2007-02-12 17:32:37 -05:00
|
|
|
/***************************************************************************
|
|
|
|
* _ _ ____ _
|
|
|
|
* Project ___| | | | _ \| |
|
|
|
|
* / __| | | | |_) | |
|
|
|
|
* | (__| |_| | _ <| |___
|
|
|
|
* \___|\___/|_| \_\_____|
|
|
|
|
*
|
2009-01-07 09:10:35 -05:00
|
|
|
* Copyright (C) 1998 - 2009, Daniel Stenberg, <daniel@haxx.se>, et al.
|
2007-02-12 17:32:37 -05:00
|
|
|
*
|
|
|
|
* This software is licensed as described in the file COPYING, which
|
|
|
|
* you should have received as part of this distribution. The terms
|
|
|
|
* are also available at http://curl.haxx.se/docs/copyright.html.
|
|
|
|
*
|
|
|
|
* You may opt to use, copy, modify, merge, publish, distribute and/or sell
|
|
|
|
* copies of the Software, and permit persons to whom the Software is
|
|
|
|
* furnished to do so, under the terms of the COPYING file.
|
|
|
|
*
|
|
|
|
* This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
|
|
|
|
* KIND, either express or implied.
|
|
|
|
*
|
|
|
|
* $Id$
|
|
|
|
***************************************************************************/
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Source file for all NSS-specific code for the TLS/SSL layer. No code
|
|
|
|
* but sslgen.c should ever call or use these functions.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include "setup.h"
|
|
|
|
|
|
|
|
#include <string.h>
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include <ctype.h>
|
|
|
|
#ifdef HAVE_SYS_SOCKET_H
|
|
|
|
#include <sys/socket.h>
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#include "urldata.h"
|
|
|
|
#include "sendf.h"
|
|
|
|
#include "formdata.h" /* for the boundary function */
|
|
|
|
#include "url.h" /* for the ssl config check function */
|
2007-02-16 13:19:35 -05:00
|
|
|
#include "connect.h"
|
2007-02-12 17:32:37 -05:00
|
|
|
#include "strequal.h"
|
|
|
|
#include "select.h"
|
|
|
|
#include "sslgen.h"
|
|
|
|
|
|
|
|
#define _MPRINTF_REPLACE /* use the internal *printf() functions */
|
|
|
|
#include <curl/mprintf.h>
|
|
|
|
|
|
|
|
#ifdef USE_NSS
|
|
|
|
|
|
|
|
#include "nssg.h"
|
|
|
|
#include <nspr.h>
|
|
|
|
#include <nss.h>
|
|
|
|
#include <ssl.h>
|
|
|
|
#include <sslerr.h>
|
|
|
|
#include <secerr.h>
|
2007-09-18 18:21:54 -04:00
|
|
|
#include <secmod.h>
|
2007-02-12 17:32:37 -05:00
|
|
|
#include <sslproto.h>
|
|
|
|
#include <prtypes.h>
|
|
|
|
#include <pk11pub.h>
|
2008-06-06 14:40:21 -04:00
|
|
|
#include <prio.h>
|
|
|
|
#include <secitem.h>
|
|
|
|
#include <secport.h>
|
2008-06-18 17:48:51 -04:00
|
|
|
#include <certdb.h>
|
2007-02-12 17:32:37 -05:00
|
|
|
|
|
|
|
#include "memory.h"
|
2008-11-15 18:43:10 -05:00
|
|
|
#include "rawstr.h"
|
2007-02-12 17:32:37 -05:00
|
|
|
#include "easyif.h" /* for Curl_convert_from_utf8 prototype */
|
|
|
|
|
|
|
|
/* The last #include file should be: */
|
|
|
|
#include "memdebug.h"
|
|
|
|
|
2007-09-18 18:21:54 -04:00
|
|
|
#define SSL_DIR "/etc/pki/nssdb"
|
|
|
|
|
|
|
|
/* enough to fit the string "PEM Token #[0|1]" */
|
|
|
|
#define SLOTSIZE 13
|
|
|
|
|
2007-02-12 17:32:37 -05:00
|
|
|
PRFileDesc *PR_ImportTCPSocket(PRInt32 osfd);
|
|
|
|
|
2008-09-23 06:27:04 -04:00
|
|
|
PRLock * nss_initlock = NULL;
|
|
|
|
|
|
|
|
volatile int initialized = 0;
|
2007-02-12 17:32:37 -05:00
|
|
|
|
2007-05-25 17:56:27 -04:00
|
|
|
#define HANDSHAKE_TIMEOUT 30
|
|
|
|
|
2007-02-12 17:32:37 -05:00
|
|
|
typedef struct {
|
|
|
|
PRInt32 retryCount;
|
|
|
|
struct SessionHandle *data;
|
|
|
|
} pphrase_arg_t;
|
|
|
|
|
|
|
|
typedef struct {
|
|
|
|
const char *name;
|
|
|
|
int num;
|
|
|
|
PRInt32 version; /* protocol version valid for this cipher */
|
|
|
|
} cipher_s;
|
|
|
|
|
2007-09-18 18:21:54 -04:00
|
|
|
#define PK11_SETATTRS(x,id,v,l) (x)->type = (id); \
|
|
|
|
(x)->pValue=(v); (x)->ulValueLen = (l)
|
|
|
|
|
|
|
|
#define CERT_NewTempCertificate __CERT_NewTempCertificate
|
|
|
|
|
2007-02-12 17:32:37 -05:00
|
|
|
enum sslversion { SSL2 = 1, SSL3 = 2, TLS = 4 };
|
|
|
|
|
2008-06-19 01:47:27 -04:00
|
|
|
#define NUM_OF_CIPHERS sizeof(cipherlist)/sizeof(cipherlist[0])
|
|
|
|
static const cipher_s cipherlist[] = {
|
2007-02-12 17:32:37 -05:00
|
|
|
/* SSL2 cipher suites */
|
|
|
|
{"rc4", SSL_EN_RC4_128_WITH_MD5, SSL2},
|
2008-06-20 07:15:54 -04:00
|
|
|
{"rc4-md5", SSL_EN_RC4_128_WITH_MD5, SSL2},
|
2007-02-12 17:32:37 -05:00
|
|
|
{"rc4export", SSL_EN_RC4_128_EXPORT40_WITH_MD5, SSL2},
|
|
|
|
{"rc2", SSL_EN_RC2_128_CBC_WITH_MD5, SSL2},
|
|
|
|
{"rc2export", SSL_EN_RC2_128_CBC_EXPORT40_WITH_MD5, SSL2},
|
|
|
|
{"des", SSL_EN_DES_64_CBC_WITH_MD5, SSL2},
|
|
|
|
{"desede3", SSL_EN_DES_192_EDE3_CBC_WITH_MD5, SSL2},
|
|
|
|
/* SSL3/TLS cipher suites */
|
|
|
|
{"rsa_rc4_128_md5", SSL_RSA_WITH_RC4_128_MD5, SSL3 | TLS},
|
|
|
|
{"rsa_rc4_128_sha", SSL_RSA_WITH_RC4_128_SHA, SSL3 | TLS},
|
|
|
|
{"rsa_3des_sha", SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL3 | TLS},
|
|
|
|
{"rsa_des_sha", SSL_RSA_WITH_DES_CBC_SHA, SSL3 | TLS},
|
|
|
|
{"rsa_rc4_40_md5", SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL3 | TLS},
|
|
|
|
{"rsa_rc2_40_md5", SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5, SSL3 | TLS},
|
|
|
|
{"rsa_null_md5", SSL_RSA_WITH_NULL_MD5, SSL3 | TLS},
|
|
|
|
{"rsa_null_sha", SSL_RSA_WITH_NULL_SHA, SSL3 | TLS},
|
|
|
|
{"fips_3des_sha", SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA, SSL3 | TLS},
|
|
|
|
{"fips_des_sha", SSL_RSA_FIPS_WITH_DES_CBC_SHA, SSL3 | TLS},
|
|
|
|
{"fortezza", SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA, SSL3 | TLS},
|
|
|
|
{"fortezza_rc4_128_sha", SSL_FORTEZZA_DMS_WITH_RC4_128_SHA, SSL3 | TLS},
|
|
|
|
{"fortezza_null", SSL_FORTEZZA_DMS_WITH_NULL_SHA, SSL3 | TLS},
|
|
|
|
/* TLS 1.0: Exportable 56-bit Cipher Suites. */
|
|
|
|
{"rsa_des_56_sha", TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA, SSL3 | TLS},
|
|
|
|
{"rsa_rc4_56_sha", TLS_RSA_EXPORT1024_WITH_RC4_56_SHA, SSL3 | TLS},
|
|
|
|
/* AES ciphers. */
|
|
|
|
{"rsa_aes_128_sha", TLS_RSA_WITH_AES_128_CBC_SHA, SSL3 | TLS},
|
|
|
|
{"rsa_aes_256_sha", TLS_RSA_WITH_AES_256_CBC_SHA, SSL3 | TLS},
|
|
|
|
#ifdef NSS_ENABLE_ECC
|
|
|
|
/* ECC ciphers. */
|
|
|
|
{"ecdh_ecdsa_null_sha", TLS_ECDH_ECDSA_WITH_NULL_SHA, TLS},
|
|
|
|
{"ecdh_ecdsa_rc4_128_sha", TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLS},
|
|
|
|
{"ecdh_ecdsa_3des_sha", TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS},
|
|
|
|
{"ecdh_ecdsa_aes_128_sha", TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS},
|
|
|
|
{"ecdh_ecdsa_aes_256_sha", TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS},
|
|
|
|
{"ecdhe_ecdsa_null_sha", TLS_ECDHE_ECDSA_WITH_NULL_SHA, TLS},
|
|
|
|
{"ecdhe_ecdsa_rc4_128_sha", TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS},
|
|
|
|
{"ecdhe_ecdsa_3des_sha", TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS},
|
|
|
|
{"ecdhe_ecdsa_aes_128_sha", TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS},
|
|
|
|
{"ecdhe_ecdsa_aes_256_sha", TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS},
|
|
