AC_ARG_WITH([default-trust-store-file],
[AS_HELP_STRING([--with-default-trust-store-file=FILE],
[use the given file default trust store])], with_default_trust_store_file="$withval",
- [if test "$build" = "$host";then
+ [if test "$build" = "$host" && test x$with_default_trust_store_pkcs11 = x;then
for i in \
/etc/ssl/ca-bundle.pem \
/etc/ssl/certs/ca-certificates.crt \
/usr/local/share/certs/ca-root-nss.crt \
/etc/ssl/cert.pem
do
- if test -e $i; then
+ if test -e "$i"; then
with_default_trust_store_file="$i"
break
fi
AC_MSG_NOTICE([System files:
- Trust store pkcs: $with_default_trust_store_pkcs11
+ Trust store pkcs11: $with_default_trust_store_pkcs11
Trust store file: $with_default_trust_store_file
Blacklist file: $with_default_blacklist_file
CRL file: $with_default_crl_file
};
-struct gnutls_x509_trust_list_st {
- unsigned int size;
- struct node_st *node;
-
- gnutls_x509_crt_t *blacklisted;
- unsigned int blacklisted_size;
-};
-
#define DEFAULT_SIZE 127
/**
unsigned int size)
{
gnutls_x509_trust_list_t tmp;
-
+
FAIL_IF_LIB_ERROR;
-
+
tmp =
gnutls_calloc(1, sizeof(struct gnutls_x509_trust_list_st));
}
gnutls_free(list->node);
+ gnutls_free(list->pkcs11_token);
gnutls_free(list);
}
gnutls_assert();
return NULL;
}
-
+
ret = _gnutls_x509_crt_cpy(dst, src);
if (ret < 0) {
gnutls_assert();
return NULL;
}
-
+
return dst;
}
break;
}
}
-
+
/* Add the CA (or plain) certificate to the black list as well.
* This will prevent a subordinate CA from being valid, and
* ensure that a server certificate will also get rejected.
if (blacklist_size == 0)
return 0;
-
+
for (i=0;i<cert_list_size;i++) {
for (j=0;j<blacklist_size;j++) {
if (_gnutls_check_if_same_cert(cert_list[i], blacklist[j]) != 0) {
return 0;
}
- *verify =
- _gnutls_x509_verify_certificate(cert_list, cert_list_size,
- list->node[hash].trusted_cas,
- list->
- node[hash].trusted_ca_size,
- flags, func);
+#ifdef ENABLE_PKCS11
+ if (list->pkcs11_token) {
+ /* use the token for verification */
+
+ *verify = _gnutls_pkcs11_verify_certificate(list->pkcs11_token,
+ cert_list, cert_list_size,
+ flags, func);
+ } else
+#endif
+ {
+ *verify =
+ _gnutls_x509_verify_certificate(cert_list, cert_list_size,
+ list->node[hash].trusted_cas,
+ list->
+ node[hash].trusted_ca_size,
+ flags, func);
+ }
if (*verify != 0 || (flags & GNUTLS_VERIFY_DISABLE_CRL_CHECKS))
return 0;
* @verify: will hold the certificate verification output.
* @func: If non-null will be called on each chain element verification with the output.
*
- * This function will try to find a certificate that is associated with the provided
- * name --see gnutls_x509_trust_list_add_named_crt(). If a match is found the certificate is considered valid. In addition to that
- * this function will also check CRLs. The @verify parameter will hold an OR'ed sequence of
- * %gnutls_certificate_status_t flags.
+ * This function will try to find a certificate that is associated with the provided
+ * name --see gnutls_x509_trust_list_add_named_crt(). If a match is found the certificate is considered valid.
+ * In addition to that this function will also check CRLs.
+ * The @verify parameter will hold an OR'ed sequence of %gnutls_certificate_status_t flags.
*
* Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
* negative error value.
