tlscertificate: add support for certificate chains

This patch changes the behavior of the following functions:

   g_tls_certificate_new_from_pem
   g_tls_certificate_new_from_file
   g_tls_certificate_new_from_files

If more than one certificate is found it will try to load the chain.

It is assumed that the chain will be in the right order (top-level
certificate will be the last one in the file). If the chain cannot be
verified, the first certificate in the file will be returned as before.

https://bugzilla.gnome.org/show_bug.cgi?id=729739
This commit is contained in:
Aleix Conchillo Flaqué 2014-10-06 10:19:48 -07:00 committed by Aleix Conchillo Flaqué
parent 4454b81536
commit da053e345b

View File

@ -198,6 +198,7 @@ g_tls_certificate_class_init (GTlsCertificateClass *class)
static GTlsCertificate * static GTlsCertificate *
g_tls_certificate_new_internal (const gchar *certificate_pem, g_tls_certificate_new_internal (const gchar *certificate_pem,
const gchar *private_key_pem, const gchar *private_key_pem,
GTlsCertificate *issuer,
GError **error) GError **error)
{ {
GObject *cert; GObject *cert;
@ -209,7 +210,9 @@ g_tls_certificate_new_internal (const gchar *certificate_pem,
NULL, error, NULL, error,
"certificate-pem", certificate_pem, "certificate-pem", certificate_pem,
"private-key-pem", private_key_pem, "private-key-pem", private_key_pem,
"issuer", issuer,
NULL); NULL);
return G_TLS_CERTIFICATE (cert); return G_TLS_CERTIFICATE (cert);
} }
@ -305,20 +308,153 @@ parse_next_pem_certificate (const gchar **data,
return g_strndup (start, end - start); return g_strndup (start, end - start);
} }
static GSList *
parse_and_create_certificate_list (const gchar *data,
gsize data_len,
GError **error)
{
GSList *first_pem_list = NULL, *pem_list = NULL;
gchar *first_pem;
const gchar *p, *end;
p = data;
end = p + data_len;
/* Make sure we can load, at least, one certificate. */
first_pem = parse_next_pem_certificate (&p, end, TRUE, error);
if (!first_pem)
return NULL;
/* Create a list with a single element. If we load more certificates
* below, we will concatenate the two lists at the end. */
first_pem_list = g_slist_prepend (first_pem_list, first_pem);
/* If we read one certificate successfully, let's see if we can read
* some more. If not, we will simply return a list with the first one.
*/
while (p && *p)
{
gchar *cert_pem;
cert_pem = parse_next_pem_certificate (&p, end, FALSE, NULL);
if (!cert_pem)
{
g_slist_free_full (pem_list, g_free);
return first_pem_list;
}
pem_list = g_slist_prepend (pem_list, cert_pem);
}
pem_list = g_slist_concat (pem_list, first_pem_list);
return pem_list;
}
static GTlsCertificate *
create_certificate_chain_from_list (GSList *pem_list,
const gchar *key_pem)
{
GTlsCertificate *cert = NULL, *issuer = NULL, *root = NULL;
GTlsCertificateFlags flags;
GSList *pem;
pem = pem_list;
while (pem)
{
const gchar *key = NULL;
/* Private key belongs only to the first certificate. */
if (!pem->next)
key = key_pem;
/* We assume that the whole file is a certificate chain, so we use
* each certificate as the issuer of the next one (list is in
* reverse order).
*/
issuer = cert;
cert = g_tls_certificate_new_internal (pem->data, key, issuer, NULL);
if (issuer)
g_object_unref (issuer);
if (!cert)
return NULL;
/* root will point to the last certificate in the file. */
if (!root)
root = cert;
pem = g_slist_next (pem);
}
/* Verify the certificate chain and return NULL if it doesn't
* verify. */
flags = g_tls_certificate_verify (cert, NULL, root);
if (flags)
{
/* Couldn't verify the certificate chain, so unref it. */
g_object_unref (cert);
cert = NULL;
}
return cert;
}
static GTlsCertificate *
parse_and_create_certificate (const gchar *data,
gsize data_len,
const gchar *key_pem,
GError **error)
{
GSList *pem_list;
GTlsCertificate *cert;
pem_list = parse_and_create_certificate_list (data, data_len, error);
if (!pem_list)
return NULL;
/* We don't pass the error here because, if it fails, we still want to