|
|
{"ecdh_rsa_null_sha", TLS_ECDH_RSA_WITH_NULL_SHA, TLS},
|
|
|
|
{"ecdh_rsa_128_sha", TLS_ECDH_RSA_WITH_RC4_128_SHA, TLS},
|
|
|
|
{"ecdh_rsa_3des_sha", TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, TLS},
|
|
|
|
{"ecdh_rsa_aes_128_sha", TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS},
|
|
|
|
{"ecdh_rsa_aes_256_sha", TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS},
|
|
|
|
{"echde_rsa_null", TLS_ECDHE_RSA_WITH_NULL_SHA, TLS},
|
|
|
|
{"ecdhe_rsa_rc4_128_sha", TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS},
|
|
|
|
{"ecdhe_rsa_3des_sha", TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, TLS},
|
|
|
|
{"ecdhe_rsa_aes_128_sha", TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS},
|
|
|
|
{"ecdhe_rsa_aes_256_sha", TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS},
|
|
|
|
{"ecdh_anon_null_sha", TLS_ECDH_anon_WITH_NULL_SHA, TLS},
|
|
|
|
{"ecdh_anon_rc4_128sha", TLS_ECDH_anon_WITH_RC4_128_SHA, TLS},
|
|
|
|
{"ecdh_anon_3des_sha", TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA, TLS},
|
|
|
|
{"ecdh_anon_aes_128_sha", TLS_ECDH_anon_WITH_AES_128_CBC_SHA, TLS},
|
|
|
|
{"ecdh_anon_aes_256_sha", TLS_ECDH_anon_WITH_AES_256_CBC_SHA, TLS},
|
|
|
|
#endif
|
|
|
|
};
|
|
|
|
|
2009-03-18 08:48:51 -04:00
|
|
|
/* following ciphers are new in NSS 3.4 and not enabled by default, therefor
|
|
|
|
they are enabled explicitly */
|
|
|
|
static const int enable_ciphers_by_default[] = {
|
|
|
|
TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
|
|
|
|
TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
|
|
|
|
TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
|
|
|
|
TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
|
|
|
|
TLS_RSA_WITH_AES_128_CBC_SHA,
|
|
|
|
TLS_RSA_WITH_AES_256_CBC_SHA,
|
|
|
|
SSL_NULL_WITH_NULL_NULL
|
|
|
|
};
|
|
|
|
|
2007-09-18 18:21:54 -04:00
|
|
|
#ifdef HAVE_PK11_CREATEGENERICOBJECT
|
|
|
|
static const char* pem_library = "libnsspem.so";
|
|
|
|
#endif
|
|
|
|
SECMODModule* mod = NULL;
|
|
|
|
|
2007-02-12 17:32:37 -05:00
|
|
|
static SECStatus set_ciphers(struct SessionHandle *data, PRFileDesc * model,
|
|
|
|
char *cipher_list)
|
|
|
|
{
|
2008-06-19 01:47:27 -04:00
|
|
|
unsigned int i;
|
|
|
|
PRBool cipher_state[NUM_OF_CIPHERS];
|
2007-02-12 17:32:37 -05:00
|
|
|
PRBool found;
|
|
|
|
char *cipher;
|
|
|
|
SECStatus rv;
|
|
|
|
|
|
|
|
/* First disable all ciphers. This uses a different max value in case
|
|
|
|
* NSS adds more ciphers later we don't want them available by
|
|
|
|
* accident
|
|
|
|
*/
|
|
|
|
for(i=0; i<SSL_NumImplementedCiphers; i++) {
|
|
|
|
SSL_CipherPrefSet(model, SSL_ImplementedCiphers[i], SSL_NOT_ALLOWED);
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Set every entry in our list to false */
|
2008-06-19 01:47:27 -04:00
|
|
|
for(i=0; i<NUM_OF_CIPHERS; i++) {
|
2007-02-12 17:32:37 -05:00
|
|
|
cipher_state[i] = PR_FALSE;
|
|
|
|
}
|
|
|
|
|
|
|
|
cipher = cipher_list;
|
|
|
|
|
|
|
|
while(cipher_list && (cipher_list[0])) {
|
2007-02-13 12:28:40 -05:00
|
|
|
while((*cipher) && (ISSPACE(*cipher)))
|
2007-02-12 17:32:37 -05:00
|
|
|
++cipher;
|
|
|
|
|
|
|
|
if((cipher_list = strchr(cipher, ','))) {
|
|
|
|
*cipher_list++ = '\0';
|
|
|
|
}
|
|
|
|
|
|
|
|
found = PR_FALSE;
|
|
|
|
|
2008-06-19 01:47:27 -04:00
|
|
|
for(i=0; i<NUM_OF_CIPHERS; i++) {
|
2008-10-16 04:23:48 -04:00
|
|
|
if(Curl_raw_equal(cipher, cipherlist[i].name)) {
|
2007-02-12 17:32:37 -05:00
|
|
|
cipher_state[i] = PR_TRUE;
|
|
|
|
found = PR_TRUE;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if(found == PR_FALSE) {
|
2007-09-18 18:21:54 -04:00
|
|
|
failf(data, "Unknown cipher in list: %s", cipher);
|
2007-02-12 17:32:37 -05:00
|
|
|
return SECFailure;
|
|
|
|
}
|
|
|
|
|
|
|
|
if(cipher_list) {
|
|
|
|
cipher = cipher_list;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Finally actually enable the selected ciphers */
|
2008-06-19 01:47:27 -04:00
|
|
|
for(i=0; i<NUM_OF_CIPHERS; i++) {
|
2007-02-12 17:32:37 -05:00
|
|
|
rv = SSL_CipherPrefSet(model, cipherlist[i].num, cipher_state[i]);
|
|
|
|
if(rv != SECSuccess) {
|
|
|
|
failf(data, "Unknown cipher in cipher list");
|
|
|
|
return SECFailure;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return SECSuccess;
|
|
|
|
}
|
|
|
|
|
2009-01-07 09:10:35 -05:00
|
|
|
/*
|
|
|
|
* Get the number of ciphers that are enabled. We use this to determine
|
|
|
|
* if we need to call NSS_SetDomesticPolicy() to enable the default ciphers.
|
|
|
|
*/
|
2009-01-07 09:12:01 -05:00
|
|
|
static int num_enabled_ciphers(void)
|
2009-01-07 09:10:35 -05:00
|
|
|
{
|
|
|
|
PRInt32 policy = 0;
|
|
|
|
int count = 0;
|
2009-01-07 09:12:01 -05:00
|
|
|
unsigned int i;
|
2009-01-07 09:10:35 -05:00
|
|
|
|
|
|
|
for(i=0; i<NUM_OF_CIPHERS; i++) {
|
|
|
|
SSL_CipherPolicyGet(cipherlist[i].num, &policy);
|
|
|
|
if(policy)
|
|
|
|
count++;
|
|
|
|
}
|
|
|
|
return count;
|
|
|
|
}
|
|
|
|
|
2007-09-18 18:21:54 -04:00
|
|
|
/*
|
|
|
|
* Determine whether the nickname passed in is a filename that needs to
|
|
|
|
* be loaded as a PEM or a regular NSS nickname.
|
|
|
|
*
|
|
|
|
* returns 1 for a file
|
|
|
|
* returns 0 for not a file (NSS nickname)
|
|
|
|
*/
|
|
|
|
static int is_file(const char *filename)
|
|
|
|
{
|
|
|
|
struct stat st;
|
|
|
|
|
|
|
|
if(filename == NULL)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
if(stat(filename, &st) == 0)
|
|
|
|
if(S_ISREG(st.st_mode))
|
|
|
|
return 1;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int
|
|
|
|
nss_load_cert(const char *filename, PRBool cacert)
|
|
|
|
{
|
|
|
|
#ifdef HAVE_PK11_CREATEGENERICOBJECT
|
|
|
|
CK_SLOT_ID slotID;
|
|
|
|
PK11SlotInfo * slot = NULL;
|
|
|
|
PK11GenericObject *rv;
|
|
|
|
CK_ATTRIBUTE *attrs;
|
|
|
|
CK_ATTRIBUTE theTemplate[20];
|
|
|
|
CK_BBOOL cktrue = CK_TRUE;
|
|
|
|
CK_BBOOL ckfalse = CK_FALSE;
|
|
|
|
CK_OBJECT_CLASS objClass = CKO_CERTIFICATE;
|
2008-11-15 18:43:10 -05:00
|
|
|
char slotname[SLOTSIZE];
|
2007-09-18 18:21:54 -04:00
|
|
|
#endif
|
|
|
|
CERTCertificate *cert;
|
|
|
|
char *nickname = NULL;
|
|
|
|
char *n = NULL;
|
|
|
|
|
|
|
|
/* If there is no slash in the filename it is assumed to be a regular
|
|
|
|
* NSS nickname.
|
|
|
|
*/
|
|
|
|
if(is_file(filename)) {
|
|
|
|
n = strrchr(filename, '/');
|
|
|
|
if(n)
|
|
|
|
n++;
|
|
|
|
if(!mod)
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
/* A nickname from the NSS internal database */
|
2007-11-05 04:45:09 -05:00
|
|
|
if(cacert)
|
2007-09-18 18:21:54 -04:00
|
|
|
return 0; /* You can't specify an NSS CA nickname this way */
|
|
|
|
nickname = strdup(filename);
|
2008-11-15 18:43:10 -05:00
|
|
|
if(!nickname)
|
|
|
|
return 0;
|
2007-09-18 18:21:54 -04:00
|
|
|
goto done;
|
|
|
|
}
|
|
|
|
|
|
|
|
#ifdef HAVE_PK11_CREATEGENERICOBJECT
|
|
|
|
attrs = theTemplate;
|
|
|
|
|
|
|
|
/* All CA and trust objects go into slot 0. Other slots are used
|
|
|
|
* for storing certificates. With each new user certificate we increment
|
|
|
|
* the slot count. We only support 1 user certificate right now.
