mirror of
https://gitlab.gnome.org/GNOME/glib.git
synced 2024-12-25 23:16:14 +01:00
tlscertificate: add support for certificate chains
This patch changes the behavior of the following functions: g_tls_certificate_new_from_pem g_tls_certificate_new_from_file g_tls_certificate_new_from_files If more than one certificate is found it will try to load the chain. It is assumed that the chain will be in the right order (top-level certificate will be the last one in the file). If the chain cannot be verified, the first certificate in the file will be returned as before. https://bugzilla.gnome.org/show_bug.cgi?id=729739
This commit is contained in:
Aleix Conchillo Flaqué
Aleix Conchillo Flaqué
parent
4454b81536
commit
da053e345b
@ -198,6 +198,7 @@ g_tls_certificate_class_init (GTlsCertificateClass *class)
|
||||
static GTlsCertificate *
|
||||
g_tls_certificate_new_internal (const gchar *certificate_pem,
|
||||
const gchar *private_key_pem,
|
||||
GTlsCertificate *issuer,
|
||||
GError **error)
|
||||
{
|
||||
GObject *cert;
|
||||
@ -209,7 +210,9 @@ g_tls_certificate_new_internal (const gchar *certificate_pem,
|
||||
NULL, error,
|
||||
"certificate-pem", certificate_pem,
|
||||
"private-key-pem", private_key_pem,
|
||||
"issuer", issuer,
|
||||
NULL);
|
||||
|
||||
return G_TLS_CERTIFICATE (cert);
|
||||
}
|
||||
|
||||
@ -305,20 +308,153 @@ parse_next_pem_certificate (const gchar **data,
|
||||
return g_strndup (start, end - start);
|
||||
}
|
||||
|
||||
static GSList *
|
||||
parse_and_create_certificate_list (const gchar *data,
|
||||
gsize data_len,
|
||||
GError **error)
|
||||
{
|
||||
GSList *first_pem_list = NULL, *pem_list = NULL;
|
||||
gchar *first_pem;
|
||||
const gchar *p, *end;
|
||||
|
||||
p = data;
|
||||
end = p + data_len;
|
||||
|
||||
/* Make sure we can load, at least, one certificate. */
|
||||
first_pem = parse_next_pem_certificate (&p, end, TRUE, error);
|
||||
if (!first_pem)
|
||||
return NULL;
|
||||
|
||||
/* Create a list with a single element. If we load more certificates
|
||||
* below, we will concatenate the two lists at the end. */
|
||||
first_pem_list = g_slist_prepend (first_pem_list, first_pem);
|
||||
|
||||
/* If we read one certificate successfully, let's see if we can read
|
||||
* some more. If not, we will simply return a list with the first one.
|
||||
*/
|
||||
while (p && *p)
|
||||
{
|
||||
gchar *cert_pem;
|
||||
|
||||
cert_pem = parse_next_pem_certificate (&p, end, FALSE, NULL);
|
||||
if (!cert_pem)
|
||||
{
|
||||
g_slist_free_full (pem_list, g_free);
|
||||
return first_pem_list;
|
||||
}
|
||||
|
||||
pem_list = g_slist_prepend (pem_list, cert_pem);
|
||||
}
|
||||
|
||||
pem_list = g_slist_concat (pem_list, first_pem_list);
|
||||
|
||||
return pem_list;
|
||||
}
|
||||
|
||||
static GTlsCertificate *
|
||||
create_certificate_chain_from_list (GSList *pem_list,
|
||||
const gchar *key_pem)
|
||||
{
|
||||
GTlsCertificate *cert = NULL, *issuer = NULL, *root = NULL;
|
||||
GTlsCertificateFlags flags;
|
||||
GSList *pem;
|
||||
|
||||
pem = pem_list;
|
||||
while (pem)
|
||||
{
|
||||
const gchar *key = NULL;
|
||||
|
||||
/* Private key belongs only to the first certificate. */
|
||||
if (!pem->next)
|
||||
key = key_pem;
|
||||
|
||||
/* We assume that the whole file is a certificate chain, so we use
|
||||
* each certificate as the issuer of the next one (list is in
|
||||
* reverse order).
