X-Git-Url: http://review.tizen.org/git/?a=blobdiff_plain;f=gio%2Fgtlscertificate.c;h=81e072f57a22625a79dba12335c03ce7a5172b1a;hb=d9ad40b4eaf1a9197ab363de4346a8d84f45f5c1;hp=2cea2be8ba94fe09e17a691e5acd46cb9d1167ae;hpb=d85b722734a6fcfe94032f6113de9e5c190fd7c3;p=platform%2Fupstream%2Fglib.git
diff --git a/gio/gtlscertificate.c b/gio/gtlscertificate.c
index 2cea2be..81e072f 100644
--- a/gio/gtlscertificate.c
+++ b/gio/gtlscertificate.c
@@ -13,9 +13,7 @@
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General
- * Public License along with this library; if not, write to the
- * Free Software Foundation, Inc., 59 Temple Place, Suite 330,
- * Boston, MA 02111-1307, USA.
+ * Public License along with this library; if not, see .
*/
#include "config.h"
@@ -32,12 +30,13 @@
* SECTION:gtlscertificate
* @title: GTlsCertificate
* @short_description: TLS certificate
+ * @include: gio/gio.h
* @see_also: #GTlsConnection
*
* A certificate used for TLS authentication and encryption.
- * This can represent either a public key only (eg, the certificate
+ * This can represent either a certificate only (eg, the certificate
* received by a client from a server), or the combination of
- * a public key and a private key (which is needed when acting as a
+ * a certificate and a private key (which is needed when acting as a
* #GTlsServerConnection).
*
* Since: 2.28
@@ -98,10 +97,9 @@ g_tls_certificate_class_init (GTlsCertificateClass *class)
/**
* GTlsCertificate:certificate:
*
- * The DER (binary) encoded representation of the certificate's
- * public key. This property and the
- * #GTlsCertificate:certificate-pem property represent the same
- * data, just in different forms.
+ * The DER (binary) encoded representation of the certificate.
+ * This property and the #GTlsCertificate:certificate-pem property
+ * represent the same data, just in different forms.
*
* Since: 2.28
*/
@@ -116,8 +114,8 @@ g_tls_certificate_class_init (GTlsCertificateClass *class)
/**
* GTlsCertificate:certificate-pem:
*
- * The PEM (ASCII) encoded representation of the certificate's
- * public key. This property and the #GTlsCertificate:certificate
+ * The PEM (ASCII) encoded representation of the certificate.
+ * This property and the #GTlsCertificate:certificate
* property represent the same data, just in different forms.
*
* Since: 2.28
@@ -140,7 +138,7 @@ g_tls_certificate_class_init (GTlsCertificateClass *class)
* but cannot be read.
*
* PKCS#8 format is supported since 2.32; earlier releases only
- * support PKCS#1. You can use the openssl rsa
+ * support PKCS#1. You can use the `openssl rsa`
* tool to convert PKCS#8 keys to PKCS#1.
*
* Since: 2.28
@@ -157,14 +155,14 @@ g_tls_certificate_class_init (GTlsCertificateClass *class)
* GTlsCertificate:private-key-pem:
*
* The PEM (ASCII) encoded representation of the certificate's
- * private key in either PKCS#1 format ("BEGIN RSA PRIVATE
- * KEY") or unencrypted PKCS#8 format ("BEGIN
- * PRIVATE KEY"). This property (or the
+ * private key in either PKCS#1 format ("`BEGIN RSA PRIVATE
+ * KEY`") or unencrypted PKCS#8 format ("`BEGIN
+ * PRIVATE KEY`"). This property (or the
* #GTlsCertificate:private-key property) can be set when
* constructing a key (eg, from a file), but cannot be read.
*
* PKCS#8 format is supported since 2.32; earlier releases only
- * support PKCS#1. You can use the openssl rsa
+ * support PKCS#1. You can use the `openssl rsa`
* tool to convert PKCS#8 keys to PKCS#1.
*
* Since: 2.28
@@ -198,9 +196,10 @@ g_tls_certificate_class_init (GTlsCertificateClass *class)
}
static GTlsCertificate *
-g_tls_certificate_new_internal (const gchar *certificate_pem,
- const gchar *private_key_pem,
- GError **error)
+g_tls_certificate_new_internal (const gchar *certificate_pem,
+ const gchar *private_key_pem,
+ GTlsCertificate *issuer,
+ GError **error)
{
GObject *cert;
GTlsBackend *backend;
@@ -211,7 +210,9 @@ g_tls_certificate_new_internal (const gchar *certificate_pem,
NULL, error,
"certificate-pem", certificate_pem,
"private-key-pem", private_key_pem,
+ "issuer", issuer,
NULL);
+
return G_TLS_CERTIFICATE (cert);
}
@@ -307,22 +308,155 @@ parse_next_pem_certificate (const gchar **data,
return g_strndup (start, end - start);
}
+static GSList *
+parse_and_create_certificate_list (const gchar *data,
+ gsize data_len,
+ GError **error)
+{
+ GSList *first_pem_list = NULL, *pem_list = NULL;
+ gchar *first_pem;
+ const gchar *p, *end;
+
+ p = data;
+ end = p + data_len;
+
+ /* Make sure we can load, at least, one certificate. */
+ first_pem = parse_next_pem_certificate (&p, end, TRUE, error);
+ if (!first_pem)
+ return NULL;
+
+ /* Create a list with a single element. If we load more certificates
+ * below, we will concatenate the two lists at the end. */
+ first_pem_list = g_slist_prepend (first_pem_list, first_pem);
+
+ /* If we read one certificate successfully, let's see if we can read
+ * some more. If not, we will simply return a list with the first one.