|
|
|
|
*/
|
2007-11-05 04:45:09 -05:00
|
|
|
if(cacert)
|
2007-09-18 18:21:54 -04:00
|
|
|
slotID = 0;
|
|
|
|
else
|
|
|
|
slotID = 1;
|
|
|
|
|
|
|
|
snprintf(slotname, SLOTSIZE, "PEM Token #%ld", slotID);
|
2008-11-15 18:43:10 -05:00
|
|
|
|
|
|
|
nickname = aprintf("PEM Token #%ld:%s", slotID, n);
|
|
|
|
if(!nickname)
|
|
|
|
return 0;
|
2007-09-18 18:21:54 -04:00
|
|
|
|
|
|
|
slot = PK11_FindSlotByName(slotname);
|
|
|
|
|
2007-11-05 04:45:09 -05:00
|
|
|
if(!slot) {
|
2007-09-18 18:21:54 -04:00
|
|
|
free(nickname);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-06-06 16:57:32 -04:00
|
|
|
PK11_SETATTRS(attrs, CKA_CLASS, &objClass, sizeof(objClass) );
|
|
|
|
attrs++;
|
|
|
|
PK11_SETATTRS(attrs, CKA_TOKEN, &cktrue, sizeof(CK_BBOOL) );
|
|
|
|
attrs++;
|
2007-09-18 18:21:54 -04:00
|
|
|
PK11_SETATTRS(attrs, CKA_LABEL, (unsigned char *)filename,
|
2008-06-06 16:57:32 -04:00
|
|
|
strlen(filename)+1);
|
|
|
|
attrs++;
|
2007-11-05 04:45:09 -05:00
|
|
|
if(cacert) {
|
2008-06-06 16:57:32 -04:00
|
|
|
PK11_SETATTRS(attrs, CKA_TRUST, &cktrue, sizeof(CK_BBOOL) );
|
2007-09-18 18:21:54 -04:00
|
|
|
}
|
|
|
|
else {
|
2008-06-06 16:57:32 -04:00
|
|
|
PK11_SETATTRS(attrs, CKA_TRUST, &ckfalse, sizeof(CK_BBOOL) );
|
2007-09-18 18:21:54 -04:00
|
|
|
}
|
2008-06-06 16:57:32 -04:00
|
|
|
attrs++;
|
2007-09-18 18:21:54 -04:00
|
|
|
|
|
|
|
/* This load the certificate in our PEM module into the appropriate
|
|
|
|
* slot.
|
|
|
|
*/
|
|
|
|
rv = PK11_CreateGenericObject(slot, theTemplate, 4, PR_FALSE /* isPerm */);
|
|
|
|
|
|
|
|
PK11_FreeSlot(slot);
|
|
|
|
|
|
|
|
if(rv == NULL) {
|
|
|
|
free(nickname);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
#else
|
|
|
|
/* We don't have PK11_CreateGenericObject but a file-based cert was passed
|
|
|
|
* in. We need to fail.
|
|
|
|
*/
|
|
|
|
return 0;
|
|
|
|
#endif
|
|
|
|
|
|
|
|
done:
|
|
|
|
/* Double-check that the certificate or nickname requested exists in
|
|
|
|
* either the token or the NSS certificate database.
|
|
|
|
*/
|
2007-11-05 04:45:09 -05:00
|
|
|
if(!cacert) {
|
2007-09-18 18:21:54 -04:00
|
|
|
cert = PK11_FindCertFromNickname((char *)nickname, NULL);
|
|
|
|
|
|
|
|
/* An invalid nickname was passed in */
|
2007-11-05 04:45:09 -05:00
|
|
|
if(cert == NULL) {
|
2007-09-18 18:21:54 -04:00
|
|
|
free(nickname);
|
|
|
|
PR_SetError(SEC_ERROR_UNKNOWN_CERT, 0);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
CERT_DestroyCertificate(cert);
|
|
|
|
}
|
|
|
|
|
|
|
|
free(nickname);
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2008-09-04 15:43:35 -04:00
|
|
|
static int nss_load_crl(const char* crlfilename, PRBool ascii)
|
2008-06-06 14:40:21 -04:00
|
|
|
{
|
|
|
|
PRFileDesc *infile;
|
|
|
|
PRStatus prstat;
|
|
|
|
PRFileInfo info;
|
|
|
|
PRInt32 nb;
|
|
|
|
int rv;
|
|
|
|
SECItem crlDER;
|
|
|
|
CERTSignedCrl *crl=NULL;
|
|
|
|
PK11SlotInfo *slot=NULL;
|
|
|
|
|
|
|
|
infile = PR_Open(crlfilename,PR_RDONLY,0);
|
|
|
|
if (!infile) {
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
crlDER.data = NULL;
|
|
|
|
prstat = PR_GetOpenFileInfo(infile,&info);
|
2008-06-06 16:57:32 -04:00
|
|
|
if (prstat!=PR_SUCCESS)
|
|
|
|
return 0;
|
2008-06-06 14:40:21 -04:00
|
|
|
if (ascii) {
|
|
|
|
SECItem filedata;
|
|
|
|
char *asc,*body;
|
|
|
|
filedata.data = NULL;
|
2008-06-06 16:57:32 -04:00
|
|
|
if (!SECITEM_AllocItem(NULL,&filedata,info.size))
|
|
|
|
return 0;
|
2008-06-06 14:40:21 -04:00
|
|
|
nb = PR_Read(infile,filedata.data,info.size);
|
2008-06-06 16:57:32 -04:00
|
|
|
if (nb!=info.size)
|
|
|
|
return 0;
|
2008-06-06 14:40:21 -04:00
|
|
|
asc = (char*)filedata.data;
|
2008-06-06 16:57:32 -04:00
|
|
|
if (!asc)
|
2008-06-06 14:40:21 -04:00
|
|
|
return 0;
|
2008-06-06 16:57:32 -04:00
|
|
|
|
|
|
|
body=strstr(asc,"-----BEGIN");
|
|
|
|
if (body != NULL) {
|
2008-06-06 14:40:21 -04:00
|
|
|
char *trailer=NULL;
|
|
|
|
asc = body;
|
|
|
|
body = PORT_Strchr(asc,'\n');
|
2008-06-06 16:57:32 -04:00
|
|
|
if (!body)
|
|
|
|
body = PORT_Strchr(asc,'\r');
|
|
|
|
if (body)
|
|
|
|
trailer = strstr(++body,"-----END");
|
|
|
|
if (trailer!=NULL)
|
|
|
|
*trailer='\0';
|
|
|
|
else
|
|
|
|
return 0;
|
2008-06-06 14:40:21 -04:00
|
|
|
}
|
|
|
|
else {
|
|
|
|
body = asc;
|
|
|
|
}
|
|
|
|
rv = ATOB_ConvertAsciiToItem(&crlDER,body);
|
|
|
|
PORT_Free(filedata.data);
|
2008-06-06 16:57:32 -04:00
|
|
|
if (rv)
|
|
|
|
return 0;
|
2008-06-06 14:40:21 -04:00
|
|
|
}
|
|
|
|
else {
|
2008-06-06 16:57:32 -04:00
|
|
|
if (!SECITEM_AllocItem(NULL,&crlDER,info.size))
|
|
|
|
return 0;
|
2008-06-06 14:40:21 -04:00
|
|
|
nb = PR_Read(infile,crlDER.data,info.size);
|
2008-06-06 16:57:32 -04:00
|
|
|
if (nb!=info.size)
|
|
|
|
return 0;
|
2008-06-06 14:40:21 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
slot = PK11_GetInternalKeySlot();
|
|
|
|
crl = PK11_ImportCRL(slot,&crlDER,
|
|
|
|
NULL,SEC_CRL_TYPE,
|
|
|
|
NULL,CRL_IMPORT_DEFAULT_OPTIONS,
|
|
|
|
NULL,(CRL_DECODE_DEFAULT_OPTIONS|
|
2009-02-27 03:53:10 -05:00
|
|
|
CRL_DECODE_DONT_COPY_DER));
|
2008-06-06 14:40:21 -04:00
|
|
|
if (slot) PK11_FreeSlot(slot);
|
|
|
|
if (!crl) return 0;
|
|
|
|
SEC_DestroyCrl(crl);
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2007-09-18 18:21:54 -04:00
|
|
|
static int nss_load_key(struct connectdata *conn, char *key_file)
|
|
|
|
{
|
|
|
|
#ifdef HAVE_PK11_CREATEGENERICOBJECT
|
|
|
|
PK11SlotInfo * slot = NULL;
|
|
|
|
PK11GenericObject *rv;
|
|
|
|
CK_ATTRIBUTE *attrs;
|
|
|
|
CK_ATTRIBUTE theTemplate[20];
|
|
|
|
CK_BBOOL cktrue = CK_TRUE;
|
|
|
|
CK_OBJECT_CLASS objClass = CKO_PRIVATE_KEY;
|
|
|
|
CK_SLOT_ID slotID;
|
|
|
|
pphrase_arg_t *parg = NULL;
|
2008-11-15 18:43:10 -05:00
|
|
|
char slotname[SLOTSIZE];
|
2007-09-18 18:21:54 -04:00
|
|
|
|
|
|
|
attrs = theTemplate;
|
|
|
|
|
|
|
|
/* FIXME: grok the various file types */
|
|
|
|
|
|
|
|
slotID = 1; /* hardcoded for now */
|
|
|
|
|
2008-11-15 18:43:10 -05:00
|
|
|
snprintf(slotname, sizeof(slotname), "PEM Token #%ld", slotID);
|
2007-09-18 18:21:54 -04:00
|
|
|
slot = PK11_FindSlotByName(slotname);
|
|
|
|
|
|
|
|
if(!slot)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
PK11_SETATTRS(attrs, CKA_CLASS, &objClass, sizeof(objClass) ); attrs++;
|
|
|
|
PK11_SETATTRS(attrs, CKA_TOKEN, &cktrue, sizeof(CK_BBOOL) ); attrs++;
|
|
|
|
PK11_SETATTRS(attrs, CKA_LABEL, (unsigned char *)key_file,
|
|
|
|
strlen(key_file)+1); attrs++;
|
|
|
|
|
|
|
|
/* When adding an encrypted key the PKCS#11 will be set as removed */
|
|
|
|
rv = PK11_CreateGenericObject(slot, theTemplate, 3, PR_FALSE /* isPerm */);
|
|
|
|
if(rv == NULL) {
|
|
|
|
PR_SetError(SEC_ERROR_BAD_KEY, 0);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* This will force the token to be seen as re-inserted */
|
|
|
|
SECMOD_WaitForAnyTokenEvent(mod, 0, 0);
|
|
|
|
PK11_IsPresent(slot);
|
|
|
|
|
2008-09-06 01:29:05 -04:00
|
|
|
parg = malloc(sizeof(pphrase_arg_t));
|
2008-11-15 18:43:10 -05:00
|
|
|
if(!parg)
|
|
|
|
return 0;
|
2007-09-18 18:21:54 -04:00
|
|
|
parg->retryCount = 0;
|
|
|
|
parg->data = conn->data;
|
|
|
|
/* parg is initialized in nss_Init_Tokens() */
|
|
|
|
if(PK11_Authenticate(slot, PR_TRUE, parg) != SECSuccess) {
|
|
|
|
free(parg);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
free(parg);
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
#else
|
|
|
|
/* If we don't have PK11_CreateGenericObject then we can't load a file-based
|
|
|
|
* key.
