1/* GIO - GLib Input, Output and Certificateing Library
2 *
3 * Copyright (C) 2010 Red Hat, Inc.
4 *
5 * This library is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU Lesser General Public
7 * License as published by the Free Software Foundation; either
8 * version 2.1 of the License, or (at your option) any later version.
9 *
10 * This library is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 * Lesser General Public License for more details.
14 *
15 * You should have received a copy of the GNU Lesser General
16 * Public License along with this library; if not, see <http://www.gnu.org/licenses/>.
17 */
18
19#include "config.h"
20
21#include "gtlscertificate.h"
22
23#include <string.h>
24#include "ginitable.h"
25#include "gtlsbackend.h"
26#include "gtlsconnection.h"
27#include "glibintl.h"
28
29/**
30 * SECTION:gtlscertificate
31 * @title: GTlsCertificate
32 * @short_description: TLS certificate
33 * @include: gio/gio.h
34 * @see_also: #GTlsConnection
35 *
36 * A certificate used for TLS authentication and encryption.
37 * This can represent either a certificate only (eg, the certificate
38 * received by a client from a server), or the combination of
39 * a certificate and a private key (which is needed when acting as a
40 * #GTlsServerConnection).
41 *
42 * Since: 2.28
43 */
44
45/**
46 * GTlsCertificate:
47 *
48 * Abstract base class for TLS certificate types.
49 *
50 * Since: 2.28
51 */
52
53G_DEFINE_ABSTRACT_TYPE (GTlsCertificate, g_tls_certificate, G_TYPE_OBJECT)
54
55enum
56{
57 PROP_0,
58
59 PROP_CERTIFICATE,
60 PROP_CERTIFICATE_PEM,
61 PROP_PRIVATE_KEY,
62 PROP_PRIVATE_KEY_PEM,
63 PROP_ISSUER,
64 PROP_PKCS11_URI,
65 PROP_PRIVATE_KEY_PKCS11_URI,
66};
67
68static void
69g_tls_certificate_init (GTlsCertificate *cert)
70{
71}
72
73static void
74g_tls_certificate_get_property (GObject *object,
75 guint prop_id,
76 GValue *value,
77 GParamSpec *pspec)
78{
79 switch (prop_id)
80 {
81 case PROP_PKCS11_URI:
82 case PROP_PRIVATE_KEY_PKCS11_URI:
83 /* Subclasses must override this property but this allows older backends to not fatally error */
84 g_value_set_static_string (value, NULL);
85 break;
86 default:
87 G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
88 }
89}
90
91static void
92g_tls_certificate_set_property (GObject *object,
93 guint prop_id,
94 const GValue *value,
95 GParamSpec *pspec)
96{
97 switch (prop_id)
98 {
99 case PROP_PKCS11_URI:
100 case PROP_PRIVATE_KEY_PKCS11_URI:
101 /* Subclasses must override this property but this allows older backends to not fatally error */
102 break;
103 default:
104 G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
105 }
106}
107
108static void
109g_tls_certificate_class_init (GTlsCertificateClass *class)
110{
111 GObjectClass *gobject_class = G_OBJECT_CLASS (class);
112
113 gobject_class->set_property = g_tls_certificate_set_property;
114 gobject_class->get_property = g_tls_certificate_get_property;
115
116 /**
117 * GTlsCertificate:certificate:
118 *
119 * The DER (binary) encoded representation of the certificate.
120 * This property and the #GTlsCertificate:certificate-pem property
121 * represent the same data, just in different forms.
122 *
123 * Since: 2.28
124 */
125 g_object_class_install_property (oclass: gobject_class, property_id: PROP_CERTIFICATE,
126 pspec: g_param_spec_boxed (name: "certificate",
127 P_("Certificate"),
128 P_("The DER representation of the certificate"),
129 G_TYPE_BYTE_ARRAY,
130 flags: G_PARAM_READWRITE |
131 G_PARAM_CONSTRUCT_ONLY |
132 G_PARAM_STATIC_STRINGS));
133 /**
134 * GTlsCertificate:certificate-pem:
135 *
136 * The PEM (ASCII) encoded representation of the certificate.
