Changeset 9d9b093 in mod_gnutls for src/gnutls_hooks.c

Timestamp:

Jan 11, 2013, 12:56:51 AM (8 years ago)

Author:

Daniel Kahn Gillmor <dkg@…>

Branches:

debian/master, debian/stretch-backports, jessie-backports, upstream

Children:

2dd044f, 8ce897a

Parents:

8df5b25

Message:

Imported Upstream version 0.5.1

File:

• src/gnutls_hooks.c (modified) (20 diffs)

src/gnutls_hooks.c

@@ -37 +37 @@
 static int mgs_cert_verify(request_rec * r, mgs_handle_t * ctxt);
 /* use side==0 for server and side==1 for client */
-static void mgs_add_common_cert_vars(request_rec * r, gnutls_x509_crt cert,
+static void mgs_add_common_cert_vars(request_rec * r, gnutls_x509_crt_t cert,
+                                     int side,
+                                     int export_certificates_enabled);
+static void mgs_add_common_pgpcert_vars(request_rec * r, gnutls_openpgp_crt_t cert,
                                      int side,
                                      int export_certificates_enabled);
@@ -69 +72 @@
 #endif
 
+    if (gnutls_check_version(LIBGNUTLS_VERSION)==NULL) {
+        fprintf(stderr, "gnutls_check_version() failed. Required: gnutls-%s Found: gnutls-%s\n", 
+          LIBGNUTLS_VERSION, gnutls_check_version(NULL));
+        return -3;
+    }
+
     ret = gnutls_global_init();
-    if (ret < 0) /* FIXME: can we print here? */
-        exit(ret);
+    if (ret < 0) {
+        fprintf(stderr, "gnutls_global_init: %s\n", gnutls_strerror(ret));
+        return -3;
+    }
+
+    ret = gnutls_global_init_extra();
+    if (ret < 0) {
+        fprintf(stderr, "gnutls_global_init_extra: %s\n", gnutls_strerror(ret));
+        return -3;
+    }
                                             
     apr_pool_cleanup_register(pconf, NULL, mgs_cleanup_pre_config,
@@ -83 +100 @@
     gnutls_global_set_log_level(9);
     gnutls_global_set_log_function(gnutls_debug_log_all);
+    apr_file_printf(debug_log_fp, "gnutls: %s\n", gnutls_check_version(NULL));
 #endif
 
     return OK;
 }
-
-/* We don't support openpgp certificates, yet */
-const static int cert_type_prio[2] = { GNUTLS_CRT_X509, 0 };
 
 static int mgs_select_virtual_server_cb(gnutls_session_t session)
@@ -96 +111 @@
     mgs_srvconf_rec *tsc;
     int ret;
+    int cprio[2];
 
     ctxt = gnutls_transport_get_ptr(session);
@@ -129 +145 @@
      */
     ret = gnutls_priority_set(session, ctxt->sc->priorities);
-    gnutls_certificate_type_set_priority(session, cert_type_prio);
-
-
     /* actually it shouldn't fail since we have checked at startup */
     if (ret < 0)
         return ret;
 
+    /* If both certificate types are not present disallow them from
+     * being negotiated.
+     */
+    if (ctxt->sc->certs_x509[0] != NULL && ctxt->sc->cert_pgp == NULL) {
+        cprio[0] = GNUTLS_CRT_X509;
+        cprio[1] = 0;
+        gnutls_certificate_type_set_priority( session, cprio);
+    } else if (ctxt->sc->cert_pgp != NULL && ctxt->sc->certs_x509[0]==NULL) {
+        cprio[0] = GNUTLS_CRT_OPENPGP;
+        cprio[1] = 0;
+        gnutls_certificate_type_set_priority( session, cprio);
+    }
 
     return 0;
@@ -146 +171 @@
     ctxt = gnutls_transport_get_ptr(session);
 
