Implement certificate chain retrieval and passing. CAs are not loaded

[claws.git] / src / common / ssl_certificate.c

diff --git a/src/common/ssl_certificate.c b/src/common/ssl_certificate.c
index baf533ca535b4e079b40e1ac8eb91e85a0f46536..72f73acb16facbd48c2ae9620a64bb680982639e 100644 (file)
--- a/src/common/ssl_certificate.c
+++ b/src/common/ssl_certificate.c
@@ -20,6 +20,7 @@
 
 #ifdef HAVE_CONFIG_H
 #  include "config.h"
+#include "claws-features.h"
 #endif
 
 #ifdef USE_GNUTLS
@@ -33,6 +34,7 @@
 #include <stdio.h>
 #include <glib.h>
 #include <glib/gi18n.h>
+#include <errno.h>
 #ifdef G_OS_WIN32
 #  include <winsock2.h>
 #else
@@ -86,12 +88,13 @@ char * readable_fingerprint(unsigned char *src, int len)
 }
 
 #if USE_GNUTLS
-static gnutls_x509_crt x509_crt_copy(gnutls_x509_crt src)
+static gnutls_x509_crt_t x509_crt_copy(gnutls_x509_crt_t src)
 {
     int ret;
     size_t size;
-    gnutls_datum tmp;
-    gnutls_x509_crt dest;
+    gnutls_datum_t tmp;
+    gnutls_x509_crt_t dest;
+    size = 0;
     
     if (gnutls_x509_crt_init(&dest) != 0) {
        g_warning("couldn't gnutls_x509_crt_init\n");
@@ -127,7 +130,7 @@ static gnutls_x509_crt x509_crt_copy(gnutls_x509_crt src)
 }
 #endif
 
-static SSLCertificate *ssl_certificate_new(gnutls_x509_crt x509_cert, const gchar *host, gushort port)
+static SSLCertificate *ssl_certificate_new(gnutls_x509_crt_t x509_cert, const gchar *host, gushort port)
 {
        SSLCertificate *cert = g_new0(SSLCertificate, 1);
        size_t n;
@@ -150,7 +153,7 @@ static SSLCertificate *ssl_certificate_new(gnutls_x509_crt x509_cert, const gcha
 }
 
 #ifdef USE_GNUTLS
-static void gnutls_i2d_X509_fp(FILE *fp, gnutls_x509_crt x509_cert)
+static void gnutls_i2d_X509_fp(FILE *fp, gnutls_x509_crt_t x509_cert)
 {
        char output[10*1024];
        size_t cert_size = 10*1024;
@@ -166,7 +169,7 @@ static void gnutls_i2d_X509_fp(FILE *fp, gnutls_x509_crt x509_cert)
        }
 }
 
-size_t gnutls_i2d_X509(gnutls_x509_crt x509_cert, unsigned char **output)
+size_t gnutls_i2d_X509(gnutls_x509_crt_t x509_cert, unsigned char **output)
 {
        size_t cert_size = 10*1024;
        int r;
@@ -185,7 +188,7 @@ size_t gnutls_i2d_X509(gnutls_x509_crt x509_cert, unsigned char **output)
        return cert_size;
 }
 
-size_t gnutls_i2d_PrivateKey(gnutls_x509_privkey pkey, unsigned char **output)
+size_t gnutls_i2d_PrivateKey(gnutls_x509_privkey_t pkey, unsigned char **output)
 {
        size_t key_size = 10*1024;
        int r;
@@ -204,10 +207,10 @@ size_t gnutls_i2d_PrivateKey(gnutls_x509_privkey pkey, unsigned char **output)
        return key_size;
 }
 
-static gnutls_x509_crt gnutls_d2i_X509_fp(FILE *fp, int format)
+static gnutls_x509_crt_t gnutls_d2i_X509_fp(FILE *fp, int format)
 {
-       gnutls_x509_crt cert = NULL;
-       gnutls_datum tmp;
+       gnutls_x509_crt_t cert = NULL;
+       gnutls_datum_t tmp;
        struct stat s;
        int r;
        if (fstat(fileno(fp), &s) < 0) {
@@ -234,10 +237,10 @@ static gnutls_x509_crt gnutls_d2i_X509_fp(FILE *fp, int format)
        return cert;
 }
 
