Changeset 792a93b for lib


Ignore:
Timestamp:
2011-12-23T12:44:08Z (13 years ago)
Author:
Wilmer van der Gaast <wilmer@…>
Branches:
master
Children:
200e151
Parents:
2d93a51e (diff), 41658da (diff)
Note: this is a merge changeset, the changes displayed below correspond to the merge itself.
Use the (diff) links above to see all the changes relative to each parent.
Message:

Merging SSL certificate verification for GnuTLS, with help from AopicieR.

Location:
lib
Files:
6 edited

Legend:

Unmodified
Added
Removed

  • lib/http_client.c

    r2d93a51e r792a93b  
    3333
    3434static gboolean http_connected( gpointer data, int source, b_input_condition cond );
    35 static gboolean http_ssl_connected( gpointer data, void *source, b_input_condition cond );
     35static gboolean http_ssl_connected( gpointer data, int returncode, void *source, b_input_condition cond );
    3636static gboolean http_incoming_data( gpointer data, int source, b_input_condition cond );
    3737static void http_free( struct http_request *req );
    … …  
    4747        if( ssl )
    4848        {
    49                 req->ssl = ssl_connect( host, port, http_ssl_connected, req );
     49                req->ssl = ssl_connect( host, port, TRUE, http_ssl_connected, req );
    5050                if( req->ssl == NULL )
    5151                        error = 1;
    … …  
    163163       
    164164error:
    165         req->status_string = g_strdup( "Error while writing HTTP request" );
     165        if( req->status_string == NULL )
     166                req->status_string = g_strdup( "Error while writing HTTP request" );
    166167       
    167168        req->func( req );
    … …  
    170171}
    171172
    172 static gboolean http_ssl_connected( gpointer data, void *source, b_input_condition cond )
     173static gboolean http_ssl_connected( gpointer data, int returncode, void *source, b_input_condition cond )
    173174{
    174175        struct http_request *req = data;
    175176       
    176177        if( source == NULL )
     178        {
     179                if( returncode != 0 )
     180                {
     181                        char *err = ssl_verify_strerror( returncode );
     182                        req->status_string = g_strdup_printf(
     183                                "Certificate verification problem 0x%x: %s",
     184                                returncode, err ? err : "Unknown" );
     185                        g_free( err );
     186                }
    177187                return http_connected( data, -1, cond );
     188        }
    178189       
    179190        req->fd = ssl_getfd( source );
    … …  
    439450                if( new_proto == PROTO_HTTPS )
    440451                {
    441                         req->ssl = ssl_connect( new_host, new_port, http_ssl_connected, req );
     452                        req->ssl = ssl_connect( new_host, new_port, TRUE, http_ssl_connected, req );
    442453                        if( req->ssl == NULL )
    443454                                error = 1;

  • lib/ssl_bogus.c

    r2d93a51e r792a93b  
    3232}
    3333
    34 void *ssl_connect( char *host, int port, ssl_input_function func, gpointer data )
     34void *ssl_connect( char *host, int port, gboolean verify, ssl_input_function func, gpointer data )
    3535{
    3636        return( NULL );
    … …  
    5656}
    5757
    58 void *ssl_starttls( int fd, ssl_input_function func, gpointer data )
     58void *ssl_starttls( int fd, char *hostname, gboolean verify, ssl_input_function func, gpointer data )
    5959{
    6060        return NULL;
    … …  
    7070        return 0;
    7171}
     72
     73char *ssl_verify_strerror( int code )
     74{
     75        return NULL;
     76}

