HGKeeper

/**

* @file certificate.c Public-Key Certificate API

* @ingroup core

* purple

* Purple is the legal property of its developers, whose names are too numerous

* to list here. Please refer to the COPYRIGHT file distributed with this

* source distribution.

* This program is free software; you can redistribute it and/or modify

* it under the terms of the GNU General Public License as published by

* the Free Software Foundation; either version 2 of the License, or

* (at your option) any later version.

* This program is distributed in the hope that it will be useful,

* but WITHOUT ANY WARRANTY; without even the implied warranty of

* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the

* GNU General Public License for more details.

* You should have received a copy of the GNU General Public License

* along with this program; if not, write to the Free Software

* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02111-1301 USA

#include "internal.h"

#include "certificate.h"

#include "dbus-maybe.h"

#include "debug.h"

#include "glibcompat.h"

#include "request.h"

#include "signals.h"

#include "util.h"

/** List holding pointers to all registered certificate schemes */

static GList *cert_schemes = NULL;

/** List of registered Verifiers */

static GList *cert_verifiers = NULL;

/** List of registered Pools */

static GList *cert_pools = NULL;

static const gchar *

invalidity_reason_to_string(PurpleCertificateInvalidityFlags flag)

{

switch (flag) {

case PURPLE_CERTIFICATE_SELF_SIGNED:

return _("The certificate is self-signed and cannot be "

"automatically checked.");

break;

case PURPLE_CERTIFICATE_CA_UNKNOWN:

return _("The certificate is not trusted because no certificate "

"that can verify it is currently trusted.");

break;

case PURPLE_CERTIFICATE_NOT_ACTIVATED:

return _("The certificate is not valid yet. Check that your "

"computer's date and time are accurate.");

break;

case PURPLE_CERTIFICATE_EXPIRED:

return _("The certificate has expired and should not be "

"considered valid. Check that your computer's date "

"and time are accurate.");

break;

case PURPLE_CERTIFICATE_NAME_MISMATCH:

/* Translators: "domain" refers to a DNS domain (e.g. talk.google.com) */

return _("The certificate presented is not issued to this domain.");

break;

case PURPLE_CERTIFICATE_NO_CA_POOL:

return _("You have no database of root certificates, so "

"this certificate cannot be validated.");

break;

case PURPLE_CERTIFICATE_INVALID_CHAIN:

return _("The certificate chain presented is invalid.");

break;

case PURPLE_CERTIFICATE_REVOKED:

return _("The certificate has been revoked.");

break;

case PURPLE_CERTIFICATE_UNKNOWN_ERROR:

default:

return _("An unknown certificate error occurred.");

break;

}

static void

get_ascii_fingerprints (PurpleCertificate *crt, gchar **sha1, gchar **sha256)

{

GByteArray *sha_bin;

if (sha1 != NULL) {

sha_bin = purple_certificate_get_fingerprint_sha1(crt);

*sha1 = purple_base16_encode_chunked(sha_bin->data, sha_bin->len);

g_byte_array_free(sha_bin, TRUE);

}

if (sha256 != NULL) {

sha_bin = purple_certificate_get_fingerprint_sha256(crt, FALSE);

*sha256 = (sha_bin == NULL) ? g_strdup("(null)") :

purple_base16_encode_chunked(sha_bin->data, sha_bin->len);

g_byte_array_free(sha_bin, TRUE);

}

void

purple_certificate_verify (PurpleCertificateVerifier *verifier,

const gchar *subject_name, GList *cert_chain,

PurpleCertificateVerifiedCallback cb,

gpointer cb_data)

{

PurpleCertificateVerificationRequest *vrq;

PurpleCertificateScheme *scheme;

g_return_if_fail(subject_name != NULL);

/* If you don't have a cert to check, why are you requesting that it

be verified? */

g_return_if_fail(cert_chain != NULL);

g_return_if_fail(cb != NULL);

/* Look up the CertificateScheme */

scheme = purple_certificate_find_scheme(verifier->scheme_name);

g_return_if_fail(scheme);

/* Check that at least the first cert in the chain matches the

Verifier scheme */

g_return_if_fail(scheme ==

((PurpleCertificate *) (cert_chain->data))->scheme);

/* Construct and fill in the request fields */

vrq = g_new0(PurpleCertificateVerificationRequest, 1);

vrq->verifier = verifier;

vrq->scheme = scheme;

vrq->subject_name = g_strdup(subject_name);

vrq->cert_chain = purple_certificate_copy_list(cert_chain);

vrq->cb = cb;

vrq->cb_data = cb_data;

/* Initiate verification */

(verifier->start_verification)(vrq);

}

void

purple_certificate_verify_complete(PurpleCertificateVerificationRequest *vrq,

PurpleCertificateVerificationStatus st)

{

PurpleCertificateVerifier *vr;

g_return_if_fail(vrq);

if (st == PURPLE_CERTIFICATE_VALID) {

purple_debug_info("certificate",

"Successfully verified certificate for %s\n",

vrq->subject_name);

} else {

purple_debug_error("certificate",

"Failed to verify certificate for %s\n",

vrq->subject_name);

}

/* Pass the results on to the request's callback */

(vrq->cb)(st, vrq->cb_data);

/* And now to eliminate the request */

/* Fetch the Verifier responsible... */

vr = vrq->verifier;

/* ...and order it to KILL */

(vr->destroy_request)(vrq);

/* Now the internals have been cleaned up, so clean up the libpurple-

created elements */

g_free(vrq->subject_name);

purple_certificate_destroy_list(vrq->cert_chain);

/* A structure born

* to much ado

* and with so much within.

* It reaches now

* its quiet end. */

g_free(vrq);

}

PurpleCertificate *

purple_certificate_copy(PurpleCertificate *crt)

{

g_return_val_if_fail(crt, NULL);

g_return_val_if_fail(crt->scheme, NULL);

g_return_val_if_fail(crt->scheme->copy_certificate, NULL);

return (crt->scheme->copy_certificate)(crt);

}

GList *

purple_certificate_copy_list(GList *crt_list)

{

GList *new_l, *l;

/* First, make a shallow copy of the list */

new_l = g_list_copy(crt_list);

/* Now go through and actually duplicate each certificate */

for (l = new_l; l; l = l->next) {

l->data = purple_certificate_copy(l->data);

}

return new_l;

}

void

purple_certificate_destroy (PurpleCertificate *crt)

{

PurpleCertificateScheme *scheme;

if (NULL == crt) return;

scheme = crt->scheme;

(scheme->destroy_certificate)(crt);

}

void

purple_certificate_destroy_list (GList * crt_list)

{

PurpleCertificate *crt;

GList *l;

for (l=crt_list; l; l = l->next) {

crt = (PurpleCertificate *) l->data;

purple_certificate_destroy(crt);

}

g_list_free(crt_list);

}

gboolean

purple_certificate_signed_by(PurpleCertificate *crt, PurpleCertificate *issuer)

{

PurpleCertificateScheme *scheme;

g_return_val_if_fail(crt, FALSE);

g_return_val_if_fail(issuer, FALSE);

scheme = crt->scheme;

g_return_val_if_fail(scheme, FALSE);

/* We can't compare two certs of unrelated schemes, obviously */

g_return_val_if_fail(issuer->scheme == scheme, FALSE);

return (scheme->signed_by)(crt, issuer);

}

gboolean

purple_certificate_check_signature_chain_with_failing(GList *chain,

PurpleCertificate **failing)

{

GList *cur;

PurpleCertificate *crt, *issuer;

gchar *uid;

time_t now, activation, expiration;

gboolean ret;

g_return_val_if_fail(chain, FALSE);

if (failing)

*failing = NULL;

uid = purple_certificate_get_unique_id((PurpleCertificate *) chain->data);

purple_debug_info("certificate",

"Checking signature chain for uid=%s\n",

uid);

g_free(uid);

/* If this is a single-certificate chain, say that it is valid */

if (chain->next == NULL) {

purple_debug_info("certificate",

"...Singleton. We'll say it's valid.\n");

return TRUE;

}

now = time(NULL);

/* Load crt with the first certificate */

crt = (PurpleCertificate *)(chain->data);

/* And start with the second certificate in the chain */

for ( cur = chain->next; cur; cur = cur->next ) {

issuer = (PurpleCertificate *)(cur->data);

uid = purple_certificate_get_unique_id(issuer);

ret = purple_certificate_get_times(issuer, &activation, &expiration);

if (!ret || now < activation || now > expiration) {

if (!ret)

purple_debug_error("certificate",

"...Failed to get validity times for certificate %s\n"