* load and return the first certificate.
*/
cert = create_certificate_chain_from_list (pem_list, key_pem);
if (!cert)
{
GSList *last = NULL;
/* Get the first certificate (which is the last one as the list is
* in reverse order).
*/
last = g_slist_last (pem_list);
cert = g_tls_certificate_new_internal (last->data, key_pem, NULL, error);
}
g_slist_free_full (pem_list, g_free);
return cert;
}
/** /**
* g_tls_certificate_new_from_pem: * g_tls_certificate_new_from_pem:
* @data: PEM-encoded certificate data * @data: PEM-encoded certificate data
* @length: the length of @data, or -1 if it's 0-terminated. * @length: the length of @data, or -1 if it's 0-terminated.
* @error: #GError for error reporting, or %NULL to ignore. * @error: #GError for error reporting, or %NULL to ignore.
* *
* Creates a new #GTlsCertificate from the PEM-encoded data in @data. * Creates a #GTlsCertificate from the PEM-encoded data in @data. If
* If @data includes both a certificate and a private key, then the * @data includes both a certificate and a private key, then the
* returned certificate will include the private key data as well. (See * returned certificate will include the private key data as well. (See
* the #GTlsCertificate:private-key-pem property for information about * the #GTlsCertificate:private-key-pem property for information about
* supported formats.) * supported formats.)
* *
* If @data includes multiple certificates, only the first one will be * The returned certificate will be the first certificate found in
* parsed. * @data. As of GLib 2.44, if @data contains more certificates it will
* try to load a certificate chain. All certificates will be verified in
* the order found (top-level certificate should be the last one in the
* file) and the #GTlsCertificate:issuer property of each certificate
* will be set accordingly if the verification succeeds. If any
* certificate in the chain cannot be verified, the first certificate in
* the file will still be returned.
* *
* Returns: the new certificate, or %NULL if @data is invalid * Returns: the new certificate, or %NULL if @data is invalid
* *
@ -329,8 +465,7 @@ g_tls_certificate_new_from_pem (const gchar *data,
gssize length, gssize length,
GError **error) GError **error)
{ {
const gchar *data_end; gchar *key_pem;
gchar *key_pem, *cert_pem;
GTlsCertificate *cert; GTlsCertificate *cert;
g_return_val_if_fail (data != NULL, NULL); g_return_val_if_fail (data != NULL, NULL);
@ -338,22 +473,12 @@ g_tls_certificate_new_from_pem (const gchar *data,
if (length == -1) if (length == -1)
length = strlen (data); length = strlen (data);
data_end = data + length;
key_pem = parse_private_key (data, length, FALSE, error); key_pem = parse_private_key (data, length, FALSE, error);
if (error && *error) if (error && *error)
return NULL; return NULL;
cert_pem = parse_next_pem_certificate (&data, data_end, TRUE, error); cert = parse_and_create_certificate (data, length, key_pem, error);
if (error && *error)
{
g_free (key_pem); g_free (key_pem);
return NULL;
}
cert = g_tls_certificate_new_internal (cert_pem, key_pem, error);
g_free (key_pem);
g_free (cert_pem);
return cert; return cert;
} }
@ -363,8 +488,17 @@ g_tls_certificate_new_from_pem (const gchar *data,
* @file: file containing a PEM-encoded certificate to import * @file: file containing a PEM-encoded certificate to import
* @error: #GError for error reporting, or %NULL to ignore. * @error: #GError for error reporting, or %NULL to ignore.
* *
* Creates a #GTlsCertificate from the PEM-encoded data in @file. If * Creates a #GTlsCertificate from the PEM-encoded data in @file. The
* @file cannot be read or parsed, the function will return %NULL and * returned certificate will be the first certificate found in @file. As
* of GLib 2.44, if @file contains more certificates it will try to load
* a certificate chain. All certificates will be verified in the order