+ */
+ while (p && *p)
+ {
+ gchar *cert_pem;
+
+ cert_pem = parse_next_pem_certificate (&p, end, FALSE, NULL);
+ if (!cert_pem)
+ {
+ g_slist_free_full (pem_list, g_free);
+ return first_pem_list;
+ }
+
+ pem_list = g_slist_prepend (pem_list, cert_pem);
+ }
+
+ pem_list = g_slist_concat (pem_list, first_pem_list);
+
+ return pem_list;
+}
+
+static GTlsCertificate *
+create_certificate_chain_from_list (GSList *pem_list,
+ const gchar *key_pem)
+{
+ GTlsCertificate *cert = NULL, *issuer = NULL, *root = NULL;
+ GTlsCertificateFlags flags;
+ GSList *pem;
+
+ pem = pem_list;
+ while (pem)
+ {
+ const gchar *key = NULL;
+
+ /* Private key belongs only to the first certificate. */
+ if (!pem->next)
+ key = key_pem;
+
+ /* We assume that the whole file is a certificate chain, so we use
+ * each certificate as the issuer of the next one (list is in
+ * reverse order).
+ */
+ issuer = cert;
+ cert = g_tls_certificate_new_internal (pem->data, key, issuer, NULL);
+ if (issuer)
+ g_object_unref (issuer);
+
+ if (!cert)
+ return NULL;
+
+ /* root will point to the last certificate in the file. */
+ if (!root)
+ root = cert;
+
+ pem = g_slist_next (pem);
+ }
+
+ /* Verify that the certificates form a chain. (We don't care at this
+ * point if there are other problems with it.)
+ */
+ flags = g_tls_certificate_verify (cert, NULL, root);
+ if (flags & G_TLS_CERTIFICATE_UNKNOWN_CA)
+ {
+ /* It wasn't a chain, it's just a bunch of unrelated certs. */
+ g_clear_object (&cert);
+ }
+
+ return cert;
+}
+
+static GTlsCertificate *
+parse_and_create_certificate (const gchar *data,
+ gsize data_len,
+ const gchar *key_pem,
+ GError **error)
+
+{
+ GSList *pem_list;
+ GTlsCertificate *cert;
+
+ pem_list = parse_and_create_certificate_list (data, data_len, error);
+ if (!pem_list)
+ return NULL;
+
+ /* We don't pass the error here because, if it fails, we still want to
+ * load and return the first certificate.
+ */
+ cert = create_certificate_chain_from_list (pem_list, key_pem);
+ if (!cert)
+ {
+ GSList *last = NULL;
+
+ /* Get the first certificate (which is the last one as the list is
+ * in reverse order).
+ */
+ last = g_slist_last (pem_list);
+
+ cert = g_tls_certificate_new_internal (last->data, key_pem, NULL, error);
+ }
+
+ g_slist_free_full (pem_list, g_free);
+
+ return cert;
+}
+
/**
* g_tls_certificate_new_from_pem:
* @data: PEM-encoded certificate data
* @length: the length of @data, or -1 if it's 0-terminated.
* @error: #GError for error reporting, or %NULL to ignore.
*
- * Creates a new #GTlsCertificate from the PEM-encoded data in @data.
- * If @data includes both a certificate and a private key, then the
+ * Creates a #GTlsCertificate from the PEM-encoded data in @data. If
+ * @data includes both a certificate and a private key, then the
* returned certificate will include the private key data as well. (See
* the #GTlsCertificate:private-key-pem property for information about
* supported formats.)
*
- * If @data includes multiple certificates, only the first one will be
- * parsed.
+ * The returned certificate will be the first certificate found in
+ * @data. As of GLib 2.44, if @data contains more certificates it will
+ * try to load a certificate chain. All certificates will be verified in
+ * the order found (top-level certificate should be the last one in the
+ * file) and the #GTlsCertificate:issuer property of each certificate
+ * will be set accordingly if the verification succeeds. If any
+ * certificate in the chain cannot be verified, the first certificate in
+ * the file will still be returned.
