Refactoring certificates & certificate checking.

author: Remko Tronçon <git@el-tramo.be> 2010-11-07 20:07:06 (GMT)
committer: Remko Tronçon <git@el-tramo.be> 2010-11-07 21:27:17 (GMT)
commit: a594eb3fef7e047d1eca7959d7734d4d10fd1eb7 (patch)
tree: f0c75a890caf231e18c963e6485d8c3fcf418324 /Swiften/TLS
parent: 8cfb6d8f3492dd4180429f37dfb463b2fa48b0b8 (diff)
download: swift-a594eb3fef7e047d1eca7959d7734d4d10fd1eb7.zip
swift-a594eb3fef7e047d1eca7959d7734d4d10fd1eb7.tar.bz2
15 files changed, 220 insertions, 173 deletions
diff --git a/Swiften/TLS/BlindCertificateTrustChecker.h b/Swiften/TLS/BlindCertificateTrustChecker.h
new file mode 100644
index 0000000..26a7f94
--- /dev/null
+++ b/Swiften/TLS/BlindCertificateTrustChecker.h
@@ -0,0 +1,18 @@
+/*
+ * Copyright (c) 2010 Remko Tronçon
+ * Licensed under the GNU General Public License v3.
+ * See Documentation/Licenses/GPLv3.txt for more information.
+ */
+
+#pragma once
+
+#include "Swiften/TLS/CertificateTrustChecker.h"
+
+namespace Swift {
+	class BlindCertificateTrustChecker : public CertificateTrustChecker {
+		public:
+			virtual bool isCertificateTrusted(Certificate::ref, const String&) {
+				return true;
+			}
+	};
+}
diff --git a/Swiften/TLS/Certificate.cpp b/Swiften/TLS/Certificate.cpp
new file mode 100644
index 0000000..7d61b22
--- /dev/null
+++ b/Swiften/TLS/Certificate.cpp
@@ -0,0 +1,17 @@
+/*
+ * Copyright (c) 2010 Remko Tronçon
+ * Licensed under the GNU General Public License v3.
+ * See Documentation/Licenses/GPLv3.txt for more information.
+ */
+
+#include "Swiften/TLS/Certificate.h"
+
+namespace Swift {
+
+const char* Certificate::ID_ON_XMPPADDR_OID = "1.3.6.1.5.5.7.8.5";
+const char* Certificate::ID_ON_DNSSRV_OID = "1.3.6.1.5.5.7.8.7";
+
+Certificate::~Certificate() {
+}
+
+}
diff --git a/Swiften/TLS/Certificate.h b/Swiften/TLS/Certificate.h
index 21ea0bd..3a812a8 100644
--- a/Swiften/TLS/Certificate.h
+++ b/Swiften/TLS/Certificate.h
@@ -15,42 +15,16 @@ namespace Swift {
 		public:
 			typedef boost::shared_ptr<Certificate> ref;
 