"Chain is INVALID\n", uid);

else if (now > expiration)

purple_debug_error("certificate",

"...Issuer %s expired at %s\nChain is INVALID\n",

uid, ctime(&expiration));

else

purple_debug_error("certificate",

"...Not-yet-activated issuer %s will be valid at %s\n"

"Chain is INVALID\n", uid, ctime(&activation));

if (failing)

*failing = crt;

g_free(uid);

return FALSE;

}

/* Check the signature for this link */

if (! purple_certificate_signed_by(crt, issuer) ) {

purple_debug_error("certificate",

"...Bad or missing signature by %s\nChain is INVALID\n",

uid);

g_free(uid);

if (failing)

*failing = crt;

return FALSE;

}

purple_debug_info("certificate",

"...Good signature by %s\n",

uid);

g_free(uid);

/* The issuer is now the next crt whose signature is to be

checked */

crt = issuer;

}

/* If control reaches this point, the chain is valid */

purple_debug_info("certificate", "Chain is VALID\n");

return TRUE;

}

gboolean

purple_certificate_check_signature_chain(GList *chain)

{

return purple_certificate_check_signature_chain_with_failing(chain, NULL);

}

PurpleCertificate *

purple_certificate_import(PurpleCertificateScheme *scheme, const gchar *filename)

{

g_return_val_if_fail(scheme, NULL);

g_return_val_if_fail(scheme->import_certificate, NULL);

g_return_val_if_fail(filename, NULL);

return (scheme->import_certificate)(filename);

}

GSList *

purple_certificates_import(PurpleCertificateScheme *scheme, const gchar *filename)

{

g_return_val_if_fail(scheme, NULL);

g_return_val_if_fail(scheme->import_certificates, NULL);

g_return_val_if_fail(filename, NULL);

return (scheme->import_certificates)(filename);

}

gboolean

purple_certificate_export(const gchar *filename, PurpleCertificate *crt)

{

PurpleCertificateScheme *scheme;

g_return_val_if_fail(filename, FALSE);

g_return_val_if_fail(crt, FALSE);

g_return_val_if_fail(crt->scheme, FALSE);

scheme = crt->scheme;

g_return_val_if_fail(scheme->export_certificate, FALSE);

return (scheme->export_certificate)(filename, crt);

}

static gboolean

byte_arrays_equal(const GByteArray *array1, const GByteArray *array2)

{

g_return_val_if_fail(array1 != NULL, FALSE);

g_return_val_if_fail(array2 != NULL, FALSE);

return (array1->len == array2->len) &&

(0 == memcmp(array1->data, array2->data, array1->len));

}

GByteArray *

purple_certificate_get_fingerprint_sha1(PurpleCertificate *crt)

{

PurpleCertificateScheme *scheme;

GByteArray *fpr;

g_return_val_if_fail(crt, NULL);

g_return_val_if_fail(crt->scheme, NULL);

scheme = crt->scheme;

g_return_val_if_fail(scheme->get_fingerprint_sha1, NULL);

fpr = (scheme->get_fingerprint_sha1)(crt);

return fpr;

}

GByteArray *

purple_certificate_get_fingerprint_sha256(PurpleCertificate *crt, gboolean sha1_fallback)

{

PurpleCertificateScheme *scheme;

GByteArray *fpr = NULL;

g_return_val_if_fail(crt, NULL);

g_return_val_if_fail(crt->scheme, NULL);

scheme = crt->scheme;

if (!PURPLE_CERTIFICATE_SCHEME_HAS_FUNC(scheme, get_fingerprint_sha256)) {

/* outdated ssl module? fallback to sha1 and print a warning */

if (sha1_fallback) {

fpr = purple_certificate_get_fingerprint_sha1(crt);

}

g_return_val_if_reached(fpr);

}

fpr = (scheme->get_fingerprint_sha256)(crt);

return fpr;

}

gchar *

purple_certificate_get_unique_id(PurpleCertificate *crt)

{

g_return_val_if_fail(crt, NULL);

g_return_val_if_fail(crt->scheme, NULL);

g_return_val_if_fail(crt->scheme->get_unique_id, NULL);

return (crt->scheme->get_unique_id)(crt);

}

gchar *

purple_certificate_get_issuer_unique_id(PurpleCertificate *crt)

{

g_return_val_if_fail(crt, NULL);

g_return_val_if_fail(crt->scheme, NULL);

g_return_val_if_fail(crt->scheme->get_issuer_unique_id, NULL);

return (crt->scheme->get_issuer_unique_id)(crt);

}

gchar *

purple_certificate_get_subject_name(PurpleCertificate *crt)

{

PurpleCertificateScheme *scheme;

gchar *subject_name;

g_return_val_if_fail(crt, NULL);

g_return_val_if_fail(crt->scheme, NULL);

scheme = crt->scheme;

g_return_val_if_fail(scheme->get_subject_name, NULL);

subject_name = (scheme->get_subject_name)(crt);

return subject_name;

}

gboolean

purple_certificate_check_subject_name(PurpleCertificate *crt, const gchar *name)

{

PurpleCertificateScheme *scheme;

g_return_val_if_fail(crt, FALSE);

g_return_val_if_fail(crt->scheme, FALSE);

g_return_val_if_fail(name, FALSE);

scheme = crt->scheme;

g_return_val_if_fail(scheme->check_subject_name, FALSE);

return (scheme->check_subject_name)(crt, name);

}

gboolean

purple_certificate_get_times(PurpleCertificate *crt, time_t *activation, time_t *expiration)

{

PurpleCertificateScheme *scheme;

g_return_val_if_fail(crt, FALSE);

scheme = crt->scheme;

g_return_val_if_fail(scheme, FALSE);

/* If both provided references are NULL, what are you doing calling

this? */

g_return_val_if_fail( (activation != NULL) || (expiration != NULL), FALSE);

/* Throw the request on down to the certscheme */

return (scheme->get_times)(crt, activation, expiration);

}

gboolean

purple_certificate_compare_pubkeys(PurpleCertificate *crt1, PurpleCertificate *crt2)

{

PurpleCertificateScheme *scheme;

g_return_val_if_fail(crt1 && crt2, FALSE);

g_return_val_if_fail(crt1->scheme && crt2->scheme, FALSE);

g_return_val_if_fail(crt1->scheme == crt2->scheme, FALSE);

scheme = crt1->scheme;

if (!(PURPLE_CERTIFICATE_SCHEME_HAS_FUNC(scheme, compare_pubkeys))) {

return FALSE;

}

return (scheme->compare_pubkeys)(crt1, crt2);

}

gchar *

purple_certificate_pool_mkpath(PurpleCertificatePool *pool, const gchar *id)

{

gchar *path;

gchar *esc_scheme_name, *esc_name, *esc_id;

g_return_val_if_fail(pool, NULL);

g_return_val_if_fail(pool->scheme_name, NULL);

g_return_val_if_fail(pool->name, NULL);

/* Escape all the elements for filesystem-friendliness */

esc_scheme_name = g_strdup(purple_escape_filename(pool->scheme_name));

esc_name = g_strdup(purple_escape_filename(pool->name));

esc_id = id ? g_strdup(purple_escape_filename(id)) : NULL;

path = g_build_filename(purple_user_dir(),

"certificates", /* TODO: constantize this? */

esc_scheme_name,

esc_name,

esc_id,

NULL);

g_free(esc_scheme_name);

g_free(esc_name);

g_free(esc_id);

return path;

}

gboolean

purple_certificate_pool_usable(PurpleCertificatePool *pool)

{

g_return_val_if_fail(pool, FALSE);

g_return_val_if_fail(pool->scheme_name, FALSE);

/* Check that the pool's scheme is loaded */

if (purple_certificate_find_scheme(pool->scheme_name) == NULL) {

return FALSE;

}

return TRUE;

}

PurpleCertificateScheme *

purple_certificate_pool_get_scheme(PurpleCertificatePool *pool)

{

g_return_val_if_fail(pool, NULL);

g_return_val_if_fail(pool->scheme_name, NULL);

return purple_certificate_find_scheme(pool->scheme_name);

}

gboolean

purple_certificate_pool_contains(PurpleCertificatePool *pool, const gchar *id)

{

g_return_val_if_fail(pool, FALSE);

g_return_val_if_fail(id, FALSE);

g_return_val_if_fail(pool->cert_in_pool, FALSE);

return (pool->cert_in_pool)(id);

}

PurpleCertificate *

purple_certificate_pool_retrieve(PurpleCertificatePool *pool, const gchar *id)