|
||||
*/
|
||||
issuer = cert;
|
||||
cert = g_tls_certificate_new_internal (pem->data, key, issuer, NULL);
|
||||
if (issuer)
|
||||
g_object_unref (issuer);
|
||||
|
||||
if (!cert)
|
||||
return NULL;
|
||||
|
||||
/* root will point to the last certificate in the file. */
|
||||
if (!root)
|
||||
root = cert;
|
||||
|
||||
pem = g_slist_next (pem);
|
||||
}
|
||||
|
||||
/* Verify the certificate chain and return NULL if it doesn't
|
||||
* verify. */
|
||||
flags = g_tls_certificate_verify (cert, NULL, root);
|
||||
if (flags)
|
||||
{
|
||||
/* Couldn't verify the certificate chain, so unref it. */
|
||||
g_object_unref (cert);
|
||||
cert = NULL;
|
||||
}
|
||||
|
||||
return cert;
|
||||
}
|
||||
|
||||
static GTlsCertificate *
|
||||
parse_and_create_certificate (const gchar *data,
|
||||
gsize data_len,
|
||||
const gchar *key_pem,
|
||||
GError **error)
|
||||
|
||||
{
|
||||
GSList *pem_list;
|
||||
GTlsCertificate *cert;
|
||||
|
||||
pem_list = parse_and_create_certificate_list (data, data_len, error);
|
||||
if (!pem_list)
|
||||
return NULL;
|
||||
|
||||
/* We don't pass the error here because, if it fails, we still want to
|
||||
* load and return the first certificate.
|
||||
*/
|
||||
cert = create_certificate_chain_from_list (pem_list, key_pem);
|
||||
if (!cert)
|
||||
{
|
||||
GSList *last = NULL;
|
||||
|
||||
/* Get the first certificate (which is the last one as the list is
|
||||
* in reverse order).
|
||||
*/
|
||||
last = g_slist_last (pem_list);
|
||||
|
||||
cert = g_tls_certificate_new_internal (last->data, key_pem, NULL, error);
|
||||
}
|
||||
|
||||
g_slist_free_full (pem_list, g_free);
|
||||
|
||||
return cert;
|
||||
}
|
||||
|
||||
/**
|
||||
* g_tls_certificate_new_from_pem:
|
||||
* @data: PEM-encoded certificate data
|
||||
* @length: the length of @data, or -1 if it's 0-terminated.
|
||||
* @error: #GError for error reporting, or %NULL to ignore.
|
||||
*
|
||||
* Creates a new #GTlsCertificate from the PEM-encoded data in @data.
|
||||
* If @data includes both a certificate and a private key, then the
|
||||
* Creates a #GTlsCertificate from the PEM-encoded data in @data. If
|
||||
* @data includes both a certificate and a private key, then the
|
||||
* returned certificate will include the private key data as well. (See
|
||||
* the #GTlsCertificate:private-key-pem property for information about
|
||||
* supported formats.)
|
||||
*
|
||||
* If @data includes multiple certificates, only the first one will be
|
||||
* parsed.
|
||||
* The returned certificate will be the first certificate found in
|
||||
* @data. As of GLib 2.44, if @data contains more certificates it will
|
||||
* try to load a certificate chain. All certificates will be verified in
|
||||
* the order found (top-level certificate should be the last one in the
|
||||
* file) and the #GTlsCertificate:issuer property of each certificate
|
||||
* will be set accordingly if the verification succeeds. If any
|
||||
* certificate in the chain cannot be verified, the first certificate in
|
||||
* the file will still be returned.
|
||||
*
|
||||
* Returns: the new certificate, or %NULL if @data is invalid
|
||||
*
|
||||
@ -329,8 +465,7 @@ g_tls_certificate_new_from_pem (const gchar *data,
|
||||
gssize length,
|
||||
GError **error)
|
||||
{
|
||||
const gchar *data_end;
|
||||
gchar *key_pem, *cert_pem;
|
||||
gchar *key_pem;
|
||||
GTlsCertificate *cert;
|
||||
|
||||
g_return_val_if_fail (data != NULL, NULL);
|
||||
@ -338,22 +473,12 @@ g_tls_certificate_new_from_pem (const gchar *data,
|
||||
if (length == -1)
|
||||
length = strlen (data);
|
||||
|
||||
data_end = data + length;
|
||||
|
||||
key_pem = parse_private_key (data, length, FALSE, error);
|
||||
if (error && *error)
|
||||
return NULL;
|
||||
|
||||
cert_pem = parse_next_pem_certificate (&data, data_end, TRUE, error);
|
||||
if (error && *error)
|
||||
{
|
||||
cert = parse_and_create_certificate (data, length, key_pem, error);
|
||||
g_free (key_pem);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
cert = g_tls_certificate_new_internal (cert_pem, key_pem, error);
|
||||
g_free (key_pem);
|
||||
g_free (cert_pem);
|
||||
|
||||
return cert;
|
||||
}
|
||||
@ -363,8 +488,17 @@ g_tls_certificate_new_from_pem (const gchar *data,
|
||||
* @file: file containing a PEM-encoded certificate to import
|
||||
* @error: #GError for error reporting, or %NULL to ignore.