137 * This property and the #GTlsCertificate:certificate
138 * property represent the same data, just in different forms.
139 *
140 * Since: 2.28
141 */
142 g_object_class_install_property (oclass: gobject_class, property_id: PROP_CERTIFICATE_PEM,
143 pspec: g_param_spec_string (name: "certificate-pem",
144 P_("Certificate (PEM)"),
145 P_("The PEM representation of the certificate"),
146 NULL,
147 flags: G_PARAM_READWRITE |
148 G_PARAM_CONSTRUCT_ONLY |
149 G_PARAM_STATIC_STRINGS));
150 /**
151 * GTlsCertificate:private-key:
152 *
153 * The DER (binary) encoded representation of the certificate's
154 * private key, in either PKCS#1 format or unencrypted PKCS#8
155 * format. This property (or the #GTlsCertificate:private-key-pem
156 * property) can be set when constructing a key (eg, from a file),
157 * but cannot be read.
158 *
159 * PKCS#8 format is supported since 2.32; earlier releases only
160 * support PKCS#1. You can use the `openssl rsa`
161 * tool to convert PKCS#8 keys to PKCS#1.
162 *
163 * Since: 2.28
164 */
165 g_object_class_install_property (oclass: gobject_class, property_id: PROP_PRIVATE_KEY,
166 pspec: g_param_spec_boxed (name: "private-key",
167 P_("Private key"),
168 P_("The DER representation of the certificate’s private key"),
169 G_TYPE_BYTE_ARRAY,
170 flags: G_PARAM_WRITABLE |
171 G_PARAM_CONSTRUCT_ONLY |
172 G_PARAM_STATIC_STRINGS));
173 /**
174 * GTlsCertificate:private-key-pem:
175 *
176 * The PEM (ASCII) encoded representation of the certificate's
177 * private key in either PKCS#1 format ("`BEGIN RSA PRIVATE
178 * KEY`") or unencrypted PKCS#8 format ("`BEGIN
179 * PRIVATE KEY`"). This property (or the
180 * #GTlsCertificate:private-key property) can be set when
181 * constructing a key (eg, from a file), but cannot be read.
182 *
183 * PKCS#8 format is supported since 2.32; earlier releases only
184 * support PKCS#1. You can use the `openssl rsa`
185 * tool to convert PKCS#8 keys to PKCS#1.
186 *
187 * Since: 2.28
188 */
189 g_object_class_install_property (oclass: gobject_class, property_id: PROP_PRIVATE_KEY_PEM,
190 pspec: g_param_spec_string (name: "private-key-pem",
191 P_("Private key (PEM)"),
192 P_("The PEM representation of the certificate’s private key"),
193 NULL,
194 flags: G_PARAM_WRITABLE |
195 G_PARAM_CONSTRUCT_ONLY |
196 G_PARAM_STATIC_STRINGS));
197 /**
198 * GTlsCertificate:issuer:
199 *
200 * A #GTlsCertificate representing the entity that issued this
201 * certificate. If %NULL, this means that the certificate is either
202 * self-signed, or else the certificate of the issuer is not
203 * available.
204 *
205 * Since: 2.28
206 */
207 g_object_class_install_property (oclass: gobject_class, property_id: PROP_ISSUER,
208 pspec: g_param_spec_object (name: "issuer",
209 P_("Issuer"),
210 P_("The certificate for the issuing entity"),
211 G_TYPE_TLS_CERTIFICATE,
212 flags: G_PARAM_READWRITE |
213 G_PARAM_CONSTRUCT_ONLY |
214 G_PARAM_STATIC_STRINGS));
215
216 /**
217 * GTlsCertificate:pkcs11-uri: (nullable)
218 *
219 * A URI referencing the PKCS \#11 objects containing an X.509 certificate
220 * and optionally a private key.
221 *
222 * If %NULL the certificate is either not backed by PKCS \#11 or the
223 * #GTlsBackend does not support PKCS \#11.