-			const String& getCommonName() const {
-				return commonName;
-			}
-
-			void setCommonName(const String& commonName) {
-				this->commonName = commonName;
-			}
-
-			const std::vector<String>& getSRVNames() const {
-				return srvNames;
-			}
-
-			void addSRVName(const String& name) {
-				srvNames.push_back(name);
-			}
-
-			const std::vector<String>& getDNSNames() const {
-				return dnsNames;
-			}
-
-			void addDNSName(const String& name) {
-				dnsNames.push_back(name);
-			}
-
-			const std::vector<String>& getXMPPAddresses() const {
-				return xmppAddresses;
-			}
-
-			void addXMPPAddress(const String& addr) {
-				xmppAddresses.push_back(addr);
-			}
-
-		private:
-			String commonName;
-			std::vector<String> dnsNames;
-			std::vector<String> xmppAddresses;
-			std::vector<String> srvNames;
+			virtual ~Certificate();
+
+			virtual String getCommonName() const = 0;
+			virtual std::vector<String> getSRVNames() const = 0;
+			virtual std::vector<String> getDNSNames() const = 0;
+			virtual std::vector<String> getXMPPAddresses() const = 0;
+
+		protected:
+			static const char* ID_ON_XMPPADDR_OID;
+			static const char* ID_ON_DNSSRV_OID;
+
 	};
 }
diff --git a/Swiften/TLS/CertificateTrustChecker.cpp b/Swiften/TLS/CertificateTrustChecker.cpp
new file mode 100644
index 0000000..f4f921d
--- /dev/null
+++ b/Swiften/TLS/CertificateTrustChecker.cpp
@@ -0,0 +1,14 @@
+/*
+ * Copyright (c) 2010 Remko Tronçon
+ * Licensed under the GNU General Public License v3.
+ * See Documentation/Licenses/GPLv3.txt for more information.
+ */
+
+#include "Swiften/TLS/CertificateTrustChecker.h"
+
+namespace Swift {
+
+CertificateTrustChecker::~CertificateTrustChecker() {
+}
+
+}
diff --git a/Swiften/TLS/CertificateTrustChecker.h b/Swiften/TLS/CertificateTrustChecker.h
new file mode 100644
index 0000000..070c4bb
--- /dev/null
+++ b/Swiften/TLS/CertificateTrustChecker.h
@@ -0,0 +1,21 @@
+/*
+ * Copyright (c) 2010 Remko Tronçon
+ * Licensed under the GNU General Public License v3.
+ * See Documentation/Licenses/GPLv3.txt for more information.
+ */
+
+#pragma once
+
+#include <boost/shared_ptr.hpp>
+
+#include "Swiften/Base/String.h"
+#include "Swiften/TLS/Certificate.h"
+
+namespace Swift {
+	class CertificateTrustChecker {
+		public:
+			virtual ~CertificateTrustChecker();
+
+			virtual bool isCertificateTrusted(Certificate::ref certificate, const String& domain) = 0;
+	};
+}
diff --git a/Swiften/TLS/CertificateVerificationError.h b/Swiften/TLS/CertificateVerificationError.h
index 76b4aff..f1bd091 100644
--- a/Swiften/TLS/CertificateVerificationError.h
+++ b/Swiften/TLS/CertificateVerificationError.h
@@ -6,8 +6,10 @@
 
