1 | /* GIO - GLib Input, Output and Certificateing Library |
2 | * |
3 | * Copyright (C) 2010 Red Hat, Inc. |
4 | * |
5 | * This library is free software; you can redistribute it and/or |
6 | * modify it under the terms of the GNU Lesser General Public |
7 | * License as published by the Free Software Foundation; either |
8 | * version 2.1 of the License, or (at your option) any later version. |
9 | * |
10 | * This library is distributed in the hope that it will be useful, |
11 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
12 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
13 | * Lesser General Public License for more details. |
14 | * |
15 | * You should have received a copy of the GNU Lesser General |
16 | * Public License along with this library; if not, see <http://www.gnu.org/licenses/>. |
17 | */ |
18 | |
19 | #include "config.h" |
20 | |
21 | #include "gtlscertificate.h" |
22 | |
23 | #include <string.h> |
24 | #include "ginitable.h" |
25 | #include "gtlsbackend.h" |
26 | #include "gtlsconnection.h" |
27 | #include "glibintl.h" |
28 | |
29 | /** |
30 | * SECTION:gtlscertificate |
31 | * @title: GTlsCertificate |
32 | * @short_description: TLS certificate |
33 | * @include: gio/gio.h |
34 | * @see_also: #GTlsConnection |
35 | * |
36 | * A certificate used for TLS authentication and encryption. |
37 | * This can represent either a certificate only (eg, the certificate |
38 | * received by a client from a server), or the combination of |
39 | * a certificate and a private key (which is needed when acting as a |
40 | * #GTlsServerConnection). |
41 | * |
42 | * Since: 2.28 |
43 | */ |
44 | |
45 | /** |
46 | * GTlsCertificate: |
47 | * |
48 | * Abstract base class for TLS certificate types. |
49 | * |
50 | * Since: 2.28 |
51 | */ |
52 | |
53 | G_DEFINE_ABSTRACT_TYPE (GTlsCertificate, g_tls_certificate, G_TYPE_OBJECT) |
54 | |
55 | enum |
56 | { |
57 | PROP_0, |
58 | |
59 | PROP_CERTIFICATE, |
60 | PROP_CERTIFICATE_PEM, |
61 | PROP_PRIVATE_KEY, |
62 | PROP_PRIVATE_KEY_PEM, |
63 | PROP_ISSUER, |
64 | PROP_PKCS11_URI, |
65 | PROP_PRIVATE_KEY_PKCS11_URI, |
66 | }; |
67 | |
68 | static void |
69 | g_tls_certificate_init (GTlsCertificate *cert) |
70 | { |
71 | } |
72 | |
73 | static void |
74 | g_tls_certificate_get_property (GObject *object, |
75 | guint prop_id, |
76 | GValue *value, |
77 | GParamSpec *pspec) |
78 | { |
79 | switch (prop_id) |
80 | { |
81 | case PROP_PKCS11_URI: |
82 | case PROP_PRIVATE_KEY_PKCS11_URI: |
83 | /* Subclasses must override this property but this allows older backends to not fatally error */ |
84 | g_value_set_static_string (value, NULL); |
85 | break; |
86 | default: |
87 | G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); |
88 | } |
89 | } |
90 | |
91 | static void |
92 | g_tls_certificate_set_property (GObject *object, |
93 | guint prop_id, |
94 | const GValue *value, |
95 | GParamSpec *pspec) |
96 | { |
97 | switch (prop_id) |
98 | { |
99 | case PROP_PKCS11_URI: |
100 | case PROP_PRIVATE_KEY_PKCS11_URI: |
101 | /* Subclasses must override this property but this allows older backends to not fatally error */ |
102 | break; |
103 | default: |
104 | G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec); |
105 | } |
106 | } |
107 | |
108 | static void |
109 | g_tls_certificate_class_init (GTlsCertificateClass *class) |
110 | { |
111 | GObjectClass *gobject_class = G_OBJECT_CLASS (class); |
112 | |
113 | gobject_class->set_property = g_tls_certificate_set_property; |
114 | gobject_class->get_property = g_tls_certificate_get_property; |
115 | |
116 | /** |
117 | * GTlsCertificate:certificate: |
118 | * |
119 | * The DER (binary) encoded representation of the certificate. |
120 | * This property and the #GTlsCertificate:certificate-pem property |
121 | * represent the same data, just in different forms. |
122 | * |
123 | * Since: 2.28 |
124 | */ |
125 | g_object_class_install_property (oclass: gobject_class, property_id: PROP_CERTIFICATE, |
