etpan-ssl.c (5562B)
1 /* 2 * Claws Mail -- a GTK based, lightweight, and fast e-mail client 3 * Copyright (C) 1999-2012 Colin Leroy <colin@colino.net> 4 * and the Claws Mail team 5 * 6 * This program is free software; you can redistribute it and/or modify 7 * it under the terms of the GNU General Public License as published by 8 * the Free Software Foundation; either version 3 of the License, or 9 * (at your option) any later version. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 * You should have received a copy of the GNU General Public License 17 * along with this program. If not, see <http://www.gnu.org/licenses/>. 18 * 19 */ 20 21 #include <libetpan/libetpan.h> 22 #include <libetpan/libetpan_version.h> 23 #include <gnutls/gnutls.h> 24 #include <gnutls/x509.h> 25 #include <stdlib.h> 26 #include <glib.h> 27 #include <glib/gi18n.h> 28 #include <errno.h> 29 30 #include "etpan-ssl.h" 31 #include "ssl_certificate.h" 32 #include "utils.h" 33 #include "log.h" 34 #include "prefs_account.h" 35 36 gboolean etpan_certificate_check(mailstream *stream, const char *host, gint port, 37 gboolean accept_if_valid) 38 { 39 #if (!defined LIBETPAN_API_CURRENT || LIBETPAN_API_CURRENT < 18) 40 unsigned char *cert_der = NULL; 41 int len; 42 gnutls_x509_crt_t cert = NULL; 43 gnutls_datum_t tmp; 44 45 if (stream == NULL) 46 return FALSE; 47 48 len = (int)mailstream_ssl_get_certificate(stream, &cert_der); 49 50 if (cert_der == NULL || len < 0) { 51 g_warning("no cert presented"); 52 return FALSE; 53 } 54 55 tmp.data = malloc(len); 56 memcpy(tmp.data, cert_der, len); 57 tmp.size = len; 58 gnutls_x509_crt_init(&cert); 59 60 free(cert_der); 61 62 if (gnutls_x509_crt_import(cert, &tmp, GNUTLS_X509_FMT_DER) < 0) { 63 free(tmp.data); 64 g_warning("IMAP: can't get cert"); 65 return FALSE; 66 } else if (ssl_certificate_check(cert, (guint)-1, host, port, accept_if_valid) == TRUE) { 67 free(tmp.data); 68 gnutls_x509_crt_deinit(cert); 69 return TRUE; 70 } else { 71 free(tmp.data); 72 gnutls_x509_crt_deinit(cert); 73 return FALSE; 74 } 75 #else 76 carray *certs_der = NULL; 77 gint chain_len = 0, i; 78 gnutls_x509_crt_t *certs = NULL; 79 gboolean result; 80 81 if (stream == NULL) 82 return FALSE; 83 84 certs_der = mailstream_get_certificate_chain(stream); 85 if (!certs_der) { 86 g_warning("could not get certs"); 87 return FALSE; 88 } 89 chain_len = carray_count(certs_der); 90 91 certs = malloc(sizeof(gnutls_x509_crt_t) * chain_len); 92 if (certs == NULL) { 93 g_warning("could not allocate certs"); 94 return FALSE; 95 } 96 97 result = TRUE; 98 for (i = 0; i < chain_len; i++) { 99 MMAPString *cert_str = carray_get(certs_der, i); 100 gnutls_datum_t tmp; 101 102 tmp.data = malloc(cert_str->len); 103 memcpy(tmp.data, cert_str->str, cert_str->len); 104 tmp.size = cert_str->len; 105 106 mmap_string_free(cert_str); 107 108 gnutls_x509_crt_init(&certs[i]); 109 if (gnutls_x509_crt_import(certs[i], &tmp, GNUTLS_X509_FMT_DER) < 0) 110 result = FALSE; 111 112 free(tmp.data); 113 } 114 115 carray_free(certs_der); 116 117 if (result == TRUE) 118 result = ssl_certificate_check_chain(certs, chain_len, host, port, 119 accept_if_valid); 120 121 for (i = 0; i < chain_len; i++) 122 gnutls_x509_crt_deinit(certs[i]); 123 free(certs); 124 125 return result; 126 #endif 127 } 128 129 void etpan_connect_ssl_context_cb(struct mailstream_ssl_context * ssl_context, void * data) 130 { 131 PrefsAccount *account = (PrefsAccount *)data; 132 const gchar *cert_path = NULL; 133 const gchar *password = NULL; 134 gnutls_x509_crt_t x509 = NULL; 135 gnutls_x509_privkey_t pkey = NULL; 136 137 if (account->in_ssl_client_cert_file && *account->in_ssl_client_cert_file) 138 cert_path = account->in_ssl_client_cert_file; 139 if (account->in_ssl_client_cert_pass && *account->in_ssl_client_cert_pass) 140 password = account->in_ssl_client_cert_pass; 141 142 if (mailstream_ssl_set_client_certificate_data(ssl_context, NULL, 0) < 0 || 143 mailstream_ssl_set_client_private_key_data(ssl_context, NULL, 0) < 0) 144 debug_print("Impossible to set the client certificate.\n"); 145 x509 = ssl_certificate_get_x509_from_pem_file(cert_path); 146 pkey = ssl_certificate_get_pkey_from_pem_file(cert_path); 147 if (!(x509 && pkey)) { 148 /* try pkcs12 format */ 149 ssl_certificate_get_x509_and_pkey_from_p12_file(cert_path, password, &x509, &pkey); 150 } 151 if (x509 && pkey) { 152 unsigned char *x509_der = NULL, *pkey_der = NULL; 153 size_t x509_len, pkey_len; 154 155 x509_len = (size_t)gnutls_i2d_X509(x509, &x509_der); 156 pkey_len = (size_t)gnutls_i2d_PrivateKey(pkey, &pkey_der); 157 if (x509_len > 0 && pkey_len > 0) { 158 if (mailstream_ssl_set_client_certificate_data(ssl_context, x509_der, x509_len) < 0 || 159 mailstream_ssl_set_client_private_key_data(ssl_context, pkey_der, pkey_len) < 0) 160 log_error(LOG_PROTOCOL, _("Impossible to set the client certificate.\n")); 161 g_free(x509_der); 162 g_free(pkey_der); 163 } 164 gnutls_x509_crt_deinit(x509); 165 gnutls_x509_privkey_deinit(pkey); 166 } 167 168 #if (defined LIBETPAN_API_CURRENT && LIBETPAN_API_CURRENT >= 23) 169 /* If we have a host name, rather than a numerical IP address, tell 170 * gnutls to send it in the Server Name Identification extension field, 171 * to give the server a chance to select the correct certificate in the 172 * virtual hosting case where multiple domain names are hosted on the 173 * same IP address. */ 174 if (account->use_tls_sni && 175 !is_numeric_host_address(account->recv_server)) { 176 int r; 177 178 r = mailstream_ssl_set_server_name(ssl_context, account->recv_server); 179 debug_print("Set libetpan SSL mail stream server name indication to %s, status = %d\n", 180 account->recv_server, r); 181 } 182 #endif /* LIBETPAN_API_CURRENT >= 23 */ 183 184 }