{

g_return_val_if_fail(pool, NULL);

g_return_val_if_fail(id, NULL);

g_return_val_if_fail(pool->get_cert, NULL);

return (pool->get_cert)(id);

}

gboolean

purple_certificate_pool_store(PurpleCertificatePool *pool, const gchar *id, PurpleCertificate *crt)

{

gboolean ret = FALSE;

g_return_val_if_fail(pool, FALSE);

g_return_val_if_fail(id, FALSE);

g_return_val_if_fail(pool->put_cert, FALSE);

/* Whether crt->scheme matches find_scheme(pool->scheme_name) is not

relevant... I think... */

g_return_val_if_fail(

g_ascii_strcasecmp(pool->scheme_name, crt->scheme->name) == 0,

FALSE);

ret = (pool->put_cert)(id, crt);

/* Signal that the certificate was stored if success*/

if (ret) {

purple_signal_emit(pool, "certificate-stored",

pool, id);

}

return ret;

}

gboolean

purple_certificate_pool_delete(PurpleCertificatePool *pool, const gchar *id)

{

gboolean ret = FALSE;

g_return_val_if_fail(pool, FALSE);

g_return_val_if_fail(id, FALSE);

g_return_val_if_fail(pool->delete_cert, FALSE);

ret = (pool->delete_cert)(id);

/* Signal that the certificate was deleted if success */

if (ret) {

purple_signal_emit(pool, "certificate-deleted",

pool, id);

}

return ret;

}

GList *

purple_certificate_pool_get_idlist(PurpleCertificatePool *pool)

{

g_return_val_if_fail(pool, NULL);

g_return_val_if_fail(pool->get_idlist, NULL);

return (pool->get_idlist)();

}

void

purple_certificate_pool_destroy_idlist(GList *idlist)

{

GList *l;

/* Iterate through and free them strings */

for ( l = idlist; l; l = l->next ) {

g_free(l->data);

}

g_list_free(idlist);

}

/****************************************************************************/

/* Builtin Verifiers, Pools, etc. */

/****************************************************************************/

static void

x509_singleuse_verify_cb (PurpleCertificateVerificationRequest *vrq, gint id)

{

g_return_if_fail(vrq);

purple_debug_info("certificate/x509_singleuse",

"VRQ on cert from %s gave %d\n",

vrq->subject_name, id);

/* Signal what happened back to the caller */

if (1 == id) {

/* Accepted! */

purple_certificate_verify_complete(vrq,

PURPLE_CERTIFICATE_VALID);

} else {

/* Not accepted */

purple_certificate_verify_complete(vrq,

PURPLE_CERTIFICATE_INVALID);

}

static void

x509_singleuse_start_verify (PurpleCertificateVerificationRequest *vrq)

{

gchar *sha1_asc, *sha256_asc;

gchar *cn;

const gchar *cn_match;

gchar *primary, *secondary, *secondary_extra;

PurpleCertificate *crt = (PurpleCertificate *) vrq->cert_chain->data;

get_ascii_fingerprints(crt, &sha1_asc, &sha256_asc);

/* Get the cert Common Name */

cn = purple_certificate_get_subject_name(crt);

/* Determine whether the name matches */

if (purple_certificate_check_subject_name(crt, vrq->subject_name)) {

cn_match = "";

} else {

cn_match = _("(DOES NOT MATCH)");

}

/* Make messages */

primary = g_strdup_printf(_("%s has presented the following certificate for just-this-once use:"), vrq->subject_name);

secondary = g_strdup_printf(_("Common name: %s %s\nFingerprint (SHA1): %s"), cn, cn_match, sha1_asc);

/* TODO: make this part of the translatable string above */

secondary_extra = g_strdup_printf("%s\nSHA256: %s", secondary, sha256_asc);

/* Make a semi-pretty display */

purple_request_accept_cancel(

vrq->cb_data, /* TODO: Find what the handle ought to be */

_("Single-use Certificate Verification"),

primary,

secondary_extra,

0, /* Accept by default */

NULL, /* No account */

NULL, /* No other user */

NULL, /* No associated conversation */

vrq,

x509_singleuse_verify_cb,

x509_singleuse_verify_cb );

/* Cleanup */

g_free(cn);

g_free(primary);

g_free(secondary);

g_free(secondary_extra);

g_free(sha1_asc);

g_free(sha256_asc);

}

static void

x509_singleuse_destroy_request (PurpleCertificateVerificationRequest *vrq)

{

/* I don't do anything! */

}

static PurpleCertificateVerifier x509_singleuse = {

"x509", /* Scheme name */

"singleuse", /* Verifier name */

x509_singleuse_start_verify, /* start_verification function */

x509_singleuse_destroy_request, /* Request cleanup operation */

NULL,

NULL

};

/***** X.509 Certificate Authority pool, keyed by Distinguished Name *****/

/* This is implemented in what may be the most inefficient and bugprone way

possible; however, future optimizations should not be difficult. */

static PurpleCertificatePool x509_ca;

/** Holds a key-value pair for quickish certificate lookup */

typedef struct {

gchar *dn;

PurpleCertificate *crt;

} x509_ca_element;

static void

x509_ca_element_free(x509_ca_element *el)

{

if (NULL == el) return;

g_free(el->dn);

purple_certificate_destroy(el->crt);

g_free(el);

}

/** System directory to probe for CA certificates */

/* This is set in the lazy_init function */

static GList *x509_ca_paths = NULL;

/** A list of loaded CAs, populated from the above path whenever the lazy_init

happens. Contains pointers to x509_ca_elements */

static GList *x509_ca_certs = NULL;

/** Used for lazy initialization purposes. */

static gboolean x509_ca_initialized = FALSE;

/** Adds a certificate to the in-memory cache, and mark it as trusted */

static gboolean

x509_ca_quiet_put_cert(PurpleCertificate *crt)

{

gboolean ret;

x509_ca_element *el;

/* lazy_init calls this function, so calling lazy_init here is a

Bad Thing */

g_return_val_if_fail(crt, FALSE);

g_return_val_if_fail(crt->scheme, FALSE);

/* Make sure that this is some kind of X.509 certificate */

/* TODO: Perhaps just check crt->scheme->name instead? */

g_return_val_if_fail(crt->scheme == purple_certificate_find_scheme(x509_ca.scheme_name), FALSE);

ret = TRUE;

if (crt->scheme->register_trusted_tls_cert) {

ret = (crt->scheme->register_trusted_tls_cert)(crt, TRUE);

}

if (ret) {

el = g_new0(x509_ca_element, 1);

el->dn = purple_certificate_get_unique_id(crt);

el->crt = purple_certificate_copy(crt);

x509_ca_certs = g_list_prepend(x509_ca_certs, el);

}

return ret;

}

/* Since the libpurple CertificatePools get registered before plugins are

loaded, an X.509 Scheme is generally not available when x509_ca_init is

called, but x509_ca requires X.509 operations in order to properly load.

To solve this, I present the lazy_init function. It attempts to finish

initialization of the Pool, but it usually fails when it is called from

x509_ca_init. However, this is OK; initialization is then simply deferred

until someone tries to use functions from the pool. */

static gboolean

x509_ca_lazy_init(void)

{

PurpleCertificateScheme *x509;

GDir *certdir;

const gchar *entry;

GPatternSpec *pempat, *crtpat;

GList *iter = NULL;

GSList *crts = NULL;

if (x509_ca_initialized) return TRUE;

/* Check that X.509 is registered */

x509 = purple_certificate_find_scheme(x509_ca.scheme_name);

if ( !x509 ) {

purple_debug_warning("certificate/x509/ca",

"Lazy init failed because an X.509 Scheme "

"is not yet registered. Maybe it will be "

"better later.\n");

return FALSE;

}

/* Use a glob to only read .pem files */

pempat = g_pattern_spec_new("*.pem");

crtpat = g_pattern_spec_new("*.crt");

/* Populate the certificates pool from the search path(s) */

for (iter = x509_ca_paths; iter; iter = iter->next) {

certdir = g_dir_open(iter->data, 0, NULL);

if (!certdir) {

purple_debug_error("certificate/x509/ca", "Couldn't open location '%s'\n", (const char *)iter->data);

continue;

}

while ( (entry = g_dir_read_name(certdir)) ) {

gchar *fullpath;

PurpleCertificate *crt;

if (!g_pattern_match_string(pempat, entry) && !g_pattern_match_string(crtpat, entry)) {

continue;

}

fullpath = g_build_filename(iter->data, entry, NULL);