*
- * Return value: the new certificate, or %NULL if @data is invalid
+ * Returns: the new certificate, or %NULL if @data is invalid
*
* Since: 2.28
*/
@@ -331,8 +465,7 @@ g_tls_certificate_new_from_pem (const gchar *data,
gssize length,
GError **error)
{
- const gchar *data_end;
- gchar *key_pem, *cert_pem;
+ gchar *key_pem;
GTlsCertificate *cert;
g_return_val_if_fail (data != NULL, NULL);
@@ -340,22 +473,12 @@ g_tls_certificate_new_from_pem (const gchar *data,
if (length == -1)
length = strlen (data);
- data_end = data + length;
-
key_pem = parse_private_key (data, length, FALSE, error);
if (error && *error)
return NULL;
- cert_pem = parse_next_pem_certificate (&data, data_end, TRUE, error);
- if (error && *error)
- {
- g_free (key_pem);
- return NULL;
- }
-
- cert = g_tls_certificate_new_internal (cert_pem, key_pem, error);
+ cert = parse_and_create_certificate (data, length, key_pem, error);
g_free (key_pem);
- g_free (cert_pem);
return cert;
}
@@ -365,12 +488,21 @@ g_tls_certificate_new_from_pem (const gchar *data,
* @file: file containing a PEM-encoded certificate to import
* @error: #GError for error reporting, or %NULL to ignore.
*
- * Creates a #GTlsCertificate from the PEM-encoded data in @file. If
- * @file cannot be read or parsed, the function will return %NULL and
+ * Creates a #GTlsCertificate from the PEM-encoded data in @file. The
+ * returned certificate will be the first certificate found in @file. As
+ * of GLib 2.44, if @file contains more certificates it will try to load
+ * a certificate chain. All certificates will be verified in the order
+ * found (top-level certificate should be the last one in the file) and
+ * the #GTlsCertificate:issuer property of each certificate will be set
+ * accordingly if the verification succeeds. If any certificate in the
+ * chain cannot be verified, the first certificate in the file will
+ * still be returned.
+ *
+ * If @file cannot be read or parsed, the function will return %NULL and
* set @error. Otherwise, this behaves like
* g_tls_certificate_new_from_pem().
*
- * Return value: the new certificate, or %NULL on error
+ * Returns: the new certificate, or %NULL on error
*
* Since: 2.28
*/
@@ -392,53 +524,57 @@ g_tls_certificate_new_from_file (const gchar *file,
/**
* g_tls_certificate_new_from_files:
- * @cert_file: file containing a PEM-encoded certificate to import
+
+ * @cert_file: file containing one or more PEM-encoded certificates to
+ * import
* @key_file: file containing a PEM-encoded private key to import
* @error: #GError for error reporting, or %NULL to ignore.
*
* Creates a #GTlsCertificate from the PEM-encoded data in @cert_file
- * and @key_file. If either file cannot be read or parsed, the
- * function will return %NULL and set @error. Otherwise, this behaves
- * like g_tls_certificate_new_from_pem().
+ * and @key_file. The returned certificate will be the first certificate
+ * found in @cert_file. As of GLib 2.44, if @cert_file contains more
+ * certificates it will try to load a certificate chain. All
+ * certificates will be verified in the order found (top-level
+ * certificate should be the last one in the file) and the
+ * #GTlsCertificate:issuer property of each certificate will be set
+ * accordingly if the verification succeeds. If any certificate in the
+ * chain cannot be verified, the first certificate in the file will
+ * still be returned.
+ *
+ * If either file cannot be read or parsed, the function will return
+ * %NULL and set @error. Otherwise, this behaves like
+ * g_tls_certificate_new_from_pem().
*
- * Return value: the new certificate, or %NULL on error
+ * Returns: the new certificate, or %NULL on error
*
* Since: 2.28
*/
GTlsCertificate *
g_tls_certificate_new_from_files (const gchar *cert_file,
- const gchar *key_file,
- GError **error)
+ const gchar *key_file,
+ GError **error)
{
GTlsCertificate *cert;
gchar *cert_data, *key_data;
gsize cert_len, key_len;
- gchar *cert_pem, *key_pem;
- const gchar *p;
+ gchar *key_pem;
- if (!g_file_get_contents (cert_file, &cert_data, &cert_len, error))
- return NULL;
- p = cert_data;
- cert_pem = parse_next_pem_certificate (&p, p + cert_len, TRUE, error);
- g_free (cert_data);
- if (error && *error)
+ if (!g_file_get_contents (key_file, &key_data, &key_len, error))
return NULL;
- if (!g_file_get_contents (key_file, &key_data, &key_len, error))
- {
- g_free (cert_pem);
- return NULL;
- }
key_pem = parse_private_key (key_data, key_len, TRUE, error);
g_free (key_data);
- if (error && *error)
+ if (!key_pem)
+ return NULL;
+
+ if (!g_file_get_contents (cert_file, &cert_data, &cert_len, error))
{
- g_free (cert_pem);
+ g_free (key_pem);
return NULL;
}
- cert = g_tls_certificate_new_internal (cert_pem, key_pem, error);
- g_free (cert_pem);
+ cert = parse_and_create_certificate (cert_data, cert_len, key_pem, error);
+ g_free (cert_data);
g_free (key_pem);
return cert;
}
@@ -448,13 +584,13 @@ g_tls_certificate_new_from_files (const gchar *cert_file,
* @file: file containing PEM-encoded certificates to import
* @error: #GError for error reporting, or %NULL to ignore.