 #pragma once
 
+#include "Swiften/Base/Error.h"
+
 namespace Swift {
-	class CertificateVerificationError {
+	class CertificateVerificationError : public Error {
 		public:
 			enum Type {
 				UnknownError,
diff --git a/Swiften/TLS/OpenSSL/OpenSSLCertificate.cpp b/Swiften/TLS/OpenSSL/OpenSSLCertificate.cpp
new file mode 100644
index 0000000..5d9aac2
--- /dev/null
+++ b/Swiften/TLS/OpenSSL/OpenSSLCertificate.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (c) 2010 Remko Tronçon
+ * Licensed under the GNU General Public License v3.
+ * See Documentation/Licenses/GPLv3.txt for more information.
+ */
+
+#include "Swiften/TLS/OpenSSL/OpenSSLCertificate.h"
+
+#include <openssl/x509v3.h>
+
+#include "Swiften/Base/ByteArray.h"
+
+#pragma GCC diagnostic ignored "-Wold-style-cast"
+
+namespace Swift {
+
+OpenSSLCertificate::OpenSSLCertificate(boost::shared_ptr<X509> cert) : cert(cert) {
+	// Common name
+	X509_NAME* subjectName = X509_get_subject_name(cert.get());
+	if (subjectName) {
+		int cnLoc = X509_NAME_get_index_by_NID(subjectName, NID_commonName, -1);
+		if (cnLoc != -1) {
+			X509_NAME_ENTRY* cnEntry = X509_NAME_get_entry(subjectName, cnLoc);
+			ASN1_STRING* cnData = X509_NAME_ENTRY_get_data(cnEntry);
+			setCommonName(ByteArray(cnData->data, cnData->length).toString());
+		}
+	}
+
+	// subjectAltNames
+	int subjectAltNameLoc = X509_get_ext_by_NID(cert.get(), NID_subject_alt_name, -1);
+	if(subjectAltNameLoc != -1) {
+		X509_EXTENSION* extension = X509_get_ext(cert.get(), subjectAltNameLoc);
+		boost::shared_ptr<GENERAL_NAMES> generalNames(reinterpret_cast<GENERAL_NAMES*>(X509V3_EXT_d2i(extension)), GENERAL_NAMES_free);
+		boost::shared_ptr<ASN1_OBJECT> xmppAddrObject(OBJ_txt2obj(ID_ON_XMPPADDR_OID, 1), ASN1_OBJECT_free);
+		boost::shared_ptr<ASN1_OBJECT> dnsSRVObject(OBJ_txt2obj(ID_ON_DNSSRV_OID, 1), ASN1_OBJECT_free);
+		for (int i = 0; i < sk_GENERAL_NAME_num(generalNames.get()); ++i) {
+			GENERAL_NAME* generalName = sk_GENERAL_NAME_value(generalNames.get(), i);
+			if (generalName->type == GEN_OTHERNAME) {
+				OTHERNAME* otherName = generalName->d.otherName;
+				if (OBJ_cmp(otherName->type_id, xmppAddrObject.get()) == 0) {
+					// XmppAddr
+					if (otherName->value->type != V_ASN1_UTF8STRING) {
+						continue;
+					}
+					ASN1_UTF8STRING* xmppAddrValue = otherName->value->value.utf8string;
+					addXMPPAddress(ByteArray(ASN1_STRING_data(xmppAddrValue), ASN1_STRING_length(xmppAddrValue)).toString());
+				}
+				else if (OBJ_cmp(otherName->type_id, dnsSRVObject.get()) == 0) {
+					// SRVName
+					if (otherName->value->type != V_ASN1_IA5STRING) {
+						continue;
+					}
+					ASN1_IA5STRING* srvNameValue = otherName->value->value.ia5string;
+					addSRVName(ByteArray(ASN1_STRING_data(srvNameValue), ASN1_STRING_length(srvNameValue)).toString());
+				}
+			}
+			else if (generalName->type == GEN_DNS) {
+				// DNSName
+				addDNSName(ByteArray(ASN1_STRING_data(generalName->d.dNSName), ASN1_STRING_length(generalName->d.dNSName)).toString());
+			}
+		}
+	}
+}
+
+}
diff --git a/Swiften/TLS/OpenSSL/OpenSSLCertificate.h b/Swiften/TLS/OpenSSL/OpenSSLCertificate.h
new file mode 100644
index 0000000..4708120
--- /dev/null
+++ b/Swiften/TLS/OpenSSL/OpenSSLCertificate.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (c) 2010 Remko Tronçon
+ * Licensed under the GNU General Public License v3.
+ * See Documentation/Licenses/GPLv3.txt for more information.
+ */
+
+#pragma once
+
+#include <boost/shared_ptr.hpp>
+#include <openssl/ssl.h>
+
+#include "Swiften/Base/String.h"
+#include "Swiften/TLS/Certificate.h"
+
+namespace Swift {
+	class OpenSSLCertificate : public Certificate {
+		public:
+			OpenSSLCertificate(boost::shared_ptr<X509>);
+
+			String getCommonName() const {
+				return commonName;
+			}
+
+			std::vector<String> getSRVNames() const {
+				return srvNames;
+			}
+
+			std::vector<String> getDNSNames() const {
+				return dnsNames;
+			}
+
+			std::vector<String> getXMPPAddresses() const {
+				return xmppAddresses;
+			}
+
+		private:
+			void addSRVName(const String& name) {
+				srvNames.push_back(name);
+			}
+
+			void addDNSName(const String& name) {
+				dnsNames.push_back(name);
+			}
+
+			void addXMPPAddress(const String& addr) {
+				xmppAddresses.push_back(addr);
+			}
+
+			void setCommonName(const String& commonName) {
+				this->commonName = commonName;
+			}
+
+		private:
+			boost::shared_ptr<X509> cert;
+			String commonName;
+			std::vector<String> dnsNames;
+			std::vector<String> xmppAddresses;
+			std::vector<String> srvNames;
+	};
+}
diff --git a/Swiften/TLS/OpenSSL/OpenSSLContext.cpp b/Swiften/TLS/OpenSSL/OpenSSLContext.cpp
index c78d5a1..41c98c1 100644
--- a/Swiften/TLS/OpenSSL/OpenSSLContext.cpp
+++ b/Swiften/TLS/OpenSSL/OpenSSLContext.cpp
@@ -7,9 +7,9 @@
 #include <vector>
 #include <openssl/err.h>
 #include <openssl/pkcs12.h>
-#include <openssl/x509v3.h>
 