  • lib/ssl_client.h

    r2d93a51e r792a93b  
    3737/* Some generic error codes. Especially SSL_AGAIN is important if you
    3838   want to do asynchronous I/O. */
     39#define NSS_VERIFY_ERROR -2
     40#define OPENSSL_VERIFY_ERROR -1
    3941#define SSL_OK            0
    4042#define SSL_NOHANDSHAKE   1
    4143#define SSL_AGAIN         2
     44#define VERIFY_CERT_ERROR 2
     45#define VERIFY_CERT_INVALID 4
     46#define VERIFY_CERT_REVOKED 8
     47#define VERIFY_CERT_SIGNER_NOT_FOUND 16
     48#define VERIFY_CERT_SIGNER_NOT_CA 32
     49#define VERIFY_CERT_INSECURE_ALGORITHM 64
     50#define VERIFY_CERT_NOT_ACTIVATED 128
     51#define VERIFY_CERT_EXPIRED 256
     52#define VERIFY_CERT_WRONG_HOSTNAME 512
    4253
    4354extern int ssl_errno;
    4455
    4556/* This is what your callback function should look like. */
    46 typedef gboolean (*ssl_input_function)(gpointer, void*, b_input_condition);
     57typedef gboolean (*ssl_input_function)(gpointer, int, void*, b_input_condition);
    4758
    4859
    … …  
    5364   ready to be used for SSL traffic. This is all done asynchronously, no
    5465   blocking I/O! (Except for the DNS lookups, for now...) */
    55 G_MODULE_EXPORT void *ssl_connect( char *host, int port, ssl_input_function func, gpointer data );
     66G_MODULE_EXPORT void *ssl_connect( char *host, int port, gboolean verify, ssl_input_function func, gpointer data );
    5667
    5768/* Start an SSL session on an existing fd. Useful for STARTTLS functionality,
    5869   for example in Jabber. */
    59 G_MODULE_EXPORT void *ssl_starttls( int fd, ssl_input_function func, gpointer data );
     70G_MODULE_EXPORT void *ssl_starttls( int fd, char *hostname, gboolean verify, ssl_input_function func, gpointer data );
    6071
    6172/* Obviously you need special read/write functions to read data. */
    … …  
    90101G_MODULE_EXPORT b_input_condition ssl_getdirection( void *conn );
    91102
     103/* Converts a verification bitfield passed to ssl_input_function into
     104   a more useful string. Or NULL if it had no useful bits set. */
     105G_MODULE_EXPORT char *ssl_verify_strerror( int code );
     106
    92107G_MODULE_EXPORT size_t ssl_des3_encrypt(const unsigned char *key, size_t key_len, const unsigned char *input, size_t input_len, const unsigned char *iv, unsigned char **res);