224 *
225 * Since: 2.68
226 */
227 g_object_class_install_property (oclass: gobject_class, property_id: PROP_PKCS11_URI,
228 pspec: g_param_spec_string (name: "pkcs11-uri",
229 P_("PKCS #11 URI"),
230 P_("The PKCS #11 URI"),
231 NULL,
232 flags: G_PARAM_READWRITE |
233 G_PARAM_CONSTRUCT_ONLY |
234 G_PARAM_STATIC_STRINGS));
235
236 /**
237 * GTlsCertificate:private-key-pkcs11-uri: (nullable)
238 *
239 * A URI referencing a PKCS \#11 object containing a private key.
240 *
241 * Since: 2.68
242 */
243 g_object_class_install_property (oclass: gobject_class, property_id: PROP_PRIVATE_KEY_PKCS11_URI,
244 pspec: g_param_spec_string (name: "private-key-pkcs11-uri",
245 P_("PKCS #11 URI"),
246 P_("The PKCS #11 URI for a private key"),
247 NULL,
248 flags: G_PARAM_READWRITE |
249 G_PARAM_CONSTRUCT_ONLY |
250 G_PARAM_STATIC_STRINGS));
251}
252
253static GTlsCertificate *
254g_tls_certificate_new_internal (const gchar *certificate_pem,
255 const gchar *private_key_pem,
256 GTlsCertificate *issuer,
257 GError **error)
258{
259 GObject *cert;
260 GTlsBackend *backend;
261
262 backend = g_tls_backend_get_default ();
263
264 cert = g_initable_new (object_type: g_tls_backend_get_certificate_type (backend),
265 NULL, error,
266 first_property_name: "certificate-pem", certificate_pem,
267 "private-key-pem", private_key_pem,
268 "issuer", issuer,
269 NULL);
270
271 return G_TLS_CERTIFICATE (cert);
272}
273
274#define PEM_CERTIFICATE_HEADER "-----BEGIN CERTIFICATE-----"
275#define PEM_CERTIFICATE_FOOTER "-----END CERTIFICATE-----"
276#define PEM_PRIVKEY_HEADER_BEGIN "-----BEGIN "
277#define PEM_PRIVKEY_HEADER_END "PRIVATE KEY-----"
278#define PEM_PRIVKEY_FOOTER_BEGIN "-----END "
279#define PEM_PRIVKEY_FOOTER_END "PRIVATE KEY-----"
280#define PEM_PKCS8_ENCRYPTED_HEADER "-----BEGIN ENCRYPTED PRIVATE KEY-----"
281
282static gchar *
283parse_private_key (const gchar *data,
284 gsize data_len,
285 gboolean required,
286 GError **error)
287{
288 const gchar *header_start = NULL, *header_end, *footer_start = NULL, *footer_end;
289 const gchar *data_end = data + data_len;
290
291 header_end = g_strstr_len (haystack: data, haystack_len: data_len, PEM_PRIVKEY_HEADER_END);
292 if (header_end)
293 header_start = g_strrstr_len (haystack: data, haystack_len: header_end - data, PEM_PRIVKEY_HEADER_BEGIN);
294
295 if (!header_start)
296 {
297 if (required)
298 g_set_error_literal (err: error, G_TLS_ERROR, code: G_TLS_ERROR_BAD_CERTIFICATE,
299 _("No PEM-encoded private key found"));
300
301 return NULL;
302 }
303
304 header_end += strlen (PEM_PRIVKEY_HEADER_END);
305
306 if (strncmp (s1: header_start, PEM_PKCS8_ENCRYPTED_HEADER, n: header_end - header_start) == 0)
307 {
308 g_set_error_literal (err: error, G_TLS_ERROR, code: G_TLS_ERROR_BAD_CERTIFICATE,
309 _("Cannot decrypt PEM-encoded private key"));
310 return NULL;
311 }
312
313 footer_end = g_strstr_len (haystack: header_end, haystack_len: data_len - (header_end - data), PEM_PRIVKEY_FOOTER_END);
314 if (footer_end)
315 footer_start = g_strrstr_len (haystack: header_end, haystack_len: footer_end - header_end, PEM_PRIVKEY_FOOTER_BEGIN);
316
317 if (!footer_start)
318 {
319 g_set_error_literal (err: error, G_TLS_ERROR, code: G_TLS_ERROR_BAD_CERTIFICATE,