126 | pspec: g_param_spec_boxed (name: "certificate" , |
127 | P_("Certificate" ), |
128 | P_("The DER representation of the certificate" ), |
129 | G_TYPE_BYTE_ARRAY, |
130 | flags: G_PARAM_READWRITE | |
131 | G_PARAM_CONSTRUCT_ONLY | |
132 | G_PARAM_STATIC_STRINGS)); |
133 | /** |
134 | * GTlsCertificate:certificate-pem: |
135 | * |
136 | * The PEM (ASCII) encoded representation of the certificate. |
137 | * This property and the #GTlsCertificate:certificate |
138 | * property represent the same data, just in different forms. |
139 | * |
140 | * Since: 2.28 |
141 | */ |
142 | g_object_class_install_property (oclass: gobject_class, property_id: PROP_CERTIFICATE_PEM, |
143 | pspec: g_param_spec_string (name: "certificate-pem" , |
144 | P_("Certificate (PEM)" ), |
145 | P_("The PEM representation of the certificate" ), |
146 | NULL, |
147 | flags: G_PARAM_READWRITE | |
148 | G_PARAM_CONSTRUCT_ONLY | |
149 | G_PARAM_STATIC_STRINGS)); |
150 | /** |
151 | * GTlsCertificate:private-key: |
152 | * |
153 | * The DER (binary) encoded representation of the certificate's |
154 | * private key, in either PKCS#1 format or unencrypted PKCS#8 |
155 | * format. This property (or the #GTlsCertificate:private-key-pem |
156 | * property) can be set when constructing a key (eg, from a file), |
157 | * but cannot be read. |
158 | * |
159 | * PKCS#8 format is supported since 2.32; earlier releases only |
160 | * support PKCS#1. You can use the `openssl rsa` |
161 | * tool to convert PKCS#8 keys to PKCS#1. |
162 | * |
163 | * Since: 2.28 |
164 | */ |
165 | g_object_class_install_property (oclass: gobject_class, property_id: PROP_PRIVATE_KEY, |
166 | pspec: g_param_spec_boxed (name: "private-key" , |
167 | P_("Private key" ), |
168 | P_("The DER representation of the certificate’s private key" ), |
169 | G_TYPE_BYTE_ARRAY, |
170 | flags: G_PARAM_WRITABLE | |
171 | G_PARAM_CONSTRUCT_ONLY | |
172 | G_PARAM_STATIC_STRINGS)); |
173 | /** |
174 | * GTlsCertificate:private-key-pem: |
175 | * |
176 | * The PEM (ASCII) encoded representation of the certificate's |
177 | * private key in either PKCS#1 format ("`BEGIN RSA PRIVATE |
178 | * KEY`") or unencrypted PKCS#8 format ("`BEGIN |
179 | * PRIVATE KEY`"). This property (or the |
180 | * #GTlsCertificate:private-key property) can be set when |
181 | * constructing a key (eg, from a file), but cannot be read. |
182 | * |
183 | * PKCS#8 format is supported since 2.32; earlier releases only |
184 | * support PKCS#1. You can use the `openssl rsa` |
185 | * tool to convert PKCS#8 keys to PKCS#1. |
186 | * |
187 | * Since: 2.28 |
188 | */ |
189 | g_object_class_install_property (oclass: gobject_class, property_id: PROP_PRIVATE_KEY_PEM, |
190 | pspec: g_param_spec_string (name: "private-key-pem" , |
191 | P_("Private key (PEM)" ), |
192 | P_("The PEM representation of the certificate’s private key" ), |
193 | NULL, |
194 | flags: G_PARAM_WRITABLE | |
195 | G_PARAM_CONSTRUCT_ONLY | |
196 | G_PARAM_STATIC_STRINGS)); |
197 | /** |
198 | * GTlsCertificate:issuer: |
199 | * |
200 | * A #GTlsCertificate representing the entity that issued this |
201 | * certificate. If %NULL, this means that the certificate is either |
202 | * self-signed, or else the certificate of the issuer is not |
203 | * available. |
204 | * |
205 | * Since: 2.28 |
206 | */ |
207 | g_object_class_install_property (oclass: gobject_class, property_id: PROP_ISSUER, |
208 | pspec: g_param_spec_object (name: "issuer" , |
209 | P_("Issuer" ), |
210 | P_("The certificate for the issuing entity" ), |
211 | G_TYPE_TLS_CERTIFICATE, |
212 | flags: G_PARAM_READWRITE | |
213 | G_PARAM_CONSTRUCT_ONLY | |
214 | G_PARAM_STATIC_STRINGS)); |
215 | |
216 | /** |
217 | * GTlsCertificate:pkcs11-uri: (nullable) |
218 | * |
219 | * A URI referencing the PKCS \#11 objects containing an X.509 certificate |
220 | * and optionally a private key. |
221 | * |
222 | * If %NULL the certificate is either not backed by PKCS \#11 or the |