  • lib/ssl_gnutls.c

    r2d93a51e r792a93b  
    2525
    2626#include <gnutls/gnutls.h>
     27#include <gnutls/x509.h>
    2728#include <gcrypt.h>
    2829#include <fcntl.h>
    … …  
    3233#include "sock.h"
    3334#include "stdlib.h"
     35#include "bitlbee.h"
    3436
    3537int ssl_errno = 0;
    … …  
    5456        gboolean established;
    5557        int inpa;
     58        char *hostname;
     59        gboolean verify;
    5660       
    5761        gnutls_session session;
    … …  
    7478}
    7579
    76 void *ssl_connect( char *host, int port, ssl_input_function func, gpointer data )
     80void *ssl_connect( char *host, int port, gboolean verify, ssl_input_function func, gpointer data )
    7781{
    7882        struct scd *conn = g_new0( struct scd, 1 );
    … …  
    8286        conn->data = data;
    8387        conn->inpa = -1;
     88        conn->hostname = g_strdup( host );
     89        conn->verify = verify && global.conf->cafile;
    8490       
    8591        if( conn->fd < 0 )
    … …  
    9298}
    9399
    94 void *ssl_starttls( int fd, ssl_input_function func, gpointer data )
     100void *ssl_starttls( int fd, char *hostname, gboolean verify, ssl_input_function func, gpointer data )
    95101{
    96102        struct scd *conn = g_new0( struct scd, 1 );
    … …  
    100106        conn->data = data;
    101107        conn->inpa = -1;
     108        conn->hostname = hostname;
     109       
     110        /* For now, SSL verification is globally enabled by setting the cafile
     111           setting in bitlbee.conf. Commented out by default because probably
     112           not everyone has this file in the same place and plenty of folks
     113           may not have the cert of their private Jabber server in it. */
     114        conn->verify = verify && global.conf->cafile;
    102115       
    103116        /* This function should be called via a (short) timeout instead of
    … …  
    122135}
    123136
     137static int verify_certificate_callback( gnutls_session_t session )
     138{
     139        unsigned int status;
     140        const gnutls_datum_t *cert_list;
     141        unsigned int cert_list_size;
     142        int gnutlsret;
     143        int verifyret = 0;
     144        gnutls_x509_crt_t cert;
     145        const char *hostname;
     146       
     147        hostname = gnutls_session_get_ptr(session );
     148
     149        gnutlsret = gnutls_certificate_verify_peers2( session, &status );
     150        if( gnutlsret < 0 )
     151                return VERIFY_CERT_ERROR;
     152
     153        if( status & GNUTLS_CERT_INVALID )
     154                verifyret |= VERIFY_CERT_INVALID;
     155
     156        if( status & GNUTLS_CERT_REVOKED )
     157                verifyret |= VERIFY_CERT_REVOKED;
     158
     159        if( status & GNUTLS_CERT_SIGNER_NOT_FOUND )
     160                verifyret |= VERIFY_CERT_SIGNER_NOT_FOUND;
     161
     162        if( status & GNUTLS_CERT_SIGNER_NOT_CA )
     163                verifyret |= VERIFY_CERT_SIGNER_NOT_CA;
     164
     165        if( status & GNUTLS_CERT_INSECURE_ALGORITHM )
     166                verifyret |= VERIFY_CERT_INSECURE_ALGORITHM;
     167
     168        if( status & GNUTLS_CERT_NOT_ACTIVATED )
     169                verifyret |= VERIFY_CERT_NOT_ACTIVATED;
     170
     171        if( status & GNUTLS_CERT_EXPIRED )
     172                verifyret |= VERIFY_CERT_EXPIRED;
     173
     174        /* The following check is already performed inside
     175         * gnutls_certificate_verify_peers2, so we don't need it.
     176
     177         * if( gnutls_certificate_type_get( session ) != GNUTLS_CRT_X509 )
     178         * return GNUTLS_E_CERTIFICATE_ERROR;
     179         */
     180
     181        if( gnutls_x509_crt_init( &cert ) < 0 )
     182                return VERIFY_CERT_ERROR;
     183
     184        cert_list = gnutls_certificate_get_peers( session, &cert_list_size );
     185        if( cert_list == NULL || gnutls_x509_crt_import( cert, &cert_list[0], GNUTLS_X509_FMT_DER ) < 0 )
     186                return VERIFY_CERT_ERROR;
     187
     188        if( !gnutls_x509_crt_check_hostname( cert, hostname ) )
     189        {
     190                verifyret |= VERIFY_CERT_INVALID;
     191                verifyret |= VERIFY_CERT_WRONG_HOSTNAME;
     192        }
     193
     194        gnutls_x509_crt_deinit( cert );