/* TODO: Respond to a failure in the following? */

crts = purple_certificates_import(x509, fullpath);

while (crts && crts->data) {

crt = crts->data;

if (x509_ca_quiet_put_cert(crt)) {

gchar *name;

name = purple_certificate_get_subject_name(crt);

purple_debug_info("certificate/x509/ca",

"Loaded %s from %s\n",

name ? name : "(unknown)", fullpath);

g_free(name);

} else {

purple_debug_error("certificate/x509/ca",

"Failed to load certificate from %s\n",

fullpath);

}

purple_certificate_destroy(crt);

crts = g_slist_delete_link(crts, crts);

}

g_free(fullpath);

}

g_dir_close(certdir);

}

g_pattern_spec_free(pempat);

g_pattern_spec_free(crtpat);

purple_debug_info("certificate/x509/ca",

"Lazy init completed.\n");

x509_ca_initialized = TRUE;

return TRUE;

}

static gboolean

x509_ca_init(void)

{

/* Attempt to point at the appropriate system path */

if (NULL == x509_ca_paths) {

#ifdef _WIN32

x509_ca_paths = g_list_append(NULL, g_build_filename(DATADIR,

"ca-certs", NULL));

#else

# ifdef SSL_CERTIFICATES_DIR

x509_ca_paths = g_list_append(NULL, g_strdup(SSL_CERTIFICATES_DIR));

# endif

x509_ca_paths = g_list_append(x509_ca_paths,

g_build_filename(DATADIR, "purple", "ca-certs", NULL));

#endif

}

/* Attempt to initialize now, but if it doesn't work, that's OK;

it will get done later */

if ( ! x509_ca_lazy_init()) {

purple_debug_info("certificate/x509/ca",

"Init failed, probably because a "

"dependency is not yet registered. "

"It has been deferred to later.\n");

}

return TRUE;

}

static void

x509_ca_uninit(void)

{

GList *l;

for (l = x509_ca_certs; l; l = l->next) {

x509_ca_element *el = l->data;

x509_ca_element_free(el);

}

g_list_free(x509_ca_certs);

x509_ca_certs = NULL;

x509_ca_initialized = FALSE;

/** TODO: the cert store in the SSL implementation wouldn't be cleared by this */

g_list_free_full(x509_ca_paths, (GDestroyNotify)g_free);

x509_ca_paths = NULL;

}

/** Look up a ca_element by dn */

static x509_ca_element *

x509_ca_locate_cert(GList *lst, const gchar *dn)

{

GList *cur;

for (cur = lst; cur; cur = cur->next) {

x509_ca_element *el = cur->data;

if (purple_strequal(dn, el->dn)) {

return el;

}

return NULL;

}

static GSList *

x509_ca_locate_certs(GList *lst, const gchar *dn)

{

GList *cur;

GSList *crts = NULL;

for (cur = lst; cur; cur = cur->next) {

x509_ca_element *el = cur->data;

if (purple_strequal(dn, el->dn)) {

crts = g_slist_prepend(crts, el);

}

return crts;

}

static gboolean

x509_ca_cert_in_pool(const gchar *id)

{

g_return_val_if_fail(x509_ca_lazy_init(), FALSE);

g_return_val_if_fail(id, FALSE);

if (x509_ca_locate_cert(x509_ca_certs, id) != NULL) {

return TRUE;

} else {

return FALSE;

}

return FALSE;

}

static PurpleCertificate *

x509_ca_get_cert(const gchar *id)

{

PurpleCertificate *crt = NULL;

x509_ca_element *el;

g_return_val_if_fail(x509_ca_lazy_init(), NULL);

g_return_val_if_fail(id, NULL);

/* Search the memory-cached pool */

el = x509_ca_locate_cert(x509_ca_certs, id);

if (el != NULL) {

/* Make a copy of the memcached one for the function caller

to play with */

crt = purple_certificate_copy(el->crt);

} else {

crt = NULL;

}

return crt;

}

static GSList *

x509_ca_get_certs(const gchar *id)

{

GSList *crts = NULL, *els = NULL;

g_return_val_if_fail(x509_ca_lazy_init(), NULL);

g_return_val_if_fail(id, NULL);

/* Search the memory-cached pool */

els = x509_ca_locate_certs(x509_ca_certs, id);

if (els != NULL) {

GSList *cur;

/* Make a copy of the memcached ones for the function caller

to play with */

for (cur = els; cur; cur = cur->next) {

x509_ca_element *el = cur->data;

crts = g_slist_prepend(crts, purple_certificate_copy(el->crt));

}

g_slist_free(els);

}

return crts;

}

static gboolean

x509_ca_put_cert(const gchar *id, PurpleCertificate *crt)

{

gboolean ret = FALSE;

g_return_val_if_fail(x509_ca_lazy_init(), FALSE);

/* TODO: This is a quick way of doing this. At some point the change

ought to be flushed to disk somehow. */

ret = x509_ca_quiet_put_cert(crt);

return ret;

}

static gboolean

x509_ca_delete_cert(const gchar *id)

{

x509_ca_element *el;

g_return_val_if_fail(x509_ca_lazy_init(), FALSE);

g_return_val_if_fail(id, FALSE);

/* Is the id even in the pool? */

el = x509_ca_locate_cert(x509_ca_certs, id);

if ( el == NULL ) {

purple_debug_warning("certificate/x509/ca",

"Id %s wasn't in the pool\n",

id);

return FALSE;

}

/* Unlink it from the memory cache and destroy it */

x509_ca_certs = g_list_remove(x509_ca_certs, el);

x509_ca_element_free(el);

return TRUE;

}

static GList *

x509_ca_get_idlist(void)

{

GList *l, *idlist;

g_return_val_if_fail(x509_ca_lazy_init(), NULL);

idlist = NULL;

for (l = x509_ca_certs; l; l = l->next) {

x509_ca_element *el = l->data;

idlist = g_list_prepend(idlist, g_strdup(el->dn));

}

return idlist;

}

static PurpleCertificatePool x509_ca = {

"x509", /* Scheme name */

"ca", /* Pool name */

N_("Certificate Authorities"),/* User-friendly name */

NULL, /* Internal data */

x509_ca_init, /* init */

x509_ca_uninit, /* uninit */

x509_ca_cert_in_pool, /* Certificate exists? */

x509_ca_get_cert, /* Cert retriever */

x509_ca_put_cert, /* Cert writer */

x509_ca_delete_cert, /* Cert remover */

x509_ca_get_idlist, /* idlist retriever */

NULL,

NULL

};

/***** Cache of certificates given by TLS/SSL peers *****/

static PurpleCertificatePool x509_tls_peers;

static gboolean

x509_tls_peers_init(void)

{

gchar *poolpath;

int ret;

/* Set up key cache here if it isn't already done */

poolpath = purple_certificate_pool_mkpath(&x509_tls_peers, NULL);

ret = purple_build_dir(poolpath, 0700); /* Make it this user only */

if (ret != 0)

purple_debug_info("certificate/tls_peers",

"Could not create %s. Certificates will not be cached.\n",

poolpath);

g_free(poolpath);

return TRUE;

}

static gboolean

x509_tls_peers_cert_in_pool(const gchar *id)

{

gchar *keypath;

gboolean ret = FALSE;

g_return_val_if_fail(id, FALSE);

keypath = purple_certificate_pool_mkpath(&x509_tls_peers, id);

ret = g_file_test(keypath, G_FILE_TEST_IS_REGULAR);

g_free(keypath);

return ret;

}

static PurpleCertificate *

x509_tls_peers_get_cert(const gchar *id)

{

PurpleCertificateScheme *x509;

PurpleCertificate *crt;

gchar *keypath;

g_return_val_if_fail(id, NULL);

/* Is it in the pool? */

if ( !x509_tls_peers_cert_in_pool(id) ) {

return NULL;

}

/* Look up the X.509 scheme */

x509 = purple_certificate_find_scheme("x509");

g_return_val_if_fail(x509, NULL);

/* Okay, now find and load that key */

keypath = purple_certificate_pool_mkpath(&x509_tls_peers, id);

crt = purple_certificate_import(x509, keypath);

g_free(keypath);

return crt;

}

static gboolean

x509_tls_peers_put_cert(const gchar *id, PurpleCertificate *crt)

{

gboolean ret = FALSE;

gchar *keypath;

g_return_val_if_fail(crt, FALSE);

g_return_val_if_fail(crt->scheme, FALSE);

