15 #include "tlsgnutlsclient.h"
37 gnutls_certificate_free_credentials( m_credentials );
45 if( m_initLib && gnutls_global_init() != 0 )
48 if( gnutls_certificate_allocate_credentials( &m_credentials ) < 0 )
51 if( gnutls_init( m_session, GNUTLS_CLIENT ) != 0 )
53 gnutls_certificate_free_credentials( m_credentials );
57 #if GNUTLS_VERSION_NUMBER >= 0x020600
58 int ret = gnutls_priority_set_direct( *m_session,
"SECURE128:+PFS:+COMP-ALL:+VERS-TLS-ALL:-VERS-SSL3.0:+SIGN-ALL:+CURVE-ALL", 0 );
59 if( ret != GNUTLS_E_SUCCESS )
62 const int protocolPriority[] = {
65 GNUTLS_TLS1_1, GNUTLS_TLS1, 0 };
66 const int kxPriority[] = { GNUTLS_KX_RSA, GNUTLS_KX_DHE_RSA, GNUTLS_KX_DHE_DSS, 0 };
67 const int cipherPriority[] = { GNUTLS_CIPHER_AES_256_CBC, GNUTLS_CIPHER_AES_128_CBC,
68 GNUTLS_CIPHER_3DES_CBC, GNUTLS_CIPHER_ARCFOUR, 0 };
69 const int compPriority[] = { GNUTLS_COMP_ZLIB, GNUTLS_COMP_NULL, 0 };
70 const int macPriority[] = { GNUTLS_MAC_SHA, GNUTLS_MAC_MD5, 0 };
71 gnutls_protocol_set_priority( *m_session, protocolPriority );
72 gnutls_cipher_set_priority( *m_session, cipherPriority );
73 gnutls_compression_set_priority( *m_session, compPriority );
74 gnutls_kx_set_priority( *m_session, kxPriority );
75 gnutls_mac_set_priority( *m_session, macPriority );
78 gnutls_certificate_set_x509_system_trust( m_credentials );
79 gnutls_credentials_set( *m_session, GNUTLS_CRD_CERTIFICATE, m_credentials );
81 gnutls_transport_set_ptr( *m_session,
static_cast<gnutls_transport_ptr_t
>(
this ) );
82 gnutls_transport_set_push_function( *m_session, pushFunc );
83 gnutls_transport_set_pull_function( *m_session, pullFunc );
93 StringList::const_iterator it = m_cacerts.begin();
94 for( ; it != m_cacerts.end(); ++it )
95 gnutls_certificate_set_x509_trust_file( m_credentials, (*it).c_str(), GNUTLS_X509_FMT_PEM );
100 m_clientKey = clientKey;
101 m_clientCerts = clientCerts;
103 if( !m_clientKey.empty() && !m_clientCerts.empty() )
105 gnutls_certificate_set_x509_key_file( m_credentials, m_clientCerts.c_str(),
106 m_clientKey.c_str(), GNUTLS_X509_FMT_PEM );
110 void GnuTLSClient::getCertInfo()
115 gnutls_certificate_free_ca_names( m_credentials );
117 if( gnutls_certificate_verify_peers2( *m_session, &status ) < 0 )
121 if( status & GNUTLS_CERT_INVALID )
123 if( status & GNUTLS_CERT_SIGNER_NOT_FOUND )
125 if( status & GNUTLS_CERT_REVOKED )
127 if( status & GNUTLS_CERT_SIGNER_NOT_CA )
130 const gnutls_datum_t* certList = 0;
131 unsigned int certListSize = 0;
132 if( !error && ( ( certList = gnutls_certificate_get_peers( *m_session, &certListSize ) ) == 0 ) )
135 unsigned int certListSizeFull = certListSize;
137 gnutls_x509_crt_t* cert =
new gnutls_x509_crt_t[certListSize];
138 for(
unsigned int i=0; !error && ( i<certListSize ); ++i )
140 if( gnutls_x509_crt_init( &cert[i] ) < 0
141 || gnutls_x509_crt_import( cert[i], &certList[i], GNUTLS_X509_FMT_DER ) < 0 )
145 if( certListSize > 1 && ( gnutls_x509_crt_check_issuer( cert[certListSize-1], cert[certListSize-1] ) > 0 ) )
148 for(
unsigned int i=1; !error && ( i<certListSize ); ++i )
150 error = !verifyAgainst( cert[i-1], cert[i] );
155 m_certInfo.
chain = verifyAgainstCAs( cert[certListSize-1], 0 , 0 );
157 time_t t = gnutls_x509_crt_get_activation_time( cert[0] );
160 else if( t > time( 0 ) )
162 m_certInfo.
date_from =
static_cast<int>( t );
164 t = gnutls_x509_crt_get_expiration_time( cert[0] );
167 else if( t < time( 0 ) )
169 m_certInfo.
date_to =
static_cast<int>( t );
172 size_t nameSize =
sizeof( name );
173 gnutls_x509_crt_get_issuer_dn( cert[0], name, &nameSize );
176 nameSize =
sizeof( name );
177 gnutls_x509_crt_get_dn( cert[0], name, &nameSize );
182 if( !gnutls_x509_crt_check_hostname( cert[0], m_server.c_str() ) )
185 for(
unsigned int i = 0; i < certListSizeFull; ++i )
186 gnutls_x509_crt_deinit( cert[i] );
193 static bool verifyCert( gnutls_x509_crt_t cert,
unsigned result )
195 return ! ( ( result & GNUTLS_CERT_INVALID )
196 || gnutls_x509_crt_get_expiration_time( cert ) < time( 0 )
197 || gnutls_x509_crt_get_activation_time( cert ) > time( 0 ) );
200 bool GnuTLSClient::verifyAgainst( gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer )
203 gnutls_x509_crt_verify( cert, &issuer, 1, 0, &result );
204 return verifyCert( cert, result );
207 bool GnuTLSClient::verifyAgainstCAs( gnutls_x509_crt_t cert, gnutls_x509_crt_t* CAList,
int CAListSize )
210 gnutls_x509_crt_verify( cert, CAList, CAListSize, GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT, &result );
211 return verifyCert( cert, result );
This is the common base class for (stream) encryption using GnuTLS.
virtual void setCACerts(const StringList &cacerts)
virtual void setClientCert(const std::string &clientKey, const std::string &clientCerts)
virtual bool init(const std::string &clientKey=EmptyString, const std::string &clientCerts=EmptyString, const StringList &cacerts=StringList())
GnuTLSClient(TLSHandler *th, const std::string &server)
An interface that allows for interacting with TLS implementations derived from TLSBase.
The namespace for the gloox library.
std::list< std::string > StringList