     195
     196        return verifyret;
     197}
     198
     199char *ssl_verify_strerror( int code )
     200{
     201        GString *ret = g_string_new( "" );
     202       
     203        if( code & VERIFY_CERT_REVOKED )
     204                g_string_append( ret, "certificate has been revoked, " );
     205        if( code & VERIFY_CERT_SIGNER_NOT_FOUND )
     206                g_string_append( ret, "certificate hasn't got a known issuer, " );
     207        if( code & VERIFY_CERT_SIGNER_NOT_CA )
     208                g_string_append( ret, "certificate's issuer is not a CA, " );
     209        if( code & VERIFY_CERT_INSECURE_ALGORITHM )
     210                g_string_append( ret, "certificate uses an insecure algorithm, " );
     211        if( code & VERIFY_CERT_NOT_ACTIVATED )
     212                g_string_append( ret, "certificate has not been activated, " );
     213        if( code & VERIFY_CERT_EXPIRED )
     214                g_string_append( ret, "certificate has expired, " );
     215        if( code & VERIFY_CERT_WRONG_HOSTNAME )
     216                g_string_append( ret, "certificate hostname mismatch, " );
     217       
     218        if( ret->len == 0 )
     219        {
     220                g_string_free( ret, TRUE );
     221                return NULL;
     222        }
     223        else
     224        {
     225                g_string_truncate( ret, ret->len - 2 );
     226                return g_string_free( ret, FALSE );
     227        }
     228}
     229
    124230static gboolean ssl_connected( gpointer data, gint source, b_input_condition cond )
    125231{
    … …  
    128234        if( source == -1 )
    129235        {
    130                 conn->func( conn->data, NULL, cond );
     236                conn->func( conn->data, 0, NULL, cond );
    131237                g_free( conn );
    132238                return FALSE;
    … …  
    136242       
    137243        gnutls_certificate_allocate_credentials( &conn->xcred );
     244        if( conn->verify && global.conf->cafile )
     245        {
     246                gnutls_certificate_set_x509_trust_file( conn->xcred, global.conf->cafile, GNUTLS_X509_FMT_PEM );
     247                gnutls_certificate_set_verify_flags( conn->xcred, GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT );
     248        }
     249
    138250        gnutls_init( &conn->session, GNUTLS_CLIENT );
     251        if( conn->verify )
     252                gnutls_session_set_ptr( conn->session, (void *) conn->hostname );
    139253#if GNUTLS_VERSION_NUMBER < 0x020c00
    140254        gnutls_transport_set_lowat( conn->session, 0 );
    … …  
    152266{
    153267        struct scd *conn = data;
    154         int st;
     268        int st, stver;
    155269       
    156270        if( ( st = gnutls_handshake( conn->session ) ) < 0 )
    … …  
    163277                else
    164278                {
    165                         conn->func( conn->data, NULL, cond );
     279                        conn->func( conn->data, 0, NULL, cond );
    166280                       
    167281                        gnutls_deinit( conn->session );
    … …  
    174288        else
    175289        {
    176                 /* For now we can't handle non-blocking perfectly everywhere... */
    177                 sock_make_blocking( conn->fd );
     290                if( conn->verify && ( stver = verify_certificate_callback( conn->session ) ) != 0 )
     291                {
     292                        conn->func( conn->data, stver, NULL, cond );
     293
     294                        gnutls_deinit( conn->session );
     295                        gnutls_certificate_free_credentials( conn->xcred );
     296                        closesocket( conn->fd );
     297
     298                        g_free( conn );
     299                }
     300                else
     301                {
     302                        /* For now we can't handle non-blocking perfectly everywhere... */
     303                        sock_make_blocking( conn->fd );
    178304               
    179                 conn->established = TRUE;
    180                 conn->func( conn->data, conn, cond );
     305                        conn->established = TRUE;
     306                        conn->func( conn->data, 0, conn, cond );
     307                }
    181308        }
    182309       