-static gnutls_x509_privkey gnutls_d2i_key_fp(FILE *fp, int format)
+static gnutls_x509_privkey_t gnutls_d2i_key_fp(FILE *fp, int format)
 {
-       gnutls_x509_privkey key = NULL;
-       gnutls_datum tmp;
+       gnutls_x509_privkey_t key = NULL;
+       gnutls_datum_t tmp;
        struct stat s;
        int r;
        if (fstat(fileno(fp), &s) < 0) {
@@ -267,18 +270,20 @@ static gnutls_x509_privkey gnutls_d2i_key_fp(FILE *fp, int format)
 static gnutls_pkcs12_t gnutls_d2i_PKCS12_fp(FILE *fp, int format)
 {
        gnutls_pkcs12_t p12 = NULL;
-       gnutls_datum tmp;
+       gnutls_datum_t tmp;
        struct stat s;
        int r;
        if (fstat(fileno(fp), &s) < 0) {
-               perror("fstat");
+               log_error(LOG_PROTOCOL, _("Cannot stat P12 certificate file (%s)\n"),
+                                 strerror(errno));
                return NULL;
        }
        tmp.data = malloc(s.st_size);
        memset(tmp.data, 0, s.st_size);
        tmp.size = s.st_size;
        if (fread (tmp.data, 1, s.st_size, fp) < s.st_size) {
-               perror("fread");
+               log_error(LOG_PROTOCOL, _("Cannot read P12 certificate file (%s)\n"),
+                                 strerror(errno));
                free(tmp.data);
                return NULL;
        }
@@ -286,7 +291,8 @@ static gnutls_pkcs12_t gnutls_d2i_PKCS12_fp(FILE *fp, int format)
        gnutls_pkcs12_init(&p12);
 
        if ((r = gnutls_pkcs12_import(p12, &tmp, (format == 0)?GNUTLS_X509_FMT_DER:GNUTLS_X509_FMT_PEM,0)) < 0) {
-               g_warning("p12 import failed: %s\n", gnutls_strerror(r));
+               log_error(LOG_PROTOCOL, _("Cannot import P12 certificate file (%s)\n"),
+                                 gnutls_strerror(r));
                gnutls_pkcs12_deinit(p12);
                p12 = NULL;
        }
@@ -358,7 +364,7 @@ SSLCertificate *ssl_certificate_find (const gchar *host, gushort port, const gch
        gchar *file = NULL;
        gchar *buf;
        SSLCertificate *cert = NULL;
-       gnutls_x509_crt tmp_x509;
+       gnutls_x509_crt_t tmp_x509;
        FILE *fp = NULL;
        gboolean must_rename = FALSE;
 
@@ -463,12 +469,12 @@ static gboolean ssl_certificate_compare (SSLCertificate *cert_a, SSLCertificate
        return TRUE;
 }
 
-static guint check_cert(gnutls_x509_crt cert)
+static guint check_cert(gnutls_x509_crt_t cert)
 {
-       gnutls_x509_crt *ca_list;
+       gnutls_x509_crt_t *ca_list;
        unsigned int max = 512;
        unsigned int flags = 0;
-       gnutls_datum tmp;
+       gnutls_datum_t tmp;
        struct stat s;
        int r, i;
        unsigned int status;
@@ -521,7 +527,7 @@ static guint check_cert(gnutls_x509_crt cert)
 
 }
 
-char *ssl_certificate_check_signer (gnutls_x509_crt cert, guint status) 
+char *ssl_certificate_check_signer (gnutls_x509_crt_t cert, guint status) 
 {
        if (status == (guint)-1) {
                status = check_cert(cert);
@@ -543,7 +549,7 @@ char *ssl_certificate_check_signer (gnutls_x509_crt cert, guint status)
        return NULL;
 }
 
-gboolean ssl_certificate_check (gnutls_x509_crt x509_cert, guint status, const gchar *host, gushort port)
+gboolean ssl_certificate_check (gnutls_x509_crt_t x509_cert, guint status, const gchar *host, gushort port)
 {
        SSLCertificate *current_cert = NULL;
        SSLCertificate *known_cert;
@@ -641,9 +647,26 @@ gboolean ssl_certificate_check (gnutls_x509_crt x509_cert, guint status, const g
        return TRUE;
 }
 
-gnutls_x509_crt ssl_certificate_get_x509_from_pem_file(const gchar *file)
+gboolean ssl_certificate_check_chain(gnutls_x509_crt_t *certs, gint chain_len, const gchar *host, gushort port)
+{
+       gboolean result = FALSE;
+       gint status;
+
+       gnutls_x509_crt_list_verify (certs,
+                             chain_len,
+                             NULL, 0,
+                             NULL, 0,
+                             GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT,
+                             &status);
+
+       result = ssl_certificate_check(certs[0], status, host, port);
+
+       return result;
+}
+
+gnutls_x509_crt_t ssl_certificate_get_x509_from_pem_file(const gchar *file)
 {
-       gnutls_x509_crt x509 = NULL;
+       gnutls_x509_crt_t x509 = NULL;
        if (!file)
                return NULL;
        