/* Make sure that this is some kind of X.509 certificate */

/* TODO: Perhaps just check crt->scheme->name instead? */

g_return_val_if_fail(crt->scheme == purple_certificate_find_scheme(x509_tls_peers.scheme_name), FALSE);

/* Work out the filename and export */

keypath = purple_certificate_pool_mkpath(&x509_tls_peers, id);

ret = purple_certificate_export(keypath, crt);

if (crt->scheme->register_trusted_tls_cert) {

ret = (crt->scheme->register_trusted_tls_cert)(crt, FALSE);

}

g_free(keypath);

return ret;

}

static gboolean

x509_tls_peers_delete_cert(const gchar *id)

{

gboolean ret = FALSE;

gchar *keypath;

g_return_val_if_fail(id, FALSE);

/* Is the id even in the pool? */

if (!x509_tls_peers_cert_in_pool(id)) {

purple_debug_warning("certificate/tls_peers",

"Id %s wasn't in the pool\n",

id);

return FALSE;

}

/* OK, so work out the keypath and delete the thing */

keypath = purple_certificate_pool_mkpath(&x509_tls_peers, id);

if ( unlink(keypath) != 0 ) {

purple_debug_error("certificate/tls_peers",

"Unlink of %s failed!\n",

keypath);

ret = FALSE;

} else {

ret = TRUE;

}

g_free(keypath);

return ret;

}

static GList *

x509_tls_peers_get_idlist(void)

{

GList *idlist = NULL;

GDir *dir;

const gchar *entry;

gchar *poolpath;

/* Get a handle on the pool directory */

poolpath = purple_certificate_pool_mkpath(&x509_tls_peers, NULL);

dir = g_dir_open(poolpath,

0, /* No flags */

NULL); /* Not interested in what the error is */

g_free(poolpath);

g_return_val_if_fail(dir, NULL);

/* Traverse the directory listing and create an idlist */

while ( (entry = g_dir_read_name(dir)) != NULL ) {

/* Unescape the filename */

const char *unescaped = purple_unescape_filename(entry);

/* Copy the entry name into our list (GLib owns the original

string) */

idlist = g_list_prepend(idlist, g_strdup(unescaped));

}

/* Release the directory */

g_dir_close(dir);

return idlist;

}

static PurpleCertificatePool x509_tls_peers = {

"x509", /* Scheme name */

"tls_peers", /* Pool name */

N_("SSL Peers Cache"), /* User-friendly name */

NULL, /* Internal data */

x509_tls_peers_init, /* init */

NULL, /* uninit not required */

x509_tls_peers_cert_in_pool, /* Certificate exists? */

x509_tls_peers_get_cert, /* Cert retriever */

x509_tls_peers_put_cert, /* Cert writer */

x509_tls_peers_delete_cert, /* Cert remover */

x509_tls_peers_get_idlist, /* idlist retriever */

NULL,

NULL

};

/***** A Verifier that uses the tls_peers cache and the CA pool to validate certificates *****/

static PurpleCertificateVerifier x509_tls_cached;

/* The following is several hacks piled together and needs to be fixed.

* It exists because show_cert (see its comments) needs the original reason

* given to user_auth in order to rebuild the dialog.

/* TODO: This will cause a ua_ctx to become memleaked if the request(s) get

closed by handle or otherwise abnormally. */

typedef struct {

PurpleCertificateVerificationRequest *vrq;

gchar *reason;

} x509_tls_cached_ua_ctx;

static x509_tls_cached_ua_ctx *

x509_tls_cached_ua_ctx_new(PurpleCertificateVerificationRequest *vrq,

const gchar *reason)

{

x509_tls_cached_ua_ctx *c;

c = g_new0(x509_tls_cached_ua_ctx, 1);

c->vrq = vrq;

c->reason = g_strdup(reason);

return c;

}

static void

x509_tls_cached_ua_ctx_free(x509_tls_cached_ua_ctx *c)

{

g_return_if_fail(c);

g_free(c->reason);

g_free(c);

}

static void

x509_tls_cached_user_auth(PurpleCertificateVerificationRequest *vrq,

const gchar *reason);

static void

x509_tls_cached_show_cert(x509_tls_cached_ua_ctx *c, gint id)

{

PurpleCertificate *disp_crt = c->vrq->cert_chain->data;

/* Since clicking a button closes the request, show it again */

x509_tls_cached_user_auth(c->vrq, c->reason);

/* Show the certificate AFTER re-opening the dialog so that this

appears above the other */

purple_certificate_display_x509(disp_crt);

x509_tls_cached_ua_ctx_free(c);

}

static void

x509_tls_cached_user_auth_cb (x509_tls_cached_ua_ctx *c, gint id)

{

PurpleCertificateVerificationRequest *vrq;

PurpleCertificatePool *tls_peers;

g_return_if_fail(c);

g_return_if_fail(c->vrq);

vrq = c->vrq;

x509_tls_cached_ua_ctx_free(c);

tls_peers = purple_certificate_find_pool("x509","tls_peers");

if (2 == id) {

gchar *cache_id = vrq->subject_name;

purple_debug_info("certificate/x509/tls_cached",

"User ACCEPTED cert\nCaching first in chain for future use as %s...\n",

cache_id);

purple_certificate_pool_store(tls_peers, cache_id,

vrq->cert_chain->data);

purple_certificate_verify_complete(vrq,

PURPLE_CERTIFICATE_VALID);

} else {

purple_debug_warning("certificate/x509/tls_cached",

"User REJECTED cert\n");

purple_certificate_verify_complete(vrq,

PURPLE_CERTIFICATE_INVALID);

}

static void

x509_tls_cached_user_auth_accept_cb(x509_tls_cached_ua_ctx *c, gint ignore)

{

x509_tls_cached_user_auth_cb(c, 2);

}

static void

x509_tls_cached_user_auth_reject_cb(x509_tls_cached_ua_ctx *c, gint ignore)

{

x509_tls_cached_user_auth_cb(c, 1);

}

/** Validates a certificate by asking the user

* @param reason String to explain why the user needs to accept/refuse the

* certificate.

* @todo Needs a handle argument

static void

x509_tls_cached_user_auth(PurpleCertificateVerificationRequest *vrq,

const gchar *reason)

{

gchar *primary;

/* Make messages */

primary = g_strdup_printf(_("Accept certificate for %s?"),

vrq->subject_name);

/* Make a semi-pretty display */

purple_request_action(

vrq->cb_data, /* TODO: Find what the handle ought to be */

_("SSL Certificate Verification"),

primary,

reason,

0, /* Accept by default */

NULL, /* No account */

NULL, /* No other user */

NULL, /* No associated conversation */

x509_tls_cached_ua_ctx_new(vrq, reason),

3, /* Number of actions */

_("Accept"), x509_tls_cached_user_auth_accept_cb,

_("Reject"), x509_tls_cached_user_auth_reject_cb,

_("_View Certificate..."), x509_tls_cached_show_cert);

/* Cleanup */

g_free(primary);

}

static void

x509_tls_cached_unknown_peer(PurpleCertificateVerificationRequest *vrq,

PurpleCertificateInvalidityFlags flags);

static void

x509_tls_cached_complete(PurpleCertificateVerificationRequest *vrq,

PurpleCertificateInvalidityFlags flags)

{

PurpleCertificatePool *tls_peers;

PurpleCertificate *peer_crt = vrq->cert_chain->data;

if (flags & PURPLE_CERTIFICATE_FATALS_MASK) {

/* TODO: Also print any other warnings? */

const gchar *error;

gchar *tmp, *secondary;

if (flags & PURPLE_CERTIFICATE_INVALID_CHAIN)

error = invalidity_reason_to_string(PURPLE_CERTIFICATE_INVALID_CHAIN);

else if (flags & PURPLE_CERTIFICATE_REVOKED)

error = invalidity_reason_to_string(PURPLE_CERTIFICATE_REVOKED);

else

error = invalidity_reason_to_string(PURPLE_CERTIFICATE_UNKNOWN_ERROR);

tmp = g_strdup_printf(_("The certificate for %s could not be validated."),

vrq->subject_name);

secondary = g_strconcat(tmp, " ", error, NULL);

g_free(tmp);

purple_notify_error(NULL, /* TODO: Probably wrong. */

_("SSL Certificate Error"),

_("Unable to validate certificate"),

secondary);

g_free(secondary);

purple_certificate_verify_complete(vrq, PURPLE_CERTIFICATE_INVALID);

return;

} else if (flags & PURPLE_CERTIFICATE_NON_FATALS_MASK) {

/* Non-fatal error. Prompt the user. */

gchar *tmp;

