(claws_ssl_get_cert_file(), "r");
 541         else
 542                 return (guint)-1;
 543
 544         if (fstat(fileno(fp), &s) < 0) {
 545                 perror("fstat");
 546                 fclose(fp);
 547                 return (guint)-1;
 548         }
 549
 550         ca_list=(gnutls_x509_crt_t*)malloc(max*sizeof(gnutls_x509_crt_t));
 551         tmp.data = malloc(s.st_size);
 552         memset(tmp.data, 0, s.st_size);
 553         tmp.size = s.st_size;
 554         if (fread (tmp.data, 1, s.st_size, fp) < s.st_size) {
 555                 perror("fread");
 556                 free(tmp.data);
 557                 free(ca_list);
 558                 fclose(fp);
 559                 return (guint)-1;
 560         }
 561
 562         if ((r = gnutls_x509_crt_list_import(ca_list, &max,
 563                         &tmp, GNUTLS_X509_FMT_PEM, flags)) < 0) {
 564                 debug_print("cert import failed: %s\n", gnutls_strerror(r));
 565                 free(tmp.data);
 566                 free(ca_list);
 567                 fclose(fp);
 568                 return (guint)-1;
 569         }
 570         free(tmp.data);
 571         debug_print("got %d certs in ca_list! %p\n", max, &ca_list);
 572         r = gnutls_x509_crt_verify(cert, ca_list, max, flags, &status);
 573         fclose(fp);
 574
 575         for (i = 0; i < max; i++)
 576                 gnutls_x509_crt_deinit(ca_list[i]);
 577         free(ca_list);
 578
 579         if (r < 0)
 580                 return (guint)-1;
 581         else
 582                 return status;
 583
 584 }
 585
 586 char *ssl_certificate_check_signer (gnutls_x509_crt cert, guint status)
 587 {
 588         if (status == (guint)-1) {
 589                 status = check_cert(cert);
 590                 if (status == -1)
 591                         return g_strdup(_("Uncheckable"));
 592         }
 593         if (status & GNUTLS_CERT_INVALID) {
 594                 if (gnutls_x509_crt_check_issuer(cert, cert))
 595                         return g_strdup(_("Self-signed certificate"));
 596         }
 597         if (status & GNUTLS_CERT_REVOKED)
 598                 return g_strdup(_("Revoked certificate"));
 599         if (status & GNUTLS_CERT_SIGNER_NOT_FOUND)
 600                 return g_strdup(_("No certificate issuer found"));
 601         if (status & GNUTLS_CERT_SIGNER_NOT_CA)
 602                 return g_strdup(_("Certificate issuer is not a CA"));
 603
 604
 605         return NULL;
 606 }
 607
 608 gboolean ssl_certificate_check (gnutls_x509_crt x509_cert, guint status, gchar *fqdn, gchar *host, gushort port)
 609 {
 610         SSLCertificate *current_cert = NULL;
 611         SSLCertificate *known_cert;
 612         SSLCertHookData cert_hook_data;
 613         gchar *fqdn_host = NULL;
 614         gchar *fingerprint;
 615         size_t n;
 616         unsigned char md[128];
 617
 618         if (fqdn)
 619                 fqdn_host = g_strdup(fqdn);
 620         else if (host)
 621                 fqdn_host = get_fqdn(host);
 622         else {
 623                 g_warning("no host!\n");
 624                 return FALSE;
 625         }
 626
 627         current_cert = ssl_certificate_new_lookup(x509_cert, fqdn_host, port, FALSE);
 628
 629         if (current_cert == NULL) {
 630                 debug_print("Buggy certificate !\n");
 631                 g_free(fqdn_host);
 632                 return FALSE;
 633         }
 634
 635         current_cert->status = status;
 636         /* fingerprint */
 637         n = 128;
 638         gnutls_x509_crt_get_fingerprint(x509_cert, GNUTLS_DIG_MD5, md, &n);
 639         fingerprint = readable_fingerprint(md, n);
 640
 641         known_cert = ssl_certificate_find_lookup (fqdn_host, port, fingerprint, FALSE);
 642
 643         g_free(fingerprint);
 644         g_free(fqdn_host);
 645
 646         if (known_cert == NULL) {
 647                 cert_hook_data.cert = current_cert;
 648                 cert_hook_data.old_cert = NULL;
 649                 cert_hook_data.expired = FALSE;
 650                 cert_hook_data.accept = FALSE;
 651
 652                 hooks_invoke(SSLCERT_ASK_HOOKLIST, &cert_hook_data);
 653
 654                 if (!cert_hook_data.accept) {
 655                         ssl_certificate_destroy(current_cert);
 656                         return FALSE;