|
|
|
|
*/
|
|
|
|
(void)conn; /* unused */
|
|
|
|
(void)key_file; /* unused */
|
|
|
|
return 0;
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
|
|
|
static int display_error(struct connectdata *conn, PRInt32 err,
|
|
|
|
const char *filename)
|
|
|
|
{
|
|
|
|
switch(err) {
|
|
|
|
case SEC_ERROR_BAD_PASSWORD:
|
2008-01-15 18:19:02 -05:00
|
|
|
failf(conn->data, "Unable to load client key: Incorrect password");
|
2007-09-18 18:21:54 -04:00
|
|
|
return 1;
|
|
|
|
case SEC_ERROR_UNKNOWN_CERT:
|
2008-01-15 18:19:02 -05:00
|
|
|
failf(conn->data, "Unable to load certificate %s", filename);
|
2007-09-18 18:21:54 -04:00
|
|
|
return 1;
|
|
|
|
default:
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
return 0; /* The caller will print a generic error */
|
|
|
|
}
|
|
|
|
|
|
|
|
static int cert_stuff(struct connectdata *conn, char *cert_file, char *key_file)
|
|
|
|
{
|
|
|
|
struct SessionHandle *data = conn->data;
|
|
|
|
int rv = 0;
|
|
|
|
|
|
|
|
if(cert_file) {
|
|
|
|
rv = nss_load_cert(cert_file, PR_FALSE);
|
|
|
|
if(!rv) {
|
|
|
|
if(!display_error(conn, PR_GetError(), cert_file))
|
|
|
|
failf(data, "Unable to load client cert %d.", PR_GetError());
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if(key_file || (is_file(cert_file))) {
|
|
|
|
if(key_file)
|
|
|
|
rv = nss_load_key(conn, key_file);
|
|
|
|
else
|
|
|
|
/* In case the cert file also has the key */
|
|
|
|
rv = nss_load_key(conn, cert_file);
|
|
|
|
if(!rv) {
|
|
|
|
if(!display_error(conn, PR_GetError(), key_file))
|
|
|
|
failf(data, "Unable to load client key %d.", PR_GetError());
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2007-02-12 17:32:37 -05:00
|
|
|
static char * nss_get_password(PK11SlotInfo * slot, PRBool retry, void *arg)
|
|
|
|
{
|
2007-09-18 18:21:54 -04:00
|
|
|
pphrase_arg_t *parg;
|
|
|
|
parg = (pphrase_arg_t *) arg;
|
|
|
|
|
2007-02-12 17:32:37 -05:00
|
|
|
(void)slot; /* unused */
|
2007-09-18 18:21:54 -04:00
|
|
|
if(retry > 2)
|
|
|
|
return NULL;
|
2007-08-01 17:20:01 -04:00
|
|
|
if(parg->data->set.str[STRING_KEY_PASSWD])
|
|
|
|
return (char *)PORT_Strdup((char *)parg->data->set.str[STRING_KEY_PASSWD]);
|
2007-02-12 17:32:37 -05:00
|
|
|
else
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2007-09-18 18:21:54 -04:00
|
|
|
/* No longer ask for the password, parg has been freed */
|
|
|
|
static char * nss_no_password(PK11SlotInfo *slot, PRBool retry, void *arg)
|
|
|
|
{
|
|
|
|
(void)slot; /* unused */
|
|
|
|
(void)retry; /* unused */
|
|
|
|
(void)arg; /* unused */
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
2007-02-12 17:32:37 -05:00
|
|
|
static SECStatus nss_Init_Tokens(struct connectdata * conn)
|
|
|
|
{
|
|
|
|
PK11SlotList *slotList;
|
|
|
|
PK11SlotListElement *listEntry;
|
|
|
|
SECStatus ret, status = SECSuccess;
|
2007-09-18 18:21:54 -04:00
|
|
|
pphrase_arg_t *parg = NULL;
|
2007-02-12 17:32:37 -05:00
|
|
|
|
2008-09-06 01:29:05 -04:00
|
|
|
parg = malloc(sizeof(pphrase_arg_t));
|
2008-11-15 18:43:10 -05:00
|
|
|
if(!parg)
|
|
|
|
return SECFailure;
|
|
|
|
|
2007-02-12 17:32:37 -05:00
|
|
|
parg->retryCount = 0;
|
|
|
|
parg->data = conn->data;
|
|
|
|
|
|
|
|
PK11_SetPasswordFunc(nss_get_password);
|
|
|
|
|
|
|
|
slotList =
|
|
|
|
PK11_GetAllTokens(CKM_INVALID_MECHANISM, PR_FALSE, PR_TRUE, NULL);
|
|
|
|
|
|
|
|
for(listEntry = PK11_GetFirstSafe(slotList);
|
|
|
|
listEntry; listEntry = listEntry->next) {
|
|
|
|
PK11SlotInfo *slot = listEntry->slot;
|
|
|
|
|
|
|
|
if(PK11_NeedLogin(slot) && PK11_NeedUserInit(slot)) {
|
|
|
|
if(slot == PK11_GetInternalKeySlot()) {
|
2008-01-15 18:19:02 -05:00
|
|
|
failf(conn->data, "The NSS database has not been initialized");
|
2007-02-12 17:32:37 -05:00
|
|
|
}
|
|
|
|
else {
|
2008-01-15 18:19:02 -05:00
|
|
|
failf(conn->data, "The token %s has not been initialized",
|
2007-02-12 17:32:37 -05:00
|
|
|
PK11_GetTokenName(slot));
|
|
|
|
}
|
|
|
|
PK11_FreeSlot(slot);
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
ret = PK11_Authenticate(slot, PR_TRUE, parg);
|
|
|
|
if(SECSuccess != ret) {
|
2007-11-05 04:45:09 -05:00
|
|
|
if(PR_GetError() == SEC_ERROR_BAD_PASSWORD)
|
2007-09-18 18:21:54 -04:00
|
|
|
infof(conn->data, "The password for token '%s' is incorrect\n",
|
|
|
|
PK11_GetTokenName(slot));
|
2007-02-12 17:32:37 -05:00
|
|
|
status = SECFailure;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
parg->retryCount = 0; /* reset counter to 0 for the next token */
|
|
|
|
PK11_FreeSlot(slot);
|
|
|
|
}
|
|
|
|
|
|
|
|
free(parg);
|
2007-09-18 18:21:54 -04:00
|
|
|
|
2007-02-12 17:32:37 -05:00
|
|
|
return status;
|
|
|
|
}
|
|
|
|
|
2007-10-25 16:54:46 -04:00
|
|
|
static SECStatus BadCertHandler(void *arg, PRFileDesc *sock)
|
2007-02-12 17:32:37 -05:00
|
|
|
{
|
|
|
|
SECStatus success = SECSuccess;
|
2007-09-18 18:21:54 -04:00
|
|
|
struct connectdata *conn = (struct connectdata *)arg;
|
|
|
|
PRErrorCode err = PR_GetError();
|
|
|
|
CERTCertificate *cert = NULL;
|
|
|
|
char *subject, *issuer;
|
|
|
|
|
2007-11-05 04:45:09 -05:00
|
|
|
if(conn->data->set.ssl.certverifyresult!=0)
|
2007-09-18 18:21:54 -04:00
|
|
|
return success;
|
|
|
|
|
|
|
|
conn->data->set.ssl.certverifyresult=err;
|
2007-10-25 16:54:46 -04:00
|
|
|
cert = SSL_PeerCertificate(sock);
|
2007-09-18 18:21:54 -04:00
|
|
|
subject = CERT_NameToAscii(&cert->subject);
|
|
|
|
issuer = CERT_NameToAscii(&cert->issuer);
|
|
|
|
CERT_DestroyCertificate(cert);
|
|
|
|
|
|
|
|
switch(err) {
|
|
|
|
case SEC_ERROR_CA_CERT_INVALID:
|
|
|
|
infof(conn->data, "Issuer certificate is invalid: '%s'\n", issuer);
|
2007-11-05 04:45:09 -05:00
|
|
|
if(conn->data->set.ssl.verifypeer)
|
2007-09-18 18:21:54 -04:00
|
|
|
success = SECFailure;
|
|
|
|
break;
|
|
|
|
case SEC_ERROR_UNTRUSTED_ISSUER:
|
2007-11-05 04:45:09 -05:00
|
|
|
if(conn->data->set.ssl.verifypeer)
|
2007-09-18 18:21:54 -04:00
|
|
|
success = SECFailure;
|
|
|
|
infof(conn->data, "Certificate is signed by an untrusted issuer: '%s'\n",
|
|
|
|
issuer);
|
|
|
|
break;
|
|
|
|
case SSL_ERROR_BAD_CERT_DOMAIN:
|
2007-11-05 04:45:09 -05:00
|
|
|
if(conn->data->set.ssl.verifypeer)
|
2007-09-18 18:21:54 -04:00
|
|
|
success = SECFailure;
|
|
|
|
infof(conn->data, "common name: %s (does not match '%s')\n",
|
|
|
|
subject, conn->host.dispname);
|
|
|
|
break;
|
|
|
|
case SEC_ERROR_EXPIRED_CERTIFICATE:
|
2007-11-05 04:45:09 -05:00
|
|
|
if(conn->data->set.ssl.verifypeer)
|
2007-09-18 18:21:54 -04:00
|
|
|
success = SECFailure;
|
|
|
|
infof(conn->data, "Remote Certificate has expired.\n");
|
|
|
|
break;
|
|
|
|
default:
|
2007-11-05 04:45:09 -05:00
|
|
|
if(conn->data->set.ssl.verifypeer)
|
2007-09-18 18:21:54 -04:00
|
|
|
success = SECFailure;
|
|
|
|
infof(conn->data, "Bad certificate received. Subject = '%s', "
|
|
|
|
"Issuer = '%s'\n", subject, issuer);
|
|
|
|
break;
|
|
|
|
}
|
2007-11-05 04:45:09 -05:00
|
|
|
if(success == SECSuccess)
|
2007-09-18 18:21:54 -04:00
|
|
|
infof(conn->data, "SSL certificate verify ok.\n");
|
|
|
|
PR_Free(subject);
|
|
|
|
PR_Free(issuer);
|
2007-02-12 17:32:37 -05:00
|
|
|
|
|
|
|
return success;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Inform the application that the handshake is complete.