GString *errors;

guint32 i = 1;

tmp = g_strdup_printf(_("The certificate for %s could not be validated."),

vrq->subject_name);

errors = g_string_new(tmp);

g_free(tmp);

errors = g_string_append_c(errors, '\n');

/* Special case a name mismatch because we want to display the two names... */

if (flags & PURPLE_CERTIFICATE_NAME_MISMATCH) {

gchar *sn = purple_certificate_get_subject_name(peer_crt);

if (sn) {

g_string_append_printf(errors, _("The certificate claims to be "

"from \"%s\" instead. This could mean that you are "

"not connecting to the service you believe you are."),

sn);

g_free(sn);

flags &= ~PURPLE_CERTIFICATE_NAME_MISMATCH;

}

while (i != PURPLE_CERTIFICATE_LAST) {

if (flags & i) {

errors = g_string_append_c(errors, '\n');

g_string_append(errors, invalidity_reason_to_string(i));

}

i <<= 1;

}

x509_tls_cached_user_auth(vrq, errors->str);

g_string_free(errors, TRUE);

return;

}

/* If we reach this point, the certificate is good. */

/* Look up the local cache and store it there for future use */

tls_peers = purple_certificate_find_pool(x509_tls_cached.scheme_name,

"tls_peers");

if (tls_peers) {

if (!purple_certificate_pool_store(tls_peers,vrq->subject_name,

peer_crt)) {

purple_debug_error("certificate/x509/tls_cached",

"FAILED to cache peer certificate\n");

}

} else {

purple_debug_error("certificate/x509/tls_cached",

"Unable to locate tls_peers certificate cache.\n");

}

purple_certificate_verify_complete(vrq, PURPLE_CERTIFICATE_VALID);

}

static void

x509_tls_cached_cert_in_cache(PurpleCertificateVerificationRequest *vrq,

PurpleCertificateInvalidityFlags flags)

{

/* TODO: Looking this up by name over and over is expensive.

Fix, please! */

PurpleCertificatePool *tls_peers =

purple_certificate_find_pool(x509_tls_cached.scheme_name,

"tls_peers");

/* The peer's certificate should be the first in the list */

PurpleCertificate *peer_crt =

(PurpleCertificate *) vrq->cert_chain->data;

PurpleCertificate *cached_crt;

GByteArray *peer_fpr, *cached_fpr;

/* Load up the cached certificate */

cached_crt = purple_certificate_pool_retrieve(

tls_peers, vrq->subject_name);

if ( !cached_crt ) {

purple_debug_warning("certificate/x509/tls_cached",

"Lookup failed on cached certificate!\n"

"Falling back to full verification.\n");

/* vrq now becomes the problem of unknown_peer */

x509_tls_cached_unknown_peer(vrq, flags);

return;

}

/* Now get SHA256 sums for both and compare them */

/* TODO: This is not an elegant way to compare certs */

peer_fpr = purple_certificate_get_fingerprint_sha256(peer_crt, TRUE);

cached_fpr = purple_certificate_get_fingerprint_sha256(cached_crt, TRUE);

if (!memcmp(peer_fpr->data, cached_fpr->data, peer_fpr->len)) {

purple_debug_info("certificate/x509/tls_cached",

"Peer cert matched cached\n");

x509_tls_cached_complete(vrq, flags);

} else {

purple_debug_error("certificate/x509/tls_cached",

"Peer cert did NOT match cached\n");

/* vrq now becomes the problem of the user */

x509_tls_cached_unknown_peer(vrq, flags);

}

purple_certificate_destroy(cached_crt);

g_byte_array_free(peer_fpr, TRUE);

g_byte_array_free(cached_fpr, TRUE);

}

* This is called from two points in x509_tls_cached_unknown_peer below

* once we've verified the signature chain is valid. Now we need to verify

* the subject name of the certificate.

static void

x509_tls_cached_check_subject_name(PurpleCertificateVerificationRequest *vrq,

PurpleCertificateInvalidityFlags flags)

{

PurpleCertificate *peer_crt;

GList *chain = vrq->cert_chain;

peer_crt = (PurpleCertificate *) chain->data;

/* Last, check that the hostname matches */

if ( ! purple_certificate_check_subject_name(peer_crt,

vrq->subject_name) ) {

gchar *sn = purple_certificate_get_subject_name(peer_crt);

flags |= PURPLE_CERTIFICATE_NAME_MISMATCH;

purple_debug_error("certificate/x509/tls_cached",

"Name mismatch: Certificate given for %s "

"has a name of %s\n",

vrq->subject_name, sn);

g_free(sn);

}

x509_tls_cached_complete(vrq, flags);

}

/* For when we've never communicated with this party before */

/* TODO: Need ways to specify possibly multiple problems with a cert, or at

least reprioritize them.

static void

x509_tls_cached_unknown_peer(PurpleCertificateVerificationRequest *vrq,

PurpleCertificateInvalidityFlags flags)

{

PurpleCertificatePool *ca;

PurpleCertificate *peer_crt;

PurpleCertificate *ca_crt, *end_crt;

PurpleCertificate *failing_crt;

GList *chain = vrq->cert_chain;

GSList *ca_crts, *cur;

GByteArray *last_fpr, *ca_fpr;

gboolean valid = FALSE;

gchar *ca_id, *ca2_id;

peer_crt = (PurpleCertificate *) chain->data;

if (peer_crt->scheme->verify_cert) {

/** Make sure we've loaded the CA certs (which causes NSS to trust them) */

g_return_if_fail(x509_ca_lazy_init());

peer_crt->scheme->verify_cert(vrq, &flags);

x509_tls_cached_complete(vrq, flags);

return;

}

/* TODO: Figure out a way to check for a bad signature, as opposed to

"not self-signed" */

if ( purple_certificate_signed_by(peer_crt, peer_crt) ) {

flags |= PURPLE_CERTIFICATE_SELF_SIGNED;

purple_debug_info("certificate/x509/tls_cached",

"Certificate for %s is self-signed.\n",

vrq->subject_name);

x509_tls_cached_check_subject_name(vrq, flags);

return;

} /* if (self signed) */

ca = purple_certificate_find_pool(x509_tls_cached.scheme_name, "ca");

/* Next, check that the certificate chain is valid */

if (!purple_certificate_check_signature_chain_with_failing(chain,

&failing_crt))

{

gboolean chain_validated = FALSE;

* Check if the failing certificate is in the CA store. If it is, then

* consider this fully validated. This works around issues with some

* prominent intermediate CAs whose signature is md5WithRSAEncryption.

* I'm looking at CACert Class 3 here. See #4458 for details.

if (ca) {

gchar *uid = purple_certificate_get_unique_id(failing_crt);

PurpleCertificate *ca_crt = purple_certificate_pool_retrieve(ca, uid);

if (ca_crt != NULL) {

GByteArray *failing_fpr;

GByteArray *ca_fpr;

failing_fpr = purple_certificate_get_fingerprint_sha256(failing_crt, TRUE);

ca_fpr = purple_certificate_get_fingerprint_sha256(ca_crt, TRUE);

if (byte_arrays_equal(failing_fpr, ca_fpr)) {

purple_debug_info("certificate/x509/tls_cached",

"Full chain verification failed (probably a bad "

"signature algorithm), but found the last "

"certificate %s in the CA pool.\n", uid);

chain_validated = TRUE;

}

g_byte_array_free(failing_fpr, TRUE);

g_byte_array_free(ca_fpr, TRUE);

}

purple_certificate_destroy(ca_crt);

g_free(uid);

}

* If we get here, either the cert matched the stuff right above

* or it didn't, in which case we give up and complain to the user.

if (!chain_validated)

/* TODO: Tell the user where the chain broke? */

flags |= PURPLE_CERTIFICATE_INVALID_CHAIN;

x509_tls_cached_check_subject_name(vrq, flags);

return;

} /* if (signature chain not good) */

/* Next, attempt to verify the last certificate is signed by a trusted

* CA, or is a trusted CA (based on fingerprint).