*
*/
+#ifndef VERIFY_HIGH_H
+# define VERIFY_HIGH_H
+
+struct gnutls_x509_trust_list_st {
+ unsigned int size;
+ struct node_st *node;
+
+ gnutls_x509_crt_t *blacklisted;
+ unsigned int blacklisted_size;
+
+ char* pkcs11_token;
+};
+
int _gnutls_trustlist_inlist(gnutls_x509_trust_list_t list,
gnutls_x509_crt_t cert);
+
+#endif
}
#ifdef ENABLE_PKCS11
-static
-int import_pkcs11_url(gnutls_x509_trust_list_t list, const char *ca_file,
- unsigned int flags)
-{
- gnutls_x509_crt_t *xcrt_list = NULL;
- gnutls_pkcs11_obj_t *pcrt_list = NULL;
- unsigned int pcrt_list_size = 0, i;
- int ret;
-
- ret =
- gnutls_pkcs11_obj_list_import_url2(&pcrt_list, &pcrt_list_size,
- ca_file,
- GNUTLS_PKCS11_OBJ_ATTR_CRT_TRUSTED_CA,
- 0);
- if (ret < 0)
- return gnutls_assert_val(ret);
-
- if (pcrt_list_size == 0) {
- ret = 0;
- goto cleanup;
- }
-
- xcrt_list =
- gnutls_malloc(sizeof(gnutls_x509_crt_t) * pcrt_list_size);
- if (xcrt_list == NULL) {
- ret = GNUTLS_E_MEMORY_ERROR;
- goto cleanup;
- }
-
- ret =
- gnutls_x509_crt_list_import_pkcs11(xcrt_list, pcrt_list_size,
- pcrt_list, 0);
- if (ret < 0) {
- gnutls_assert();
- goto cleanup;
- }
-
- ret =
- gnutls_x509_trust_list_add_cas(list, xcrt_list, pcrt_list_size,
- flags);
-
- cleanup:
- for (i = 0; i < pcrt_list_size; i++)
- gnutls_pkcs11_obj_deinit(pcrt_list[i]);
- gnutls_free(pcrt_list);
- gnutls_free(xcrt_list);
-
- return ret;
-}
-
static
int remove_pkcs11_url(gnutls_x509_trust_list_t list, const char *ca_file)
{
#ifdef ENABLE_PKCS11
if (strncmp(ca_file, "pkcs11:", 7) == 0) {
- ret = import_pkcs11_url(list, ca_file, tl_flags);
- if (ret < 0)
- return gnutls_assert_val(ret);
+ list->pkcs11_token = strdup(ca_file);
+
+ return 0;
} else
#endif
{
return 0;
}
+#ifdef ENABLE_PKCS11
+/* Verify X.509 certificate chain using a PKCS #11 token.
+ *
+ * Note that the return value is an OR of GNUTLS_CERT_* elements.
+ *
+ * This function verifies a X.509 certificate list. The certificate
+ * list should lead to a trusted certificate in order to be trusted.
+ */
+unsigned int
+_gnutls_pkcs11_verify_certificate(const char* url,
+ const gnutls_x509_crt_t * certificate_list,
+ int clist_size,
+ unsigned int flags,
+ gnutls_verify_output_function func)
+{
+ int ret;
+ unsigned int status = 0;
+ gnutls_x509_crt_t issuer = NULL;
+ gnutls_datum_t raw_issuer = {NULL, 0};
+
+ if (clist_size > 1) {
+ /* Check if the last certificate in the path is self signed.
+ * In that case ignore it (a certificate is trusted only if it
+ * leads to a trusted party by us, not the server's).
+ *
+ * This prevents from verifying self signed certificates against
+ * themselves. This (although not bad) caused verification
+ * failures on some root self signed certificates that use the
+ * MD2 algorithm.
+ */
+ if (gnutls_x509_crt_check_issuer
+ (certificate_list[clist_size - 1],
+ certificate_list[clist_size - 1]) != 0) {
+ clist_size--;
+ }
+ }
+
+ ret = gnutls_pkcs11_get_raw_issuer(url, certificate_list[clist_size - 1],
+ &raw_issuer, GNUTLS_X509_FMT_DER, 0);
+ if (ret < 0) {
+ gnutls_assert();
+ status |= GNUTLS_CERT_INVALID;
+ status |= GNUTLS_CERT_SIGNER_NOT_FOUND;
+ return status;
+ }
+
+ ret = gnutls_x509_crt_init(&issuer);
+ if (ret < 0) {
+ gnutls_assert();
+ status |= GNUTLS_CERT_INVALID;
+ status |= GNUTLS_CERT_SIGNER_NOT_FOUND;
+ goto cleanup;
+ }
+
+ ret = gnutls_x509_crt_import(issuer, &raw_issuer, GNUTLS_X509_FMT_DER);
+ if (ret < 0) {
+ gnutls_assert();
+ status |= GNUTLS_CERT_INVALID;
+ status |= GNUTLS_CERT_SIGNER_NOT_FOUND;
+ goto cleanup;
+ }
+
+ status = _gnutls_x509_verify_certificate(certificate_list, clist_size,
+ &issuer, 1, flags, func);
+
+cleanup:
+ gnutls_free(raw_issuer.data);
+ if (issuer != NULL)
+ gnutls_x509_crt_deinit(issuer);
+
+ return status;
+}
+#endif
+
/* This will return the appropriate hash to verify the given signature.
* If signature is NULL it will return an (or the) appropriate hash for
* the given parameters.
unsigned int flags,
gnutls_verify_output_function func);
+#ifdef ENABLE_PKCS11
+unsigned int
+_gnutls_pkcs11_verify_certificate(const char* url,
+ const gnutls_x509_crt_t * certificate_list,
+ int clist_size,
+ unsigned int flags,
+ gnutls_verify_output_function func);
+#endif
+
int _gnutls_is_same_dn(gnutls_x509_crt_t cert1, gnutls_x509_crt_t cert2);
int
projects / thirdparty / gnutls.git / commitdiff
