1 /* GIO - GLib Input, Output and Certificateing Library
3 * Copyright (C) 2010 Red Hat, Inc.
5 * This library is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU Lesser General Public
7 * License as published by the Free Software Foundation; either
8 * version 2 of the License, or (at your option) any later version.
10 * This library is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 * Lesser General Public License for more details.
15 * You should have received a copy of the GNU Lesser General
16 * Public License along with this library; if not, write to the
17 * Free Software Foundation, Inc., 59 Temple Place, Suite 330,
18 * Boston, MA 02111-1307, USA.
23 #include "gtlscertificate.h"
26 #include "ginitable.h"
27 #include "gtlsbackend.h"
28 #include "gtlsconnection.h"
32 * SECTION: gtlscertificate
33 * @title: GTlsCertificate
34 * @short_description: TLS certificate
35 * @see_also: #GTlsConnection
37 * A certificate used for TLS authentication and encryption.
38 * This can represent either a public key only (eg, the certificate
39 * received by a client from a server), or the combination of
40 * a public key and a private key (which is needed when acting as a
41 * #GTlsServerConnection).
49 * Abstract base class for TLS certificate types.
54 G_DEFINE_ABSTRACT_TYPE (GTlsCertificate, g_tls_certificate, G_TYPE_OBJECT);
56 struct _GTlsCertificatePrivate
58 GTlsCertificate *issuer;
73 g_tls_certificate_init (GTlsCertificate *cert)
75 cert->priv = G_TYPE_INSTANCE_GET_PRIVATE (cert,
76 G_TYPE_TLS_CERTIFICATE,
77 GTlsCertificatePrivate);
81 g_tls_certificate_get_property (GObject *object,
86 GTlsCertificate *cert = G_TLS_CERTIFICATE (object);
91 g_value_set_object (value, cert->priv->issuer);
95 G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
100 g_tls_certificate_set_property (GObject *object,
105 GTlsCertificate *cert = G_TLS_CERTIFICATE (object);
110 cert->priv->issuer = g_value_dup_object (value);
114 G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
119 g_tls_certificate_finalize (GObject *object)
121 GTlsCertificate *cert = G_TLS_CERTIFICATE (object);
123 if (cert->priv->issuer)
124 g_object_unref (cert->priv->issuer);
126 G_OBJECT_CLASS (g_tls_certificate_parent_class)->finalize (object);
130 g_tls_certificate_class_init (GTlsCertificateClass *class)
132 GObjectClass *gobject_class = G_OBJECT_CLASS (class);
134 g_type_class_add_private (class, sizeof (GTlsCertificatePrivate));
136 gobject_class->set_property = g_tls_certificate_set_property;
137 gobject_class->get_property = g_tls_certificate_get_property;
138 gobject_class->finalize = g_tls_certificate_finalize;
141 * GTlsCertificate:certificate:
143 * The DER (binary) encoded representation of the certificate's
144 * public key. This property and the
145 * #GTlsCertificate:certificate-pem property represent the same
146 * data, just in different forms.
150 g_object_class_install_property (gobject_class, PROP_CERTIFICATE,
151 g_param_spec_boxed ("certificate",
153 P_("The DER representation of the certificate"),
156 G_PARAM_CONSTRUCT_ONLY |
157 G_PARAM_STATIC_STRINGS));
159 * GTlsCertificate:certificate-pem:
161 * The PEM (ASCII) encoded representation of the certificate's
162 * public key. This property and the #GTlsCertificate:certificate
163 * property represent the same data, just in different forms.
167 g_object_class_install_property (gobject_class, PROP_CERTIFICATE_PEM,
168 g_param_spec_string ("certificate-pem",
169 P_("Certificate (PEM)"),
170 P_("The PEM representation of the certificate"),
173 G_PARAM_CONSTRUCT_ONLY |
174 G_PARAM_STATIC_STRINGS));
176 * GTlsCertificate:private-key:
178 * The DER (binary) encoded representation of the certificate's
179 * private key. This property (or the
180 * #GTlsCertificate:private-key-pem property) can be set when
181 * constructing a key (eg, from a file), but cannot be read.