223 | * #GTlsBackend does not support PKCS \#11. |
224 | * |
225 | * Since: 2.68 |
226 | */ |
227 | g_object_class_install_property (oclass: gobject_class, property_id: PROP_PKCS11_URI, |
228 | pspec: g_param_spec_string (name: "pkcs11-uri" , |
229 | P_("PKCS #11 URI" ), |
230 | P_("The PKCS #11 URI" ), |
231 | NULL, |
232 | flags: G_PARAM_READWRITE | |
233 | G_PARAM_CONSTRUCT_ONLY | |
234 | G_PARAM_STATIC_STRINGS)); |
235 | |
236 | /** |
237 | * GTlsCertificate:private-key-pkcs11-uri: (nullable) |
238 | * |
239 | * A URI referencing a PKCS \#11 object containing a private key. |
240 | * |
241 | * Since: 2.68 |
242 | */ |
243 | g_object_class_install_property (oclass: gobject_class, property_id: PROP_PRIVATE_KEY_PKCS11_URI, |
244 | pspec: g_param_spec_string (name: "private-key-pkcs11-uri" , |
245 | P_("PKCS #11 URI" ), |
246 | P_("The PKCS #11 URI for a private key" ), |
247 | NULL, |
248 | flags: G_PARAM_READWRITE | |
249 | G_PARAM_CONSTRUCT_ONLY | |
250 | G_PARAM_STATIC_STRINGS)); |
251 | } |
252 | |
253 | static GTlsCertificate * |
254 | g_tls_certificate_new_internal (const gchar *certificate_pem, |
255 | const gchar *private_key_pem, |
256 | GTlsCertificate *issuer, |
257 | GError **error) |
258 | { |
259 | GObject *cert; |
260 | GTlsBackend *backend; |
261 | |
262 | backend = g_tls_backend_get_default (); |
263 | |
264 | cert = g_initable_new (object_type: g_tls_backend_get_certificate_type (backend), |
265 | NULL, error, |
266 | first_property_name: "certificate-pem" , certificate_pem, |
267 | "private-key-pem" , private_key_pem, |
268 | "issuer" , issuer, |
269 | NULL); |
270 | |
271 | return G_TLS_CERTIFICATE (cert); |
272 | } |
273 | |
274 | #define "-----BEGIN CERTIFICATE-----" |
275 | #define "-----END CERTIFICATE-----" |
276 | #define "-----BEGIN " |
277 | #define "PRIVATE KEY-----" |
278 | #define "-----END " |
279 | #define "PRIVATE KEY-----" |
280 | #define "-----BEGIN ENCRYPTED PRIVATE KEY-----" |
281 | |
282 | static gchar * |
283 | parse_private_key (const gchar *data, |
284 | gsize data_len, |
285 | gboolean required, |
286 | GError **error) |
287 | { |
288 | const gchar * = NULL, *, * = NULL, *; |
289 | const gchar *data_end = data + data_len; |
290 | |
291 | header_end = g_strstr_len (haystack: data, haystack_len: data_len, PEM_PRIVKEY_HEADER_END); |
292 | if (header_end) |
293 | header_start = g_strrstr_len (haystack: data, haystack_len: header_end - data, PEM_PRIVKEY_HEADER_BEGIN); |
294 | |
295 | if (!header_start) |
296 | { |
297 | if (required) |
298 | g_set_error_literal (err: error, G_TLS_ERROR, code: G_TLS_ERROR_BAD_CERTIFICATE, |
299 | _("No PEM-encoded private key found" )); |
300 | |
301 | return NULL; |
302 | } |
303 | |
304 | header_end += strlen (PEM_PRIVKEY_HEADER_END); |
305 | |
306 | if (strncmp (s1: header_start, PEM_PKCS8_ENCRYPTED_HEADER, n: header_end - header_start) == 0) |
307 | { |
308 | g_set_error_literal (err: error, G_TLS_ERROR, code: G_TLS_ERROR_BAD_CERTIFICATE, |
309 | _("Cannot decrypt PEM-encoded private key" )); |
310 | return NULL; |
311 | } |
312 | |
313 | footer_end = g_strstr_len (haystack: header_end, haystack_len: data_len - (header_end - data), PEM_PRIVKEY_FOOTER_END); |
314 | if (footer_end) |
315 | footer_start = g_strrstr_len (haystack: header_end, haystack_len: footer_end - header_end, PEM_PRIVKEY_FOOTER_BEGIN); |
316 | |
317 | if (!footer_start) |
318 | { |
319 | g_set_error_literal (err: error, G_TLS_ERROR, code: G_TLS_ERROR_BAD_CERTIFICATE, |
320 | _("Could not parse PEM-encoded private key" )); |
321 | return NULL; |
322 | } |
323 | |
324 | footer_end += strlen (PEM_PRIVKEY_FOOTER_END); |
325 | |
326 | while ((footer_end < data_end) && (*footer_end == '\r' || *footer_end == '\n')) |
327 | footer_end++; |
328 | |
329 | return g_strndup (str: header_start, n: footer_end - header_start); |
330 | } |
331 | |
332 | |
333 | static gchar * |
334 | parse_next_pem_certificate (const gchar **data, |
335 | const gchar *data_end, |
336 | gboolean required, |