|
|
|
|
*/
|
2007-10-25 16:54:46 -04:00
|
|
|
static SECStatus HandshakeCallback(PRFileDesc *sock, void *arg)
|
2007-02-12 17:32:37 -05:00
|
|
|
{
|
2007-10-25 16:54:46 -04:00
|
|
|
(void)sock;
|
2007-02-12 17:32:37 -05:00
|
|
|
(void)arg;
|
|
|
|
return SECSuccess;
|
|
|
|
}
|
|
|
|
|
2007-10-25 16:54:46 -04:00
|
|
|
static void display_conn_info(struct connectdata *conn, PRFileDesc *sock)
|
2007-09-18 18:21:54 -04:00
|
|
|
{
|
|
|
|
SSLChannelInfo channel;
|
|
|
|
SSLCipherSuiteInfo suite;
|
|
|
|
CERTCertificate *cert;
|
|
|
|
char *subject, *issuer, *common_name;
|
|
|
|
PRExplodedTime printableTime;
|
|
|
|
char timeString[256];
|
|
|
|
PRTime notBefore, notAfter;
|
|
|
|
|
2007-11-05 04:45:09 -05:00
|
|
|
if(SSL_GetChannelInfo(sock, &channel, sizeof channel) ==
|
2008-06-06 16:57:32 -04:00
|
|
|
SECSuccess && channel.length == sizeof channel &&
|
|
|
|
channel.cipherSuite) {
|
2007-11-05 04:45:09 -05:00
|
|
|
if(SSL_GetCipherSuiteInfo(channel.cipherSuite,
|
2008-06-06 16:57:32 -04:00
|
|
|
&suite, sizeof suite) == SECSuccess) {
|
2007-09-18 18:21:54 -04:00
|
|
|
infof(conn->data, "SSL connection using %s\n", suite.cipherSuiteName);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
infof(conn->data, "Server certificate:\n");
|
|
|
|
|
2007-10-25 16:54:46 -04:00
|
|
|
cert = SSL_PeerCertificate(sock);
|
2007-09-18 18:21:54 -04:00
|
|
|
subject = CERT_NameToAscii(&cert->subject);
|
|
|
|
issuer = CERT_NameToAscii(&cert->issuer);
|
|
|
|
common_name = CERT_GetCommonName(&cert->subject);
|
|
|
|
infof(conn->data, "\tsubject: %s\n", subject);
|
|
|
|
|
|
|
|
CERT_GetCertTimes(cert, ¬Before, ¬After);
|
|
|
|
PR_ExplodeTime(notBefore, PR_GMTParameters, &printableTime);
|
|
|
|
PR_FormatTime(timeString, 256, "%b %d %H:%M:%S %Y GMT", &printableTime);
|
|
|
|
infof(conn->data, "\tstart date: %s\n", timeString);
|
|
|
|
PR_ExplodeTime(notAfter, PR_GMTParameters, &printableTime);
|
|
|
|
PR_FormatTime(timeString, 256, "%b %d %H:%M:%S %Y GMT", &printableTime);
|
|
|
|
infof(conn->data, "\texpire date: %s\n", timeString);
|
|
|
|
infof(conn->data, "\tcommon name: %s\n", common_name);
|
|
|
|
infof(conn->data, "\tissuer: %s\n", issuer);
|
|
|
|
|
|
|
|
PR_Free(subject);
|
|
|
|
PR_Free(issuer);
|
|
|
|
PR_Free(common_name);
|
|
|
|
|
|
|
|
CERT_DestroyCertificate(cert);
|
|
|
|
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2008-06-06 16:52:32 -04:00
|
|
|
/**
|
|
|
|
*
|
|
|
|
* Check that the Peer certificate's issuer certificate matches the one found
|
|
|
|
* by issuer_nickname. This is not exactly the way OpenSSL and GNU TLS do the
|
|
|
|
* issuer check, so we provide comments that mimic the OpenSSL
|
|
|
|
* X509_check_issued function (in x509v3/v3_purp.c)
|
|
|
|
*/
|
2008-06-18 17:50:40 -04:00
|
|
|
static SECStatus check_issuer_cert(PRFileDesc *sock,
|
2008-11-15 18:43:10 -05:00
|
|
|
char *issuer_nickname)
|
2008-06-06 16:52:32 -04:00
|
|
|
{
|
|
|
|
CERTCertificate *cert,*cert_issuer,*issuer;
|
|
|
|
SECStatus res=SECSuccess;
|
|
|
|
void *proto_win = NULL;
|
|
|
|
|
|
|
|
/*
|
|
|
|
PRArenaPool *tmpArena = NULL;
|
|
|
|
CERTAuthKeyID *authorityKeyID = NULL;
|
|
|
|
SECITEM *caname = NULL;
|
|
|
|
*/
|
|
|
|
|
|
|
|
cert = SSL_PeerCertificate(sock);
|
|
|
|
cert_issuer = CERT_FindCertIssuer(cert,PR_Now(),certUsageObjectSigner);
|
|
|
|
|
|
|
|
proto_win = SSL_RevealPinArg(sock);
|
|
|
|
issuer = NULL;
|
|
|
|
issuer = PK11_FindCertFromNickname(issuer_nickname, proto_win);
|
|
|
|
|
|
|
|
if ((!cert_issuer) || (!issuer))
|
|
|
|
res = SECFailure;
|
2008-06-18 17:48:51 -04:00
|
|
|
else if (SECITEM_CompareItem(&cert_issuer->derCert,
|
|
|
|
&issuer->derCert)!=SECEqual)
|
2008-06-06 16:52:32 -04:00
|
|
|
res = SECFailure;
|
|
|
|
|
|
|
|
CERT_DestroyCertificate(cert);
|
|
|
|
CERT_DestroyCertificate(issuer);
|
|
|
|
CERT_DestroyCertificate(cert_issuer);
|
|
|
|
return res;
|
|
|
|
}
|
|
|
|
|
2007-02-12 17:32:37 -05:00
|
|
|
/**
|
|
|
|
*
|
|
|
|
* Callback to pick the SSL client certificate.
|
|
|
|
*/
|
2007-10-25 16:54:46 -04:00
|
|
|
static SECStatus SelectClientCert(void *arg, PRFileDesc *sock,
|
|
|
|
struct CERTDistNamesStr *caNames,
|
|
|
|
struct CERTCertificateStr **pRetCert,
|
|
|
|
struct SECKEYPrivateKeyStr **pRetKey)
|
2007-02-12 17:32:37 -05:00
|
|
|
{
|
|
|
|
CERTCertificate *cert;
|
|
|
|
SECKEYPrivateKey *privKey;
|
|
|
|
char *nickname = (char *)arg;
|
|
|
|
void *proto_win = NULL;
|
|
|
|
SECStatus secStatus = SECFailure;
|
2007-09-18 18:21:54 -04:00
|
|
|
PK11SlotInfo *slot;
|
2007-02-12 17:32:37 -05:00
|
|
|
(void)caNames;
|
|
|
|
|
2007-10-25 16:54:46 -04:00
|
|
|
proto_win = SSL_RevealPinArg(sock);
|
2007-02-12 17:32:37 -05:00
|
|
|
|
2007-11-05 04:45:09 -05:00
|
|
|
if(!nickname)
|
2007-09-18 18:21:54 -04:00
|
|
|
return secStatus;
|
|
|
|
|
2007-02-12 17:32:37 -05:00
|
|
|
cert = PK11_FindCertFromNickname(nickname, proto_win);
|
|
|
|
if(cert) {
|
2007-09-18 18:21:54 -04:00
|
|
|
|
|
|
|
if(!strncmp(nickname, "PEM Token", 9)) {
|
|
|
|
CK_SLOT_ID slotID = 1; /* hardcoded for now */
|
2008-11-15 18:43:10 -05:00
|
|
|
char slotname[SLOTSIZE];
|
2007-09-18 18:21:54 -04:00
|
|
|
snprintf(slotname, SLOTSIZE, "PEM Token #%ld", slotID);
|
|
|
|
slot = PK11_FindSlotByName(slotname);
|
|
|
|
privKey = PK11_FindPrivateKeyFromCert(slot, cert, NULL);
|
|
|
|
PK11_FreeSlot(slot);
|
|
|
|
if(privKey) {
|
|
|
|
secStatus = SECSuccess;
|
|
|
|
}
|
2007-02-12 17:32:37 -05:00
|
|
|
}
|
|
|
|
else {
|
2007-09-18 18:21:54 -04:00
|
|
|
privKey = PK11_FindKeyByAnyCert(cert, proto_win);
|
|
|
|
if(privKey)
|
|
|
|
secStatus = SECSuccess;
|
2007-02-12 17:32:37 -05:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if(secStatus == SECSuccess) {
|
|
|
|
*pRetCert = cert;
|
|
|
|
*pRetKey = privKey;
|
|
|
|
}
|
2007-09-18 18:21:54 -04:00
|
|
|
else {
|
2007-11-05 04:45:09 -05:00
|
|
|
if(cert)
|
2007-09-18 18:21:54 -04:00
|
|
|
CERT_DestroyCertificate(cert);
|
|
|
|
}
|
2007-02-12 17:32:37 -05:00
|
|
|
|
|
|
|
return secStatus;
|
|
|
|
}
|
|
|
|
|
|
|
|
/**
|
|
|
|
* Global SSL init
|
|
|
|
*
|
|
|
|
* @retval 0 error initializing SSL
|
|
|
|
* @retval 1 SSL initialized successfully
|
|
|
|
*/
|
|
|
|
int Curl_nss_init(void)
|
|
|
|
{
|
2008-09-23 06:27:04 -04:00
|
|
|
/* curl_global_init() is not thread-safe so this test is ok */
|
|
|
|
if (nss_initlock == NULL) {
|
2007-02-12 17:32:37 -05:00
|
|
|
PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 256);
|
2008-09-23 06:27:04 -04:00
|
|
|
nss_initlock = PR_NewLock();
|
|
|
|
}
|
2007-02-12 17:32:37 -05:00
|
|
|
|
|
|
|
/* We will actually initialize NSS later */
|
|
|
|
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Global cleanup */
|
|
|
|
void Curl_nss_cleanup(void)
|
|
|
|
{
|
2008-09-23 06:27:04 -04:00
|
|
|
/* This function isn't required to be threadsafe and this is only done
|
|
|
|
* as a safety feature.