320 _("Could not parse PEM-encoded private key"));
321 return NULL;
322 }
323
324 footer_end += strlen (PEM_PRIVKEY_FOOTER_END);
325
326 while ((footer_end < data_end) && (*footer_end == '\r' || *footer_end == '\n'))
327 footer_end++;
328
329 return g_strndup (str: header_start, n: footer_end - header_start);
330}
331
332
333static gchar *
334parse_next_pem_certificate (const gchar **data,
335 const gchar *data_end,
336 gboolean required,
337 GError **error)
338{
339 const gchar *start, *end;
340
341 start = g_strstr_len (haystack: *data, haystack_len: data_end - *data, PEM_CERTIFICATE_HEADER);
342 if (!start)
343 {
344 if (required)
345 {
346 g_set_error_literal (err: error, G_TLS_ERROR, code: G_TLS_ERROR_BAD_CERTIFICATE,
347 _("No PEM-encoded certificate found"));
348 }
349 return NULL;
350 }
351
352 end = g_strstr_len (haystack: start, haystack_len: data_end - start, PEM_CERTIFICATE_FOOTER);
353 if (!end)
354 {
355 g_set_error_literal (err: error, G_TLS_ERROR, code: G_TLS_ERROR_BAD_CERTIFICATE,
356 _("Could not parse PEM-encoded certificate"));
357 return NULL;
358 }
359 end += strlen (PEM_CERTIFICATE_FOOTER);
360 while ((end < data_end) && (*end == '\r' || *end == '\n'))
361 end++;
362
363 *data = end;
364
365 return g_strndup (str: start, n: end - start);
366}
367
368static GSList *
369parse_and_create_certificate_list (const gchar *data,
370 gsize data_len,
371 GError **error)
372{
373 GSList *first_pem_list = NULL, *pem_list = NULL;
374 gchar *first_pem;
375 const gchar *p, *end;
376
377 p = data;
378 end = p + data_len;
379
380 /* Make sure we can load, at least, one certificate. */
381 first_pem = parse_next_pem_certificate (data: &p, data_end: end, TRUE, error);
382 if (!first_pem)
383 return NULL;
384
385 /* Create a list with a single element. If we load more certificates
386 * below, we will concatenate the two lists at the end. */
387 first_pem_list = g_slist_prepend (list: first_pem_list, data: first_pem);
388
389 /* If we read one certificate successfully, let's see if we can read
390 * some more. If not, we will simply return a list with the first one.
391 */
392 while (p < end && p && *p)
393 {
394 gchar *cert_pem;
395 GError *error = NULL;
396
397 cert_pem = parse_next_pem_certificate (data: &p, data_end: end, FALSE, error: &error);
398 if (error)
399 {
400 g_slist_free_full (list: pem_list, free_func: g_free);
401 g_error_free (error);
402 return first_pem_list;
403 }
404 else if (!cert_pem)
405 {
406 break;
407 }
408
409 pem_list = g_slist_prepend (list: pem_list, data: cert_pem);
410 }
411
412 pem_list = g_slist_concat (list1: pem_list, list2: first_pem_list);
413
414 return pem_list;
415}
416
417static GTlsCertificate *
418create_certificate_chain_from_list (GSList *pem_list,
419 const gchar *key_pem)
420{
421 GTlsCertificate *cert = NULL, *issuer = NULL, *root = NULL;
422 GTlsCertificateFlags flags;
423 GSList *pem;
424
425 pem = pem_list;
426 while (pem)
427 {
428 const gchar *key = NULL;
429
430 /* Private key belongs only to the first certificate. */
431 if (!pem->next)
432 key = key_pem;
433
434 /* We assume that the whole file is a certificate chain, so we use
435 * each certificate as the issuer of the next one (list is in
436 * reverse order).
