luc14n0/glib
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/glib.git synced 2024-09-20 01:06:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

tlscertificate: add support for certificate chains

Browse Source 
This patch changes the behavior of the following functions:

   g_tls_certificate_new_from_pem
   g_tls_certificate_new_from_file
   g_tls_certificate_new_from_files

If more than one certificate is found it will try to load the chain.

It is assumed that the chain will be in the right order (top-level
certificate will be the last one in the file). If the chain cannot be
verified, the first certificate in the file will be returned as before.

https://bugzilla.gnome.org/show_bug.cgi?id=729739
This commit is contained in:
Aleix Conchillo Flaqué 2014-10-06 10:19:48 -07:00 committed by Aleix Conchillo Flaqué
parent 4454b81536
commit da053e345b
1 changed files with 185 additions and 47 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

232
gio/gtlscertificate.c
View File

@ -196,9 +196,10 @@ g_tls_certificate_class_init (GTlsCertificateClass *class)
}
static GTlsCertificate *
g_tls_certificate_new_internal (const gchar *certificate_pem,
const gchar *private_key_pem,
GError **error)
g_tls_certificate_new_internal (const gchar *certificate_pem,
const gchar *private_key_pem,
GTlsCertificate *issuer,
GError **error)
{
GObject *cert;
GTlsBackend *backend;
@ -209,7 +210,9 @@ g_tls_certificate_new_internal (const gchar *certificate_pem,
NULL, error,
"certificate-pem", certificate_pem,
"private-key-pem", private_key_pem,
"issuer", issuer,
NULL);
return G_TLS_CERTIFICATE (cert);
}
@ -305,20 +308,153 @@ parse_next_pem_certificate (const gchar **data,
return g_strndup (start, end - start);
}
static GSList *
parse_and_create_certificate_list (const gchar *data,
gsize data_len,
GError **error)
{
GSList *first_pem_list = NULL, *pem_list = NULL;
gchar *first_pem;
const gchar *p, *end;
p = data;
end = p + data_len;
/* Make sure we can load, at least, one certificate. */
first_pem = parse_next_pem_certificate (&p, end, TRUE, error);
if (!first_pem)
return NULL;
/* Create a list with a single element. If we load more certificates
* below, we will concatenate the two lists at the end. */
first_pem_list = g_slist_prepend (first_pem_list, first_pem);
/* If we read one certificate successfully, let's see if we can read
* some more. If not, we will simply return a list with the first one.
*/
while (p && *p)
{
gchar *cert_pem;
cert_pem = parse_next_pem_certificate (&p, end, FALSE, NULL);
if (!cert_pem)
{
g_slist_free_full (pem_list, g_free);
return first_pem_list;
}
pem_list = g_slist_prepend (pem_list, cert_pem);
}
pem_list = g_slist_concat (pem_list, first_pem_list);
return pem_list;
}
static GTlsCertificate *
create_certificate_chain_from_list (GSList *pem_list,
const gchar *key_pem)
{
GTlsCertificate *cert = NULL, *issuer = NULL, *root = NULL;
GTlsCertificateFlags flags;
GSList *pem;
pem = pem_list;
while (pem)
{
const gchar *key = NULL;
/* Private key belongs only to the first certificate. */
if (!pem->next)
key = key_pem;
/* We assume that the whole file is a certificate chain, so we use
* each certificate as the issuer of the next one (list is in
* reverse order).
*/
issuer = cert;
cert = g_tls_certificate_new_internal (pem->data, key, issuer, NULL);
if (issuer)
g_object_unref (issuer);
if (!cert)
return NULL;
/* root will point to the last certificate in the file. */
if (!root)
root = cert;
pem = g_slist_next (pem);
}
/* Verify the certificate chain and return NULL if it doesn't
* verify. */
flags = g_tls_certificate_verify (cert, NULL, root);
if (flags)
{
/* Couldn't verify the certificate chain, so unref it. */
g_object_unref (cert);
cert = NULL;
}
return cert;
}
static GTlsCertificate *
parse_and_create_certificate (const gchar *data,
gsize data_len,
const gchar *key_pem,
GError **error)
{
GSList *pem_list;
GTlsCertificate *cert;
pem_list = parse_and_create_certificate_list (data, data_len, error);
if (!pem_list)
return NULL;
/* We don't pass the error here because, if it fails, we still want to
* load and return the first certificate.
*/
cert = create_certificate_chain_from_list (pem_list, key_pem);
if (!cert)
{
GSList *last = NULL;
/* Get the first certificate (which is the last one as the list is
* in reverse order).
*/
last = g_slist_last (pem_list);
cert = g_tls_certificate_new_internal (last->data, key_pem, NULL, error);
}
g_slist_free_full (pem_list, g_free);
return cert;
}
/**
* g_tls_certificate_new_from_pem:
* @data: PEM-encoded certificate data
* @length: the length of @data, or -1 if it's 0-terminated.
* @error: #GError for error reporting, or %NULL to ignore.
*
* Creates a new #GTlsCertificate from the PEM-encoded data in @data.
* If @data includes both a certificate and a private key, then the
* Creates a #GTlsCertificate from the PEM-encoded data in @data. If
* @data includes both a certificate and a private key, then the
* returned certificate will include the private key data as well. (See
* the #GTlsCertificate:private-key-pem property for information about
* supported formats.)
*
* If @data includes multiple certificates, only the first one will be
* parsed.
* The returned certificate will be the first certificate found in