 657                 } else {
 658                         ssl_certificate_save(current_cert);
 659                         ssl_certificate_destroy(current_cert);
 660                         return TRUE;
 661                 }
 662         } else if (!ssl_certificate_compare (current_cert, known_cert)) {
 663                 cert_hook_data.cert = current_cert;
 664                 cert_hook_data.old_cert = known_cert;
 665                 cert_hook_data.expired = FALSE;
 666                 cert_hook_data.accept = FALSE;
 667
 668                 hooks_invoke(SSLCERT_ASK_HOOKLIST, &cert_hook_data);
 669
 670                 if (!cert_hook_data.accept) {
 671                         ssl_certificate_destroy(current_cert);
 672                         ssl_certificate_destroy(known_cert);
 673                         return FALSE;
 674                 } else {
 675                         ssl_certificate_save(current_cert);
 676                         ssl_certificate_destroy(current_cert);
 677                         ssl_certificate_destroy(known_cert);
 678                         return TRUE;
 679                 }
 680         } else if (gnutls_x509_crt_get_expiration_time(current_cert->x509_cert) < time(NULL)) {
 681                 gchar *tmp = g_strdup_printf("%s:%d", current_cert->host, current_cert->port);
 682
 683                 if (warned_expired == NULL)
 684                         warned_expired = g_hash_table_new(g_str_hash, g_str_equal);
 685
 686                 if (g_hash_table_lookup(warned_expired, tmp)) {
 687                         g_free(tmp);
 688                         ssl_certificate_destroy(current_cert);
 689                         ssl_certificate_destroy(known_cert);
 690                         return TRUE;
 691                 }
 692
 693                 cert_hook_data.cert = current_cert;
 694                 cert_hook_data.old_cert = NULL;
 695                 cert_hook_data.expired = TRUE;
 696                 cert_hook_data.accept = FALSE;
 697
 698                 hooks_invoke(SSLCERT_ASK_HOOKLIST, &cert_hook_data);
 699
 700                 if (!cert_hook_data.accept) {
 701                         g_free(tmp);
 702                         ssl_certificate_destroy(current_cert);
 703                         ssl_certificate_destroy(known_cert);
 704                         return FALSE;
 705                 } else {
 706                         g_hash_table_insert(warned_expired, tmp, GINT_TO_POINTER(1));
 707                         ssl_certificate_destroy(current_cert);
 708                         ssl_certificate_destroy(known_cert);
 709                         return TRUE;
 710                 }
 711         }
 712
 713         ssl_certificate_destroy(current_cert);
 714         ssl_certificate_destroy(known_cert);
 715         return TRUE;
 716 }
 717
 718 gnutls_x509_crt ssl_certificate_get_x509_from_pem_file(const gchar *file)
 719 {
 720         gnutls_x509_crt x509 = NULL;
 721         if (!file)
 722                 return NULL;
 723
 724         if (is_file_exist(file)) {
 725                 FILE *fp = g_fopen(file, "r");
 726                 if (fp) {
 727                         x509 = gnutls_d2i_X509_fp(fp, 1);
 728                         fclose(fp);
 729                         return x509;
 730                 }
 731         } else {
 732                 log_error(LOG_PROTOCOL, "Can not open certificate file %s\n", file);
 733         }
 734         return NULL;
 735 }
 736
 737 gnutls_x509_privkey ssl_certificate_get_pkey_from_pem_file(const gchar *file)
 738 {
 739         gnutls_x509_privkey key = NULL;
 740         if (!file)
 741                 return NULL;
 742
 743         if (is_file_exist(file)) {
 744                 FILE *fp = g_fopen(file, "r");
 745                 if (fp) {
 746                         key = gnutls_d2i_key_fp(fp, 1);
 747                         fclose(fp);
 748                         return key;
 749                 }
 750         } else {
 751                 log_error(LOG_PROTOCOL, "Can not open key file %s\n", file);
 752         }
 753         return NULL;
 754 }
 755
 756 /* From GnuTLS lib/gnutls_x509.c */
 757 static int
 758 parse_pkcs12 (gnutls_pkcs12_t p12,
 759               const char *password,
 760               gnutls_x509_privkey * key,