|
|
|
|
*/
|
|
|
|
PR_Lock(nss_initlock);
|
|
|
|
if (initialized)
|
|
|
|
NSS_Shutdown();
|
|
|
|
PR_Unlock(nss_initlock);
|
|
|
|
|
|
|
|
PR_DestroyLock(nss_initlock);
|
|
|
|
nss_initlock = NULL;
|
|
|
|
|
2007-02-12 17:32:37 -05:00
|
|
|
initialized = 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* This function uses SSL_peek to determine connection status.
|
|
|
|
*
|
|
|
|
* Return codes:
|
|
|
|
* 1 means the connection is still in place
|
|
|
|
* 0 means the connection has been closed
|
|
|
|
* -1 means the connection status is unknown
|
|
|
|
*/
|
|
|
|
int
|
|
|
|
Curl_nss_check_cxn(struct connectdata *conn)
|
|
|
|
{
|
|
|
|
int rc;
|
|
|
|
char buf;
|
|
|
|
|
|
|
|
rc =
|
|
|
|
PR_Recv(conn->ssl[FIRSTSOCKET].handle, (void *)&buf, 1, PR_MSG_PEEK,
|
|
|
|
PR_SecondsToInterval(1));
|
|
|
|
if(rc > 0)
|
|
|
|
return 1; /* connection still in place */
|
|
|
|
|
|
|
|
if(rc == 0)
|
|
|
|
return 0; /* connection has been closed */
|
|
|
|
|
|
|
|
return -1; /* connection status unknown */
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* This function is called when an SSL connection is closed.
|
|
|
|
*/
|
2007-07-29 08:54:05 -04:00
|
|
|
void Curl_nss_close(struct connectdata *conn, int sockindex)
|
2007-02-12 17:32:37 -05:00
|
|
|
{
|
2007-07-29 08:54:05 -04:00
|
|
|
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
|
2007-02-12 17:32:37 -05:00
|
|
|
|
2007-07-29 08:54:05 -04:00
|
|
|
if(connssl->handle) {
|
|
|
|
PR_Close(connssl->handle);
|
2007-09-18 18:21:54 -04:00
|
|
|
if(connssl->client_nickname != NULL) {
|
|
|
|
free(connssl->client_nickname);
|
|
|
|
connssl->client_nickname = NULL;
|
|
|
|
}
|
2007-07-29 08:54:05 -04:00
|
|
|
connssl->handle = NULL;
|
2007-02-12 17:32:37 -05:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* This function is called when the 'data' struct is going away. Close
|
|
|
|
* down everything and free all resources!
|
|
|
|
*/
|
|
|
|
int Curl_nss_close_all(struct SessionHandle *data)
|
|
|
|
{
|
|
|
|
(void)data;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-06-06 16:52:32 -04:00
|
|
|
CURLcode Curl_nss_connect(struct connectdata *conn, int sockindex)
|
2007-02-12 17:32:37 -05:00
|
|
|
{
|
|
|
|
PRInt32 err;
|
|
|
|
PRFileDesc *model = NULL;
|
|
|
|
PRBool ssl2, ssl3, tlsv1;
|
|
|
|
struct SessionHandle *data = conn->data;
|
|
|
|
curl_socket_t sockfd = conn->sock[sockindex];
|
|
|
|
struct ssl_connect_data *connssl = &conn->ssl[sockindex];
|
|
|
|
SECStatus rv;
|
2007-10-25 16:54:46 -04:00
|
|
|
#ifdef HAVE_PK11_CREATEGENERICOBJECT
|
2007-09-18 18:21:54 -04:00
|
|
|
char *configstring = NULL;
|
2007-10-25 16:54:46 -04:00
|
|
|
#endif
|
2007-09-18 18:21:54 -04:00
|
|
|
char *certDir = NULL;
|
|
|
|
int curlerr;
|
2009-03-18 08:48:51 -04:00
|
|
|
const int *cipher_to_enable;
|
2007-09-18 18:21:54 -04:00
|
|
|
|
|
|
|
curlerr = CURLE_SSL_CONNECT_ERROR;
|
2007-02-12 17:32:37 -05:00
|
|
|
|
2008-06-18 18:01:55 -04:00
|
|
|
if (connssl->state == ssl_connection_complete)
|
|
|
|
return CURLE_OK;
|
|
|
|
|
2007-02-12 17:32:37 -05:00
|
|
|
/* FIXME. NSS doesn't support multiple databases open at the same time. */
|
2008-09-23 06:27:04 -04:00
|
|
|
PR_Lock(nss_initlock);
|
2009-01-07 09:10:35 -05:00
|
|
|
if(!initialized) {
|
2007-09-18 18:21:54 -04:00
|
|
|
|
|
|
|
certDir = getenv("SSL_DIR"); /* Look in $SSL_DIR */
|
|
|
|
|
2007-11-05 04:45:09 -05:00
|
|
|
if(!certDir) {
|
2007-09-18 18:21:54 -04:00
|
|
|
struct stat st;
|
|
|
|
|
2007-11-05 04:45:09 -05:00
|
|
|
if(stat(SSL_DIR, &st) == 0)
|
|
|
|
if(S_ISDIR(st.st_mode)) {
|
2007-09-18 18:21:54 -04:00
|
|
|
certDir = (char *)SSL_DIR;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2009-01-07 09:10:35 -05:00
|
|
|
if (!NSS_IsInitialized()) {
|
|
|
|
initialized = 1;
|
|
|
|
if(!certDir) {
|
|
|
|
rv = NSS_NoDB_Init(NULL);
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
rv = NSS_Initialize(certDir, NULL, NULL, "secmod.db",
|
|
|
|
NSS_INIT_READONLY);
|
|
|
|
}
|
|
|
|
if(rv != SECSuccess) {
|
|
|
|
infof(conn->data, "Unable to initialize NSS database\n");
|
|
|
|
curlerr = CURLE_SSL_CACERT_BADFILE;
|
|
|
|
initialized = 0;
|
|
|
|
PR_Unlock(nss_initlock);
|
|
|
|
goto error;
|
|
|
|
}
|
2007-02-12 17:32:37 -05:00
|
|
|
}
|
|
|
|
|
2009-01-07 09:10:35 -05:00
|
|
|
if(num_enabled_ciphers() == 0)
|
|
|
|
NSS_SetDomesticPolicy();
|
2007-09-18 18:21:54 -04:00
|
|
|
|
|
|
|
#ifdef HAVE_PK11_CREATEGENERICOBJECT
|
2008-11-15 18:43:10 -05:00
|
|
|
configstring = aprintf("library=%s name=PEM", pem_library);
|
2009-01-07 09:10:35 -05:00
|
|
|
if(!configstring) {
|
|
|
|
PR_Unlock(nss_initlock);
|
2008-11-15 18:43:10 -05:00
|
|
|
goto error;
|
2009-01-07 09:10:35 -05:00
|
|
|
}
|
2007-09-18 18:21:54 -04:00
|
|
|
mod = SECMOD_LoadUserModule(configstring, NULL, PR_FALSE);
|
|
|
|
free(configstring);
|
2008-11-15 18:43:10 -05:00
|
|
|
|
2007-11-05 04:45:09 -05:00
|
|
|
if(!mod || !mod->loaded) {
|
|
|
|
if(mod) {
|
2007-09-18 18:21:54 -04:00
|
|
|
SECMOD_DestroyModule(mod);
|
|
|
|
mod = NULL;
|
|
|
|
}
|
|
|
|
infof(data, "WARNING: failed to load NSS PEM library %s. Using OpenSSL "
|
|
|
|
"PEM certificates will not work.\n", pem_library);
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
}
|
2008-09-23 06:27:04 -04:00
|
|
|
PR_Unlock(nss_initlock);
|
2007-02-12 17:32:37 -05:00
|
|
|
|
|
|
|
model = PR_NewTCPSocket();
|
|
|
|
if(!model)
|
|
|
|
goto error;
|
|
|
|
model = SSL_ImportFD(NULL, model);
|
|
|
|
|
|
|
|
if(SSL_OptionSet(model, SSL_SECURITY, PR_TRUE) != SECSuccess)
|
|
|
|
goto error;
|
|
|
|
if(SSL_OptionSet(model, SSL_HANDSHAKE_AS_SERVER, PR_FALSE) != SECSuccess)
|
|
|
|
goto error;
|
|
|
|
if(SSL_OptionSet(model, SSL_HANDSHAKE_AS_CLIENT, PR_TRUE) != SECSuccess)
|
|
|
|
goto error;
|
|
|
|
|
|
|
|
ssl2 = ssl3 = tlsv1 = PR_FALSE;
|
|
|
|
|
|
|
|
switch (data->set.ssl.version) {
|
|
|
|
default:
|
|
|
|
case CURL_SSLVERSION_DEFAULT:
|
2008-02-19 18:10:07 -05:00
|
|
|
ssl3 = tlsv1 = PR_TRUE;
|
2007-02-12 17:32:37 -05:00
|
|
|
break;
|
|
|
|
case CURL_SSLVERSION_TLSv1:
|
|
|
|
tlsv1 = PR_TRUE;
|
|
|
|
break;
|
|
|