  • lib/ssl_nss.c

    r2d93a51e r792a93b  
    5252        PRFileDesc *prfd;
    5353        gboolean established;
     54        gboolean verify;
    5455};
    5556
    … …  
    102103}
    103104
    104 void *ssl_connect( char *host, int port, ssl_input_function func, gpointer data )
     105void *ssl_connect( char *host, int port, gboolean verify, ssl_input_function func, gpointer data )
    105106{
    106107        struct scd *conn = g_new0( struct scd, 1 );
    … …  
    132133}
    133134
    134 void *ssl_starttls( int fd, ssl_input_function func, gpointer data )
     135void *ssl_starttls( int fd, char *hostname, gboolean verify, ssl_input_function func, gpointer data )
    135136{
    136137        struct scd *conn = g_new0( struct scd, 1 );
    … …  
    139140        conn->func = func;
    140141        conn->data = data;
     142        conn->verify = verify;
    141143
    142144        /* This function should be called via a (short) timeout instead of
    … …  
    157159{
    158160        struct scd *conn = data;
     161       
     162        /* Right now we don't have any verification functionality for nss so we
     163           fail in case verification has been requested by the user. */
     164
     165        if( conn->verify )
     166        {
     167                conn->func( conn->data, NSS_VERIFY_ERROR, NULL, cond );
     168                if( source >= 0 ) closesocket( source );
     169                g_free( conn );
     170
     171                return FALSE;
     172        }
    159173       
    160174        if( source == -1 )
    … …  
    177191       
    178192        conn->established = TRUE;
    179         conn->func( conn->data, conn, cond );
     193        conn->func( conn->data, 0, conn, cond );
    180194        return FALSE;
    181195       
    182196        ssl_connected_failure:
    183197       
    184         conn->func( conn->data, NULL, cond );
     198        conn->func( conn->data, 0, NULL, cond );
    185199       
    186200        PR_Close( conn -> prfd );
    … …  
    238252        return B_EV_IO_READ;
    239253}
     254
     255char *ssl_verify_strerror( int code )
     256{
     257        return g_strdup( "SSL certificate verification not supported by BitlBee NSS code." );
     258}

  • lib/ssl_openssl.c

    r2d93a51e r792a93b  
    4545        int fd;
    4646        gboolean established;
     47        gboolean verify;
    4748       
    4849        int inpa;
    … …  
    6465}
    6566
    66 void *ssl_connect( char *host, int port, ssl_input_function func, gpointer data )
     67void *ssl_connect( char *host, int port, gboolean verify, ssl_input_function func, gpointer data )
    6768{
    6869        struct scd *conn = g_new0( struct scd, 1 );
    … …  
    8283}
    8384
    84 void *ssl_starttls( int fd, ssl_input_function func, gpointer data )
     85void *ssl_starttls( int fd, char *hostname, gboolean verify, ssl_input_function func, gpointer data )
    8586{
    8687        struct scd *conn = g_new0( struct scd, 1 );
    … …  
    9091        conn->data = data;
    9192        conn->inpa = -1;
     93        conn->verify = verify;
    9294       
    9395        /* This function should be called via a (short) timeout instead of
    … …  
    117119        SSL_METHOD *meth;
    118120       
     121        /* Right now we don't have any verification functionality for openssl so we
     122           fail in case verification has been requested by the user. */
     123
     124        if( conn->verify )
     125        {
     126                conn->func( conn->data, OPENSSL_VERIFY_ERROR, NULL, cond );
     127                if( source >= 0 ) closesocket( source );
     128                g_free( conn );
     129
     130                return FALSE;
     131        }
     132
    119133        if( source == -1 )
    120134                goto ssl_connected_failure;
    … …  
    141155
    142156ssl_connected_failure:
    143         conn->func( conn->data, NULL, cond );
     157        conn->func( conn->data, 0, NULL, cond );
    144158       
    145159        if( conn->ssl )
    … …  
    169183                if( conn->lasterr != SSL_ERROR_WANT_READ && conn->lasterr != SSL_ERROR_WANT_WRITE )
    170184                {
    171                         conn->func( conn->data, NULL, cond );
     185                        conn->func( conn->data, 0, NULL, cond );
    172186                       
    173187                        SSL_shutdown( conn->ssl );
    … …  
    187201        conn->established = TRUE;
    188202        sock_make_blocking( conn->fd );         /* For now... */
    189         conn->func( conn->data, conn, cond );
     203        conn->func( conn->data, 0, conn, cond );
    190204        return FALSE;
    191205}
    … …  
    272286{
    273287        return( ((struct scd*)conn)->lasterr == SSL_ERROR_WANT_WRITE ? B_EV_IO_WRITE : B_EV_IO_READ );
     288}
     289
     290char *ssl_verify_strerror( int code )
     291{
     292        return g_strdup( "SSL certificate verification not supported by BitlBee OpenSSL code." );
    274293}
    275294
Note: See TracChangeset for help on using the changeset viewer.