-*/
static int
_gnutls_openpgp_crt_verify_peers(gnutls_session_t session,
+ gnutls_x509_subject_alt_name_t type,
const char *hostname,
unsigned int *status)
{
/* Verify certificate
*/
ret =
- _gnutls_openpgp_verify_key(cred, hostname,
+ _gnutls_openpgp_verify_key(cred, type, hostname,
&info->raw_certificate_list[0],
peer_certificate_list_size,
verify_flags,
* using gnutls_certificate_set_verify_flags(). See the documentation
* of gnutls_certificate_verify_peers2() for details in the verification process.
*
- * The acceptable @data types are %GNUTLS_DT_DNS_HOSTNAME and %GNUTLS_DT_KEY_PURPOSE_OID.
- * The former accepts as data a null-terminated hostname, and the latter a null-terminated
+ * The acceptable @data types are %GNUTLS_DT_DNS_HOSTNAME, %GNUTLS_DT_RFC822NAME and %GNUTLS_DT_KEY_PURPOSE_OID.
+ * The former two accept as data a null-terminated hostname or email address, and the latter a null-terminated
* object identifier (e.g., %GNUTLS_KP_TLS_WWW_SERVER).
* If a DNS hostname is provided then this function will compare
* the hostname in the certificate against the given. If names do not match the
{
cert_auth_info_t info;
const char *hostname = NULL;
- unsigned i;
+ unsigned i, type = 0;
CHECK_AUTH(GNUTLS_CRD_CERTIFICATE, GNUTLS_E_INVALID_REQUEST);
case GNUTLS_CRT_OPENPGP:
for (i=0;i<elements;i++) {
if (data[i].type == GNUTLS_DT_DNS_HOSTNAME) {
- hostname = (void*)data[i].data;
+ hostname = (char*)data[i].data;
+ type = GNUTLS_SAN_DNSNAME;
+ break;
+ } else if (data[i].type == GNUTLS_DT_RFC822NAME) {
+ hostname = (char*)data[i].data;
+ type = GNUTLS_SAN_RFC822NAME;
break;
}
}
- return _gnutls_openpgp_crt_verify_peers(session, hostname,
+ return _gnutls_openpgp_crt_verify_peers(session,
+ type,
+ hostname,
status);
#endif
default:
* gnutls_vdata_types_t:
* @GNUTLS_DT_UNKNOWN: Unknown data type.
* @GNUTLS_DT_DNS_HOSTNAME: The data contain a null-terminated DNS hostname.
+ * @GNUTLS_DT_RFC822NAME: The data contain a null-terminated email address.
* @GNUTLS_DT_KEY_PURPOSE_OID: The data contain a null-terminated key purpose OID.
*
* Enumeration of different key exchange algorithms.
typedef enum {
GNUTLS_DT_UNKNOWN = 0,
GNUTLS_DT_DNS_HOSTNAME = 1,
- GNUTLS_DT_KEY_PURPOSE_OID = 2
+ GNUTLS_DT_KEY_PURPOSE_OID = 2,
+ GNUTLS_DT_RFC822NAME = 3
} gnutls_vdata_types_t;
typedef struct {
const char *hostname);
int gnutls_openpgp_crt_check_hostname2(gnutls_openpgp_crt_t key,
const char *hostname, unsigned int flags);
+int
+gnutls_openpgp_crt_check_email(gnutls_openpgp_crt_t key, const char *email, unsigned flags);
int gnutls_openpgp_crt_get_revoked_status(gnutls_openpgp_crt_t key);
const char *hostname);
int gnutls_x509_crt_check_hostname2(gnutls_x509_crt_t cert,
const char *hostname, unsigned int flags);
+int
+gnutls_x509_crt_check_email(gnutls_x509_crt_t cert,
+ const char *email, unsigned int flags);
int gnutls_x509_crt_get_signature_algorithm(gnutls_x509_crt_t cert);
int gnutls_x509_crt_get_signature(gnutls_x509_crt_t cert,
gnutls_do_send_supplemental;
gnutls_ext_get_data;
gnutls_ext_set_data;
+ gnutls_openpgp_crt_check_email;
+ gnutls_x509_crt_check_email;
local:
*;
};
* Verify all signatures in the certificate list. When the key
* is not available, the signature is skipped.
*
- * The return value is one of the CertificateStatus entries.
+ * Returns: a negative error code on error and %GNUTLS_E_SUCCESS (0) on success.
*
* NOTE: this function does not verify using any "web of trust". You
* may use GnuPG for that purpose, or any other external PGP application.