* @data. As of GLib 2.44, if @data contains more certificates it will
* try to load a certificate chain. All certificates will be verified in
* the order found (top-level certificate should be the last one in the
* file) and the #GTlsCertificate:issuer property of each certificate
* will be set accordingly if the verification succeeds. If any
* certificate in the chain cannot be verified, the first certificate in
* the file will still be returned.
*
* Returns: the new certificate, or %NULL if @data is invalid
*
@ -329,8 +465,7 @@ g_tls_certificate_new_from_pem (const gchar *data,
gssize length,
GError **error)
{
const gchar *data_end;
gchar *key_pem, *cert_pem;
gchar *key_pem;
GTlsCertificate *cert;
g_return_val_if_fail (data != NULL, NULL);
@ -338,22 +473,12 @@ g_tls_certificate_new_from_pem (const gchar *data,
if (length == -1)
length = strlen (data);
data_end = data + length;
key_pem = parse_private_key (data, length, FALSE, error);
if (error && *error)
return NULL;
cert_pem = parse_next_pem_certificate (&data, data_end, TRUE, error);
if (error && *error)
{
g_free (key_pem);
return NULL;
}
cert = g_tls_certificate_new_internal (cert_pem, key_pem, error);
cert = parse_and_create_certificate (data, length, key_pem, error);
g_free (key_pem);
g_free (cert_pem);
return cert;
}
@ -363,8 +488,17 @@ g_tls_certificate_new_from_pem (const gchar *data,
* @file: file containing a PEM-encoded certificate to import
* @error: #GError for error reporting, or %NULL to ignore.
*
* Creates a #GTlsCertificate from the PEM-encoded data in @file. If
* @file cannot be read or parsed, the function will return %NULL and
* Creates a #GTlsCertificate from the PEM-encoded data in @file. The
* returned certificate will be the first certificate found in @file. As
* of GLib 2.44, if @file contains more certificates it will try to load
* a certificate chain. All certificates will be verified in the order
* found (top-level certificate should be the last one in the file) and
* the #GTlsCertificate:issuer property of each certificate will be set
* accordingly if the verification succeeds. If any certificate in the
* chain cannot be verified, the first certificate in the file will
* still be returned.
*
* If @file cannot be read or parsed, the function will return %NULL and
* set @error. Otherwise, this behaves like
* g_tls_certificate_new_from_pem().
*
@ -390,14 +524,26 @@ g_tls_certificate_new_from_file (const gchar *file,
/**
* g_tls_certificate_new_from_files:
* @cert_file: file containing a PEM-encoded certificate to import
* @cert_file: file containing one or more PEM-encoded certificates to
* import
* @key_file: file containing a PEM-encoded private key to import
* @error: #GError for error reporting, or %NULL to ignore.
*
* Creates a #GTlsCertificate from the PEM-encoded data in @cert_file
* and @key_file. If either file cannot be read or parsed, the
* function will return %NULL and set @error. Otherwise, this behaves
* like g_tls_certificate_new_from_pem().
* and @key_file. The returned certificate will be the first certificate
* found in @cert_file. As of GLib 2.44, if @cert_file contains more
* certificates it will try to load a certificate chain. All
* certificates will be verified in the order found (top-level
* certificate should be the last one in the file) and the
* #GTlsCertificate:issuer property of each certificate will be set
* accordingly if the verification succeeds. If any certificate in the
* chain cannot be verified, the first certificate in the file will
* still be returned.
*
* If either file cannot be read or parsed, the function will return
* %NULL and set @error. Otherwise, this behaves like
* g_tls_certificate_new_from_pem().
*
* Returns: the new certificate, or %NULL on error
*
@ -405,38 +551,30 @@ g_tls_certificate_new_from_file (const gchar *file,
*/
GTlsCertificate *
g_tls_certificate_new_from_files (const gchar *cert_file,
const gchar *key_file,
GError **error)
const gchar *key_file,
GError **error)
{
GTlsCertificate *cert;
gchar *cert_data, *key_data;
gsize cert_len, key_len;
gchar *cert_pem, *key_pem;
const gchar *p;
if (!g_file_get_contents (cert_file, &cert_data, &cert_len, error))
return NULL;
p = cert_data;
cert_pem = parse_next_pem_certificate (&p, p + cert_len, TRUE, error);
g_free (cert_data);
if (error && *error)
return NULL;
gchar *key_pem;
if (!g_file_get_contents (key_file, &key_data, &key_len, error))
{
g_free (cert_pem);
return NULL;
}
return NULL;
key_pem = parse_private_key (key_data, key_len, TRUE, error);
g_free (key_data);
if (error && *error)
if (!key_pem)
return NULL;
if (!g_file_get_contents (cert_file, &cert_data, &cert_len, error))
{
g_free (cert_pem);
g_free (key_pem);
return NULL;
}
cert = g_tls_certificate_new_internal (cert_pem, key_pem, error);
g_free (cert_pem);
cert = parse_and_create_certificate (cert_data, cert_len, key_pem, error);
g_free (cert_data);
g_free (key_pem);
return cert;
}
@ -481,7 +619,7 @@ g_tls_certificate_list_new_from_file (const gchar *file,
cert_pem = parse_next_pem_certificate (&p, end, FALSE, &parse_error);
if (cert_pem)
{
cert = g_tls_certificate_new_internal (cert_pem, NULL, &parse_error);
cert = g_tls_certificate_new_internal (cert_pem, NULL, NULL, &parse_error);
g_free (cert_pem);
}
if (!cert)