1 /* GIO - GLib Input, Output and Certificateing Library
3 * Copyright (C) 2010 Red Hat, Inc.
5 * This library is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU Lesser General Public
7 * License as published by the Free Software Foundation; either
8 * version 2 of the License, or (at your option) any later version.
10 * This library is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 * Lesser General Public License for more details.
15 * You should have received a copy of the GNU Lesser General
16 * Public License along with this library; if not, write to the
17 * Free Software Foundation, Inc., 59 Temple Place, Suite 330,
18 * Boston, MA 02111-1307, USA.
23 #include "gtlscertificate.h"
26 #include "ginitable.h"
27 #include "gtlsbackend.h"
28 #include "gtlsconnection.h"
32 * SECTION:gtlscertificate
33 * @title: GTlsCertificate
34 * @short_description: TLS certificate
36 * @see_also: #GTlsConnection
38 * A certificate used for TLS authentication and encryption.
39 * This can represent either a certificate only (eg, the certificate
40 * received by a client from a server), or the combination of
41 * a certificate and a private key (which is needed when acting as a
42 * #GTlsServerConnection).
50 * Abstract base class for TLS certificate types.
55 G_DEFINE_ABSTRACT_TYPE (GTlsCertificate, g_tls_certificate, G_TYPE_OBJECT);
69 g_tls_certificate_init (GTlsCertificate *cert)
74 g_tls_certificate_get_property (GObject *object,
79 G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
83 g_tls_certificate_set_property (GObject *object,
88 G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
92 g_tls_certificate_class_init (GTlsCertificateClass *class)
94 GObjectClass *gobject_class = G_OBJECT_CLASS (class);
96 gobject_class->set_property = g_tls_certificate_set_property;
97 gobject_class->get_property = g_tls_certificate_get_property;
100 * GTlsCertificate:certificate:
102 * The DER (binary) encoded representation of the certificate.
103 * This property and the #GTlsCertificate:certificate-pem property
104 * represent the same data, just in different forms.
108 g_object_class_install_property (gobject_class, PROP_CERTIFICATE,
109 g_param_spec_boxed ("certificate",
111 P_("The DER representation of the certificate"),
114 G_PARAM_CONSTRUCT_ONLY |
115 G_PARAM_STATIC_STRINGS));
117 * GTlsCertificate:certificate-pem:
119 * The PEM (ASCII) encoded representation of the certificate.
120 * This property and the #GTlsCertificate:certificate
121 * property represent the same data, just in different forms.
125 g_object_class_install_property (gobject_class, PROP_CERTIFICATE_PEM,
126 g_param_spec_string ("certificate-pem",
127 P_("Certificate (PEM)"),
128 P_("The PEM representation of the certificate"),
131 G_PARAM_CONSTRUCT_ONLY |
132 G_PARAM_STATIC_STRINGS));
134 * GTlsCertificate:private-key:
136 * The DER (binary) encoded representation of the certificate's
137 * private key, in either PKCS#1 format or unencrypted PKCS#8
138 * format. This property (or the #GTlsCertificate:private-key-pem
139 * property) can be set when constructing a key (eg, from a file),
140 * but cannot be read.
142 * PKCS#8 format is supported since 2.32; earlier releases only
143 * support PKCS#1. You can use the <literal>openssl rsa</literal>
144 * tool to convert PKCS#8 keys to PKCS#1.
148 g_object_class_install_property (gobject_class, PROP_PRIVATE_KEY,
149 g_param_spec_boxed ("private-key",
151 P_("The DER representation of the certificate's private key"),
154 G_PARAM_CONSTRUCT_ONLY |
155 G_PARAM_STATIC_STRINGS));
157 * GTlsCertificate:private-key-pem:
159 * The PEM (ASCII) encoded representation of the certificate's
160 * private key in either PKCS#1 format ("<literal>BEGIN RSA PRIVATE
161 * KEY</literal>") or unencrypted PKCS#8 format ("<literal>BEGIN
162 * PRIVATE KEY</literal>"). This property (or the
163 * #GTlsCertificate:private-key property) can be set when
164 * constructing a key (eg, from a file), but cannot be read.