-    ret->type = GNUTLS_CRT_X509;
-    ret->ncerts = ctxt->sc->certs_x509_num;
-    ret->deinit_all = 0;
-
-    ret->cert.x509 = ctxt->sc->certs_x509;
-    ret->key.x509 = ctxt->sc->privkey_x509;
-    return 0;
-}
-
+    if (gnutls_certificate_type_get( session) == GNUTLS_CRT_X509) {
+        ret->type = GNUTLS_CRT_X509;
+        ret->ncerts = ctxt->sc->certs_x509_num;
+        ret->deinit_all = 0;
+
+        ret->cert.x509 = ctxt->sc->certs_x509;
+        ret->key.x509 = ctxt->sc->privkey_x509;
+        
+        return 0;
+    } else if (gnutls_certificate_type_get( session) == GNUTLS_CRT_OPENPGP) {
+        ret->type = GNUTLS_CRT_OPENPGP;
+        ret->ncerts = 1;
+        ret->deinit_all = 0;
+
+        ret->cert.pgp = ctxt->sc->cert_pgp;
+        ret->key.pgp = ctxt->sc->privkey_pgp;
+
+        return 0;
+    
+    }
+
+    return GNUTLS_E_INTERNAL_ERROR;
+}
+
+/* 2048-bit group parameters from SRP specification */
 const char static_dh_params[] = "-----BEGIN DH PARAMETERS-----\n"
     "MIIBBwKCAQCsa9tBMkqam/Fm3l4TiVgvr3K2ZRmH7gf8MZKUPbVgUKNzKcu0oJnt\n"
@@ -170 +211 @@
  */
 static int read_crt_cn(server_rec * s, apr_pool_t * p,
-                       gnutls_x509_crt cert, char **cert_cn)
+                       gnutls_x509_crt_t cert, char **cert_cn)
 {
     int rv = 0, i;
@@ -178 +219 @@
     *cert_cn = NULL;
 
+    data_len = 0;
     rv = gnutls_x509_crt_get_dn_by_oid(cert,
                                        GNUTLS_OID_X520_COMMON_NAME,
@@ -188 +230 @@
                                            0, *cert_cn, &data_len);
     } else {                    /* No CN return subject alternative name */
-        ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
-                     "No common name found in certificate for '%s:%d'. Looking for subject alternative name.",
+        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
+                     "No common name found in certificate for '%s:%d'. Looking for subject alternative name...",
                      s->server_hostname, s->port);
         rv = 0;
@@ -217 +259 @@
 
     return rv;
-
-}
+}
+
+static int read_pgpcrt_cn(server_rec * s, apr_pool_t * p,
+                       gnutls_openpgp_crt_t cert, char **cert_cn)
+{
+    int rv = 0;
+    size_t data_len;
+
+
+    *cert_cn = NULL;
+
+    data_len = 0;
+    rv = gnutls_openpgp_crt_get_name(cert, 0, NULL, &data_len);
+
+    if (rv == GNUTLS_E_SHORT_MEMORY_BUFFER && data_len > 1) {
+        *cert_cn = apr_palloc(p, data_len);
+        rv = gnutls_openpgp_crt_get_name(cert, 0, *cert_cn, &data_len);
+    } else {                    /* No CN return subject alternative name */
+        ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
+                     "No name found in PGP certificate for '%s:%d'.",
+                     s->server_hostname, s->port);
+    }
+
+    return rv;
+}
+
 
 int
@@ -355 +421 @@
             if (sc->enabled == GNUTLS_ENABLED_TRUE) {
                 rv = read_crt_cn(s, p, sc->certs_x509[0], &sc->cert_cn);
+                if (rv < 0 && sc->cert_pgp != NULL)  /* try openpgp certificate */
+                    rv = read_pgpcrt_cn(s, p, sc->cert_pgp, &sc->cert_cn);
+
                 if (rv < 0) {
                     ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,
@@ -483 +552 @@
     ctxt = gnutls_transport_get_ptr(session);
 
-    sni_type = gnutls_certificate_type_get(session);
-    if (sni_type != GNUTLS_CRT_X509) {
-        /* In theory, we could support OpenPGP Certificates. Theory != code. */
-        ap_log_error(APLOG_MARK, APLOG_CRIT, 0,
-                     ctxt->c->base_server,
-                     "GnuTLS: Only x509 Certificates are currently supported.");
-        return NULL;
-    }
-
     rv = gnutls_server_name_get(ctxt->session, sni_name,
                                 &data_len, &sni_type, 0);
@@ -691 +751 @@
     apr_table_setn(env, "SSL_SESSION_ID", apr_pstrdup(r->pool, tmp));
 