*
- * Creates one or more #GTlsCertificates from the PEM-encoded
+ * Creates one or more #GTlsCertificates from the PEM-encoded
* data in @file. If @file cannot be read or parsed, the function will
* return %NULL and set @error. If @file does not contain any
* PEM-encoded certificates, this will return an empty list and not
* set @error.
*
- * Return value: (element-type Gio.TlsCertificate) (transfer full): a
+ * Returns: (element-type Gio.TlsCertificate) (transfer full): a
* #GList containing #GTlsCertificate objects. You must free the list
* and its contents when you are done with it.
*
@@ -478,19 +614,24 @@ g_tls_certificate_list_new_from_file (const gchar *file,
{
gchar *cert_pem;
GTlsCertificate *cert = NULL;
+ GError *parse_error = NULL;
- cert_pem = parse_next_pem_certificate (&p, end, FALSE, error);
+ cert_pem = parse_next_pem_certificate (&p, end, FALSE, &parse_error);
if (cert_pem)
- {
- cert = g_tls_certificate_new_internal (cert_pem, NULL, error);
- g_free (cert_pem);
- }
+ {
+ cert = g_tls_certificate_new_internal (cert_pem, NULL, NULL, &parse_error);
+ g_free (cert_pem);
+ }
if (!cert)
- {
- g_list_free_full (queue.head, g_object_unref);
- queue.head = NULL;
- break;
- }
+ {
+ if (parse_error)
+ {
+ g_propagate_error (error, parse_error);
+ g_list_free_full (queue.head, g_object_unref);
+ queue.head = NULL;
+ }
+ break;
+ }
g_queue_push_tail (&queue, cert);
}
@@ -505,7 +646,7 @@ g_tls_certificate_list_new_from_file (const gchar *file,
*
* Gets the #GTlsCertificate representing @cert's issuer, if known
*
- * Return value: (transfer none): The certificate of @cert's issuer,
+ * Returns: (transfer none): The certificate of @cert's issuer,
* or %NULL if @cert is self-signed or signed with an unknown
* certificate.
*
@@ -549,7 +690,7 @@ g_tls_certificate_get_issuer (GTlsCertificate *cert)
* (All other #GTlsCertificateFlags values will always be set or unset
* as appropriate.)
*
- * Return value: the appropriate #GTlsCertificateFlags
+ * Returns: the appropriate #GTlsCertificateFlags
*
* Since: 2.28
*/
@@ -560,3 +701,40 @@ g_tls_certificate_verify (GTlsCertificate *cert,
{
return G_TLS_CERTIFICATE_GET_CLASS (cert)->verify (cert, identity, trusted_ca);
}
+
+/**
+ * g_tls_certificate_is_same:
+ * @cert_one: first certificate to compare
+ * @cert_two: second certificate to compare
+ *
+ * Check if two #GTlsCertificate objects represent the same certificate.
+ * The raw DER byte data of the two certificates are checked for equality.
+ * This has the effect that two certificates may compare equal even if
+ * their #GTlsCertificate:issuer, #GTlsCertificate:private-key, or
+ * #GTlsCertificate:private-key-pem properties differ.
+ *
+ * Returns: whether the same or not
+ *
+ * Since: 2.34
+ */
+gboolean
+g_tls_certificate_is_same (GTlsCertificate *cert_one,
+ GTlsCertificate *cert_two)
+{
+ GByteArray *b1, *b2;
+ gboolean equal;
+
+ g_return_val_if_fail (G_IS_TLS_CERTIFICATE (cert_one), FALSE);
+ g_return_val_if_fail (G_IS_TLS_CERTIFICATE (cert_two), FALSE);
+
+ g_object_get (cert_one, "certificate", &b1, NULL);
+ g_object_get (cert_two, "certificate", &b2, NULL);
+
+ equal = (b1->len == b2->len &&
+ memcmp (b1->data, b2->data, b1->len) == 0);
+
+ g_byte_array_unref (b1);
+ g_byte_array_unref (b2);
+
+ return equal;
+}