166 * PKCS#8 format is supported since 2.32; earlier releases only
167 * support PKCS#1. You can use the <literal>openssl rsa</literal>
168 * tool to convert PKCS#8 keys to PKCS#1.
172 g_object_class_install_property (gobject_class, PROP_PRIVATE_KEY_PEM,
173 g_param_spec_string ("private-key-pem",
174 P_("Private key (PEM)"),
175 P_("The PEM representation of the certificate's private key"),
178 G_PARAM_CONSTRUCT_ONLY |
179 G_PARAM_STATIC_STRINGS));
181 * GTlsCertificate:issuer:
183 * A #GTlsCertificate representing the entity that issued this
184 * certificate. If %NULL, this means that the certificate is either
185 * self-signed, or else the certificate of the issuer is not
190 g_object_class_install_property (gobject_class, PROP_ISSUER,
191 g_param_spec_object ("issuer",
193 P_("The certificate for the issuing entity"),
194 G_TYPE_TLS_CERTIFICATE,
196 G_PARAM_CONSTRUCT_ONLY |
197 G_PARAM_STATIC_STRINGS));
200 static GTlsCertificate *
201 g_tls_certificate_new_internal (const gchar *certificate_pem,
202 const gchar *private_key_pem,
206 GTlsBackend *backend;
208 backend = g_tls_backend_get_default ();
210 cert = g_initable_new (g_tls_backend_get_certificate_type (backend),
212 "certificate-pem", certificate_pem,
213 "private-key-pem", private_key_pem,
215 return G_TLS_CERTIFICATE (cert);
218 #define PEM_CERTIFICATE_HEADER "-----BEGIN CERTIFICATE-----"
219 #define PEM_CERTIFICATE_FOOTER "-----END CERTIFICATE-----"
220 #define PEM_PKCS1_PRIVKEY_HEADER "-----BEGIN RSA PRIVATE KEY-----"
221 #define PEM_PKCS1_PRIVKEY_FOOTER "-----END RSA PRIVATE KEY-----"
222 #define PEM_PKCS8_PRIVKEY_HEADER "-----BEGIN PRIVATE KEY-----"
223 #define PEM_PKCS8_PRIVKEY_FOOTER "-----END PRIVATE KEY-----"
224 #define PEM_PKCS8_ENCRYPTED_HEADER "-----BEGIN ENCRYPTED PRIVATE KEY-----"
225 #define PEM_PKCS8_ENCRYPTED_FOOTER "-----END ENCRYPTED PRIVATE KEY-----"
228 parse_private_key (const gchar *data,
233 const gchar *start, *end, *footer;
235 start = g_strstr_len (data, data_len, PEM_PKCS1_PRIVKEY_HEADER);
237 footer = PEM_PKCS1_PRIVKEY_FOOTER;
240 start = g_strstr_len (data, data_len, PEM_PKCS8_PRIVKEY_HEADER);
242 footer = PEM_PKCS8_PRIVKEY_FOOTER;
245 start = g_strstr_len (data, data_len, PEM_PKCS8_ENCRYPTED_HEADER);
248 g_set_error_literal (error, G_TLS_ERROR, G_TLS_ERROR_BAD_CERTIFICATE,
249 _("Cannot decrypt PEM-encoded private key"));
253 g_set_error_literal (error, G_TLS_ERROR, G_TLS_ERROR_BAD_CERTIFICATE,
254 _("No PEM-encoded private key found"));
260 end = g_strstr_len (start, data_len - (data - start), footer);
263 g_set_error_literal (error, G_TLS_ERROR, G_TLS_ERROR_BAD_CERTIFICATE,
264 _("Could not parse PEM-encoded private key"));
267 end += strlen (footer);
268 while (*end == '\r' || *end == '\n')
271 return g_strndup (start, end - start);
276 parse_next_pem_certificate (const gchar **data,
277 const gchar *data_end,
281 const gchar *start, *end;
283 start = g_strstr_len (*data, data_end - *data, PEM_CERTIFICATE_HEADER);
288 g_set_error_literal (error, G_TLS_ERROR, G_TLS_ERROR_BAD_CERTIFICATE,
289 _("No PEM-encoded certificate found"));
294 end = g_strstr_len (start, data_end - start, PEM_CERTIFICATE_FOOTER);
297 g_set_error_literal (error, G_TLS_ERROR, G_TLS_ERROR_BAD_CERTIFICATE,
298 _("Could not parse PEM-encoded certificate"));
301 end += strlen (PEM_CERTIFICATE_FOOTER);
302 while (*end == '\r' || *end == '\n')
307 return g_strndup (start, end - start);
311 * g_tls_certificate_new_from_pem:
312 * @data: PEM-encoded certificate data
313 * @length: the length of @data, or -1 if it's 0-terminated.