 #include "Swiften/TLS/OpenSSL/OpenSSLContext.h"
+#include "Swiften/TLS/OpenSSL/OpenSSLCertificate.h"
 #include "Swiften/TLS/PKCS12Certificate.h"
 
 #pragma GCC diagnostic ignored "-Wold-style-cast"
@@ -166,67 +166,20 @@ bool OpenSSLContext::setClientCertificate(const PKCS12Certificate& certificate)
 Certificate::ref OpenSSLContext::getPeerCertificate() const {
 	boost::shared_ptr<X509> x509Cert(SSL_get_peer_certificate(handle_), X509_free);
 	if (x509Cert) {
-		Certificate::ref certificate(new Certificate());
-
-		// Common name
-		X509_NAME* subjectName = X509_get_subject_name(x509Cert.get());
-		if (subjectName) {
-			int cnLoc = X509_NAME_get_index_by_NID(subjectName, NID_commonName, -1);
-			if (cnLoc != -1) {
-				X509_NAME_ENTRY* cnEntry = X509_NAME_get_entry(subjectName, cnLoc);
-				ASN1_STRING* cnData = X509_NAME_ENTRY_get_data(cnEntry);
-				certificate->setCommonName(ByteArray(cnData->data, cnData->length).toString());
-			}
-		}
-
-		// subjectAltNames
-		int subjectAltNameLoc = X509_get_ext_by_NID(x509Cert.get(), NID_subject_alt_name, -1);
-		if(subjectAltNameLoc != -1) {
-			X509_EXTENSION* extension = X509_get_ext(x509Cert.get(), subjectAltNameLoc);
-			boost::shared_ptr<GENERAL_NAMES> generalNames(reinterpret_cast<GENERAL_NAMES*>(X509V3_EXT_d2i(extension)), GENERAL_NAMES_free);
-			boost::shared_ptr<ASN1_OBJECT> xmppAddrObject(OBJ_txt2obj(ID_ON_XMPPADDR_OID, 1), ASN1_OBJECT_free);
-			boost::shared_ptr<ASN1_OBJECT> dnsSRVObject(OBJ_txt2obj(ID_ON_DNSSRV_OID, 1), ASN1_OBJECT_free);
-			for (int i = 0; i < sk_GENERAL_NAME_num(generalNames.get()); ++i) {
-				GENERAL_NAME* generalName = sk_GENERAL_NAME_value(generalNames.get(), i);
-				if (generalName->type == GEN_OTHERNAME) {
-					OTHERNAME* otherName = generalName->d.otherName;
-					if (OBJ_cmp(otherName->type_id, xmppAddrObject.get()) == 0) {
-						// XmppAddr
-						if (otherName->value->type != V_ASN1_UTF8STRING) {
-							continue;
-						}
-						ASN1_UTF8STRING* xmppAddrValue = otherName->value->value.utf8string;
-						certificate->addXMPPAddress(ByteArray(ASN1_STRING_data(xmppAddrValue), ASN1_STRING_length(xmppAddrValue)).toString());
-					}
-					else if (OBJ_cmp(otherName->type_id, dnsSRVObject.get()) == 0) {
-						// SRVName
-						if (otherName->value->type != V_ASN1_IA5STRING) {
-							continue;
-						}
-						ASN1_IA5STRING* srvNameValue = otherName->value->value.ia5string;
-						certificate->addSRVName(ByteArray(ASN1_STRING_data(srvNameValue), ASN1_STRING_length(srvNameValue)).toString());
-					}
-				}
-				else if (generalName->type == GEN_DNS) {
-					// DNSName
-					certificate->addDNSName(ByteArray(ASN1_STRING_data(generalName->d.dNSName), ASN1_STRING_length(generalName->d.dNSName)).toString());
-				}
-			}
-		}
-		return certificate;
+		return Certificate::ref(new OpenSSLCertificate(x509Cert));
 	}
 	else {
 		return Certificate::ref();
 	}
 }
 
