enum {
PROP_TLS_CERTIFICATE = 1,
PROP_HOSTNAME,
+ PROP_REFERENCE_IDENTITIES,
LAST_PROPERTY,
};
typedef struct {
EmpathyTLSCertificate *certificate;
gchar *hostname;
+ gchar **reference_identities;
GSimpleAsyncResult *verify_result;
GHashTable *details;
static void
build_certificate_list_for_gnutls (GcrCertificateChain *chain,
- gnutls_x509_crt_t **list, guint *n_list,
- gnutls_x509_crt_t **anchors, guint *n_anchors)
+ gnutls_x509_crt_t **list,
+ guint *n_list,
+ gnutls_x509_crt_t **anchors,
+ guint *n_anchors)
{
GcrCertificate *cert;
guint idx, length;
*n_list = length;
/* See if we have an anchor */
- if (gcr_certificate_chain_get_chain_type (chain) ==
+ if (gcr_certificate_chain_get_status (chain) ==
GCR_CERTIFICATE_CHAIN_ANCHORED)
{
cert = gcr_certificate_chain_get_anchor (chain);
}
static void
-free_certificate_list_for_gnutls (gnutls_x509_crt_t *list, guint n_list)
+free_certificate_list_for_gnutls (gnutls_x509_crt_t *list,
+ guint n_list)
{
guint idx;
}
static void
-perform_verification (EmpathyTLSVerifier *self, GcrCertificateChain *chain)
+debug_certificate (GcrCertificate *cert)
+{
+ gchar *subject = gcr_certificate_get_subject_dn (cert);
+ DEBUG ("Certificate: %s", subject);
+ g_free (subject);
+}
+
+static void
+debug_certificate_chain (GcrCertificateChain *chain)
+{
+ GEnumClass *enum_class;
+ GEnumValue *enum_value;
+ gint idx, length;
+ GcrCertificate *cert;
+
+ enum_class = G_ENUM_CLASS
+ (g_type_class_peek (GCR_TYPE_CERTIFICATE_CHAIN_STATUS));
+ enum_value = g_enum_get_value (enum_class,
+ gcr_certificate_chain_get_status (chain));
+ length = gcr_certificate_chain_get_length (chain);
+ DEBUG ("Certificate chain: length %u status %s",
+ length, enum_value ? enum_value->value_nick : "XXX");
+
+ for (idx = 0; idx < length; ++idx)
+ {
+ cert = gcr_certificate_chain_get_certificate (chain, idx);
+ debug_certificate (cert);
+ }
+}
+
+static void
+perform_verification (EmpathyTLSVerifier *self,
+ GcrCertificateChain *chain)
{
gboolean ret = FALSE;
EmpTLSCertificateRejectReason reason =
guint n_list, n_anchors;
guint verify_output;
gint res;
+ gint i;
+ gboolean matched = FALSE;
EmpathyTLSVerifierPriv *priv = GET_PRIV (self);
DEBUG ("Performing verification");
+ debug_certificate_chain (chain);
+
+ list = anchors = NULL;
+ n_list = n_anchors = 0;
/*
* If the first certificate is an pinned certificate then we completely
* ignore the rest of the verification process.
*/
- if (gcr_certificate_chain_get_chain_type (chain) == GCR_CERTIFICATE_CHAIN_PINNED)
+ if (gcr_certificate_chain_get_status (chain) == GCR_CERTIFICATE_CHAIN_PINNED)
{
DEBUG ("Found pinned certificate for %s", priv->hostname);
complete_verification (self);
goto out;
}
- /* now check if the certificate matches the hostname. */
- if (gnutls_x509_crt_check_hostname (list[0], priv->hostname) == 0)
+ /* now check if the certificate matches one of the reference identities. */
+ if (priv->reference_identities != NULL)
+ {
+ for (i = 0, matched = FALSE; priv->reference_identities[i] != NULL; ++i)
+ {
+ if (gnutls_x509_crt_check_hostname (list[0],
+ priv->reference_identities[i]) == 1)
+ {
+ matched = TRUE;
+ break;
+ }
+ }
+ }
+
+ if (!matched)
{
gchar *certified_hostname;
}
static void
-perform_verification_cb (GObject *object, GAsyncResult *res, gpointer user_data)
+perform_verification_cb (GObject *object,
+ GAsyncResult *res,
+ gpointer user_data)
{
GError *error = NULL;
case PROP_HOSTNAME:
g_value_set_string (value, priv->hostname);
break;
+ case PROP_REFERENCE_IDENTITIES:
+ g_value_set_boxed (value, priv->reference_identities);
+ break;
default:
G_OBJECT_WARN_INVALID_PROPERTY_ID (object, property_id, pspec);
break;
case PROP_HOSTNAME:
priv->hostname = g_value_dup_string (value);
break;
+ case PROP_REFERENCE_IDENTITIES:
+ priv->reference_identities = g_value_dup_boxed (value);
+ break;
default:
G_OBJECT_WARN_INVALID_PROPERTY_ID (object, property_id, pspec);
break;
tp_clear_boxed (G_TYPE_HASH_TABLE, &priv->details);
g_free (priv->hostname);
+ g_strfreev (priv->reference_identities);
G_OBJECT_CLASS (empathy_tls_verifier_parent_class)->finalize (object);
}
g_object_class_install_property (oclass, PROP_TLS_CERTIFICATE, pspec);
pspec = g_param_spec_string ("hostname", "The hostname",
- "The hostname which should be certified by the certificate.",
+ "The hostname which is certified by the certificate.",
NULL,
G_PARAM_CONSTRUCT_ONLY | G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
g_object_class_install_property (oclass, PROP_HOSTNAME, pspec);
+
+ pspec = g_param_spec_boxed ("reference-identities",
+ "The reference identities",
+ "The certificate should certify one of these identities.",
+ G_TYPE_STRV,
+ G_PARAM_CONSTRUCT_ONLY | G_PARAM_READWRITE | G_PARAM_STATIC_STRINGS);
+ g_object_class_install_property (oclass, PROP_REFERENCE_IDENTITIES, pspec);
}
EmpathyTLSVerifier *
empathy_tls_verifier_new (EmpathyTLSCertificate *certificate,
- const gchar *hostname)
+ const gchar *hostname, const gchar **reference_identities)
{
g_assert (EMPATHY_IS_TLS_CERTIFICATE (certificate));
g_assert (hostname != NULL);
+ g_assert (reference_identities != NULL);
return g_object_new (EMPATHY_TYPE_TLS_VERIFIER,
"certificate", certificate,
"hostname", hostname,
+ "reference-identities", reference_identities,
NULL);
}
{
GcrCertificateChain *chain;
GcrCertificate *cert;
- GPtrArray *certs = NULL;
- GArray *cert_data;
+ GPtrArray *cert_data = NULL;
+ GArray *data;
guint idx;
EmpathyTLSVerifierPriv *priv = GET_PRIV (self);
g_return_if_fail (priv->verify_result == NULL);
- g_object_get (priv->certificate, "cert-data", &certs, NULL);
- g_return_if_fail (certs);
+ g_object_get (priv->certificate, "cert-data", &cert_data, NULL);
+ g_return_if_fail (cert_data);
priv->verify_result = g_simple_async_result_new (G_OBJECT (self),
callback, user_data, NULL);
/* Create a certificate chain */
chain = gcr_certificate_chain_new ();
- for (idx = 0; idx < certs->len; ++idx) {
- cert_data = g_ptr_array_index (certs, idx);
- cert = gcr_simple_certificate_new_static (cert_data->data, cert_data->len);
+ for (idx = 0; idx < cert_data->len; ++idx) {
+ data = g_ptr_array_index (cert_data, idx);
+ cert = gcr_simple_certificate_new ((guchar *) data->data, data->len);
gcr_certificate_chain_add (chain, cert);
g_object_unref (cert);
}
NULL, perform_verification_cb, g_object_ref (self));
g_object_unref (chain);
- g_ptr_array_unref (certs);
+ g_boxed_free (TP_ARRAY_TYPE_UCHAR_ARRAY_LIST, cert_data);
}
gboolean
void
empathy_tls_verifier_store_exception (EmpathyTLSVerifier *self)
{
- GArray *last_cert;
+ GArray *data;
GcrCertificate *cert;
- GPtrArray *certs;
+ GPtrArray *cert_data = NULL;
GError *error = NULL;
EmpathyTLSVerifierPriv *priv = GET_PRIV (self);
- g_object_get (priv->certificate, "cert-data", &certs, NULL);
- last_cert = g_ptr_array_index (certs, certs->len - 1);
- cert = gcr_simple_certificate_new_static ((gpointer)last_cert->data,
- last_cert->len);
+ g_object_get (priv->certificate, "cert-data", &cert_data, NULL);
+ g_return_if_fail (cert_data);
+
+ if (!cert_data->len)
+ {
+ DEBUG ("No certificate to pin.");
+ return;
+ }
+
+ /* The first certificate in the chain is for the host */
+ data = g_ptr_array_index (cert_data, 0);
+ cert = gcr_simple_certificate_new ((gpointer)data->data, data->len);
+
+ DEBUG ("Storing pinned certificate:");
+ debug_certificate (cert);
if (!gcr_trust_add_pinned_certificate (cert, GCR_PURPOSE_CLIENT_AUTH,
priv->hostname, NULL, &error))
- DEBUG ("Can't store the certificate exeption: %s", error->message);
+ DEBUG ("Can't store the pinned certificate: %s", error->message);
g_object_unref (cert);
+ g_boxed_free (TP_ARRAY_TYPE_UCHAR_ARRAY_LIST, cert_data);
}
projects / empathy.git / blobdiff