gloox  1.0.28
tlsgnutlsclient.cpp
1 /*
2  Copyright (c) 2005-2023 by Jakob Schröter <js@camaya.net>
3  This file is part of the gloox library. http://camaya.net/gloox
4 
5  This software is distributed under a license. The full license
6  agreement can be found in the file LICENSE in this distribution.
7  This software may not be copied, modified, sold or distributed
8  other than expressed in the named license agreement.
9 
10  This software is distributed without any warranty.
11 */
12 
13 
14 
15 #include "tlsgnutlsclient.h"
16 
17 #ifdef HAVE_GNUTLS
18 
19 #include <errno.h>
20 
21 namespace gloox
22 {
23 
24  GnuTLSClient::GnuTLSClient( TLSHandler* th, const std::string& server )
25  : GnuTLSBase( th, server )
26  {
27  }
28 
30  {
31  }
32 
34  {
36  if( m_credentials )
37  gnutls_certificate_free_credentials( m_credentials );
38  init();
39  }
40 
41  bool GnuTLSClient::init( const std::string& /*clientKey*/,
42  const std::string& /*clientCerts*/,
43  const StringList& /*cacerts*/ )
44  {
45  if( m_initLib && gnutls_global_init() != 0 )
46  return false;
47 
48  if( gnutls_certificate_allocate_credentials( &m_credentials ) < 0 )
49  return false;
50 
51  if( gnutls_init( m_session, GNUTLS_CLIENT ) != 0 )
52  {
53  gnutls_certificate_free_credentials( m_credentials );
54  return false;
55  }
56 
57 #if GNUTLS_VERSION_NUMBER >= 0x020600
58  int ret = gnutls_priority_set_direct( *m_session, "SECURE128:+PFS:+COMP-ALL:+VERS-TLS-ALL:-VERS-SSL3.0:+SIGN-ALL:+CURVE-ALL", 0 );
59  if( ret != GNUTLS_E_SUCCESS )
60  return false;
61 #else
62  const int protocolPriority[] = {
63  GNUTLS_TLS1_3,
64  GNUTLS_TLS1_2,
65  GNUTLS_TLS1_1, GNUTLS_TLS1, 0 };
66  const int kxPriority[] = { GNUTLS_KX_RSA, GNUTLS_KX_DHE_RSA, GNUTLS_KX_DHE_DSS, 0 };
67  const int cipherPriority[] = { GNUTLS_CIPHER_AES_256_CBC, GNUTLS_CIPHER_AES_128_CBC,
68  GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_ARCFOUR, 0 };
69  const int compPriority[] = { GNUTLS_COMP_ZLIB, GNUTLS_COMP_NULL, 0 };
70  const int macPriority[] = { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, 0 };
71  gnutls_protocol_set_priority( *m_session, protocolPriority );
72  gnutls_cipher_set_priority( *m_session, cipherPriority );
73  gnutls_compression_set_priority( *m_session, compPriority );
74  gnutls_kx_set_priority( *m_session, kxPriority );
75  gnutls_mac_set_priority( *m_session, macPriority );
76 #endif
77 
78  gnutls_certificate_set_x509_system_trust( m_credentials );
79  gnutls_credentials_set( *m_session, GNUTLS_CRD_CERTIFICATE, m_credentials );
80 
81  gnutls_transport_set_ptr( *m_session, static_cast<gnutls_transport_ptr_t>( this ) );
82  gnutls_transport_set_push_function( *m_session, pushFunc );
83  gnutls_transport_set_pull_function( *m_session, pullFunc );
84 
85  m_valid = true;
86  return true;
87  }
88 
89  void GnuTLSClient::setCACerts( const StringList& cacerts )
90  {
91  m_cacerts = cacerts;
92 
93  StringList::const_iterator it = m_cacerts.begin();
94  for( ; it != m_cacerts.end(); ++it )
95  gnutls_certificate_set_x509_trust_file( m_credentials, (*it).c_str(), GNUTLS_X509_FMT_PEM );
96  }
97 
98  void GnuTLSClient::setClientCert( const std::string& clientKey, const std::string& clientCerts )
99  {
100  m_clientKey = clientKey;
101  m_clientCerts = clientCerts;
102 
103  if( !m_clientKey.empty() && !m_clientCerts.empty() )
104  {
105  gnutls_certificate_set_x509_key_file( m_credentials, m_clientCerts.c_str(),
106  m_clientKey.c_str(), GNUTLS_X509_FMT_PEM );
107  }
108  }
109 
110  void GnuTLSClient::getCertInfo()
111  {
112  unsigned int status;
113  bool error = false;
114 
115  gnutls_certificate_free_ca_names( m_credentials );
116 
117  if( gnutls_certificate_verify_peers2( *m_session, &status ) < 0 )
118  error = true;
119 
120  m_certInfo.status = 0;
121  if( status & GNUTLS_CERT_INVALID )
122  m_certInfo.status |= CertInvalid;
123  if( status & GNUTLS_CERT_SIGNER_NOT_FOUND )
124  m_certInfo.status |= CertSignerUnknown;
125  if( status & GNUTLS_CERT_REVOKED )
126  m_certInfo.status |= CertRevoked;
127  if( status & GNUTLS_CERT_SIGNER_NOT_CA )
