X-Git-Url: http://review.tizen.org/git/?a=blobdiff_plain;f=gio%2Fgtlscertificate.c;h=81e072f57a22625a79dba12335c03ce7a5172b1a;hb=51fac05d73f8363de821eb0d6940dedca13a8c0f;hp=47de03df772b46edb4af47edf5bba26fe89e5cc9;hpb=65f26691733a8c8b48476d899b52cf17c0cfae88;p=platform%2Fupstream%2Fglib.git diff --git a/gio/gtlscertificate.c b/gio/gtlscertificate.c index 47de03d..81e072f 100644 --- a/gio/gtlscertificate.c +++ b/gio/gtlscertificate.c @@ -196,9 +196,10 @@ g_tls_certificate_class_init (GTlsCertificateClass *class) } static GTlsCertificate * -g_tls_certificate_new_internal (const gchar *certificate_pem, - const gchar *private_key_pem, - GError **error) +g_tls_certificate_new_internal (const gchar *certificate_pem, + const gchar *private_key_pem, + GTlsCertificate *issuer, + GError **error) { GObject *cert; GTlsBackend *backend; @@ -209,7 +210,9 @@ g_tls_certificate_new_internal (const gchar *certificate_pem, NULL, error, "certificate-pem", certificate_pem, "private-key-pem", private_key_pem, + "issuer", issuer, NULL); + return G_TLS_CERTIFICATE (cert); } @@ -305,20 +308,153 @@ parse_next_pem_certificate (const gchar **data, return g_strndup (start, end - start); } +static GSList * +parse_and_create_certificate_list (const gchar *data, + gsize data_len, + GError **error) +{ + GSList *first_pem_list = NULL, *pem_list = NULL; + gchar *first_pem; + const gchar *p, *end; + + p = data; + end = p + data_len; + + /* Make sure we can load, at least, one certificate. */ + first_pem = parse_next_pem_certificate (&p, end, TRUE, error); + if (!first_pem) + return NULL; + + /* Create a list with a single element. If we load more certificates + * below, we will concatenate the two lists at the end. */ + first_pem_list = g_slist_prepend (first_pem_list, first_pem); + + /* If we read one certificate successfully, let's see if we can read + * some more. If not, we will simply return a list with the first one. + */ + while (p && *p) + { + gchar *cert_pem; + + cert_pem = parse_next_pem_certificate (&p, end, FALSE, NULL); + if (!cert_pem) + { + g_slist_free_full (pem_list, g_free); + return first_pem_list; + } + + pem_list = g_slist_prepend (pem_list, cert_pem); + } + + pem_list = g_slist_concat (pem_list, first_pem_list); + + return pem_list; +} + +static GTlsCertificate * +create_certificate_chain_from_list (GSList *pem_list, + const gchar *key_pem) +{ + GTlsCertificate *cert = NULL, *issuer = NULL, *root = NULL; + GTlsCertificateFlags flags; + GSList *pem; + + pem = pem_list; + while (pem) + { + const gchar *key = NULL; + + /* Private key belongs only to the first certificate. */ + if (!pem->next) + key = key_pem; + + /* We assume that the whole file is a certificate chain, so we use + * each certificate as the issuer of the next one (list is in + * reverse order). + */ + issuer = cert; + cert = g_tls_certificate_new_internal (pem->data, key, issuer, NULL); + if (issuer) + g_object_unref (issuer); + + if (!cert) + return NULL; + + /* root will point to the last certificate in the file. */ + if (!root) + root = cert; + + pem = g_slist_next (pem); + } + + /* Verify that the certificates form a chain. (We don't care at this + * point if there are other problems with it.) + */ + flags = g_tls_certificate_verify (cert, NULL, root); + if (flags & G_TLS_CERTIFICATE_UNKNOWN_CA) + { + /* It wasn't a chain, it's just a bunch of unrelated certs. */ + g_clear_object (&cert); + } + + return cert; +} + +static GTlsCertificate * +parse_and_create_certificate (const gchar *data, + gsize data_len, + const gchar *key_pem, + GError **error) + +{ + GSList *pem_list; + GTlsCertificate *cert; + + pem_list = parse_and_create_certificate_list (data, data_len, error); + if (!pem_list) + return NULL; + + /* We don't pass the error here because, if it fails, we still want to + * load and return the first certificate. + */ + cert = create_certificate_chain_from_list (pem_list, key_pem); + if (!cert) + { + GSList *last = NULL; + + /* Get the first certificate (which is the last one as the list is + * in reverse order). + */ + last = g_slist_last (pem_list); + + cert = g_tls_certificate_new_internal (last->data, key_pem, NULL, error); + } + + g_slist_free_full (pem_list, g_free); + + return cert; +} + /** * g_tls_certificate_new_from_pem: * @data: PEM-encoded certificate data * @length: the length of @data, or -1 if it's 0-terminated. * @error: #GError for error reporting, or %NULL to ignore. * - * Creates a new #GTlsCertificate from the PEM-encoded data in @data. - * If @data includes both a certificate and a private key, then the + * Creates a #GTlsCertificate from the PEM-encoded data in @data. If + * @data includes both a certificate and a private key, then the * returned certificate will include the private key data as well. (See * the #GTlsCertificate:private-key-pem property for information about * supported formats.) * - * If @data includes multiple certificates, only the first one will be - * parsed. + * The returned certificate will be the first certificate found in + * @data. As of GLib 2.44, if @data contains more certificates it will + * try to load a certificate chain. All certificates will be verified in + * the order found (top-level certificate should be the last one in the + * file) and