314 * @error: #GError for error reporting, or %NULL to ignore.
316 * Creates a new #GTlsCertificate from the PEM-encoded data in @data.
317 * If @data includes both a certificate and a private key, then the
318 * returned certificate will include the private key data as well. (See
319 * the #GTlsCertificate:private-key-pem property for information about
320 * supported formats.)
322 * If @data includes multiple certificates, only the first one will be
325 * Return value: the new certificate, or %NULL if @data is invalid
330 g_tls_certificate_new_from_pem (const gchar *data,
334 const gchar *data_end;
335 gchar *key_pem, *cert_pem;
336 GTlsCertificate *cert;
338 g_return_val_if_fail (data != NULL, NULL);
341 length = strlen (data);
343 data_end = data + length;
345 key_pem = parse_private_key (data, length, FALSE, error);
349 cert_pem = parse_next_pem_certificate (&data, data_end, TRUE, error);
356 cert = g_tls_certificate_new_internal (cert_pem, key_pem, error);
364 * g_tls_certificate_new_from_file:
365 * @file: file containing a PEM-encoded certificate to import
366 * @error: #GError for error reporting, or %NULL to ignore.
368 * Creates a #GTlsCertificate from the PEM-encoded data in @file. If
369 * @file cannot be read or parsed, the function will return %NULL and
370 * set @error. Otherwise, this behaves like
371 * g_tls_certificate_new_from_pem().
373 * Return value: the new certificate, or %NULL on error
378 g_tls_certificate_new_from_file (const gchar *file,
381 GTlsCertificate *cert;
385 if (!g_file_get_contents (file, &contents, &length, error))
388 cert = g_tls_certificate_new_from_pem (contents, length, error);
394 * g_tls_certificate_new_from_files:
395 * @cert_file: file containing a PEM-encoded certificate to import
396 * @key_file: file containing a PEM-encoded private key to import
397 * @error: #GError for error reporting, or %NULL to ignore.
399 * Creates a #GTlsCertificate from the PEM-encoded data in @cert_file
400 * and @key_file. If either file cannot be read or parsed, the
401 * function will return %NULL and set @error. Otherwise, this behaves
402 * like g_tls_certificate_new_from_pem().
404 * Return value: the new certificate, or %NULL on error
409 g_tls_certificate_new_from_files (const gchar *cert_file,
410 const gchar *key_file,
413 GTlsCertificate *cert;
414 gchar *cert_data, *key_data;
415 gsize cert_len, key_len;
416 gchar *cert_pem, *key_pem;
419 if (!g_file_get_contents (cert_file, &cert_data, &cert_len, error))
422 cert_pem = parse_next_pem_certificate (&p, p + cert_len, TRUE, error);
427 if (!g_file_get_contents (key_file, &key_data, &key_len, error))
432 key_pem = parse_private_key (key_data, key_len, TRUE, error);
440 cert = g_tls_certificate_new_internal (cert_pem, key_pem, error);
447 * g_tls_certificate_list_new_from_file:
448 * @file: file containing PEM-encoded certificates to import
449 * @error: #GError for error reporting, or %NULL to ignore.