-    mgs_add_common_cert_vars(r, ctxt->sc->certs_x509[0], 0,
+    if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509)
+        mgs_add_common_cert_vars(r, ctxt->sc->certs_x509[0], 0,
+                             ctxt->sc->export_certificates_enabled);
+    else if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_OPENPGP)
+        mgs_add_common_pgpcert_vars(r, ctxt->sc->cert_pgp, 0,
                              ctxt->sc->export_certificates_enabled);
 
@@ -753 +817 @@
 #define MGS_SIDE ((side==0)?"SSL_SERVER":"SSL_CLIENT")
 static void
-mgs_add_common_cert_vars(request_rec * r, gnutls_x509_crt cert, int side,
+mgs_add_common_cert_vars(request_rec * r, gnutls_x509_crt_t cert, int side,
                          int export_certificates_enabled)
 {
@@ -859 +923 @@
         }
     }
-
-
-}
-
-
+}
+
+static void
+mgs_add_common_pgpcert_vars(request_rec * r, gnutls_openpgp_crt_t cert, int side,
+                         int export_certificates_enabled)
+{
+    unsigned char sbuf[64];     /* buffer to hold serials */
+    char buf[AP_IOBUFSIZE];
+    const char *tmp;
+    size_t len;
+    int ret;
+
+    apr_table_t *env = r->subprocess_env;
+
+    if (export_certificates_enabled != 0) {
+        char cert_buf[10 * 1024];
+        len = sizeof(cert_buf);
+
+        if (gnutls_openpgp_crt_export
+            (cert, GNUTLS_OPENPGP_FMT_BASE64, cert_buf, &len) >= 0)
+            apr_table_setn(env,
+                           apr_pstrcat(r->pool, MGS_SIDE, "_CERT", NULL),
+                           apr_pstrmemdup(r->pool, cert_buf, len));
+
+    }
+
+    len = sizeof(buf);
+    gnutls_openpgp_crt_get_name(cert, 0, buf, &len);
+    apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_NAME", NULL),
+                   apr_pstrmemdup(r->pool, buf, len));
+
+    len = sizeof(sbuf);
+    gnutls_openpgp_crt_get_fingerprint(cert, sbuf, &len);
+    tmp = mgs_session_id2sz(sbuf, len, buf, sizeof(buf));
+    apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_FINGERPRINT", NULL),
+                   apr_pstrdup(r->pool, tmp));
+
+    ret = gnutls_openpgp_crt_get_version(cert);
+    if (ret > 0)
+        apr_table_setn(env,
+                       apr_pstrcat(r->pool, MGS_SIDE, "_M_VERSION", NULL),
+                       apr_psprintf(r->pool, "%u", ret));
+
+    apr_table_setn(env,
+       apr_pstrcat(r->pool, MGS_SIDE, "_CERT_TYPE", NULL), "OPENPGP");
+
+    tmp =
+        mgs_time2sz(gnutls_openpgp_crt_get_expiration_time
+                    (cert), buf, sizeof(buf));
+    apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_V_END", NULL),
+                   apr_pstrdup(r->pool, tmp));
+
+    tmp =
+        mgs_time2sz(gnutls_openpgp_crt_get_creation_time
+                    (cert), buf, sizeof(buf));
+    apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_V_START", NULL),
+                   apr_pstrdup(r->pool, tmp));
+
+    ret = gnutls_openpgp_crt_get_pk_algorithm(cert, NULL);
+    if (ret >= 0) {
+        apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_A_KEY", NULL),
+                       gnutls_pk_algorithm_get_name(ret));
+    }
+
+}
+
+/* TODO: Allow client sending a X.509 certificate chain */
 static int mgs_cert_verify(request_rec * r, mgs_handle_t * ctxt)
 {
@@ -869 +995 @@
     unsigned int cert_list_size, status, expired;
     int rv, ret;
-    gnutls_x509_crt_t cert;
+    union {
+      gnutls_x509_crt_t x509;
+      gnutls_openpgp_crt_t pgp;
+    } cert;
     apr_time_t activation_time, expiration_time, cur_time;
 