337 | GError **error) |
338 | { |
339 | const gchar *start, *end; |
340 | |
341 | start = g_strstr_len (haystack: *data, haystack_len: data_end - *data, PEM_CERTIFICATE_HEADER); |
342 | if (!start) |
343 | { |
344 | if (required) |
345 | { |
346 | g_set_error_literal (err: error, G_TLS_ERROR, code: G_TLS_ERROR_BAD_CERTIFICATE, |
347 | _("No PEM-encoded certificate found" )); |
348 | } |
349 | return NULL; |
350 | } |
351 | |
352 | end = g_strstr_len (haystack: start, haystack_len: data_end - start, PEM_CERTIFICATE_FOOTER); |
353 | if (!end) |
354 | { |
355 | g_set_error_literal (err: error, G_TLS_ERROR, code: G_TLS_ERROR_BAD_CERTIFICATE, |
356 | _("Could not parse PEM-encoded certificate" )); |
357 | return NULL; |
358 | } |
359 | end += strlen (PEM_CERTIFICATE_FOOTER); |
360 | while ((end < data_end) && (*end == '\r' || *end == '\n')) |
361 | end++; |
362 | |
363 | *data = end; |
364 | |
365 | return g_strndup (str: start, n: end - start); |
366 | } |
367 | |
368 | static GSList * |
369 | parse_and_create_certificate_list (const gchar *data, |
370 | gsize data_len, |
371 | GError **error) |
372 | { |
373 | GSList *first_pem_list = NULL, *pem_list = NULL; |
374 | gchar *first_pem; |
375 | const gchar *p, *end; |
376 | |
377 | p = data; |
378 | end = p + data_len; |
379 | |
380 | /* Make sure we can load, at least, one certificate. */ |
381 | first_pem = parse_next_pem_certificate (data: &p, data_end: end, TRUE, error); |
382 | if (!first_pem) |
383 | return NULL; |
384 | |
385 | /* Create a list with a single element. If we load more certificates |
386 | * below, we will concatenate the two lists at the end. */ |
387 | first_pem_list = g_slist_prepend (list: first_pem_list, data: first_pem); |
388 | |
389 | /* If we read one certificate successfully, let's see if we can read |
390 | * some more. If not, we will simply return a list with the first one. |
391 | */ |
392 | while (p < end && p && *p) |
393 | { |
394 | gchar *cert_pem; |
395 | GError *error = NULL; |
396 | |
397 | cert_pem = parse_next_pem_certificate (data: &p, data_end: end, FALSE, error: &error); |
398 | if (error) |
399 | { |
400 | g_slist_free_full (list: pem_list, free_func: g_free); |
401 | g_error_free (error); |
402 | return first_pem_list; |
403 | } |
404 | else if (!cert_pem) |
405 | { |
406 | break; |
407 | } |
408 | |
409 | pem_list = g_slist_prepend (list: pem_list, data: cert_pem); |
410 | } |
411 | |
412 | pem_list = g_slist_concat (list1: pem_list, list2: first_pem_list); |
413 | |
414 | return pem_list; |
415 | } |
416 | |
417 | static GTlsCertificate * |
418 | create_certificate_chain_from_list (GSList *pem_list, |
419 | const gchar *key_pem) |
420 | { |
421 | GTlsCertificate *cert = NULL, *issuer = NULL, *root = NULL; |
422 | GTlsCertificateFlags flags; |
423 | GSList *pem; |
424 | |
425 | pem = pem_list; |
426 | while (pem) |
427 | { |
428 | const gchar *key = NULL; |
429 | |
430 | /* Private key belongs only to the first certificate. */ |
431 | if (!pem->next) |
432 | key = key_pem; |
433 | |
434 | /* We assume that the whole file is a certificate chain, so we use |
435 | * each certificate as the issuer of the next one (list is in |
436 | * reverse order). |
437 | */ |
438 | issuer = cert; |
439 | cert = g_tls_certificate_new_internal (certificate_pem: pem->data, private_key_pem: key, issuer, NULL); |
440 | if (issuer) |
441 | g_object_unref (object: issuer); |
442 | |
443 | if (!cert) |
444 | return NULL; |
445 | |
446 | /* root will point to the last certificate in the file. */ |
447 | if (!root) |
448 | root = cert; |
449 | |
450 | pem = g_slist_next (pem); |
451 | } |
452 | |
453 | /* Verify that the certificates form a chain. (We don't care at this |
454 | * point if there are other problems with it.) |
455 | */ |
456 | flags = g_tls_certificate_verify (cert, NULL, trusted_ca: root); |
457 | if (flags & G_TLS_CERTIFICATE_UNKNOWN_CA) |
458 | { |
459 | /* It wasn't a chain, it's just a bunch of unrelated certs. */ |