185 g_object_class_install_property (gobject_class, PROP_PRIVATE_KEY,
186 g_param_spec_boxed ("private-key",
188 P_("The DER representation of the certificate's private key"),
191 G_PARAM_CONSTRUCT_ONLY |
192 G_PARAM_STATIC_STRINGS));
194 * GTlsCertificate:private-key-pem:
196 * The PEM (ASCII) encoded representation of the certificate's
197 * private key. This property (or the #GTlsCertificate:private-key
198 * property) can be set when constructing a key (eg, from a file),
199 * but cannot be read.
203 g_object_class_install_property (gobject_class, PROP_PRIVATE_KEY_PEM,
204 g_param_spec_string ("private-key-pem",
205 P_("Private key (PEM)"),
206 P_("The PEM representation of the certificate's private key"),
209 G_PARAM_CONSTRUCT_ONLY |
210 G_PARAM_STATIC_STRINGS));
212 * GTlsCertificate:issuer:
214 * A #GTlsCertificate representing the entity that issued this
215 * certificate. If %NULL, this means that the certificate is either
216 * self-signed, or else the certificate of the issuer is not
221 g_object_class_install_property (gobject_class, PROP_ISSUER,
222 g_param_spec_object ("issuer",
224 P_("The certificate for the issuing entity"),
225 G_TYPE_TLS_CERTIFICATE,
227 G_PARAM_CONSTRUCT_ONLY |
228 G_PARAM_STATIC_STRINGS));
231 static GTlsCertificate *
232 g_tls_certificate_new_internal (const gchar *certificate_pem,
233 const gchar *private_key_pem,
237 GTlsBackend *backend;
239 backend = g_tls_backend_get_default ();
241 cert = g_initable_new (g_tls_backend_get_certificate_type (backend),
243 "certificate-pem", certificate_pem,
244 "private-key-pem", private_key_pem,
246 return G_TLS_CERTIFICATE (cert);
249 #define PEM_CERTIFICATE_HEADER "-----BEGIN CERTIFICATE-----"
250 #define PEM_CERTIFICATE_FOOTER "-----END CERTIFICATE-----"
251 #define PEM_PRIVKEY_HEADER "-----BEGIN RSA PRIVATE KEY-----"
252 #define PEM_PRIVKEY_FOOTER "-----END RSA PRIVATE KEY-----"
254 static GTlsCertificate *
255 parse_next_pem_certificate (const gchar **data,
256 const gchar *data_end,
260 const gchar *start, *end, *next;
261 gchar *cert_pem, *privkey_pem = NULL;
262 GTlsCertificate *cert;
264 start = g_strstr_len (*data, data_end - *data, PEM_CERTIFICATE_HEADER);
269 g_set_error_literal (error, G_TLS_ERROR, G_TLS_ERROR_BAD_CERTIFICATE,
270 _("No PEM-encoded certificate found"));
275 end = g_strstr_len (start, data_end - start, PEM_CERTIFICATE_FOOTER);
278 g_set_error_literal (error, G_TLS_ERROR, G_TLS_ERROR_BAD_CERTIFICATE,
279 _("Could not parse PEM-encoded certificate"));
282 end += strlen (PEM_CERTIFICATE_FOOTER);
283 while (*end == '\r' || *end == '\n')
286 cert_pem = g_strndup (start, end - start);
290 next = g_strstr_len (*data, data_end - *data, PEM_CERTIFICATE_HEADER);
291 start = g_strstr_len (*data, data_end - *data, PEM_PRIVKEY_HEADER);
293 end = g_strstr_len (start, data_end - start, PEM_PRIVKEY_FOOTER);
295 if (start && (!next || start < next))
297 if (!end || (next && end > next))
299 g_set_error_literal (error, G_TLS_ERROR, G_TLS_ERROR_BAD_CERTIFICATE,
300 _("Could not parse PEM-encoded private key"));
304 end += strlen (PEM_PRIVKEY_FOOTER);
305 while (*end == '\r' || *end == '\n')
308 privkey_pem = g_strndup (start, end - start);
310 *data = end + strlen (PEM_PRIVKEY_FOOTER);
313 cert = g_tls_certificate_new_internal (cert_pem, privkey_pem, error);
315 g_free (privkey_pem);
321 * g_tls_certificate_new_from_pem:
322 * @data: PEM-encoded certificate data
323 * @length: the length of @data, or -1 if it's 0-terminated.