-boost::optional<CertificateVerificationError> OpenSSLContext::getPeerCertificateVerificationError() const {
+boost::shared_ptr<CertificateVerificationError> OpenSSLContext::getPeerCertificateVerificationError() const {
 	int verifyResult = SSL_get_verify_result(handle_);
 	if (verifyResult != X509_V_OK) {
-		return CertificateVerificationError(getVerificationErrorTypeForResult(verifyResult));
+		return boost::shared_ptr<CertificateVerificationError>(new CertificateVerificationError(getVerificationErrorTypeForResult(verifyResult)));
 	}
 	else {
-		return boost::optional<CertificateVerificationError>();
+		return boost::shared_ptr<CertificateVerificationError>();
 	}
 }
 
diff --git a/Swiften/TLS/OpenSSL/OpenSSLContext.h b/Swiften/TLS/OpenSSL/OpenSSLContext.h
index 31141a5..9cb287d 100644
--- a/Swiften/TLS/OpenSSL/OpenSSLContext.h
+++ b/Swiften/TLS/OpenSSL/OpenSSLContext.h
@@ -28,7 +28,7 @@ namespace Swift {
 			void handleDataFromApplication(const ByteArray&);
 
 			Certificate::ref getPeerCertificate() const;
-			boost::optional<CertificateVerificationError> getPeerCertificateVerificationError() const;
+			boost::shared_ptr<CertificateVerificationError> getPeerCertificateVerificationError() const;
 
 		private:
 			static void ensureLibraryInitialized();	
diff --git a/Swiften/TLS/SConscript b/Swiften/TLS/SConscript
index b84dbc0..bb33239 100644
--- a/Swiften/TLS/SConscript
+++ b/Swiften/TLS/SConscript
@@ -1,14 +1,16 @@
 Import("swiften_env")
 
 objects = swiften_env.StaticObject([
+			"Certificate.cpp",
+			"CertificateTrustChecker.cpp",
 			"TLSContext.cpp",
 			"TLSContextFactory.cpp",
-			"SecurityError.cpp",
 		])
 		
 if swiften_env.get("HAVE_OPENSSL", 0) :
 	objects += swiften_env.StaticObject([
 			"OpenSSL/OpenSSLContext.cpp",
+			"OpenSSL/OpenSSLCertificate.cpp",
 			"OpenSSL/OpenSSLContextFactory.cpp",
 		])
 		