/* If, for whatever reason, there is no Certificate Authority pool

loaded, we'll verify the subject name and then warn about thsi. */

if ( !ca ) {

purple_debug_error("certificate/x509/tls_cached",

"No X.509 Certificate Authority pool "

"could be found!\n");

flags |= PURPLE_CERTIFICATE_NO_CA_POOL;

x509_tls_cached_check_subject_name(vrq, flags);

return;

}

end_crt = g_list_last(chain)->data;

/* Attempt to look up the last certificate, and the last certificate's

* issuer.

ca_id = purple_certificate_get_issuer_unique_id(end_crt);

ca2_id = purple_certificate_get_unique_id(end_crt);

purple_debug_info("certificate/x509/tls_cached",

"Checking for a CA with DN=%s\n",

ca_id);

purple_debug_info("certificate/x509/tls_cached",

"Also checking for a CA with DN=%s\n",

ca2_id);

ca_crts = g_slist_concat(x509_ca_get_certs(ca_id), x509_ca_get_certs(ca2_id));

g_free(ca_id);

g_free(ca2_id);

if ( NULL == ca_crts ) {

flags |= PURPLE_CERTIFICATE_CA_UNKNOWN;

purple_debug_warning("certificate/x509/tls_cached",

"No Certificate Authorities with either DN found "

"found. I'll prompt the user, I guess.\n");

x509_tls_cached_check_subject_name(vrq, flags);

return;

}

* Check the fingerprints; if they match, then this certificate *is* one

* of the designated "trusted roots", and we don't need to verify the

* signature. This is good because some of the older roots are self-signed

* with bad hash algorithms that we don't want to allow in any other

* circumstances (one of Verisign's root CAs is self-signed with MD2).

* If the fingerprints don't match, we'll fall back to checking the

* signature.

last_fpr = purple_certificate_get_fingerprint_sha256(end_crt, TRUE);

ca_id = purple_certificate_get_unique_id(end_crt);

for (cur = ca_crts; cur; cur = cur->next) {

ca_crt = cur->data;

ca_fpr = purple_certificate_get_fingerprint_sha256(ca_crt, TRUE);

ca2_id = purple_certificate_get_unique_id(ca_crt);

if ( byte_arrays_equal(last_fpr, ca_fpr) ||

(purple_strequal(ca_id, ca2_id) &&

purple_certificate_compare_pubkeys(end_crt, ca_crt)) ||

purple_certificate_signed_by(end_crt, ca_crt) )

{

/* TODO: If signed_by ever returns a reason, maybe mention

that, too. */

/* TODO: Also mention the CA involved. While I could do this

now, a full DN is a little much with which to assault the

user's poor, leaky eyes. */

valid = TRUE;

g_byte_array_free(ca_fpr, TRUE);

g_free(ca2_id);

break;

}

g_byte_array_free(ca_fpr, TRUE);

g_free(ca2_id);

}

g_free(ca_id);

if (valid == FALSE)

flags |= PURPLE_CERTIFICATE_INVALID_CHAIN;

g_slist_free_full(ca_crts, (GDestroyNotify)purple_certificate_destroy);

g_byte_array_free(last_fpr, TRUE);

x509_tls_cached_check_subject_name(vrq, flags);

}

static void

x509_tls_cached_start_verify(PurpleCertificateVerificationRequest *vrq)

{

const gchar *tls_peers_name = "tls_peers"; /* Name of local cache */

PurpleCertificatePool *tls_peers;

time_t now, activation, expiration;

PurpleCertificateInvalidityFlags flags = PURPLE_CERTIFICATE_NO_PROBLEMS;

gboolean ret;

g_return_if_fail(vrq);

purple_debug_info("certificate/x509/tls_cached",

"Starting verify for %s\n",

vrq->subject_name);

* Verify the first certificate (the main one) has been activated and

* isn't expired, i.e. activation < now < expiration.

now = time(NULL);

ret = purple_certificate_get_times(vrq->cert_chain->data, &activation,

&expiration);

if (!ret) {

flags |= PURPLE_CERTIFICATE_EXPIRED | PURPLE_CERTIFICATE_NOT_ACTIVATED;

purple_debug_error("certificate/x509/tls_cached",

"Failed to get validity times for certificate %s\n",

vrq->subject_name);

} else if (now > expiration) {

flags |= PURPLE_CERTIFICATE_EXPIRED;

purple_debug_error("certificate/x509/tls_cached",

"Certificate %s expired at %s\n",

vrq->subject_name, ctime(&expiration));

} else if (now < activation) {

flags |= PURPLE_CERTIFICATE_NOT_ACTIVATED;

purple_debug_error("certificate/x509/tls_cached",

"Certificate %s is not yet valid, will be at %s\n",

vrq->subject_name, ctime(&activation));

}

tls_peers = purple_certificate_find_pool(x509_tls_cached.scheme_name,tls_peers_name);

if (!tls_peers) {

purple_debug_error("certificate/x509/tls_cached",

"Couldn't find local peers cache %s\n",

tls_peers_name);

/* vrq now becomes the problem of unknown_peer */

x509_tls_cached_unknown_peer(vrq, flags);

return;

}

/* Check if the peer has a certificate cached already */

purple_debug_info("certificate/x509/tls_cached",

"Checking for cached cert...\n");

if (purple_certificate_pool_contains(tls_peers, vrq->subject_name)) {

purple_debug_info("certificate/x509/tls_cached",

"...Found cached cert\n");

/* vrq is now the responsibility of cert_in_cache */

x509_tls_cached_cert_in_cache(vrq, flags);

} else {

purple_debug_warning("certificate/x509/tls_cached",

"...Not in cache\n");

/* vrq now becomes the problem of unknown_peer */

x509_tls_cached_unknown_peer(vrq, flags);

}

static void

x509_tls_cached_destroy_request(PurpleCertificateVerificationRequest *vrq)

{

g_return_if_fail(vrq);

}

static PurpleCertificateVerifier x509_tls_cached = {

"x509", /* Scheme name */

"tls_cached", /* Verifier name */

x509_tls_cached_start_verify, /* Verification begin */

x509_tls_cached_destroy_request,/* Request cleanup */

NULL,

NULL

};

/****************************************************************************/

/* Subsystem */

/****************************************************************************/

void

purple_certificate_init(void)

{

/* Register builtins */

purple_certificate_register_verifier(&x509_singleuse);

purple_certificate_register_pool(&x509_ca);

purple_certificate_register_pool(&x509_tls_peers);

purple_certificate_register_verifier(&x509_tls_cached);

}

void

purple_certificate_uninit(void)

{

/* Unregister all Verifiers */

g_list_foreach(cert_verifiers, (GFunc)purple_certificate_unregister_verifier, NULL);

/* Unregister all Pools */

g_list_foreach(cert_pools, (GFunc)purple_certificate_unregister_pool, NULL);

}

gpointer

purple_certificate_get_handle(void)

{

static gint handle;

return &handle;

}

PurpleCertificateScheme *

purple_certificate_find_scheme(const gchar *name)

{

PurpleCertificateScheme *scheme = NULL;

GList *l;

g_return_val_if_fail(name, NULL);

/* Traverse the list of registered schemes and locate the

one whose name matches */

for(l = cert_schemes; l; l = l->next) {

scheme = (PurpleCertificateScheme *)(l->data);

/* Name matches? that's our man */

if(!g_ascii_strcasecmp(scheme->name, name))

return scheme;

}

purple_debug_warning("certificate",

"CertificateScheme %s requested but not found.\n",

name);

/* TODO: Signalling and such? */

return NULL;

}

GList *

purple_certificate_get_schemes(void)

{

return cert_schemes;

}

gboolean

purple_certificate_register_scheme(PurpleCertificateScheme *scheme)

{

g_return_val_if_fail(scheme != NULL, FALSE);

/* Make sure no scheme is registered with the same name */

if (purple_certificate_find_scheme(scheme->name) != NULL) {

return FALSE;

}

/* Okay, we're golden. Register it. */

cert_schemes = g_list_prepend(cert_schemes, scheme);

/* TODO: Signalling and such? */

purple_debug_info("certificate",

"CertificateScheme %s registered\n",

scheme->name);

return TRUE;

}

gboolean

purple_certificate_unregister_scheme(PurpleCertificateScheme *scheme)

{

if (NULL == scheme) {

purple_debug_warning("certificate",

"Attempting to unregister NULL scheme\n");

return FALSE;

}

/* TODO: signalling? */

/* TODO: unregister all CertificateVerifiers for this scheme?*/

/* TODO: unregister all CertificatePools for this scheme? */

/* Neither of the above should be necessary, though */

cert_schemes = g_list_remove(cert_schemes, scheme);

purple_debug_info("certificate",

"CertificateScheme %s unregistered\n",

scheme->name);

return TRUE;

}

PurpleCertificateVerifier *

purple_certificate_find_verifier(const gchar *scheme_name, const gchar *ver_name)

{

PurpleCertificateVerifier *vr = NULL;

GList *l;

g_return_val_if_fail(scheme_name, NULL);

g_return_val_if_fail(ver_name, NULL);