 761               gnutls_x509_crt_t * cert)
 762 {
 763   gnutls_pkcs12_bag bag = NULL;
 764   int index = 0;
 765   int ret;
 766
 767   for (;;)
 768     {
 769       int elements_in_bag;
 770       int i;
 771
 772       ret = gnutls_pkcs12_bag_init (&bag);
 773       if (ret < 0)
 774         {
 775           bag = NULL;
 776           goto done;
 777         }
 778
 779       ret = gnutls_pkcs12_get_bag (p12, index, bag);
 780       if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
 781         break;
 782       if (ret < 0)
 783         {
 784           goto done;
 785         }
 786
 787       ret = gnutls_pkcs12_bag_get_type (bag, 0);
 788       if (ret < 0)
 789         {
 790           goto done;
 791         }
 792
 793       if (ret == GNUTLS_BAG_ENCRYPTED)
 794         {
 795           ret = gnutls_pkcs12_bag_decrypt (bag, password);
 796           if (ret < 0)
 797             {
 798               goto done;
 799             }
 800         }
 801
 802       elements_in_bag = gnutls_pkcs12_bag_get_count (bag);
 803       if (elements_in_bag < 0)
 804         {
 805           goto done;
 806         }
 807
 808       for (i = 0; i < elements_in_bag; i++)
 809         {
 810           int type;
 811           gnutls_datum data;
 812
 813           type = gnutls_pkcs12_bag_get_type (bag, i);
 814           if (type < 0)
 815             {
 816               goto done;
 817             }
 818
 819           ret = gnutls_pkcs12_bag_get_data (bag, i, &data);
 820           if (ret < 0)
 821             {
 822               goto done;
 823             }
 824
 825           switch (type)
 826             {
 827             case GNUTLS_BAG_PKCS8_ENCRYPTED_KEY:
 828             case GNUTLS_BAG_PKCS8_KEY:
 829               ret = gnutls_x509_privkey_init (key);
 830               if (ret < 0)
 831                 {
 832                   goto done;
 833                 }
 834
 835               ret = gnutls_x509_privkey_import_pkcs8
 836                 (*key, &data, GNUTLS_X509_FMT_DER, password,
 837                  type == GNUTLS_BAG_PKCS8_KEY ? GNUTLS_PKCS_PLAIN : 0);
 838               if (ret < 0)
 839                 {
 840                   goto done;
 841                 }
 842               break;
 843
 844             case GNUTLS_BAG_CERTIFICATE:
 845               ret = gnutls_x509_crt_init (cert);
 846               if (ret < 0)
 847                 {
 848                   goto done;
 849                 }
 850
 851               ret =
 852                 gnutls_x509_crt_import (*cert, &data, GNUTLS_X509_FMT_DER);
 853               if (ret < 0)
 854                 {
 855                   goto done;
 856                 }
 857               break;
 858
 859             case GNUTLS_BAG_ENCRYPTED:
 860               /* XXX Bother to recurse one level down?  Unlikely to
 861                  use the same password anyway. */
 862             case GNUTLS_BAG_EMPTY:
 863             default:
 864               break;
 865             }
 866         }
 867
 868       index++;
 869       gnutls_pkcs12_bag_deinit (bag);
 870     }
 871
 872   ret = 0;
 873
 874 done:
 875   if (bag)
 876     gnutls_pkcs12_bag_deinit (bag);
 877
 878   return ret;
 879 }
 880 void ssl_certificate_get_x509_and_pkey_from_p12_file(const gchar *file, const gchar *password,
 881                         gnutls_x509_crt *x509, gnutls_x509_privkey *pkey)
 882 {
 883         gnutls_pkcs12_t p12 = NULL;
 884
 885         int r;
 886
 887         *x509 = NULL;
 888         *pkey = NULL;
 889         if (!file)
 890                 return;
 891
 892         if (is_file_exist(file)) {
 893                 FILE *fp = g_fopen(file, "r");
 894                 if (fp) {
 895                         p12 = gnutls_d2i_PKCS12_fp(fp, 0);
 896                         fclose(fp);
 897                 }
 898         } else {
 899                 log_error(LOG_PROTOCOL, "Can not open certificate file %s\n", file);
 900         }
 901         if (p12 != NULL) {
 902                 if ((r = parse_pkcs12(p12, password, pkey, x509)) == 0) {
 903                         debug_print("got p12\n");
 904                 } else {
 905                         log_error(LOG_PROTOCOL, "%s\n", gnutls_strerror(r));
 906                 }
 907                 gnutls_pkcs12_deinit(p12);
 908         }
 909 }
 910 #endif /* USE_GNUTLS */