-*/
int
_gnutls_openpgp_verify_key(const gnutls_certificate_credentials_t cred,
+ gnutls_x509_subject_alt_name_t type,
const char *hostname,
const gnutls_datum_t * cert_list,
int cert_list_length,
const gnutls_certificate_credentials_t cred,
uint8_t * key_fpr, int key_fpr_size);
-int _gnutls_openpgp_verify_key(const gnutls_certificate_credentials_t,
- const char *hostname,
- const gnutls_datum_t * cert_list,
- int cert_list_length,
- unsigned int verify_flags,
- unsigned int *status);
+int
+_gnutls_openpgp_verify_key(const gnutls_certificate_credentials_t cred,
+ gnutls_x509_subject_alt_name_t type,
+ const char *hostname,
+ const gnutls_datum_t * cert_list,
+ int cert_list_length,
+ unsigned int verify_flags,
+ unsigned int *status);
int _gnutls_openpgp_fingerprint(const gnutls_datum_t * cert,
unsigned char *fpr, size_t * fprlen);
time_t _gnutls_openpgp_get_raw_key_creation_time(const gnutls_datum_t *
return 0;
}
+/**
+ * gnutls_openpgp_crt_check_email:
+ * @key: should contain a #gnutls_openpgp_crt_t type
+ * @email: A null terminated string that contains an RFC822 address (email)
+ * @flags: gnutls_certificate_verify_flags
+ *
+ * This function will check if the given key's owner matches the
+ * given email address.
+ *
+ * Returns: non-zero for a successful match, and zero on failure.
+ **/
+int
+gnutls_openpgp_crt_check_email(gnutls_openpgp_crt_t key,
+ const char *email, unsigned flags)
+{
+ char rfc822name[MAX_CN];
+ size_t rfc822name_size;
+ int ret = 0;
+ int i;
+
+ /* Check through all included names. */
+ for (i = 0; !(ret < 0); i++) {
+ rfc822name_size = sizeof(rfc822name);
+ ret =
+ gnutls_openpgp_crt_get_name(key, i, rfc822name,
+ &rfc822name_size);
+
+ if (ret == 0) {
+ /* Length returned by gnutls_openpgp_crt_get_name includes
+ the terminating (0). */
+ rfc822name_size--;
+
+ if (_gnutls_hostname_compare
+ (rfc822name, rfc822name_size, email, GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS))
+ return 1;
+ }
+ }
+
+ /* not found a matching name */
+ return 0;
+}
+
unsigned int _gnutls_get_pgp_key_usage(unsigned int cdk_usage)
{
unsigned int usage = 0;
verify-high.c \
verify-high2.c \
verify-high.h \
- x509_ext.c
+ x509_ext.c \
+ email-verify.c
if ENABLE_OCSP
libgnutls_x509_la_SOURCES += ocsp.c ocsp_output.c
--- /dev/null
+/*
+ * Copyright (C) 2003-2012 Free Software Foundation, Inc.
+ * Copyright (C) 2002 Andrew McDonald
+ *
+ * This file is part of GnuTLS.
+ *
+ * The GnuTLS is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public License
+ * as published by the Free Software Foundation; either version 2.1 of
+ * the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_str.h>
+#include <x509_int.h>
+#include <common.h>
+#include <gnutls_errors.h>
+#include <system.h>
+#include <gnutls-idna.h>
+
+static int has_embedded_null(const char *str, unsigned size)
+{
+ if (strlen(str) != size)
+ return 1;
+ return 0;
+}
+
+/**
+ * gnutls_x509_crt_check_email:
+ * @cert: should contain an gnutls_x509_crt_t type
+ * @email: A null terminated string that contains an email address (RFC822)
+ * @flags: should be zero
+ *
+ * This function will check if the given certificate's subject matches
+ * the given email address.
+ *
+ * Returns: non-zero for a successful match, and zero on failure.
+ **/
+int
+gnutls_x509_crt_check_email(gnutls_x509_crt_t cert,
+ const char *email, unsigned int flags)
+{
+ char rfc822name[MAX_CN];
+ size_t rfc822namesize;
+ int found_rfc822name = 0;
+ int ret = 0, rc;
+ int i = 0;
+ char *a_email;
+ char *a_rfc822name;
+
+ /* convert the provided email to ACE-Labels domain. */
+ rc = idna_to_ascii_8z (email, &a_email, 0);
+ if (rc != IDNA_SUCCESS) {
+ _gnutls_debug_log("unable to convert email %s to IDNA format: %s\n", email, idna_strerror (rc));
+ a_email = (char*)email;
+ }
+
+ /* try matching against:
+ * 1) an address as an alternative name (subjectAltName) extension
+ * in the certificate
+ * 2) the EMAIL field in the certificate
+ *
+ * only try (2) if there is no subjectAltName extension of
+ * type RFC822Name, and there is a single EMAIL.