437 */
438 issuer = cert;
439 cert = g_tls_certificate_new_internal (certificate_pem: pem->data, private_key_pem: key, issuer, NULL);
440 if (issuer)
441 g_object_unref (object: issuer);
442
443 if (!cert)
444 return NULL;
445
446 /* root will point to the last certificate in the file. */
447 if (!root)
448 root = cert;
449
450 pem = g_slist_next (pem);
451 }
452
453 /* Verify that the certificates form a chain. (We don't care at this
454 * point if there are other problems with it.)
455 */
456 flags = g_tls_certificate_verify (cert, NULL, trusted_ca: root);
457 if (flags & G_TLS_CERTIFICATE_UNKNOWN_CA)
458 {
459 /* It wasn't a chain, it's just a bunch of unrelated certs. */
460 g_clear_object (&cert);
461 }
462
463 return cert;
464}
465
466static GTlsCertificate *
467parse_and_create_certificate (const gchar *data,
468 gsize data_len,
469 const gchar *key_pem,
470 GError **error)
471
472{
473 GSList *pem_list;
474 GTlsCertificate *cert;
475
476 pem_list = parse_and_create_certificate_list (data, data_len, error);
477 if (!pem_list)
478 return NULL;
479
480 /* We don't pass the error here because, if it fails, we still want to
481 * load and return the first certificate.
482 */
483 cert = create_certificate_chain_from_list (pem_list, key_pem);
484 if (!cert)
485 {
486 GSList *last = NULL;
487
488 /* Get the first certificate (which is the last one as the list is
489 * in reverse order).
490 */
491 last = g_slist_last (list: pem_list);
492
493 cert = g_tls_certificate_new_internal (certificate_pem: last->data, private_key_pem: key_pem, NULL, error);
494 }
495
496 g_slist_free_full (list: pem_list, free_func: g_free);
497
498 return cert;
499}
500
501/**
502 * g_tls_certificate_new_from_pem:
503 * @data: PEM-encoded certificate data
504 * @length: the length of @data, or -1 if it's 0-terminated.
505 * @error: #GError for error reporting, or %NULL to ignore.
506 *
507 * Creates a #GTlsCertificate from the PEM-encoded data in @data. If
508 * @data includes both a certificate and a private key, then the
509 * returned certificate will include the private key data as well. (See
510 * the #GTlsCertificate:private-key-pem property for information about
511 * supported formats.)
512 *
513 * The returned certificate will be the first certificate found in
514 * @data. As of GLib 2.44, if @data contains more certificates it will
515 * try to load a certificate chain. All certificates will be verified in
516 * the order found (top-level certificate should be the last one in the
517 * file) and the #GTlsCertificate:issuer property of each certificate
518 * will be set accordingly if the verification succeeds. If any
519 * certificate in the chain cannot be verified, the first certificate in
520 * the file will still be returned.
521 *
522 * Returns: the new certificate, or %NULL if @data is invalid
523 *
524 * Since: 2.28
525 */
526GTlsCertificate *
527g_tls_certificate_new_from_pem (const gchar *data,
528 gssize length,
529 GError **error)
530{
531 GError *child_error = NULL;
532 gchar *key_pem;
533 GTlsCertificate *cert;
534
535 g_return_val_if_fail (data != NULL, NULL);
536 g_return_val_if_fail (error == NULL || *error == NULL, NULL);
537
538 if (length == -1)
539 length = strlen (s: data);
540
541 key_pem = parse_private_key (data, data_len: length, FALSE, error: &child_error);
542 if (child_error != NULL)
543 {
544 g_propagate_error (dest: error, src: child_error);
545 return NULL;
546 }
547
548 cert = parse_and_create_certificate (data, data_len: length, key_pem, error);
549 g_free (mem: key_pem);
550
551 return cert;
552}
553
554/**
555 * g_tls_certificate_new_from_file:
556 * @file: (type filename): file containing a PEM-encoded certificate to import
557 * @error: #GError for error reporting, or %NULL to ignore.