128  m_certInfo.status |= CertSignerNotCa;
129 
130  const gnutls_datum_t* certList = 0;
131  unsigned int certListSize = 0;
132  if( !error && ( ( certList = gnutls_certificate_get_peers( *m_session, &certListSize ) ) == 0 ) )
133  error = true;
134 
135  unsigned int certListSizeFull = certListSize;
136 
137  gnutls_x509_crt_t* cert = new gnutls_x509_crt_t[certListSize];
138  for( unsigned int i=0; !error && ( i<certListSize ); ++i )
139  {
140  if( gnutls_x509_crt_init( &cert[i] ) < 0
141  || gnutls_x509_crt_import( cert[i], &certList[i], GNUTLS_X509_FMT_DER ) < 0 )
142  error = true;
143  }
144 
145  if( certListSize > 1 && ( gnutls_x509_crt_check_issuer( cert[certListSize-1], cert[certListSize-1] ) > 0 ) )
146  certListSize--;
147 
148  for( unsigned int i=1; !error && ( i<certListSize ); ++i )
149  {
150  error = !verifyAgainst( cert[i-1], cert[i] );
151  if( error )
152  m_certInfo.status |= CertInvalid;
153  }
154 
155  m_certInfo.chain = verifyAgainstCAs( cert[certListSize-1], 0 /*CAList*/, 0 /*CAListSize*/ );
156 
157  time_t t = gnutls_x509_crt_get_activation_time( cert[0] );
158  if( t == -1 )
159  error = true;
160  else if( t > time( 0 ) )
161  m_certInfo.status |= CertNotActive;
162  m_certInfo.date_from = static_cast<int>( t );
163 
164  t = gnutls_x509_crt_get_expiration_time( cert[0] );
165  if( t == -1 )
166  error = true;
167  else if( t < time( 0 ) )
168  m_certInfo.status |= CertExpired;
169  m_certInfo.date_to = static_cast<int>( t );
170 
171  char name[64];
172  size_t nameSize = sizeof( name );
173  gnutls_x509_crt_get_issuer_dn( cert[0], name, &nameSize );
174  m_certInfo.issuer = name;
175 
176  nameSize = sizeof( name );
177  gnutls_x509_crt_get_dn( cert[0], name, &nameSize );
178  m_certInfo.server = name;
179 
180  getCommonCertInfo();
181 
182  if( !gnutls_x509_crt_check_hostname( cert[0], m_server.c_str() ) )
183  m_certInfo.status |= CertWrongPeer;
184 
185  for( unsigned int i = 0; i < certListSizeFull; ++i )
186  gnutls_x509_crt_deinit( cert[i] );
187 
188  delete[] cert;
189 
190  m_valid = true;
191  }
192 
193  static bool verifyCert( gnutls_x509_crt_t cert, unsigned result )
194  {
195  return ! ( ( result & GNUTLS_CERT_INVALID )
196  || gnutls_x509_crt_get_expiration_time( cert ) < time( 0 )
197  || gnutls_x509_crt_get_activation_time( cert ) > time( 0 ) );
198  }
199 
200  bool GnuTLSClient::verifyAgainst( gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer )
201  {
202  unsigned int result;
203  gnutls_x509_crt_verify( cert, &issuer, 1, 0, &result );
204  return verifyCert( cert, result );
205  }
206 
207  bool GnuTLSClient::verifyAgainstCAs( gnutls_x509_crt_t cert, gnutls_x509_crt_t* CAList, int CAListSize )
208  {
209  unsigned int result;
210  gnutls_x509_crt_verify( cert, CAList, CAListSize, GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT, &result );
211  return verifyCert( cert, result );
212  }
213 
214 }
215 
216 #endif // HAVE_GNUTLS
This is the common base class for (stream) encryption using GnuTLS.
Definition: tlsgnutlsbase.h:39
virtual void cleanup()
virtual void setCACerts(const StringList &cacerts)
virtual void cleanup()
virtual void setClientCert(const std::string &clientKey, const std::string &clientCerts)
virtual bool init(const std::string &clientKey=EmptyString, const std::string &clientCerts=EmptyString, const StringList &cacerts=StringList())
GnuTLSClient(TLSHandler *th, const std::string &server)
An interface that allows for interacting with TLS implementations derived from TLSBase.
Definition: tlshandler.h:35
The namespace for the gloox library.
Definition: adhoc.cpp:28
std::list< std::string > StringList
Definition: gloox.h:1251
@ CertExpired
Definition: gloox.h:979
@ CertWrongPeer
Definition: gloox.h:981
@ CertSignerUnknown
Definition: gloox.h:977
@ CertSignerNotCa
Definition: gloox.h:983
@ CertInvalid
Definition: gloox.h:976
@ CertNotActive
Definition: gloox.h:980
@ CertRevoked
Definition: gloox.h:978
bool chain
Definition: gloox.h:992
std::string server
Definition: gloox.h:994
int date_from
Definition: gloox.h:995
std::string issuer
Definition: gloox.h:993