|
||||
*
|
||||
* Creates a #GTlsCertificate from the PEM-encoded data in @file. If
|
||||
* @file cannot be read or parsed, the function will return %NULL and
|
||||
* Creates a #GTlsCertificate from the PEM-encoded data in @file. The
|
||||
* returned certificate will be the first certificate found in @file. As
|
||||
* of GLib 2.44, if @file contains more certificates it will try to load
|
||||
* a certificate chain. All certificates will be verified in the order
|
||||
* found (top-level certificate should be the last one in the file) and
|
||||
* the #GTlsCertificate:issuer property of each certificate will be set
|
||||
* accordingly if the verification succeeds. If any certificate in the
|
||||
* chain cannot be verified, the first certificate in the file will
|
||||
* still be returned.
|
||||
*
|
||||
* If @file cannot be read or parsed, the function will return %NULL and
|
||||
* set @error. Otherwise, this behaves like
|
||||
* g_tls_certificate_new_from_pem().
|
||||
*
|
||||
@ -390,14 +524,26 @@ g_tls_certificate_new_from_file (const gchar *file,
|
||||
|
||||
/**
|
||||
* g_tls_certificate_new_from_files:
|
||||
* @cert_file: file containing a PEM-encoded certificate to import
|
||||
|
||||
* @cert_file: file containing one or more PEM-encoded certificates to
|
||||
* import
|
||||
* @key_file: file containing a PEM-encoded private key to import
|
||||
* @error: #GError for error reporting, or %NULL to ignore.
|
||||
*
|
||||
* Creates a #GTlsCertificate from the PEM-encoded data in @cert_file
|
||||
* and @key_file. If either file cannot be read or parsed, the
|
||||
* function will return %NULL and set @error. Otherwise, this behaves
|
||||
* like g_tls_certificate_new_from_pem().
|
||||
* and @key_file. The returned certificate will be the first certificate
|
||||
* found in @cert_file. As of GLib 2.44, if @cert_file contains more
|
||||
* certificates it will try to load a certificate chain. All
|
||||
* certificates will be verified in the order found (top-level
|
||||
* certificate should be the last one in the file) and the
|
||||
* #GTlsCertificate:issuer property of each certificate will be set
|
||||
* accordingly if the verification succeeds. If any certificate in the
|
||||
* chain cannot be verified, the first certificate in the file will
|
||||
* still be returned.
|
||||
*
|
||||
* If either file cannot be read or parsed, the function will return
|
||||
* %NULL and set @error. Otherwise, this behaves like
|
||||
* g_tls_certificate_new_from_pem().
|
||||
*
|
||||
* Returns: the new certificate, or %NULL on error
|
||||
*
|
||||
@ -411,32 +557,24 @@ g_tls_certificate_new_from_files (const gchar *cert_file,
|
||||
GTlsCertificate *cert;
|
||||
gchar *cert_data, *key_data;
|
||||
gsize cert_len, key_len;
|
||||
gchar *cert_pem, *key_pem;
|
||||
const gchar *p;
|
||||
|
||||
if (!g_file_get_contents (cert_file, &cert_data, &cert_len, error))
|
||||
return NULL;
|
||||
p = cert_data;
|
||||
cert_pem = parse_next_pem_certificate (&p, p + cert_len, TRUE, error);
|
||||
g_free (cert_data);
|
||||
if (error && *error)
|
||||
return NULL;
|
||||
gchar *key_pem;
|
||||
|
||||
if (!g_file_get_contents (key_file, &key_data, &key_len, error))
|
||||
{
|
||||
g_free (cert_pem);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
key_pem = parse_private_key (key_data, key_len, TRUE, error);
|
||||
g_free (key_data);
|
||||
if (error && *error)
|
||||
if (!key_pem)
|
||||
return NULL;
|
||||
|
||||
if (!g_file_get_contents (cert_file, &cert_data, &cert_len, error))
|
||||
{
|
||||
g_free (cert_pem);
|
||||
g_free (key_pem);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
cert = g_tls_certificate_new_internal (cert_pem, key_pem, error);
|
||||
g_free (cert_pem);
|
||||
cert = parse_and_create_certificate (cert_data, cert_len, key_pem, error);
|
||||
g_free (cert_data);
|
||||
g_free (key_pem);
|
||||
return cert;
|
||||
}
|
||||
@ -481,7 +619,7 @@ g_tls_certificate_list_new_from_file (const gchar *file,
|
||||
cert_pem = parse_next_pem_certificate (&p, end, FALSE, &parse_error);
|
||||
if (cert_pem)
|
||||
{
|
||||
cert = g_tls_certificate_new_internal (cert_pem, NULL, &parse_error);
|
||||
cert = g_tls_certificate_new_internal (cert_pem, NULL, NULL, &parse_error);
|
||||
g_free (cert_pem);
|
||||
}
|
||||
if (!cert)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user