diff --git a/Swiften/TLS/SecurityError.cpp b/Swiften/TLS/SecurityError.cpp
deleted file mode 100644
index 03aadf0..0000000
--- a/Swiften/TLS/SecurityError.cpp
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Copyright (c) 2010 Remko Tronçon
- * Licensed under the GNU General Public License v3.
- * See Documentation/Licenses/GPLv3.txt for more information.
- */
-
-#include "Swiften/TLS/SecurityError.h"
-#include "Swiften/TLS/CertificateVerificationError.h"
-
-namespace Swift {
-
-SecurityError::SecurityError(Type type) : type(type) {
-}
-
-SecurityError::SecurityError(const CertificateVerificationError& verificationError) {
-	type = UnknownError;
-	switch(verificationError.getType()) {
-		case CertificateVerificationError::UnknownError: type = UnknownError;
-		case CertificateVerificationError::Expired: type = Expired;
-		case CertificateVerificationError::NotYetValid: type = NotYetValid;
-		case CertificateVerificationError::SelfSigned: type = SelfSigned;
-		case CertificateVerificationError::Rejected: type = Rejected;
-		case CertificateVerificationError::Untrusted: type = Untrusted;
-		case CertificateVerificationError::InvalidPurpose: type = InvalidPurpose;
-		case CertificateVerificationError::PathLengthExceeded: type = PathLengthExceeded;
-		case CertificateVerificationError::InvalidSignature: type = InvalidSignature;
-		case CertificateVerificationError::InvalidCA: type = InvalidCA;
-	}
-}
-
-}
diff --git a/Swiften/TLS/SecurityError.h b/Swiften/TLS/SecurityError.h
deleted file mode 100644
index 55ac7d5..0000000
--- a/Swiften/TLS/SecurityError.h
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright (c) 2010 Remko Tronçon
- * Licensed under the GNU General Public License v3.
- * See Documentation/Licenses/GPLv3.txt for more information.
- */
-
-#pragma once
-
-namespace Swift {
-	class CertificateVerificationError;
-
-	class SecurityError {
-		public:
-			enum Type {
-				// From CertificateVerificationError
-				UnknownError,
-				Expired,
-				NotYetValid,
-				SelfSigned,
-				Rejected,
-				Untrusted,
-				InvalidPurpose,
-				PathLengthExceeded,
-				InvalidSignature,
-				InvalidCA,
-
-				// Identity verification
-				InvalidIdentity,
-			};
-
-			SecurityError(Type type);
-			SecurityError(const CertificateVerificationError& verificationError);
-
-
-			Type getType() const { 
-				return type; 
-			}
-
-		private:
-			Type type;
-	};
-}
diff --git a/Swiften/TLS/TLSContext.cpp b/Swiften/TLS/TLSContext.cpp
index 67fa903..008bfc0 100644
--- a/Swiften/TLS/TLSContext.cpp
+++ b/Swiften/TLS/TLSContext.cpp
@@ -8,9 +8,6 @@
 
 namespace Swift {
 
-const char* TLSContext::ID_ON_XMPPADDR_OID = "1.3.6.1.5.5.7.8.5";
-const char* TLSContext::ID_ON_DNSSRV_OID = "1.3.6.1.5.5.7.8.7";
-
 TLSContext::~TLSContext() {
 }
 
diff --git a/Swiften/TLS/TLSContext.h b/Swiften/TLS/TLSContext.h
index 2d05100..47f2697 100644
--- a/Swiften/TLS/TLSContext.h
+++ b/Swiften/TLS/TLSContext.h
@@ -7,6 +7,7 @@
 #pragma once
 
 #include "Swiften/Base/boost_bsignals.h"
+#include <boost/shared_ptr.hpp>
 
 #include "Swiften/Base/ByteArray.h"
 #include "Swiften/TLS/Certificate.h"
@@ -27,11 +28,7 @@ namespace Swift {
 			virtual void handleDataFromApplication(const ByteArray&) = 0;
 
 			virtual Certificate::ref getPeerCertificate() const = 0;
-			virtual boost::optional<CertificateVerificationError> getPeerCertificateVerificationError() const = 0;
-
-		protected:
-			static const char* ID_ON_XMPPADDR_OID;
-			static const char* ID_ON_DNSSRV_OID;
+			virtual boost::shared_ptr<CertificateVerificationError> getPeerCertificateVerificationError() const = 0;
 
 		public:
 			boost::signal<void (const ByteArray&)> onDataForNetwork;
author	Remko Tronçon <git@el-tramo.be>	2010-11-07 20:07:06 (GMT)
committer	Remko Tronçon <git@el-tramo.be>	2010-11-07 21:27:17 (GMT)
commit	a594eb3fef7e047d1eca7959d7734d4d10fd1eb7 (patch)
tree	f0c75a890caf231e18c963e6485d8c3fcf418324 /Swiften/TLS
parent	8cfb6d8f3492dd4180429f37dfb463b2fa48b0b8 (diff)
download	swift-a594eb3fef7e047d1eca7959d7734d4d10fd1eb7.zip swift-a594eb3fef7e047d1eca7959d7734d4d10fd1eb7.tar.bz2