15 #include "tlsgnutlsclient.h"
40 void GnuTLSClient::init()
42 const int protocolPriority[] = { GNUTLS_TLS1, GNUTLS_SSL3, 0 };
43 const int kxPriority[] = { GNUTLS_KX_RSA, 0 };
44 const int cipherPriority[] = { GNUTLS_CIPHER_AES_256_CBC, GNUTLS_CIPHER_AES_128_CBC,
45 GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_ARCFOUR, 0 };
46 const int compPriority[] = { GNUTLS_COMP_ZLIB, GNUTLS_COMP_NULL, 0 };
47 const int macPriority[] = { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, 0 };
49 if( gnutls_global_init() != 0 )
55 if( gnutls_certificate_allocate_credentials( &m_credentials ) < 0 )
61 if( gnutls_init( m_session, GNUTLS_CLIENT ) != 0 )
63 gnutls_certificate_free_credentials( m_credentials );
68 gnutls_protocol_set_priority( *m_session, protocolPriority );
69 gnutls_cipher_set_priority( *m_session, cipherPriority );
70 gnutls_compression_set_priority( *m_session, compPriority );
71 gnutls_kx_set_priority( *m_session, kxPriority );
72 gnutls_mac_set_priority( *m_session, macPriority );
73 gnutls_credentials_set( *m_session, GNUTLS_CRD_CERTIFICATE, m_credentials );
75 gnutls_transport_set_ptr( *m_session, (gnutls_transport_ptr_t)
this );
76 gnutls_transport_set_push_function( *m_session, pushFunc );
77 gnutls_transport_set_pull_function( *m_session, pullFunc );
84 StringList::const_iterator it = m_cacerts.begin();
85 for( ; it != m_cacerts.end(); ++it )
86 gnutls_certificate_set_x509_trust_file( m_credentials, (*it).c_str(), GNUTLS_X509_FMT_PEM );
91 m_clientKey = clientKey;
92 m_clientCerts = clientCerts;
94 if( !m_clientKey.empty() && !m_clientCerts.empty() )
96 gnutls_certificate_set_x509_key_file( m_credentials, m_clientCerts.c_str(),
97 m_clientKey.c_str(), GNUTLS_X509_FMT_PEM );
101 void GnuTLSClient::getCertInfo()
106 gnutls_certificate_free_ca_names( m_credentials );
108 if( gnutls_certificate_verify_peers2( *m_session, &status ) < 0 )
112 if( status & GNUTLS_CERT_INVALID )
114 if( status & GNUTLS_CERT_SIGNER_NOT_FOUND )
116 if( status & GNUTLS_CERT_REVOKED )
118 if( status & GNUTLS_CERT_SIGNER_NOT_CA )
120 const gnutls_datum_t* certList = 0;
121 unsigned int certListSize;
122 if( !error && ( ( certList = gnutls_certificate_get_peers( *m_session, &certListSize ) ) == 0 ) )
125 gnutls_x509_crt_t *cert =
new gnutls_x509_crt_t[certListSize+1];
126 for(
unsigned int i=0; !error && ( i<certListSize ); ++i )
128 if( !error && ( gnutls_x509_crt_init( &cert[i] ) < 0
129 || gnutls_x509_crt_import( cert[i], &certList[i], GNUTLS_X509_FMT_DER ) < 0 ) )
133 if( ( gnutls_x509_crt_check_issuer( cert[certListSize-1], cert[certListSize-1] ) > 0 )
134 && certListSize > 0 )
138 for(
unsigned int i=1; !error && ( i<certListSize ); ++i )
140 chain = error = !verifyAgainst( cert[i-1], cert[i] );
144 m_certInfo.
chain = chain;
146 m_certInfo.
chain = verifyAgainstCAs( cert[certListSize], 0 , 0 );
148 int t = (int)gnutls_x509_crt_get_activation_time( cert[0] );
151 else if( t > time( 0 ) )
155 t = (
int)gnutls_x509_crt_get_expiration_time( cert[0] );
158 else if( t < time( 0 ) )
163 size_t nameSize =
sizeof( name );
164 gnutls_x509_crt_get_issuer_dn( cert[0], name, &nameSize );
167 nameSize =
sizeof( name );
168 gnutls_x509_crt_get_dn( cert[0], name, &nameSize );
172 info = gnutls_compression_get_name( gnutls_compression_get( *m_session ) );
176 info = gnutls_mac_get_name( gnutls_mac_get( *m_session ) );
178 m_certInfo.
mac = info;
180 info = gnutls_cipher_get_name( gnutls_cipher_get( *m_session ) );
184 info = gnutls_protocol_get_name( gnutls_protocol_get_version( *m_session ) );
188 if( !gnutls_x509_crt_check_hostname( cert[0], m_server.c_str() ) )
191 for(
unsigned int i=0; i<certListSize; ++i )
192 gnutls_x509_crt_deinit( cert[i] );
199 static bool verifyCert( gnutls_x509_crt_t cert,
unsigned result )
201 return ! ( ( result & GNUTLS_CERT_INVALID )
202 || gnutls_x509_crt_get_expiration_time( cert ) < time( 0 )
203 || gnutls_x509_crt_get_activation_time( cert ) > time( 0 ) );
206 bool GnuTLSClient::verifyAgainst( gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer )
209 gnutls_x509_crt_verify( cert, &issuer, 1, 0, &result );
210 return verifyCert( cert, result );
213 bool GnuTLSClient::verifyAgainstCAs( gnutls_x509_crt_t cert, gnutls_x509_crt_t *CAList,
int CAListSize )
216 gnutls_x509_crt_verify( cert, CAList, CAListSize, GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT, &result );
217 return verifyCert( cert, result );
222 #endif // HAVE_GNUTLS