From: Nikos Mavrogiannopoulos Date: Tue, 5 Mar 2013 20:28:56 +0000 (+0100) Subject: Added functions that remove certificates from a trust list. X-Git-Tag: gnutls_3_1_10~54 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5eb64ff2eab8dc02876123e21d1230808fe75008;p=thirdparty%2Fgnutls.git Added functions that remove certificates from a trust list. --- diff --git a/NEWS b/NEWS index fe8fe673d7..10b3b44b4a 100644 --- a/NEWS +++ b/NEWS @@ -21,6 +21,9 @@ gnutls_x509_crt_get_issuer_dn2: Added gnutls_x509_crt_get_dn2: Added gnutls_x509_crl_get_issuer_dn2: Added gnutls_x509_crq_get_dn2: Added +gnutls_x509_trust_list_remove_trust_mem: Added +gnutls_x509_trust_list_remove_trust_file: Added +gnutls_x509_trust_list_remove_cas: Added * Version 3.1.9 (released 2013-02-27) diff --git a/lib/includes/gnutls/x509.h b/lib/includes/gnutls/x509.h index 46bd2247b7..f460cd293a 100644 --- a/lib/includes/gnutls/x509.h +++ b/lib/includes/gnutls/x509.h @@ -1040,6 +1040,9 @@ extern "C" int gnutls_x509_trust_list_add_cas (gnutls_x509_trust_list_t list, const gnutls_x509_crt_t * clist, int clist_size, unsigned int flags); + int gnutls_x509_trust_list_remove_cas(gnutls_x509_trust_list_t list, + const gnutls_x509_crt_t * clist, + int clist_size); int gnutls_x509_trust_list_add_named_crt (gnutls_x509_trust_list_t list, gnutls_x509_crt_t cert, const void* name, size_t name_size, unsigned int flags); @@ -1094,6 +1097,16 @@ gnutls_x509_trust_list_add_trust_file(gnutls_x509_trust_list_t list, unsigned int tl_flags, unsigned int tl_vflags); +int +gnutls_x509_trust_list_remove_trust_file(gnutls_x509_trust_list_t list, + const char* ca_file, + gnutls_x509_crt_fmt_t type); + +int +gnutls_x509_trust_list_remove_trust_mem(gnutls_x509_trust_list_t list, + const gnutls_datum_t * cas, + gnutls_x509_crt_fmt_t type); + int gnutls_x509_trust_list_add_system_trust(gnutls_x509_trust_list_t list, unsigned int tl_flags, unsigned int tl_vflags); diff --git a/lib/libgnutls.map b/lib/libgnutls.map index 2fd42760f2..3a793a1521 100644 --- a/lib/libgnutls.map +++ b/lib/libgnutls.map @@ -897,6 +897,9 @@ GNUTLS_3_1_0 { gnutls_x509_crt_get_dn2; gnutls_x509_crl_get_issuer_dn2; gnutls_x509_crq_get_dn2; + gnutls_x509_trust_list_remove_trust_mem; + gnutls_x509_trust_list_remove_trust_file; + gnutls_x509_trust_list_remove_cas; } GNUTLS_3_0_0; GNUTLS_PRIVATE { diff --git a/lib/system.c b/lib/system.c index c0400d8113..855b629534 100644 --- a/lib/system.c +++ b/lib/system.c @@ -469,8 +469,7 @@ int add_system_trust(gnutls_x509_trust_list_t list, unsigned int tl_flags, unsig # include # include static int load_dir_certs(const char* dirname, gnutls_x509_trust_list_t list, - unsigned int tl_flags, unsigned int tl_vflags, unsigned type, - unsigned check_revoked) + unsigned int tl_flags, unsigned int tl_vflags, unsigned type) { DIR * dirp; struct dirent *d; @@ -486,16 +485,6 @@ char path[GNUTLS_PATH_MAX]; d = readdir(dirp); if (d != NULL && d->d_type == DT_REG) { - - if (check_revoked) - { - snprintf(path, sizeof(path), - "/data/misc/keychain/cacerts-removed/%s", d->d_name); - if (access(path, R_OK) == 0) - /* revoked -> do not add */ - continue; - } - snprintf(path, sizeof(path), "%s/%s", dirname, d->d_name); ret = gnutls_x509_trust_list_add_trust_file(list, path, NULL, type, tl_flags, tl_vflags); @@ -510,6 +499,37 @@ char path[GNUTLS_PATH_MAX]; return r; } +static int load_revoked_certs(gnutls_x509_trust_list_t list, + unsigned int tl_flags, unsigned int tl_vflags, unsigned type) +{ +DIR * dirp; +struct dirent *d; +int ret; +int r = 0; +char path[GNUTLS_PATH_MAX]; + + dirp = opendir("/data/misc/keychain/cacerts-removed/"); + if (dirp != NULL) + { + do + { + d = readdir(dirp); + if (d != NULL && d->d_type == DT_REG) + { + snprintf(path, sizeof(path), "/data/misc/keychain/cacerts-removed/%s", d->d_name); + + ret = gnutls_x509_trust_list_remove_trust_file(list, path, type); + if (ret >= 0) + r += ret; + } + } + while(d != NULL); + closedir(dirp); + } + + return r; +} + /* This works on android 4.x */ static @@ -517,14 +537,18 @@ int add_system_trust(gnutls_x509_trust_list_t list, unsigned int tl_flags, unsig { int r = 0, ret; - ret = load_dir_certs("/system/etc/security/cacerts/", list, tl_flags, tl_vflags, GNUTLS_X509_FMT_PEM, 1); + ret = load_dir_certs("/system/etc/security/cacerts/", list, tl_flags, tl_vflags, GNUTLS_X509_FMT_PEM); if (ret >= 0) r += ret; - ret = load_dir_certs("/data/misc/keychain/cacerts-added/", list, tl_flags, tl_vflags, GNUTLS_X509_FMT_DER, 0); + ret = load_dir_certs("/data/misc/keychain/cacerts-added/", list, tl_flags, tl_vflags, GNUTLS_X509_FMT_DER); if (ret >= 0) r += ret; - + + ret = load_revoked_certs(list, tl_flags, tl_vflags); + if (ret >= 0) + r -= ret; + return r; } #else @@ -699,3 +723,4 @@ const char *src = data; return 0; } #endif + diff --git a/lib/x509/verify-high.c b/lib/x509/verify-high.c index ace0bf2672..d5069a45ee 100644 --- a/lib/x509/verify-high.c +++ b/lib/x509/verify-high.c @@ -184,6 +184,48 @@ gnutls_x509_trust_list_add_cas(gnutls_x509_trust_list_t list, return i; } +/** + * gnutls_x509_trust_list_remove_cas: + * @list: The structure of the list + * @clist: A list of CAs + * @clist_size: The length of the CA list + * + * This function will remove the given certificate authorities + * from the trusted list. + * + * Returns: The number of removed elements is returned. + * + * Since: 3.1.10 + **/ +int +gnutls_x509_trust_list_remove_cas(gnutls_x509_trust_list_t list, + const gnutls_x509_crt_t * clist, + int clist_size) +{ + int i, r = 0; + unsigned j; + uint32_t hash; + + for (i = 0; i < clist_size; i++) + { + hash = hash_pjw_bare(clist[i]->raw_dn.data, clist[i]->raw_dn.size); + hash %= list->size; + + for (j=0;jnode[hash].trusted_ca_size;j++) + { + if (_gnutls_check_if_same_cert(clist[i], list->node[hash].trusted_cas[j]) != 0) + { + list->node[hash].trusted_cas[j] = + list->node[hash].trusted_cas[list->node[hash].trusted_ca_size-1]; + list->node[hash].trusted_ca_size--; + r++; + } + } + } + + return r; +} + /** * gnutls_x509_trust_list_add_named_crt: * @list: The structure of the list diff --git a/lib/x509/verify-high2.c b/lib/x509/verify-high2.c index 039d312e40..623a402855 100644 --- a/lib/x509/verify-high2.c +++ b/lib/x509/verify-high2.c @@ -99,6 +99,50 @@ gnutls_x509_trust_list_add_trust_mem(gnutls_x509_trust_list_t list, return r; } +/** + * gnutls_x509_trust_list_remove_trust_mem: + * @list: The structure of the list + * @cas: A buffer containing a list of CAs (optional) + * @type: The format of the certificates + * + * This function will add the given certificate authorities + * to the trusted list. + * + * Returns: The number of added elements is returned. + * + * Since: 3.1.10 + **/ +int +gnutls_x509_trust_list_remove_trust_mem(gnutls_x509_trust_list_t list, + const gnutls_datum_t * cas, + gnutls_x509_crt_fmt_t type) +{ + int ret; + gnutls_x509_crt_t *x509_ca_list = NULL; + unsigned int x509_ncas; + unsigned int r = 0, i; + + if (cas != NULL && cas->data != NULL) + { + ret = gnutls_x509_crt_list_import2( &x509_ca_list, &x509_ncas, cas, type, 0); + if (ret < 0) + return gnutls_assert_val(ret); + + ret = gnutls_x509_trust_list_remove_cas(list, x509_ca_list, x509_ncas); + + for (i=0;i