/* Traverse the list of registered verifiers and locate the

one whose name matches */

for(l = cert_verifiers; l; l = l->next) {

vr = (PurpleCertificateVerifier *)(l->data);

/* Scheme and name match? */

if(!g_ascii_strcasecmp(vr->scheme_name, scheme_name) &&

!g_ascii_strcasecmp(vr->name, ver_name))

return vr;

}

purple_debug_warning("certificate",

"CertificateVerifier %s, %s requested but not found.\n",

scheme_name, ver_name);

/* TODO: Signalling and such? */

return NULL;

}

GList *

purple_certificate_get_verifiers(void)

{

return cert_verifiers;

}

gboolean

purple_certificate_register_verifier(PurpleCertificateVerifier *vr)

{

g_return_val_if_fail(vr != NULL, FALSE);

/* Make sure no verifier is registered with the same scheme/name */

if (purple_certificate_find_verifier(vr->scheme_name, vr->name) != NULL) {

return FALSE;

}

/* Okay, we're golden. Register it. */

cert_verifiers = g_list_prepend(cert_verifiers, vr);

/* TODO: Signalling and such? */

purple_debug_info("certificate",

"CertificateVerifier %s registered\n",

vr->name);

return TRUE;

}

gboolean

purple_certificate_unregister_verifier(PurpleCertificateVerifier *vr)

{

if (NULL == vr) {

purple_debug_warning("certificate",

"Attempting to unregister NULL verifier\n");

return FALSE;

}

/* TODO: signalling? */

cert_verifiers = g_list_remove(cert_verifiers, vr);

purple_debug_info("certificate",

"CertificateVerifier %s unregistered\n",

vr->name);

return TRUE;

}

PurpleCertificatePool *

purple_certificate_find_pool(const gchar *scheme_name, const gchar *pool_name)

{

PurpleCertificatePool *pool = NULL;

GList *l;

g_return_val_if_fail(scheme_name, NULL);

g_return_val_if_fail(pool_name, NULL);

/* Traverse the list of registered pools and locate the

one whose name matches */

for(l = cert_pools; l; l = l->next) {

pool = (PurpleCertificatePool *)(l->data);

/* Scheme and name match? */

if(!g_ascii_strcasecmp(pool->scheme_name, scheme_name) &&

!g_ascii_strcasecmp(pool->name, pool_name))

return pool;

}

purple_debug_warning("certificate",

"CertificatePool %s, %s requested but not found.\n",

scheme_name, pool_name);

/* TODO: Signalling and such? */

return NULL;

}

GList *

purple_certificate_get_pools(void)

{

return cert_pools;

}

gboolean

purple_certificate_register_pool(PurpleCertificatePool *pool)

{

g_return_val_if_fail(pool, FALSE);

g_return_val_if_fail(pool->scheme_name, FALSE);

g_return_val_if_fail(pool->name, FALSE);

g_return_val_if_fail(pool->fullname, FALSE);

/* Make sure no pools are registered under this name */

if (purple_certificate_find_pool(pool->scheme_name, pool->name)) {

return FALSE;

}

/* Initialize the pool if needed */

if (pool->init) {

gboolean success;

success = pool->init();

if (!success)

return FALSE;

}

/* Register the Pool */

cert_pools = g_list_prepend(cert_pools, pool);

/* TODO: Emit a signal that the pool got registered */

PURPLE_DBUS_REGISTER_POINTER(pool, PurpleCertificatePool);

purple_signal_register(pool, /* Signals emitted from pool */

"certificate-stored",

purple_marshal_VOID__POINTER_POINTER,

NULL, /* No callback return value */

2, /* Two non-data arguments */

purple_value_new(PURPLE_TYPE_SUBTYPE,

PURPLE_SUBTYPE_CERTIFICATEPOOL),

purple_value_new(PURPLE_TYPE_STRING));

purple_signal_register(pool, /* Signals emitted from pool */

"certificate-deleted",

purple_marshal_VOID__POINTER_POINTER,

NULL, /* No callback return value */

2, /* Two non-data arguments */

purple_value_new(PURPLE_TYPE_SUBTYPE,

PURPLE_SUBTYPE_CERTIFICATEPOOL),

purple_value_new(PURPLE_TYPE_STRING));

purple_debug_info("certificate",

"CertificatePool %s registered\n",

pool->name);

return TRUE;

}

gboolean

purple_certificate_unregister_pool(PurpleCertificatePool *pool)

{

if (NULL == pool) {

purple_debug_warning("certificate",

"Attempting to unregister NULL pool\n");

return FALSE;

}

/* Check that the pool is registered */

if (!g_list_find(cert_pools, pool)) {

purple_debug_warning("certificate",

"Pool to unregister isn't registered!\n");

return FALSE;

}

/* Uninit the pool if needed */

PURPLE_DBUS_UNREGISTER_POINTER(pool);

if (pool->uninit) {

pool->uninit();

}

cert_pools = g_list_remove(cert_pools, pool);

/* TODO: Signalling? */

purple_signal_unregister(pool, "certificate-stored");

purple_signal_unregister(pool, "certificate-deleted");

purple_debug_info("certificate",

"CertificatePool %s unregistered\n",

pool->name);

return TRUE;

}

/****************************************************************************/

/* Scheme-specific functions */

/****************************************************************************/

static void display_x509_issuer(gchar *issuer_id) {

PurpleCertificate *issuer_crt;

issuer_crt = x509_ca_get_cert(issuer_id);

if (issuer_crt) {

purple_certificate_display_x509(issuer_crt);

purple_certificate_destroy(issuer_crt);

} else {

purple_notify_info(NULL, /* TODO: Find what the handle ought to be */

_("Certificate Information"),

"",

_("Unable to find Issuer Certificate"));

}

g_free(issuer_id);

}

void

purple_certificate_display_x509(PurpleCertificate *crt)

{

gchar *sha1_asc, *sha256_asc;

gchar *cn, *issuer_id;

time_t activation, expiration;

gchar *activ_str, *expir_str;

gchar *secondary, *secondary_extra;

gboolean self_signed;

get_ascii_fingerprints(crt, &sha1_asc, &sha256_asc);

/* Get the cert Common Name */

/* TODO: Will break on CA certs */

cn = purple_certificate_get_subject_name(crt);

issuer_id = purple_certificate_get_issuer_unique_id(crt);

/* Get the certificate times */

/* TODO: Check the times against localtime */

/* TODO: errorcheck? */

if (!purple_certificate_get_times(crt, &activation, &expiration)) {

purple_debug_error("certificate",

"Failed to get certificate times!\n");

activation = expiration = 0;

}

activ_str = g_strdup(ctime(&activation));

expir_str = g_strdup(ctime(&expiration));

self_signed = purple_certificate_signed_by(crt, crt);

/* Make messages */

secondary = g_strdup_printf(_("Common name: %s\n\n"

"Issued By: %s\n\n"

"Fingerprint (SHA1): %s\n\n"

"Activation date: %s\n"

"Expiration date: %s\n"),

cn ? cn : "(null)",

self_signed ? _("(self-signed)") : (issuer_id ? issuer_id : "(null)"),

sha1_asc ? sha1_asc : "(null)",

activ_str ? activ_str : "(null)",

expir_str ? expir_str : "(null)");

/* TODO: make this part of the translatable string above */

secondary_extra = g_strdup_printf("%sSHA256: %s", secondary, sha256_asc);

/* Make a semi-pretty display */

if (self_signed) {

purple_notify_info(NULL, /* TODO: Find what the handle ought to be */

_("Certificate Information"),

"",

secondary_extra);

} else {

purple_request_action(NULL, /* TODO: Find what the handle ought to be */

_("Certificate Information"), _("Certificate Information"),

secondary_extra, 2, NULL, NULL, NULL,

issuer_id, 2,

_("View Issuer Certificate"), PURPLE_CALLBACK(display_x509_issuer),

_("Close"), PURPLE_CALLBACK(g_free));

/* purple_request_action has taken ownership of issuer_id */

issuer_id = NULL;

}

/* Cleanup */

g_free(cn);

g_free(issuer_id);

g_free(secondary);

g_free(secondary_extra);

g_free(sha1_asc);

g_free(sha256_asc);

g_free(activ_str);

g_free(expir_str);

}

void purple_certificate_add_ca_search_path(const char *path)

{

if (g_list_find_custom(x509_ca_paths, path, (GCompareFunc)strcmp))

return;

x509_ca_paths = g_list_append(x509_ca_paths, g_strdup(path));

}

pidgin/pidgin