460 | g_clear_object (&cert); |
461 | } |
462 | |
463 | return cert; |
464 | } |
465 | |
466 | static GTlsCertificate * |
467 | parse_and_create_certificate (const gchar *data, |
468 | gsize data_len, |
469 | const gchar *key_pem, |
470 | GError **error) |
471 | |
472 | { |
473 | GSList *pem_list; |
474 | GTlsCertificate *cert; |
475 | |
476 | pem_list = parse_and_create_certificate_list (data, data_len, error); |
477 | if (!pem_list) |
478 | return NULL; |
479 | |
480 | /* We don't pass the error here because, if it fails, we still want to |
481 | * load and return the first certificate. |
482 | */ |
483 | cert = create_certificate_chain_from_list (pem_list, key_pem); |
484 | if (!cert) |
485 | { |
486 | GSList *last = NULL; |
487 | |
488 | /* Get the first certificate (which is the last one as the list is |
489 | * in reverse order). |
490 | */ |
491 | last = g_slist_last (list: pem_list); |
492 | |
493 | cert = g_tls_certificate_new_internal (certificate_pem: last->data, private_key_pem: key_pem, NULL, error); |
494 | } |
495 | |
496 | g_slist_free_full (list: pem_list, free_func: g_free); |
497 | |
498 | return cert; |
499 | } |
500 | |
501 | /** |
502 | * g_tls_certificate_new_from_pem: |
503 | * @data: PEM-encoded certificate data |
504 | * @length: the length of @data, or -1 if it's 0-terminated. |
505 | * @error: #GError for error reporting, or %NULL to ignore. |
506 | * |
507 | * Creates a #GTlsCertificate from the PEM-encoded data in @data. If |
508 | * @data includes both a certificate and a private key, then the |
509 | * returned certificate will include the private key data as well. (See |
510 | * the #GTlsCertificate:private-key-pem property for information about |
511 | * supported formats.) |
512 | * |
513 | * The returned certificate will be the first certificate found in |
514 | * @data. As of GLib 2.44, if @data contains more certificates it will |
515 | * try to load a certificate chain. All certificates will be verified in |
516 | * the order found (top-level certificate should be the last one in the |
517 | * file) and the #GTlsCertificate:issuer property of each certificate |
518 | * will be set accordingly if the verification succeeds. If any |
519 | * certificate in the chain cannot be verified, the first certificate in |
520 | * the file will still be returned. |
521 | * |
522 | * Returns: the new certificate, or %NULL if @data is invalid |
523 | * |
524 | * Since: 2.28 |
525 | */ |
526 | GTlsCertificate * |
527 | g_tls_certificate_new_from_pem (const gchar *data, |
528 | gssize length, |
529 | GError **error) |
530 | { |
531 | GError *child_error = NULL; |
532 | gchar *key_pem; |
533 | GTlsCertificate *cert; |
534 | |
535 | g_return_val_if_fail (data != NULL, NULL); |
536 | g_return_val_if_fail (error == NULL || *error == NULL, NULL); |
537 | |
538 | if (length == -1) |
539 | length = strlen (s: data); |
540 | |
541 | key_pem = parse_private_key (data, data_len: length, FALSE, error: &child_error); |
542 | if (child_error != NULL) |
543 | { |
544 | g_propagate_error (dest: error, src: child_error); |
545 | return NULL; |
546 | } |
547 | |
548 | cert = parse_and_create_certificate (data, data_len: length, key_pem, error); |
549 | g_free (mem: key_pem); |
550 | |
551 | return cert; |
552 | } |
553 | |
554 | /** |
555 | * g_tls_certificate_new_from_file: |
556 | * @file: (type filename): file containing a PEM-encoded certificate to import |
557 | * @error: #GError for error reporting, or %NULL to ignore. |
558 | * |
559 | * Creates a #GTlsCertificate from the PEM-encoded data in @file. The |
560 | * returned certificate will be the first certificate found in @file. As |
561 | * of GLib 2.44, if @file contains more certificates it will try to load |
562 | * a certificate chain. All certificates will be verified in the order |
563 | * found (top-level certificate should be the last one in the file) and |
564 | * the #GTlsCertificate:issuer property of each certificate will be set |