the #GTlsCertificate:issuer property of each certificate + * will be set accordingly if the verification succeeds. If any + * certificate in the chain cannot be verified, the first certificate in + * the file will still be returned. * * Returns: the new certificate, or %NULL if @data is invalid * @@ -329,8 +465,7 @@ g_tls_certificate_new_from_pem (const gchar *data, gssize length, GError **error) { - const gchar *data_end; - gchar *key_pem, *cert_pem; + gchar *key_pem; GTlsCertificate *cert; g_return_val_if_fail (data != NULL, NULL); @@ -338,22 +473,12 @@ g_tls_certificate_new_from_pem (const gchar *data, if (length == -1) length = strlen (data); - data_end = data + length; - key_pem = parse_private_key (data, length, FALSE, error); if (error && *error) return NULL; - cert_pem = parse_next_pem_certificate (&data, data_end, TRUE, error); - if (error && *error) - { - g_free (key_pem); - return NULL; - } - - cert = g_tls_certificate_new_internal (cert_pem, key_pem, error); + cert = parse_and_create_certificate (data, length, key_pem, error); g_free (key_pem); - g_free (cert_pem); return cert; } @@ -363,8 +488,17 @@ g_tls_certificate_new_from_pem (const gchar *data, * @file: file containing a PEM-encoded certificate to import * @error: #GError for error reporting, or %NULL to ignore. * - * Creates a #GTlsCertificate from the PEM-encoded data in @file. If - * @file cannot be read or parsed, the function will return %NULL and + * Creates a #GTlsCertificate from the PEM-encoded data in @file. The + * returned certificate will be the first certificate found in @file. As + * of GLib 2.44, if @file contains more certificates it will try to load + * a certificate chain. All certificates will be verified in the order + * found (top-level certificate should be the last one in the file) and + * the #GTlsCertificate:issuer property of each certificate will be set + * accordingly if the verification succeeds. If any certificate in the + * chain cannot be verified, the first certificate in the file will + * still be returned. + * + * If @file cannot be read or parsed, the function will return %NULL and * set @error. Otherwise, this behaves like * g_tls_certificate_new_from_pem(). * @@ -390,14 +524,26 @@ g_tls_certificate_new_from_file (const gchar *file, /** * g_tls_certificate_new_from_files: - * @cert_file: file containing a PEM-encoded certificate to import + + * @cert_file: file containing one or more PEM-encoded certificates to + * import * @key_file: file containing a PEM-encoded private key to import * @error: #GError for error reporting, or %NULL to ignore. * * Creates a #GTlsCertificate from the PEM-encoded data in @cert_file - * and @key_file. If either file cannot be read or parsed, the - * function will return %NULL and set @error. Otherwise, this behaves - * like g_tls_certificate_new_from_pem(). + * and @key_file. The returned certificate will be the first certificate + * found in @cert_file. As of GLib 2.44, if @cert_file contains more + * certificates it will try to load a certificate chain. All + * certificates will be verified in the order found (top-level + * certificate should be the last one in the file) and the + * #GTlsCertificate:issuer property of each certificate will be set + * accordingly if the verification succeeds. If any certificate in the + * chain cannot be verified, the first certificate in the file will + * still be returned. + * + * If either file cannot be read or parsed, the function will return + * %NULL and set @error. Otherwise, this behaves like + * g_tls_certificate_new_from_pem(). * * Returns: the new certificate, or %NULL on error * @@ -405,38 +551,30 @@ g_tls_certificate_new_from_file (const gchar *file, */ GTlsCertificate * g_tls_certificate_new_from_files (const gchar *cert_file, - const gchar *key_file, - GError **error) + const gchar *key_file, + GError **error) { GTlsCertificate *cert; gchar *cert_data, *key_data; gsize cert_len, key_len; - gchar *cert_pem, *key_pem; - const gchar *p; + gchar *key_pem; - if (!g_file_get_contents (cert_file, &cert_data, &cert_len, error)) - return NULL; - p = cert_data; - cert_pem = parse_next_pem_certificate (&p, p + cert_len, TRUE, error); - g_free (cert_data); - if (error && *error) + if (!g_file_get_contents (key_file, &key_data, &key_len, error)) return NULL; - if (!g_file_get_contents (key_file, &key_data, &key_len, error)) - { - g_free (cert_pem); - return NULL; - } key_pem = parse_private_key (key_data, key_len, TRUE, error); g_free (key_data); - if (error && *error) + if (!key_pem) + return NULL; + + if (!g_file_get_contents (cert_file, &cert_data, &cert_len, error)) { - g_free (cert_pem); + g_free (key_pem); return NULL; } - cert = g_tls_certificate_new_internal (cert_pem, key_pem, error); - g_free (cert_pem); + cert = parse_and_create_certificate (cert_data, cert_len, key_pem, error); + g_free (cert_data); g_free (key_pem); return cert; } @@ -481,7 +619,7 @@ g_tls_certificate_list_new_from_file (const gchar *file, cert_pem = parse_next_pem_certificate (&p, end, FALSE, &parse_error); if (cert_pem) { - cert = g_tls_certificate_new_internal (cert_pem, NULL, &parse_error); + cert = g_tls_certificate_new_internal (cert_pem, NULL, NULL, &parse_error); g_free (cert_pem); } if (!cert)