+ */
+
+ /* Check through all included subjectAltName extensions, comparing
+ * against all those of type RFC822Name.
+ */
+ for (i = 0; !(ret < 0); i++) {
+
+ rfc822namesize = sizeof(rfc822name);
+ ret = gnutls_x509_crt_get_subject_alt_name(cert, i,
+ rfc822name,
+ &rfc822namesize,
+ NULL);
+
+ if (ret == GNUTLS_SAN_RFC822NAME) {
+ found_rfc822name = 1;
+
+ if (has_embedded_null(rfc822name, rfc822namesize)) {
+ _gnutls_debug_log("certificate has %s with embedded null in rfc822name\n", rfc822name);
+ continue;
+ }
+
+ rc = idna_to_ascii_8z (rfc822name, &a_rfc822name, 0);
+ if (rc != IDNA_SUCCESS) {
+ _gnutls_debug_log("unable to convert rfc822name %s to IDNA format: %s\n", rfc822name, idna_strerror (rc));
+ continue;
+ }
+
+ ret = _gnutls_hostname_compare(a_rfc822name, strlen(a_rfc822name), a_email, GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS);
+ idn_free(a_rfc822name);
+
+ if (ret != 0) {
+ ret = 1;
+ goto cleanup;
+ }
+ }
+ }
+
+ if (!found_rfc822name) {
+ /* did not get the necessary extension, use CN instead
+ */
+
+ /* enforce the RFC6125 (ยง1.8) requirement that only
+ * a single CN must be present */
+ rfc822namesize = sizeof(rfc822name);
+ ret = gnutls_x509_crt_get_dn_by_oid
+ (cert, GNUTLS_OID_PKCS9_EMAIL, 1, 0, rfc822name,
+ &rfc822namesize);
+ if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
+ ret = 0;
+ goto cleanup;
+ }
+
+ rfc822namesize = sizeof(rfc822name);
+ ret = gnutls_x509_crt_get_dn_by_oid
+ (cert, GNUTLS_OID_PKCS9_EMAIL, 0, 0, rfc822name,
+ &rfc822namesize);
+ if (ret < 0) {
+ ret = 0;
+ goto cleanup;
+ }
+
+ if (has_embedded_null(rfc822name, rfc822namesize)) {
+ _gnutls_debug_log("certificate has EMAIL %s with embedded null in name\n", rfc822name);
+ ret = 0;
+ goto cleanup;
+ }
+
+ rc = idna_to_ascii_8z (rfc822name, &a_rfc822name, 0);
+ if (rc != IDNA_SUCCESS) {
+ _gnutls_debug_log("unable to convert EMAIL %s to IDNA format: %s\n", rfc822name, idna_strerror (rc));
+ ret = 0;
+ goto cleanup;
+ }
+
+ ret = _gnutls_hostname_compare(a_rfc822name, strlen(a_rfc822name), a_email, GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS);
+
+ idn_free(a_rfc822name);
+
+ if (ret != 0) {
+ ret = 1;
+ goto cleanup;
+ }
+ }
+
+ /* not found a matching name
+ */
+ ret = 0;
+ cleanup:
+ if (a_email != email) {
+ idn_free(a_email);
+ }
+ return ret;
+}
unsigned int i;
uint32_t hash;
gnutls_x509_crt_t sorted[DEFAULT_MAX_VERIFY_DEPTH];
- const char *hostname = NULL, *purpose = NULL;
+ const char *hostname = NULL, *purpose = NULL, *email = NULL;
unsigned hostname_size = 0;
if (cert_list == NULL || cert_list_size < 1)
if (data[i].size > 0) {
hostname_size = data[i].size;
}
+ if (email != NULL) return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+ } else if (data[i].type == GNUTLS_DT_RFC822NAME) {
+ email = (void*)data[i].data;
+ if (hostname != NULL) return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
} else if (data[i].type == GNUTLS_DT_KEY_PURPOSE_OID) {
purpose = (void*)data[i].data;
}
*voutput |= GNUTLS_CERT_UNEXPECTED_OWNER|GNUTLS_CERT_INVALID;
}
+ if (email) {
+ ret =
+ gnutls_x509_crt_check_email(cert_list[0], email, 0);
+ if (ret == 0)
+ *voutput |= GNUTLS_CERT_UNEXPECTED_OWNER|GNUTLS_CERT_INVALID;
+ }
+
/* CRL checks follow */
if (*voutput != 0 || (flags & GNUTLS_VERIFY_DISABLE_CRL_CHECKS))
projects / thirdparty / gnutls.git / commitdiff