565 | * accordingly if the verification succeeds. If any certificate in the |
566 | * chain cannot be verified, the first certificate in the file will |
567 | * still be returned. |
568 | * |
569 | * If @file cannot be read or parsed, the function will return %NULL and |
570 | * set @error. Otherwise, this behaves like |
571 | * g_tls_certificate_new_from_pem(). |
572 | * |
573 | * Returns: the new certificate, or %NULL on error |
574 | * |
575 | * Since: 2.28 |
576 | */ |
577 | GTlsCertificate * |
578 | g_tls_certificate_new_from_file (const gchar *file, |
579 | GError **error) |
580 | { |
581 | GTlsCertificate *cert; |
582 | gchar *contents; |
583 | gsize length; |
584 | |
585 | if (!g_file_get_contents (filename: file, contents: &contents, length: &length, error)) |
586 | return NULL; |
587 | |
588 | cert = g_tls_certificate_new_from_pem (data: contents, length, error); |
589 | g_free (mem: contents); |
590 | return cert; |
591 | } |
592 | |
593 | /** |
594 | * g_tls_certificate_new_from_files: |
595 | * @cert_file: (type filename): file containing one or more PEM-encoded |
596 | * certificates to import |
597 | * @key_file: (type filename): file containing a PEM-encoded private key |
598 | * to import |
599 | * @error: #GError for error reporting, or %NULL to ignore. |
600 | * |
601 | * Creates a #GTlsCertificate from the PEM-encoded data in @cert_file |
602 | * and @key_file. The returned certificate will be the first certificate |
603 | * found in @cert_file. As of GLib 2.44, if @cert_file contains more |
604 | * certificates it will try to load a certificate chain. All |
605 | * certificates will be verified in the order found (top-level |
606 | * certificate should be the last one in the file) and the |
607 | * #GTlsCertificate:issuer property of each certificate will be set |
608 | * accordingly if the verification succeeds. If any certificate in the |
609 | * chain cannot be verified, the first certificate in the file will |
610 | * still be returned. |
611 | * |
612 | * If either file cannot be read or parsed, the function will return |
613 | * %NULL and set @error. Otherwise, this behaves like |
614 | * g_tls_certificate_new_from_pem(). |
615 | * |
616 | * Returns: the new certificate, or %NULL on error |
617 | * |
618 | * Since: 2.28 |
619 | */ |
620 | GTlsCertificate * |
621 | g_tls_certificate_new_from_files (const gchar *cert_file, |
622 | const gchar *key_file, |
623 | GError **error) |
624 | { |
625 | GTlsCertificate *cert; |
626 | gchar *cert_data, *key_data; |
627 | gsize cert_len, key_len; |
628 | gchar *key_pem; |
629 | |
630 | if (!g_file_get_contents (filename: key_file, contents: &key_data, length: &key_len, error)) |
631 | return NULL; |
632 | |
633 | key_pem = parse_private_key (data: key_data, data_len: key_len, TRUE, error); |
634 | g_free (mem: key_data); |
635 | if (!key_pem) |
636 | return NULL; |
637 | |
638 | if (!g_file_get_contents (filename: cert_file, contents: &cert_data, length: &cert_len, error)) |
639 | { |
640 | g_free (mem: key_pem); |
641 | return NULL; |
642 | } |
643 | |
644 | cert = parse_and_create_certificate (data: cert_data, data_len: cert_len, key_pem, error); |
645 | g_free (mem: cert_data); |
646 | g_free (mem: key_pem); |
647 | return cert; |
648 | } |
649 | |
650 | /** |
651 | * g_tls_certificate_new_from_pkcs11_uris: |
652 | * @pkcs11_uri: A PKCS \#11 URI |
653 | * @private_key_pkcs11_uri: (nullable): A PKCS \#11 URI |
654 | * @error: #GError for error reporting, or %NULL to ignore. |
655 | * |
656 | * Creates a #GTlsCertificate from a PKCS \#11 URI. |
657 | * |
658 | * An example @pkcs11_uri would be `pkcs11:model=Model;manufacturer=Manufacture;serial=1;token=My%20Client%20Certificate;id=%01` |
659 | * |
660 | * Where the token’s layout is: |
661 | * |
662 | * ``` |
663 | * Object 0: |
664 | * URL: pkcs11:model=Model;manufacturer=Manufacture;serial=1;token=My%20Client%20Certificate;id=%01;object=private%20key;type=private |