|
case CURL_SSLVERSION_SSLv2:
|
|
|
|
ssl2 = PR_TRUE;
|
|
|
|
break;
|
|
|
|
case CURL_SSLVERSION_SSLv3:
|
|
|
|
ssl3 = PR_TRUE;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
if(SSL_OptionSet(model, SSL_ENABLE_SSL2, ssl2) != SECSuccess)
|
|
|
|
goto error;
|
|
|
|
if(SSL_OptionSet(model, SSL_ENABLE_SSL3, ssl3) != SECSuccess)
|
|
|
|
goto error;
|
|
|
|
if(SSL_OptionSet(model, SSL_ENABLE_TLS, tlsv1) != SECSuccess)
|
|
|
|
goto error;
|
|
|
|
|
2008-02-19 18:10:07 -05:00
|
|
|
if(SSL_OptionSet(model, SSL_V2_COMPATIBLE_HELLO, ssl2) != SECSuccess)
|
|
|
|
goto error;
|
|
|
|
|
2009-03-18 08:48:51 -04:00
|
|
|
/* enable all ciphers from enable_ciphers_by_default */
|
|
|
|
cipher_to_enable = enable_ciphers_by_default;
|
|
|
|
while (SSL_NULL_WITH_NULL_NULL != *cipher_to_enable) {
|
|
|
|
if (SSL_CipherPrefSet(model, *cipher_to_enable, PR_TRUE) != SECSuccess) {
|
|
|
|
curlerr = CURLE_SSL_CIPHER;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
cipher_to_enable++;
|
|
|
|
}
|
|
|
|
|
2007-02-12 17:32:37 -05:00
|
|
|
if(data->set.ssl.cipher_list) {
|
2007-09-18 18:21:54 -04:00
|
|
|
if(set_ciphers(data, model, data->set.ssl.cipher_list) != SECSuccess) {
|
|
|
|
curlerr = CURLE_SSL_CIPHER;
|
2007-02-12 17:32:37 -05:00
|
|
|
goto error;
|
2007-09-18 18:21:54 -04:00
|
|
|
}
|
2007-02-12 17:32:37 -05:00
|
|
|
}
|
|
|
|
|
2007-09-18 18:21:54 -04:00
|
|
|
data->set.ssl.certverifyresult=0; /* not checked yet */
|
|
|
|
if(SSL_BadCertHook(model, (SSLBadCertHandler) BadCertHandler, conn)
|
|
|
|
!= SECSuccess) {
|
2007-02-12 17:32:37 -05:00
|
|
|
goto error;
|
2007-09-18 18:21:54 -04:00
|
|
|
}
|
2007-02-12 17:32:37 -05:00
|
|
|
if(SSL_HandshakeCallback(model, (SSLHandshakeCallback) HandshakeCallback,
|
|
|
|
NULL) != SECSuccess)
|
|
|
|
goto error;
|
|
|
|
|
2007-10-25 17:08:55 -04:00
|
|
|
if(!data->set.ssl.verifypeer)
|
|
|
|
/* skip the verifying of the peer */
|
|
|
|
;
|
2007-11-05 04:45:09 -05:00
|
|
|
else if(data->set.ssl.CAfile) {
|
2007-10-25 17:08:55 -04:00
|
|
|
int rc = nss_load_cert(data->set.ssl.CAfile, PR_TRUE);
|
2007-11-05 04:45:09 -05:00
|
|
|
if(!rc) {
|
2007-09-18 18:21:54 -04:00
|
|
|
curlerr = CURLE_SSL_CACERT_BADFILE;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
}
|
2007-11-05 04:45:09 -05:00
|
|
|
else if(data->set.ssl.CApath) {
|
2007-09-18 18:21:54 -04:00
|
|
|
struct stat st;
|
|
|
|
PRDir *dir;
|
|
|
|
PRDirEntry *entry;
|
|
|
|
|
2007-11-05 04:45:09 -05:00
|
|
|
if(stat(data->set.ssl.CApath, &st) == -1) {
|
2007-09-18 18:21:54 -04:00
|
|
|
curlerr = CURLE_SSL_CACERT_BADFILE;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
|
2007-11-05 04:45:09 -05:00
|
|
|
if(S_ISDIR(st.st_mode)) {
|
2007-10-25 16:54:46 -04:00
|
|
|
int rc;
|
2007-09-18 18:21:54 -04:00
|
|
|
|
|
|
|
dir = PR_OpenDir(data->set.ssl.CApath);
|
|
|
|
do {
|
|
|
|
entry = PR_ReadDir(dir, PR_SKIP_BOTH | PR_SKIP_HIDDEN);
|
|
|
|
|
2007-11-05 04:45:09 -05:00
|
|
|
if(entry) {
|
2007-09-18 18:21:54 -04:00
|
|
|
char fullpath[PATH_MAX];
|
|
|
|
|
|
|
|
snprintf(fullpath, sizeof(fullpath), "%s/%s", data->set.ssl.CApath,
|
|
|
|
entry->name);
|
2007-10-25 16:54:46 -04:00
|
|
|
rc = nss_load_cert(fullpath, PR_TRUE);
|
|
|
|
/* FIXME: check this return value! */
|
2007-09-18 18:21:54 -04:00
|
|
|
}
|
2008-06-06 16:57:32 -04:00
|
|
|
/* This is purposefully tolerant of errors so non-PEM files
|
|
|
|
* can be in the same directory */
|
2007-11-05 04:45:09 -05:00
|
|
|
} while(entry != NULL);
|
2007-09-18 18:21:54 -04:00
|
|
|
PR_CloseDir(dir);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
infof(data,
|
|
|
|
" CAfile: %s\n"
|
|
|
|
" CApath: %s\n",
|
|
|
|
data->set.ssl.CAfile ? data->set.ssl.CAfile : "none",
|
|
|
|
data->set.ssl.CApath ? data->set.ssl.CApath : "none");
|
|
|
|
|
2008-06-06 14:40:21 -04:00
|
|
|
if (data->set.ssl.CRLfile) {
|
|
|
|
int rc = nss_load_crl(data->set.ssl.CRLfile, PR_FALSE);
|
|
|
|
if (!rc) {
|
|
|
|
curlerr = CURLE_SSL_CRL_BADFILE;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
infof(data,
|
|
|
|
" CRLfile: %s\n",
|
|
|
|
data->set.ssl.CRLfile ? data->set.ssl.CRLfile : "none");
|
|
|
|
}
|
|
|
|
|
2007-08-01 17:20:01 -04:00
|
|
|
if(data->set.str[STRING_CERT]) {
|
2007-10-25 17:08:55 -04:00
|
|
|
char *n;
|
|
|
|
char *nickname;
|
2008-11-15 18:43:10 -05:00
|
|
|
bool nickname_alloc = FALSE;
|
2007-09-18 18:21:54 -04:00
|
|
|
|
|
|
|
if(is_file(data->set.str[STRING_CERT])) {
|
|
|
|
n = strrchr(data->set.str[STRING_CERT], '/');
|
2007-11-05 04:45:09 -05:00
|
|
|
if(n) {
|
2007-09-18 18:21:54 -04:00
|
|
|
n++; /* skip last slash */
|
2009-02-17 07:18:34 -05:00
|
|
|
nickname = aprintf("PEM Token #%d:%s", 1, n);
|
2008-11-15 18:43:10 -05:00
|
|
|
if(!nickname)
|
|
|
|
return CURLE_OUT_OF_MEMORY;
|
|
|
|
|
|
|
|
nickname_alloc = TRUE;
|
2007-09-18 18:21:54 -04:00
|
|
|
}
|
|
|
|
}
|
|
|
|
else {
|
2008-11-15 18:43:10 -05:00
|
|
|
nickname = data->set.str[STRING_CERT];
|
2007-09-18 18:21:54 -04:00
|
|
|
}
|
|
|
|
if(nss_Init_Tokens(conn) != SECSuccess) {
|
2008-11-15 18:43:10 -05:00
|
|
|
if(nickname_alloc)
|
|
|
|
free(nickname);
|
2007-09-18 18:21:54 -04:00
|
|
|
goto error;
|
|
|
|
}
|
2007-11-05 04:45:09 -05:00
|
|
|
if(!cert_stuff(conn, data->set.str[STRING_CERT],
|
2007-10-25 17:08:55 -04:00
|
|
|
data->set.str[STRING_KEY])) {
|
2007-09-18 18:21:54 -04:00
|
|
|
/* failf() is already done in cert_stuff() */
|
2008-11-15 18:43:10 -05:00
|
|
|
if(nickname_alloc)
|
|
|
|
free(nickname);
|
2007-09-18 18:21:54 -04:00
|
|
|
return CURLE_SSL_CERTPROBLEM;
|
|
|
|
}
|
|
|
|
|
2008-11-15 18:43:10 -05:00
|
|
|
/* this "takes over" the pointer to the allocated name or makes a
|
|
|
|
dup of it */
|
|
|
|
connssl->client_nickname = nickname_alloc?nickname:strdup(nickname);
|
|
|
|
if(!connssl->client_nickname)
|
|
|
|
return CURLE_OUT_OF_MEMORY;
|
|
|
|
|
2007-02-12 17:32:37 -05:00
|
|
|
if(SSL_GetClientAuthDataHook(model,
|
|
|
|
(SSLGetClientAuthData) SelectClientCert,
|
2009-02-17 07:18:34 -05:00
|
|
|
(void *)connssl->client_nickname) !=
|
|
|
|
SECSuccess) {
|
2007-02-12 17:32:37 -05:00
|
|
|