324 * @error: #GError for error reporting, or %NULL to ignore.
326 * Creates a new #GTlsCertificate from the PEM-encoded data in @data.
327 * If @data includes both a certificate and a private key, then the
328 * returned certificate will include the private key data as well.
330 * If @data includes multiple certificates, only the first one will be
333 * Return value: the new certificate, or %NULL if @data is invalid
338 g_tls_certificate_new_from_pem (const gchar *data,
342 const gchar *data_end;
344 g_return_val_if_fail (data != NULL, NULL);
347 data_end = data + strlen (data);
349 data_end = data + length;
350 return parse_next_pem_certificate (&data, data_end, TRUE, error);
354 * g_tls_certificate_new_from_file:
355 * @file: file containing a PEM-encoded certificate to import
356 * @error: #GError for error reporting, or %NULL to ignore.
358 * Creates a #GTlsCertificate from the PEM-encoded data in @file. If
359 * @file cannot be read or parsed, the function will return %NULL and
360 * set @error. Otherwise, this behaves like g_tls_certificate_new().
362 * Return value: the new certificate, or %NULL on error
367 g_tls_certificate_new_from_file (const gchar *file,
370 GTlsCertificate *cert;
374 if (!g_file_get_contents (file, &contents, &length, error))
377 cert = g_tls_certificate_new_from_pem (contents, length, error);
383 * g_tls_certificate_new_from_files:
384 * @cert_file: file containing a PEM-encoded certificate to import
385 * @key_file: file containing a PEM-encoded private key to import
386 * @error: #GError for error reporting, or %NULL to ignore.
388 * Creates a #GTlsCertificate from the PEM-encoded data in @cert_file
389 * and @key_file. If either file cannot be read or parsed, the
390 * function will return %NULL and set @error. Otherwise, this behaves
391 * like g_tls_certificate_new().
393 * Return value: the new certificate, or %NULL on error
398 g_tls_certificate_new_from_files (const gchar *cert_file,
399 const gchar *key_file,
402 GTlsCertificate *cert;
403 gchar *cert_data, *key_data;
405 if (!g_file_get_contents (cert_file, &cert_data, NULL, error))
407 if (!g_file_get_contents (key_file, &key_data, NULL, error))
413 cert = g_tls_certificate_new_internal (cert_data, key_data, error);
420 * g_tls_certificate_list_new_from_file:
421 * @file: file containing PEM-encoded certificates to import
422 * @error: #GError for error reporting, or %NULL to ignore.
424 * Creates one or more #GTlsCertificate<!-- -->s from the PEM-encoded
425 * data in @file. If @file cannot be read or parsed, the function will
426 * return %NULL and set @error. If @file does not contain any
427 * PEM-encoded certificates, this will return an empty list and not
430 * Return value: (element-type Gio.TlsCertificate) (transfer full): a
431 * #GList containing #GTlsCertificate objects. You must free the list
432 * and its contents when you are done with it.
437 g_tls_certificate_list_new_from_file (const gchar *file,
440 GTlsCertificate *cert;
442 gchar *contents, *end;
446 if (!g_file_get_contents (file, &contents, &length, error))
450 end = contents + length;
454 cert = parse_next_pem_certificate (&p, end, FALSE, error);
457 for (l = list; l; l = l->next)
458 g_object_unref (l->data);
463 list = g_list_prepend (list, cert);
466 return g_list_reverse (list);
471 * g_tls_certificate_get_issuer:
472 * @cert: a #GTlsCertificate
474 * Gets the #GTlsCertificate representing @cert's issuer, if known
476 * Return value: (transfer none): The certificate of @cert's issuer,
477 * or %NULL if @cert is self-signed or signed with an unknown
483 g_tls_certificate_get_issuer (GTlsCertificate *cert)
485 return cert->priv->issuer;