665 | * Type: Private key (RSA-2048) |
666 | * ID: 01 |
667 | * |
668 | * Object 1: |
669 | * URL: pkcs11:model=Model;manufacturer=Manufacture;serial=1;token=My%20Client%20Certificate;id=%01;object=Certificate%20for%20Authentication;type=cert |
670 | * Type: X.509 Certificate (RSA-2048) |
671 | * ID: 01 |
672 | * ``` |
673 | * |
674 | * In this case the certificate and private key would both be detected and used as expected. |
675 | * @pkcs_uri may also just reference an X.509 certificate object and then optionally |
676 | * @private_key_pkcs11_uri allows using a private key exposed under a different URI. |
677 | * |
678 | * Note that the private key is not accessed until usage and may fail or require a PIN later. |
679 | * |
680 | * Returns: (transfer full): the new certificate, or %NULL on error |
681 | * |
682 | * Since: 2.68 |
683 | */ |
684 | GTlsCertificate * |
685 | g_tls_certificate_new_from_pkcs11_uris (const gchar *pkcs11_uri, |
686 | const gchar *private_key_pkcs11_uri, |
687 | GError **error) |
688 | { |
689 | GObject *cert; |
690 | GTlsBackend *backend; |
691 | |
692 | g_return_val_if_fail (error == NULL || *error == NULL, NULL); |
693 | g_return_val_if_fail (pkcs11_uri, NULL); |
694 | |
695 | backend = g_tls_backend_get_default (); |
696 | |
697 | cert = g_initable_new (object_type: g_tls_backend_get_certificate_type (backend), |
698 | NULL, error, |
699 | first_property_name: "pkcs11-uri" , pkcs11_uri, |
700 | "private-key-pkcs11-uri" , private_key_pkcs11_uri, |
701 | NULL); |
702 | |
703 | if (cert != NULL) |
704 | { |
705 | gchar *objects_uri; |
706 | |
707 | /* Old implementations might not override this property */ |
708 | g_object_get (object: cert, first_property_name: "pkcs11-uri" , &objects_uri, NULL); |
709 | if (objects_uri == NULL) |
710 | { |
711 | g_set_error_literal (err: error, G_IO_ERROR, code: G_IO_ERROR_NOT_SUPPORTED, _("This GTlsBackend does not support creating PKCS #11 certificates" )); |
712 | g_object_unref (object: cert); |
713 | return NULL; |
714 | } |
715 | g_free (mem: objects_uri); |
716 | } |
717 | |
718 | return G_TLS_CERTIFICATE (cert); |
719 | } |
720 | |
721 | /** |
722 | * g_tls_certificate_list_new_from_file: |
723 | * @file: (type filename): file containing PEM-encoded certificates to import |
724 | * @error: #GError for error reporting, or %NULL to ignore. |
725 | * |
726 | * Creates one or more #GTlsCertificates from the PEM-encoded |
727 | * data in @file. If @file cannot be read or parsed, the function will |
728 | * return %NULL and set @error. If @file does not contain any |
729 | * PEM-encoded certificates, this will return an empty list and not |
730 | * set @error. |
731 | * |
732 | * Returns: (element-type Gio.TlsCertificate) (transfer full): a |
733 | * #GList containing #GTlsCertificate objects. You must free the list |
734 | * and its contents when you are done with it. |
735 | * |
736 | * Since: 2.28 |
737 | */ |
738 | GList * |
739 | g_tls_certificate_list_new_from_file (const gchar *file, |
740 | GError **error) |
741 | { |
742 | GQueue queue = G_QUEUE_INIT; |
743 | gchar *contents, *end; |
744 | const gchar *p; |
745 | gsize length; |
746 | |
747 | if (!g_file_get_contents (filename: file, contents: &contents, length: &length, error)) |
748 | return NULL; |
749 | |
750 | end = contents + length; |
751 | p = contents; |
752 | while (p && *p) |
753 | { |
754 | gchar *cert_pem; |
755 | GTlsCertificate *cert = NULL; |
756 | GError *parse_error = NULL; |
757 | |
758 | cert_pem = parse_next_pem_certificate (data: &p, data_end: end, FALSE, error: &parse_error); |
759 | if (cert_pem) |
760 | { |
761 | cert = g_tls_certificate_new_internal (certificate_pem: cert_pem, NULL, NULL, error: &parse_error); |
762 | g_free (mem: cert_pem); |
763 | } |
764 | if (!cert) |
765 | { |
766 | if (parse_error) |
767 | { |
768 | g_propagate_error (dest: error, src: parse_error); |
769 | g_list_free_full (list: queue.head, free_func: g_object_unref); |