558 *
559 * Creates a #GTlsCertificate from the PEM-encoded data in @file. The
560 * returned certificate will be the first certificate found in @file. As
561 * of GLib 2.44, if @file contains more certificates it will try to load
562 * a certificate chain. All certificates will be verified in the order
563 * found (top-level certificate should be the last one in the file) and
564 * the #GTlsCertificate:issuer property of each certificate will be set
565 * accordingly if the verification succeeds. If any certificate in the
566 * chain cannot be verified, the first certificate in the file will
567 * still be returned.
568 *
569 * If @file cannot be read or parsed, the function will return %NULL and
570 * set @error. Otherwise, this behaves like
571 * g_tls_certificate_new_from_pem().
572 *
573 * Returns: the new certificate, or %NULL on error
574 *
575 * Since: 2.28
576 */
577GTlsCertificate *
578g_tls_certificate_new_from_file (const gchar *file,
579 GError **error)
580{
581 GTlsCertificate *cert;
582 gchar *contents;
583 gsize length;
584
585 if (!g_file_get_contents (filename: file, contents: &contents, length: &length, error))
586 return NULL;
587
588 cert = g_tls_certificate_new_from_pem (data: contents, length, error);
589 g_free (mem: contents);
590 return cert;
591}
592
593/**
594 * g_tls_certificate_new_from_files:
595 * @cert_file: (type filename): file containing one or more PEM-encoded
596 * certificates to import
597 * @key_file: (type filename): file containing a PEM-encoded private key
598 * to import
599 * @error: #GError for error reporting, or %NULL to ignore.
600 *
601 * Creates a #GTlsCertificate from the PEM-encoded data in @cert_file
602 * and @key_file. The returned certificate will be the first certificate
603 * found in @cert_file. As of GLib 2.44, if @cert_file contains more
604 * certificates it will try to load a certificate chain. All
605 * certificates will be verified in the order found (top-level
606 * certificate should be the last one in the file) and the
607 * #GTlsCertificate:issuer property of each certificate will be set
608 * accordingly if the verification succeeds. If any certificate in the
609 * chain cannot be verified, the first certificate in the file will
610 * still be returned.
611 *
612 * If either file cannot be read or parsed, the function will return
613 * %NULL and set @error. Otherwise, this behaves like
614 * g_tls_certificate_new_from_pem().
615 *
616 * Returns: the new certificate, or %NULL on error
617 *
618 * Since: 2.28
619 */
620GTlsCertificate *
621g_tls_certificate_new_from_files (const gchar *cert_file,
622 const gchar *key_file,
623 GError **error)
624{
625 GTlsCertificate *cert;
626 gchar *cert_data, *key_data;
627 gsize cert_len, key_len;
628 gchar *key_pem;
629
630 if (!g_file_get_contents (filename: key_file, contents: &key_data, length: &key_len, error))
631 return NULL;
632
633 key_pem = parse_private_key (data: key_data, data_len: key_len, TRUE, error);
634 g_free (mem: key_data);
635 if (!key_pem)
636 return NULL;
637
638 if (!g_file_get_contents (filename: cert_file, contents: &cert_data, length: &cert_len, error))
639 {
640 g_free (mem: key_pem);
641 return NULL;
642 }
643
644 cert = parse_and_create_certificate (data: cert_data, data_len: cert_len, key_pem, error);
645 g_free (mem: cert_data);
646 g_free (mem: key_pem);
647 return cert;
648}
649
650/**
651 * g_tls_certificate_new_from_pkcs11_uris:
652 * @pkcs11_uri: A PKCS \#11 URI
653 * @private_key_pkcs11_uri: (nullable): A PKCS \#11 URI
654 * @error: #GError for error reporting, or %NULL to ignore.
655 *
656 * Creates a #GTlsCertificate from a PKCS \#11 URI.