curlerr = CURLE_SSL_CERTPROBLEM;
|
|
|
|
goto error;
|
|
|
|
}
|
2007-09-18 18:21:54 -04:00
|
|
|
|
|
|
|
PK11_SetPasswordFunc(nss_no_password);
|
2007-02-12 17:32:37 -05:00
|
|
|
}
|
2007-09-18 18:21:54 -04:00
|
|
|
else
|
|
|
|
connssl->client_nickname = NULL;
|
2007-02-12 17:32:37 -05:00
|
|
|
|
2008-06-06 16:52:32 -04:00
|
|
|
|
2007-02-12 17:32:37 -05:00
|
|
|
/* Import our model socket onto the existing file descriptor */
|
|
|
|
connssl->handle = PR_ImportTCPSocket(sockfd);
|
|
|
|
connssl->handle = SSL_ImportFD(model, connssl->handle);
|
|
|
|
if(!connssl->handle)
|
|
|
|
goto error;
|
2007-09-18 18:21:54 -04:00
|
|
|
PR_Close(model); /* We don't need this any more */
|
2007-02-12 17:32:37 -05:00
|
|
|
|
|
|
|
/* Force handshake on next I/O */
|
|
|
|
SSL_ResetHandshake(connssl->handle, /* asServer */ PR_FALSE);
|
|
|
|
|
|
|
|
SSL_SetURL(connssl->handle, conn->host.name);
|
|
|
|
|
2007-05-25 17:56:27 -04:00
|
|
|
/* Force the handshake now */
|
2007-11-05 04:45:09 -05:00
|
|
|
if(SSL_ForceHandshakeWithTimeout(connssl->handle,
|
2007-05-25 17:56:27 -04:00
|
|
|
PR_SecondsToInterval(HANDSHAKE_TIMEOUT))
|
2007-09-18 18:21:54 -04:00
|
|
|
!= SECSuccess) {
|
2007-11-05 04:45:09 -05:00
|
|
|
if(conn->data->set.ssl.certverifyresult!=0)
|
2007-09-18 18:21:54 -04:00
|
|
|
curlerr = CURLE_SSL_CACERT;
|
2007-05-25 17:56:27 -04:00
|
|
|
goto error;
|
2007-09-18 18:21:54 -04:00
|
|
|
}
|
|
|
|
|
2008-02-20 04:56:26 -05:00
|
|
|
connssl->state = ssl_connection_complete;
|
|
|
|
|
2007-09-18 18:21:54 -04:00
|
|
|
display_conn_info(conn, connssl->handle);
|
2007-05-25 17:56:27 -04:00
|
|
|
|
2008-06-06 16:52:32 -04:00
|
|
|
if (data->set.str[STRING_SSL_ISSUERCERT]) {
|
|
|
|
char *n;
|
|
|
|
char *nickname;
|
2008-11-15 18:43:10 -05:00
|
|
|
bool nickname_alloc = FALSE;
|
|
|
|
SECStatus ret;
|
|
|
|
|
2008-06-06 16:52:32 -04:00
|
|
|
if(is_file(data->set.str[STRING_SSL_ISSUERCERT])) {
|
|
|
|
n = strrchr(data->set.str[STRING_SSL_ISSUERCERT], '/');
|
|
|
|
if (n) {
|
|
|
|
n++; /* skip last slash */
|
2008-11-15 18:43:10 -05:00
|
|
|
nickname = aprintf("PEM Token #%d:%s", 1, n);
|
|
|
|
if(!nickname)
|
|
|
|
return CURLE_OUT_OF_MEMORY;
|
|
|
|
nickname_alloc = TRUE;
|
2008-06-06 16:52:32 -04:00
|
|
|
}
|
|
|
|
}
|
2008-11-15 18:43:10 -05:00
|
|
|
else
|
|
|
|
nickname = data->set.str[STRING_SSL_ISSUERCERT];
|
|
|
|
|
|
|
|
ret = check_issuer_cert(connssl->handle, nickname);
|
|
|
|
|
|
|
|
if(nickname_alloc)
|
2008-06-06 16:52:32 -04:00
|
|
|
free(nickname);
|
2008-11-15 18:43:10 -05:00
|
|
|
|
|
|
|
if(SECFailure == ret) {
|
|
|
|
infof(data,"SSL certificate issuer check failed\n");
|
2008-06-06 16:52:32 -04:00
|
|
|
curlerr = CURLE_SSL_ISSUER_ERROR;
|
|
|
|
goto error;
|
|
|
|
}
|
|
|
|
else {
|
2008-06-12 18:00:35 -04:00
|
|
|
infof(data, "SSL certificate issuer check ok\n");
|
2008-06-06 16:52:32 -04:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2007-02-12 17:32:37 -05:00
|
|
|
return CURLE_OK;
|
|
|
|
|
|
|
|
error:
|
|
|
|
err = PR_GetError();
|
2007-09-18 18:21:54 -04:00
|
|
|
infof(data, "NSS error %d\n", err);
|
2007-02-12 17:32:37 -05:00
|
|
|
if(model)
|
|
|
|
PR_Close(model);
|
|
|
|
return curlerr;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* return number of sent (non-SSL) bytes */
|
|
|
|
int Curl_nss_send(struct connectdata *conn, /* connection data */
|
|
|
|
int sockindex, /* socketindex */
|
2008-06-21 17:19:42 -04:00
|
|
|
const void *mem, /* send this data */
|
2007-02-12 17:32:37 -05:00
|
|
|
size_t len) /* amount to write */
|
|
|
|
{
|
|
|
|
PRInt32 err;
|
|
|
|
struct SessionHandle *data = conn->data;
|
|
|
|
PRInt32 timeout;
|
|
|
|
int rc;
|
|
|
|
|
|
|
|
if(data->set.timeout)
|
|
|
|
timeout = PR_MillisecondsToInterval(data->set.timeout);
|
|
|
|
else
|
|
|
|
timeout = PR_MillisecondsToInterval(DEFAULT_CONNECT_TIMEOUT);
|
|
|
|
|
|
|
|
rc = PR_Send(conn->ssl[sockindex].handle, mem, (int)len, 0, timeout);
|
|
|
|
|
|
|
|
if(rc < 0) {
|
|
|
|
err = PR_GetError();
|
|
|
|
|
|
|
|
if(err == PR_IO_TIMEOUT_ERROR) {
|
|
|
|
failf(data, "SSL connection timeout");
|
2007-08-30 16:34:57 -04:00
|
|
|
return CURLE_OPERATION_TIMEDOUT;
|
2007-02-12 17:32:37 -05:00
|
|
|
}
|
|
|
|
|
2008-01-15 18:19:02 -05:00
|
|
|
failf(conn->data, "SSL write: error %d", err);
|
2007-02-12 17:32:37 -05:00
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
return rc; /* number of bytes */
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* If the read would block we return -1 and set 'wouldblock' to TRUE.
|
|
|
|
* Otherwise we return the amount of data read. Other errors should return -1
|
|
|
|
* and set 'wouldblock' to FALSE.
|
|
|
|
*/
|
|
|
|
ssize_t Curl_nss_recv(struct connectdata * conn, /* connection data */
|
|
|
|
int num, /* socketindex */
|
|
|
|
char *buf, /* store read data here */
|
|
|
|
size_t buffersize, /* max amount to read */
|
|
|
|
bool * wouldblock)
|
|
|
|
{
|
|
|
|
ssize_t nread;
|
|
|
|
struct SessionHandle *data = conn->data;
|
|
|
|
PRInt32 timeout;
|
|
|
|
|
|
|
|
if(data->set.timeout)
|
|
|
|
timeout = PR_SecondsToInterval(data->set.timeout);
|
|
|
|
else
|
|
|
|
timeout = PR_MillisecondsToInterval(DEFAULT_CONNECT_TIMEOUT);
|
|
|
|
|
|
|
|
nread = PR_Recv(conn->ssl[num].handle, buf, (int)buffersize, 0, timeout);
|
|
|
|
*wouldblock = FALSE;
|
|
|
|
if(nread < 0) {
|
|
|
|
/* failed SSL read */
|
|
|
|
PRInt32 err = PR_GetError();
|
|
|
|
|
|
|
|
if(err == PR_WOULD_BLOCK_ERROR) {
|
|
|
|
*wouldblock = TRUE;
|
|
|
|
return -1; /* basically EWOULDBLOCK */
|
|
|
|
}
|
|
|
|
if(err == PR_IO_TIMEOUT_ERROR) {
|
|
|
|
failf(data, "SSL connection timeout");
|
2007-08-30 16:34:57 -04:00
|
|
|
return CURLE_OPERATION_TIMEDOUT;
|
2007-02-12 17:32:37 -05:00
|
|
|
}
|
|
|
|
failf(conn->data, "SSL read: errno %d", err);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
return nread;
|
|
|
|
}
|
|
|
|
|
|
|
|
size_t Curl_nss_version(char *buffer, size_t size)
|
|
|
|
{
|
2007-08-24 05:06:17 -04:00
|
|
|
return snprintf(buffer, size, "NSS/%s", NSS_VERSION);
|
2007-02-12 17:32:37 -05:00
|
|
|
}
|
|
|
|
#endif /* USE_NSS */
|