* found (top-level certificate should be the last one in the file) and
* the #GTlsCertificate:issuer property of each certificate will be set
* accordingly if the verification succeeds. If any certificate in the
* chain cannot be verified, the first certificate in the file will
* still be returned.
*
* If @file cannot be read or parsed, the function will return %NULL and
* set @error. Otherwise, this behaves like * set @error. Otherwise, this behaves like
* g_tls_certificate_new_from_pem(). * g_tls_certificate_new_from_pem().
* *
@ -390,14 +524,26 @@ g_tls_certificate_new_from_file (const gchar *file,
/** /**
* g_tls_certificate_new_from_files: * g_tls_certificate_new_from_files:
* @cert_file: file containing a PEM-encoded certificate to import
* @cert_file: file containing one or more PEM-encoded certificates to
* import
* @key_file: file containing a PEM-encoded private key to import * @key_file: file containing a PEM-encoded private key to import
* @error: #GError for error reporting, or %NULL to ignore. * @error: #GError for error reporting, or %NULL to ignore.
* *
* Creates a #GTlsCertificate from the PEM-encoded data in @cert_file * Creates a #GTlsCertificate from the PEM-encoded data in @cert_file
* and @key_file. If either file cannot be read or parsed, the * and @key_file. The returned certificate will be the first certificate
* function will return %NULL and set @error. Otherwise, this behaves * found in @cert_file. As of GLib 2.44, if @cert_file contains more
* like g_tls_certificate_new_from_pem(). * certificates it will try to load a certificate chain. All
* certificates will be verified in the order found (top-level
* certificate should be the last one in the file) and the
* #GTlsCertificate:issuer property of each certificate will be set
* accordingly if the verification succeeds. If any certificate in the
* chain cannot be verified, the first certificate in the file will
* still be returned.
*
* If either file cannot be read or parsed, the function will return
* %NULL and set @error. Otherwise, this behaves like
* g_tls_certificate_new_from_pem().
* *
* Returns: the new certificate, or %NULL on error * Returns: the new certificate, or %NULL on error
* *
@ -411,32 +557,24 @@ g_tls_certificate_new_from_files (const gchar *cert_file,
GTlsCertificate *cert; GTlsCertificate *cert;
gchar *cert_data, *key_data; gchar *cert_data, *key_data;
gsize cert_len, key_len; gsize cert_len, key_len;
gchar *cert_pem, *key_pem; gchar *key_pem;
const gchar *p;
if (!g_file_get_contents (cert_file, &cert_data, &cert_len, error))
return NULL;
p = cert_data;
cert_pem = parse_next_pem_certificate (&p, p + cert_len, TRUE, error);
g_free (cert_data);
if (error && *error)
return NULL;
if (!g_file_get_contents (key_file, &key_data, &key_len, error)) if (!g_file_get_contents (key_file, &key_data, &key_len, error))
{
g_free (cert_pem);
return NULL; return NULL;
}
key_pem = parse_private_key (key_data, key_len, TRUE, error); key_pem = parse_private_key (key_data, key_len, TRUE, error);
g_free (key_data); g_free (key_data);
if (error && *error) if (!key_pem)
return NULL;
if (!g_file_get_contents (cert_file, &cert_data, &cert_len, error))
{ {
g_free (cert_pem); g_free (key_pem);
return NULL; return NULL;
} }
cert = g_tls_certificate_new_internal (cert_pem, key_pem, error); cert = parse_and_create_certificate (cert_data, cert_len, key_pem, error);
g_free (cert_pem); g_free (cert_data);
g_free (key_pem); g_free (key_pem);
return cert; return cert;
} }
@ -481,7 +619,7 @@ g_tls_certificate_list_new_from_file (const gchar *file,
cert_pem = parse_next_pem_certificate (&p, end, FALSE, &parse_error); cert_pem = parse_next_pem_certificate (&p, end, FALSE, &parse_error);
if (cert_pem) if (cert_pem)
{ {
cert = g_tls_certificate_new_internal (cert_pem, NULL, &parse_error); cert = g_tls_certificate_new_internal (cert_pem, NULL, NULL, &parse_error);
g_free (cert_pem); g_free (cert_pem);
} }
if (!cert) if (!cert)