770 | queue.head = NULL; |
771 | } |
772 | break; |
773 | } |
774 | g_queue_push_tail (queue: &queue, data: cert); |
775 | } |
776 | |
777 | g_free (mem: contents); |
778 | return queue.head; |
779 | } |
780 | |
781 | |
782 | /** |
783 | * g_tls_certificate_get_issuer: |
784 | * @cert: a #GTlsCertificate |
785 | * |
786 | * Gets the #GTlsCertificate representing @cert's issuer, if known |
787 | * |
788 | * Returns: (nullable) (transfer none): The certificate of @cert's issuer, |
789 | * or %NULL if @cert is self-signed or signed with an unknown |
790 | * certificate. |
791 | * |
792 | * Since: 2.28 |
793 | */ |
794 | GTlsCertificate * |
795 | g_tls_certificate_get_issuer (GTlsCertificate *cert) |
796 | { |
797 | GTlsCertificate *issuer; |
798 | |
799 | g_object_get (G_OBJECT (cert), first_property_name: "issuer" , &issuer, NULL); |
800 | if (issuer) |
801 | g_object_unref (object: issuer); |
802 | |
803 | return issuer; |
804 | } |
805 | |
806 | /** |
807 | * g_tls_certificate_verify: |
808 | * @cert: a #GTlsCertificate |
809 | * @identity: (nullable): the expected peer identity |
810 | * @trusted_ca: (nullable): the certificate of a trusted authority |
811 | * |
812 | * This verifies @cert and returns a set of #GTlsCertificateFlags |
813 | * indicating any problems found with it. This can be used to verify a |
814 | * certificate outside the context of making a connection, or to |
815 | * check a certificate against a CA that is not part of the system |
816 | * CA database. |
817 | * |
818 | * If @identity is not %NULL, @cert's name(s) will be compared against |
819 | * it, and %G_TLS_CERTIFICATE_BAD_IDENTITY will be set in the return |
820 | * value if it does not match. If @identity is %NULL, that bit will |
821 | * never be set in the return value. |
822 | * |
823 | * If @trusted_ca is not %NULL, then @cert (or one of the certificates |
824 | * in its chain) must be signed by it, or else |
825 | * %G_TLS_CERTIFICATE_UNKNOWN_CA will be set in the return value. If |
826 | * @trusted_ca is %NULL, that bit will never be set in the return |
827 | * value. |
828 | * |
829 | * (All other #GTlsCertificateFlags values will always be set or unset |
830 | * as appropriate.) |
831 | * |
832 | * Returns: the appropriate #GTlsCertificateFlags |
833 | * |
834 | * Since: 2.28 |
835 | */ |
836 | GTlsCertificateFlags |
837 | g_tls_certificate_verify (GTlsCertificate *cert, |
838 | GSocketConnectable *identity, |
839 | GTlsCertificate *trusted_ca) |
840 | { |
841 | return G_TLS_CERTIFICATE_GET_CLASS (cert)->verify (cert, identity, trusted_ca); |
842 | } |
843 | |
844 | /** |
845 | * g_tls_certificate_is_same: |
846 | * @cert_one: first certificate to compare |
847 | * @cert_two: second certificate to compare |
848 | * |
849 | * Check if two #GTlsCertificate objects represent the same certificate. |
850 | * The raw DER byte data of the two certificates are checked for equality. |
851 | * This has the effect that two certificates may compare equal even if |
852 | * their #GTlsCertificate:issuer, #GTlsCertificate:private-key, or |
853 | * #GTlsCertificate:private-key-pem properties differ. |
854 | * |
855 | * Returns: whether the same or not |
856 | * |
857 | * Since: 2.34 |
858 | */ |
859 | gboolean |
860 | g_tls_certificate_is_same (GTlsCertificate *cert_one, |
861 | GTlsCertificate *cert_two) |
862 | { |
863 | GByteArray *b1, *b2; |
864 | gboolean equal; |
865 | |
866 | g_return_val_if_fail (G_IS_TLS_CERTIFICATE (cert_one), FALSE); |
867 | g_return_val_if_fail (G_IS_TLS_CERTIFICATE (cert_two), FALSE); |
868 | |
869 | g_object_get (object: cert_one, first_property_name: "certificate" , &b1, NULL); |
870 | g_object_get (object: cert_two, first_property_name: "certificate" , &b2, NULL); |
871 | |
872 | equal = (b1->len == b2->len && |
873 | memcmp (s1: b1->data, s2: b2->data, n: b1->len) == 0); |
874 | |
875 | g_byte_array_unref (array: b1); |
876 | g_byte_array_unref (array: b2); |
877 | |
878 | return equal; |
879 | } |
880 | |