@@ -653,16 +676,20 @@ gnutls_x509_crt ssl_certificate_get_x509_from_pem_file(const gchar *file)
                        x509 = gnutls_d2i_X509_fp(fp, 1);
                        fclose(fp);
                        return x509;
+               } else {
+                       log_error(LOG_PROTOCOL, _("Cannot open certificate file %s: %s\n"),
+                                 file, strerror(errno));
                }
        } else {
-               log_error(LOG_PROTOCOL, _("Cannot open certificate file %s\n"), file);
+               log_error(LOG_PROTOCOL, _("Certificate file %s missing (%s)\n"),
+                         file, strerror(errno));
        }
        return NULL;
 }
 
-gnutls_x509_privkey ssl_certificate_get_pkey_from_pem_file(const gchar *file)
+gnutls_x509_privkey_t ssl_certificate_get_pkey_from_pem_file(const gchar *file)
 {
-       gnutls_x509_privkey key = NULL;
+       gnutls_x509_privkey_t key = NULL;
        if (!file)
                return NULL;
        
@@ -672,9 +699,13 @@ gnutls_x509_privkey ssl_certificate_get_pkey_from_pem_file(const gchar *file)
                        key = gnutls_d2i_key_fp(fp, 1);
                        fclose(fp);
                        return key;
+               } else {
+                       log_error(LOG_PROTOCOL, _("Cannot open key file %s (%s)\n"),
+                       file, strerror(errno));
                }
        } else {
-               log_error(LOG_PROTOCOL, _("Cannot open key file %s\n"), file);
+               log_error(LOG_PROTOCOL, _("Key file %s missing (%s)\n"), file,
+                         strerror(errno));
        }
        return NULL;
 }
@@ -683,7 +714,7 @@ gnutls_x509_privkey ssl_certificate_get_pkey_from_pem_file(const gchar *file)
 static int
 parse_pkcs12 (gnutls_pkcs12_t p12,
              const char *password,
-             gnutls_x509_privkey * key,
+             gnutls_x509_privkey_t * key,
              gnutls_x509_crt_t * cert)
 {
   gnutls_pkcs12_bag_t bag = NULL;
@@ -734,7 +765,7 @@ parse_pkcs12 (gnutls_pkcs12_t p12,
       for (i = 0; i < elements_in_bag; i++)
        {
          int type;
-         gnutls_datum data;
+         gnutls_datum_t data;
 
          type = gnutls_pkcs12_bag_get_type (bag, i);
          if (type < 0)
@@ -804,7 +835,7 @@ done:
   return ret;
 }
 void ssl_certificate_get_x509_and_pkey_from_p12_file(const gchar *file, const gchar *password,
-                       gnutls_x509_crt *x509, gnutls_x509_privkey *pkey)
+                       gnutls_x509_crt_t *x509, gnutls_x509_privkey_t *pkey)
 {
        gnutls_pkcs12_t p12 = NULL;
 
@@ -820,9 +851,16 @@ void ssl_certificate_get_x509_and_pkey_from_p12_file(const gchar *file, const gc
                if (fp) {
                        p12 = gnutls_d2i_PKCS12_fp(fp, 0);
                        fclose(fp);
+                       if (!p12) {
+                               log_error(LOG_PROTOCOL, _("Failed to read P12 certificate file %s\n"), file);
+                       }
+               } else {
+                       log_error(LOG_PROTOCOL, _("Cannot open P12 certificate file %s (%s)\n"),
+                                 file, strerror(errno));
                }
        } else {
-               log_error(LOG_PROTOCOL, _("Cannot open certificate file %s\n"), file);
+               log_error(LOG_PROTOCOL, _("P12 Certificate file %s missing (%s)\n"), file,
+                         strerror(errno));
        }
        if (p12 != NULL) {
                if ((r = parse_pkcs12(p12, password, pkey, x509)) == 0) {
@@ -833,4 +871,22 @@ void ssl_certificate_get_x509_and_pkey_from_p12_file(const gchar *file, const gc
                gnutls_pkcs12_deinit(p12);
        }
 }
+
+gboolean ssl_certificate_check_subject_cn(SSLCertificate *cert)
+{
+       return gnutls_x509_crt_check_hostname(cert->x509_cert, cert->host) != 0;
+}
+
+gchar *ssl_certificate_get_subject_cn(SSLCertificate *cert)
+{
+       gchar subject_cn[BUFFSIZE];
+       size_t n = BUFFSIZE;
+
+       if(gnutls_x509_crt_get_dn_by_oid(cert->x509_cert, 
+               GNUTLS_OID_X520_COMMON_NAME, 0, 0, subject_cn, &n))
+               strncpy(subject_cn, _("<not in certificate>"), BUFFSIZE);
+
+       return g_strdup(subject_cn);
+}
+
 #endif /* USE_GNUTLS */