657 *
658 * An example @pkcs11_uri would be `pkcs11:model=Model;manufacturer=Manufacture;serial=1;token=My%20Client%20Certificate;id=%01`
659 *
660 * Where the token’s layout is:
661 *
662 * ```
663 * Object 0:
664 * URL: pkcs11:model=Model;manufacturer=Manufacture;serial=1;token=My%20Client%20Certificate;id=%01;object=private%20key;type=private
665 * Type: Private key (RSA-2048)
666 * ID: 01
667 *
668 * Object 1:
669 * URL: pkcs11:model=Model;manufacturer=Manufacture;serial=1;token=My%20Client%20Certificate;id=%01;object=Certificate%20for%20Authentication;type=cert
670 * Type: X.509 Certificate (RSA-2048)
671 * ID: 01
672 * ```
673 *
674 * In this case the certificate and private key would both be detected and used as expected.
675 * @pkcs_uri may also just reference an X.509 certificate object and then optionally
676 * @private_key_pkcs11_uri allows using a private key exposed under a different URI.
677 *
678 * Note that the private key is not accessed until usage and may fail or require a PIN later.
679 *
680 * Returns: (transfer full): the new certificate, or %NULL on error
681 *
682 * Since: 2.68
683 */
684GTlsCertificate *
685g_tls_certificate_new_from_pkcs11_uris (const gchar *pkcs11_uri,
686 const gchar *private_key_pkcs11_uri,
687 GError **error)
688{
689 GObject *cert;
690 GTlsBackend *backend;
691
692 g_return_val_if_fail (error == NULL || *error == NULL, NULL);
693 g_return_val_if_fail (pkcs11_uri, NULL);
694
695 backend = g_tls_backend_get_default ();
696
697 cert = g_initable_new (object_type: g_tls_backend_get_certificate_type (backend),
698 NULL, error,
699 first_property_name: "pkcs11-uri", pkcs11_uri,
700 "private-key-pkcs11-uri", private_key_pkcs11_uri,
701 NULL);
702
703 if (cert != NULL)
704 {
705 gchar *objects_uri;
706
707 /* Old implementations might not override this property */
708 g_object_get (object: cert, first_property_name: "pkcs11-uri", &objects_uri, NULL);
709 if (objects_uri == NULL)
710 {
711 g_set_error_literal (err: error, G_IO_ERROR, code: G_IO_ERROR_NOT_SUPPORTED, _("This GTlsBackend does not support creating PKCS #11 certificates"));
712 g_object_unref (object: cert);
713 return NULL;
714 }
715 g_free (mem: objects_uri);
716 }
717
718 return G_TLS_CERTIFICATE (cert);
719}
720
721/**
722 * g_tls_certificate_list_new_from_file:
723 * @file: (type filename): file containing PEM-encoded certificates to import
724 * @error: #GError for error reporting, or %NULL to ignore.
725 *
726 * Creates one or more #GTlsCertificates from the PEM-encoded
727 * data in @file. If @file cannot be read or parsed, the function will
728 * return %NULL and set @error. If @file does not contain any
729 * PEM-encoded certificates, this will return an empty list and not
730 * set @error.
731 *
732 * Returns: (element-type Gio.TlsCertificate) (transfer full): a
733 * #GList containing #GTlsCertificate objects. You must free the list
734 * and its contents when you are done with it.
735 *
736 * Since: 2.28
737 */
738GList *
739g_tls_certificate_list_new_from_file (const gchar *file,
740 GError **error)
741{
742 GQueue queue = G_QUEUE_INIT;
743 gchar *contents, *end;
744 const gchar *p;
745 gsize length;
746
747 if (!g_file_get_contents (filename: file, contents: &contents, length: &length, error))
748 return NULL;
749
750 end = contents + length;
751 p = contents;
752 while (p && *p)
753 {
754 gchar *cert_pem;
755 GTlsCertificate *cert = NULL;
756 GError *parse_error = NULL;
757
758 cert_pem = parse_next_pem_certificate (data: &p, data_end: end, FALSE, error: &parse_error);
759 if (cert_pem)
760 {
761 cert = g_tls_certificate_new_internal (certificate_pem: cert_pem, NULL, NULL, error: &parse_error);
762 g_free (mem: cert_pem);
763 }
764 if (!cert)
765 {
766 if (parse_error)
767 {
768 g_propagate_error (dest: error, src: parse_error);
769 g_list_free_full (list: queue.head, free_func: g_object_unref);
770 queue.head = NULL;
771 }
772 break;
773 }
774 g_queue_push_tail (queue: &queue, data: cert);
775 }
776
777 g_free (mem: contents);
778 return queue.head;
779}
780
781
782/**
783 * g_tls_certificate_get_issuer:
784 * @cert: a #GTlsCertificate
785 *
786 * Gets the #GTlsCertificate representing @cert's issuer, if known
787 *
788 * Returns: (nullable) (transfer none): The certificate of @cert's issuer,
789 * or %NULL if @cert is self-signed or signed with an unknown
790 * certificate.