451 * Creates one or more #GTlsCertificate<!-- -->s from the PEM-encoded
452 * data in @file. If @file cannot be read or parsed, the function will
453 * return %NULL and set @error. If @file does not contain any
454 * PEM-encoded certificates, this will return an empty list and not
457 * Return value: (element-type Gio.TlsCertificate) (transfer full): a
458 * #GList containing #GTlsCertificate objects. You must free the list
459 * and its contents when you are done with it.
464 g_tls_certificate_list_new_from_file (const gchar *file,
467 GQueue queue = G_QUEUE_INIT;
468 gchar *contents, *end;
472 if (!g_file_get_contents (file, &contents, &length, error))
475 end = contents + length;
480 GTlsCertificate *cert = NULL;
482 cert_pem = parse_next_pem_certificate (&p, end, FALSE, error);
485 cert = g_tls_certificate_new_internal (cert_pem, NULL, error);
490 g_list_free_full (queue.head, g_object_unref);
494 g_queue_push_tail (&queue, cert);
503 * g_tls_certificate_get_issuer:
504 * @cert: a #GTlsCertificate
506 * Gets the #GTlsCertificate representing @cert's issuer, if known
508 * Return value: (transfer none): The certificate of @cert's issuer,
509 * or %NULL if @cert is self-signed or signed with an unknown
515 g_tls_certificate_get_issuer (GTlsCertificate *cert)
517 GTlsCertificate *issuer;
519 g_object_get (G_OBJECT (cert), "issuer", &issuer, NULL);
521 g_object_unref (issuer);
527 * g_tls_certificate_verify:
528 * @cert: a #GTlsCertificate
529 * @identity: (allow-none): the expected peer identity
530 * @trusted_ca: (allow-none): the certificate of a trusted authority
532 * This verifies @cert and returns a set of #GTlsCertificateFlags
533 * indicating any problems found with it. This can be used to verify a
534 * certificate outside the context of making a connection, or to
535 * check a certificate against a CA that is not part of the system
538 * If @identity is not %NULL, @cert's name(s) will be compared against
539 * it, and %G_TLS_CERTIFICATE_BAD_IDENTITY will be set in the return
540 * value if it does not match. If @identity is %NULL, that bit will
541 * never be set in the return value.
543 * If @trusted_ca is not %NULL, then @cert (or one of the certificates
544 * in its chain) must be signed by it, or else
545 * %G_TLS_CERTIFICATE_UNKNOWN_CA will be set in the return value. If
546 * @trusted_ca is %NULL, that bit will never be set in the return
549 * (All other #GTlsCertificateFlags values will always be set or unset
552 * Return value: the appropriate #GTlsCertificateFlags
557 g_tls_certificate_verify (GTlsCertificate *cert,
558 GSocketConnectable *identity,
559 GTlsCertificate *trusted_ca)
561 return G_TLS_CERTIFICATE_GET_CLASS (cert)->verify (cert, identity, trusted_ca);
565 * g_tls_certificate_is_same:
566 * @cert_one: first certificate to compare
567 * @cert_two: second certificate to compare
569 * Check if two #GTlsCertificate objects represent the same certificate.
570 * The raw DER byte data of the two certificates are checked for equality.
571 * This has the effect that two certificates may compare equal even if
572 * their #GTlsCertificate:issuer, #GTlsCertificate:private-key, or
573 * #GTlsCertificate:private-key-pem properties differ.
575 * Return value: whether the same or not
580 g_tls_certificate_is_same (GTlsCertificate *cert_one,
581 GTlsCertificate *cert_two)
586 g_return_val_if_fail (G_IS_TLS_CERTIFICATE (cert_one), FALSE);
587 g_return_val_if_fail (G_IS_TLS_CERTIFICATE (cert_two), FALSE);
589 g_object_get (cert_one, "certificate", &b1, NULL);
590 g_object_get (cert_two, "certificate", &b2, NULL);
592 equal = (b1->len == b2->len &&
593 memcmp (b1->data, b2->data, b1->len) == 0);
595 g_byte_array_unref (b1);
596 g_byte_array_unref (b2);