@@ -895 +1024 @@
     }
 
-    gnutls_x509_crt_init(&cert);
-    rv = gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER);
+    if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509) {
+        gnutls_x509_crt_init(&cert.x509);
+        rv = gnutls_x509_crt_import(cert.x509, &cert_list[0], GNUTLS_X509_FMT_DER);
+    } else if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_OPENPGP) {
+        gnutls_openpgp_crt_init(&cert.pgp);
+        rv = gnutls_openpgp_crt_import(cert.pgp, &cert_list[0], GNUTLS_OPENPGP_FMT_RAW);
+    } else return HTTP_FORBIDDEN;
+ 
     if (rv < 0) {
-        ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
+       ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
                       "GnuTLS: Failed to Verify Peer: "
                       "Failed to import peer certificates.");
-        ret = HTTP_FORBIDDEN;
-        goto exit;
-    }
-
-    apr_time_ansi_put(&expiration_time,
-                      gnutls_x509_crt_get_expiration_time(cert));
-    apr_time_ansi_put(&activation_time,
-                      gnutls_x509_crt_get_activation_time(cert));
-
-    rv = gnutls_x509_crt_verify(cert, ctxt->sc->ca_list,
+       ret = HTTP_FORBIDDEN;
+       goto exit;
+    }
+
+    if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509) {
+        apr_time_ansi_put(&expiration_time,
+                      gnutls_x509_crt_get_expiration_time(cert.x509));
+        apr_time_ansi_put(&activation_time,
+                      gnutls_x509_crt_get_activation_time(cert.x509));
+
+        rv = gnutls_x509_crt_verify(cert.x509, ctxt->sc->ca_list,
                                 ctxt->sc->ca_list_size, 0, &status);
+    } else {
+        apr_time_ansi_put(&expiration_time,
+                      gnutls_openpgp_crt_get_expiration_time(cert.pgp));
+        apr_time_ansi_put(&activation_time,
+                      gnutls_openpgp_crt_get_creation_time(cert.pgp));
+
+        rv = gnutls_openpgp_crt_verify_ring(cert.pgp, ctxt->sc->pgp_list,
+                      0, &status);
+    }
 
     if (rv < 0) {
@@ -917 +1062 @@
                       "GnuTLS: Failed to Verify Peer certificate: (%d) %s",
                       rv, gnutls_strerror(rv));
+        if (rv == GNUTLS_E_NO_CERTIFICATE_FOUND)
+            ap_log_rerror(APLOG_MARK, APLOG_EMERG, 0, r,
+                      "GnuTLS: No certificate was found for verification. Did you set the GnuTLSX509CAFile or GnuTLSPGPKeyringFile directives?");
         ret = HTTP_FORBIDDEN;
         goto exit;
     }
+
+    /* TODO: X509 CRL Verification. */
+    /* May add later if anyone needs it.
+     */
+    /* ret = gnutls_x509_crt_check_revocation(crt, crl_list, crl_list_size); */
 
     expired = 0;
@@ -955 +1108 @@
     }
 
-    /* TODO: Further Verification. */
-    /* Revocation is X.509 non workable paradigm, I really doubt implementation
-     * is worth doing --nmav
-     */
-/// ret = gnutls_x509_crt_check_revocation(crt, crl_list, crl_list_size);
-
-//    mgs_hook_fixups(r);
-//    rv = mgs_authz_lua(r);
-
-    mgs_add_common_cert_vars(r, cert, 1,
+    if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509)
+        mgs_add_common_cert_vars(r, cert.x509, 1,
+                             ctxt->sc->export_certificates_enabled);
+    else if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_OPENPGP)
+        mgs_add_common_pgpcert_vars(r, cert.pgp, 1,
                              ctxt->sc->export_certificates_enabled);
 
@@ -988 +1136 @@
 
   exit:
-    gnutls_x509_crt_deinit(cert);
+    if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509)
+        gnutls_x509_crt_deinit(cert.x509);
+    else if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_OPENPGP)
+        gnutls_openpgp_crt_deinit(cert.pgp);
     return ret;