791 *
792 * Since: 2.28
793 */
794GTlsCertificate *
795g_tls_certificate_get_issuer (GTlsCertificate *cert)
796{
797 GTlsCertificate *issuer;
798
799 g_object_get (G_OBJECT (cert), first_property_name: "issuer", &issuer, NULL);
800 if (issuer)
801 g_object_unref (object: issuer);
802
803 return issuer;
804}
805
806/**
807 * g_tls_certificate_verify:
808 * @cert: a #GTlsCertificate
809 * @identity: (nullable): the expected peer identity
810 * @trusted_ca: (nullable): the certificate of a trusted authority
811 *
812 * This verifies @cert and returns a set of #GTlsCertificateFlags
813 * indicating any problems found with it. This can be used to verify a
814 * certificate outside the context of making a connection, or to
815 * check a certificate against a CA that is not part of the system
816 * CA database.
817 *
818 * If @identity is not %NULL, @cert's name(s) will be compared against
819 * it, and %G_TLS_CERTIFICATE_BAD_IDENTITY will be set in the return
820 * value if it does not match. If @identity is %NULL, that bit will
821 * never be set in the return value.
822 *
823 * If @trusted_ca is not %NULL, then @cert (or one of the certificates
824 * in its chain) must be signed by it, or else
825 * %G_TLS_CERTIFICATE_UNKNOWN_CA will be set in the return value. If
826 * @trusted_ca is %NULL, that bit will never be set in the return
827 * value.
828 *
829 * (All other #GTlsCertificateFlags values will always be set or unset
830 * as appropriate.)
831 *
832 * Returns: the appropriate #GTlsCertificateFlags
833 *
834 * Since: 2.28
835 */
836GTlsCertificateFlags
837g_tls_certificate_verify (GTlsCertificate *cert,
838 GSocketConnectable *identity,
839 GTlsCertificate *trusted_ca)
840{
841 return G_TLS_CERTIFICATE_GET_CLASS (cert)->verify (cert, identity, trusted_ca);
842}
843
844/**
845 * g_tls_certificate_is_same:
846 * @cert_one: first certificate to compare
847 * @cert_two: second certificate to compare
848 *
849 * Check if two #GTlsCertificate objects represent the same certificate.
850 * The raw DER byte data of the two certificates are checked for equality.
851 * This has the effect that two certificates may compare equal even if
852 * their #GTlsCertificate:issuer, #GTlsCertificate:private-key, or
853 * #GTlsCertificate:private-key-pem properties differ.
854 *
855 * Returns: whether the same or not
856 *
857 * Since: 2.34
858 */
859gboolean
860g_tls_certificate_is_same (GTlsCertificate *cert_one,
861 GTlsCertificate *cert_two)
862{
863 GByteArray *b1, *b2;
864 gboolean equal;
865
866 g_return_val_if_fail (G_IS_TLS_CERTIFICATE (cert_one), FALSE);
867 g_return_val_if_fail (G_IS_TLS_CERTIFICATE (cert_two), FALSE);
868
869 g_object_get (object: cert_one, first_property_name: "certificate", &b1, NULL);
870 g_object_get (object: cert_two, first_property_name: "certificate", &b2, NULL);
871
872 equal = (b1->len == b2->len &&
873 memcmp (s1: b1->data, s2: b2->data, n: b1->len) == 0);
874
875 g_byte_array_unref (array: b1);
876 g_byte_array_unref (array: b2);
877
878 return equal;
879}
880

source code of gtk/subprojects/glib/gio/gtlscertificate.c