From 4522121196f11de0200ed54ea50830c1baf017a6 Mon Sep 17 00:00:00 2001 From: Vincent Richard Date: Sun, 30 Oct 2005 15:02:39 +0000 Subject: Moved certificate code into 'vmime::net::security::cert' namespace. --- src/net/service.cpp | 8 +- src/net/tls/TLSSession.cpp | 4 +- src/net/tls/TLSSocket.cpp | 14 +- src/net/tls/X509Certificate.cpp | 273 ----------------------- src/net/tls/certificateChain.cpp | 53 ----- src/net/tls/defaultCertificateVerifier.cpp | 164 -------------- src/security/cert/X509Certificate.cpp | 273 +++++++++++++++++++++++ src/security/cert/certificateChain.cpp | 53 +++++ src/security/cert/defaultCertificateVerifier.cpp | 164 ++++++++++++++ 9 files changed, 503 insertions(+), 503 deletions(-) delete mode 100644 src/net/tls/X509Certificate.cpp delete mode 100644 src/net/tls/certificateChain.cpp delete mode 100644 src/net/tls/defaultCertificateVerifier.cpp create mode 100644 src/security/cert/X509Certificate.cpp create mode 100644 src/security/cert/certificateChain.cpp create mode 100644 src/security/cert/defaultCertificateVerifier.cpp (limited to 'src') diff --git a/src/net/service.cpp b/src/net/service.cpp index 8dde675a..6b1c34f3 100644 --- a/src/net/service.cpp +++ b/src/net/service.cpp @@ -29,7 +29,7 @@ #endif // VMIME_HAVE_SASL_SUPPORT #if VMIME_HAVE_TLS_SUPPORT - #include "vmime/net/tls/defaultCertificateVerifier.hpp" + #include "vmime/security/cert/defaultCertificateVerifier.hpp" #endif // VMIME_HAVE_TLS_SUPPORT @@ -53,7 +53,7 @@ service::service(ref sess, const serviceInfos& /* infos */, } #if VMIME_HAVE_TLS_SUPPORT - m_certVerifier = vmime::create (); + m_certVerifier = vmime::create (); #endif // VMIME_HAVE_TLS_SUPPORT m_socketFactory = platformDependant::getHandler()->getSocketFactory(); @@ -97,13 +97,13 @@ void service::setAuthenticator(ref auth) #if VMIME_HAVE_TLS_SUPPORT -void service::setCertificateVerifier(ref cv) +void service::setCertificateVerifier(ref cv) { m_certVerifier = cv; } -ref service::getCertificateVerifier() +ref service::getCertificateVerifier() { return m_certVerifier; } diff --git a/src/net/tls/TLSSession.cpp b/src/net/tls/TLSSession.cpp index fb84714c..caa63d0a 100644 --- a/src/net/tls/TLSSession.cpp +++ b/src/net/tls/TLSSession.cpp @@ -91,7 +91,7 @@ static TLSGlobal g_gnutlsGlobal; -TLSSession::TLSSession(ref cv) +TLSSession::TLSSession(ref cv) : m_certVerifier(cv) { int res; @@ -212,7 +212,7 @@ ref TLSSession::getSocket(ref sok) } -ref TLSSession::getCertificateVerifier() +ref TLSSession::getCertificateVerifier() { return m_certVerifier; } diff --git a/src/net/tls/TLSSocket.cpp b/src/net/tls/TLSSocket.cpp index ebf3214b..93066b98 100644 --- a/src/net/tls/TLSSocket.cpp +++ b/src/net/tls/TLSSocket.cpp @@ -29,7 +29,7 @@ #include "vmime/platformDependant.hpp" -#include "vmime/net/tls/X509Certificate.hpp" +#include "vmime/security/cert/X509Certificate.hpp" namespace vmime { @@ -185,7 +185,7 @@ void TLSSocket::handshake(ref toHandler) m_toHandler = NULL; // Verify server's certificate(s) - ref certs = getPeerCertificates(); + ref certs = getPeerCertificates(); if (certs == NULL) throw exceptions::tls_exception("No peer certificate."); @@ -280,7 +280,7 @@ ssize_t TLSSocket::gnutlsPullFunc } -ref TLSSocket::getPeerCertificates() +ref TLSSocket::getPeerCertificates() { unsigned int certCount = 0; const gnutls_datum* rawData = gnutls_certificate_get_peers @@ -304,7 +304,7 @@ ref TLSSocket::getPeerCertificates() if (res >= 1) { - std::vector > certs; + std::vector > certs; bool error = false; count = static_cast (res); @@ -321,8 +321,8 @@ ref TLSSocket::getPeerCertificates() gnutls_x509_crt_export(x509Certs[i], GNUTLS_X509_FMT_DER, data, &dataSize); - ref cert = - X509Certificate::import(data, dataSize); + ref cert = + security::cert::X509Certificate::import(data, dataSize); if (cert != NULL) certs.push_back(cert); @@ -339,7 +339,7 @@ ref TLSSocket::getPeerCertificates() if (error) return NULL; - return vmime::create (certs); + return vmime::create (certs); } delete [] x509Certs; diff --git a/src/net/tls/X509Certificate.cpp b/src/net/tls/X509Certificate.cpp deleted file mode 100644 index cfb52a1d..00000000 --- a/src/net/tls/X509Certificate.cpp +++ /dev/null @@ -1,273 +0,0 @@ -// -// VMime library (http://www.vmime.org) -// Copyright (C) 2002-2005 Vincent Richard -// -// This program is free software; you can redistribute it and/or -// modify it under the terms of the GNU General Public License as -// published by the Free Software Foundation; either version 2 of -// the License, or (at your option) any later version. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -// -// Linking this library statically or dynamically with other modules is making -// a combined work based on this library. Thus, the terms and conditions of -// the GNU General Public License cover the whole combination. -// - -#include -#include - -#include - -#include "vmime/net/tls/X509Certificate.hpp" - - -namespace vmime { -namespace net { -namespace tls { - - -#ifndef VMIME_BUILDING_DOC - -struct X509CertificateInternalData -{ - X509CertificateInternalData() - { - gnutls_x509_crt_init(&cert); - } - - ~X509CertificateInternalData() - { - gnutls_x509_crt_deinit(cert); - } - - - gnutls_x509_crt cert; -}; - -#endif // VMIME_BUILDING_DOC - - -X509Certificate::X509Certificate() - : m_data(new X509CertificateInternalData) -{ -} - - -X509Certificate::X509Certificate(const X509Certificate&) - : certificate(), m_data(NULL) -{ - // Not used -} - - -X509Certificate::~X509Certificate() -{ - delete m_data; -} - - -// static -ref X509Certificate::import(utility::inputStream& is) -{ - byteArray bytes; - utility::stream::value_type chunk[4096]; - - while (!is.eof()) - { - const int len = is.read(chunk, sizeof(chunk)); - bytes.insert(bytes.end(), chunk, chunk + len); - } - - return import(&bytes[0], bytes.size()); -} - - -// static -ref X509Certificate::import - (const byte* data, const unsigned int length) -{ - ref cert = vmime::create (); - - gnutls_datum buffer; - buffer.data = const_cast (data); - buffer.size = length; - - // Try DER format - if (gnutls_x509_crt_import(cert->m_data->cert, &buffer, GNUTLS_X509_FMT_DER) >= 0) - return cert; - - // Try PEM format - if (gnutls_x509_crt_import(cert->m_data->cert, &buffer, GNUTLS_X509_FMT_PEM) >= 0) - return cert; - - return NULL; -} - - -void X509Certificate::write - (utility::outputStream& os, const Format format) const -{ - size_t dataSize = 0; - gnutls_x509_crt_fmt fmt = GNUTLS_X509_FMT_DER; - - switch (format) - { - case FORMAT_DER: fmt = GNUTLS_X509_FMT_DER; break; - case FORMAT_PEM: fmt = GNUTLS_X509_FMT_PEM; break; - } - - gnutls_x509_crt_export(m_data->cert, fmt, NULL, &dataSize); - - byte* data = new byte[dataSize]; - - gnutls_x509_crt_export(m_data->cert, fmt, data, &dataSize); - - try - { - os.write(reinterpret_cast (data), dataSize); - } - catch (...) - { - delete [] data; - throw; - } -} - - -const byteArray X509Certificate::getSerialNumber() const -{ - char serial[64]; - size_t serialSize = sizeof(serial); - - gnutls_x509_crt_get_serial(m_data->cert, serial, &serialSize); - - return byteArray(serial, serial + serialSize); -} - - -const bool X509Certificate::checkIssuer - (ref issuer) const -{ - return (gnutls_x509_crt_check_issuer - (m_data->cert, issuer->m_data->cert) >= 1); -} - - -const bool X509Certificate::verify(ref caCert) const -{ - unsigned int verify = 0; - - const int res = gnutls_x509_crt_verify - (m_data->cert, &(caCert->m_data->cert), 1, - GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT, - &verify); - - return (res == 0 && verify == 0); -} - - -const datetime X509Certificate::getActivationDate() const -{ - const time_t t = gnutls_x509_crt_get_activation_time(m_data->cert); - return datetime(t); -} - - -const datetime X509Certificate::getExpirationDate() const -{ - const time_t t = gnutls_x509_crt_get_expiration_time(m_data->cert); - return datetime(t); -} - - -const byteArray X509Certificate::getFingerprint(const DigestAlgorithm algo) const -{ - gnutls_digest_algorithm galgo; - - switch (algo) - { - case DIGEST_MD5: - - galgo = GNUTLS_DIG_MD5; - break; - - default: - case DIGEST_SHA1: - - galgo = GNUTLS_DIG_SHA; - break; - } - - size_t bufferSize = 0; - gnutls_x509_crt_get_fingerprint - (m_data->cert, galgo, NULL, &bufferSize); - - byte* buffer = new byte[bufferSize]; - - if (gnutls_x509_crt_get_fingerprint - (m_data->cert, galgo, buffer, &bufferSize) == 0) - { - byteArray res; - res.insert(res.end(), buffer, buffer + bufferSize); - - delete [] buffer; - - return res; - } - - delete [] buffer; - - return byteArray(); -} - - -const byteArray X509Certificate::getEncoded() const -{ - byteArray bytes; - utility::outputStreamByteArrayAdapter os(bytes); - - write(os, FORMAT_DER); - - return bytes; -} - - -const string X509Certificate::getType() const -{ - return "X.509"; -} - - -const int X509Certificate::getVersion() const -{ - return gnutls_x509_crt_get_version(m_data->cert); -} - - -const bool X509Certificate::equals(ref other) const -{ - ref otherX509 = - other.dynamicCast (); - - if (!otherX509) - return false; - - const byteArray fp1 = getFingerprint(DIGEST_MD5); - const byteArray fp2 = otherX509->getFingerprint(DIGEST_MD5); - - return fp1 == fp2; -} - - -} // tls -} // net -} // vmime - diff --git a/src/net/tls/certificateChain.cpp b/src/net/tls/certificateChain.cpp deleted file mode 100644 index 52855cc2..00000000 --- a/src/net/tls/certificateChain.cpp +++ /dev/null @@ -1,53 +0,0 @@ -// -// VMime library (http://www.vmime.org) -// Copyright (C) 2002-2005 Vincent Richard -// -// This program is free software; you can redistribute it and/or -// modify it under the terms of the GNU General Public License as -// published by the Free Software Foundation; either version 2 of -// the License, or (at your option) any later version. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -// -// Linking this library statically or dynamically with other modules is making -// a combined work based on this library. Thus, the terms and conditions of -// the GNU General Public License cover the whole combination. -// - -#include "vmime/net/tls/certificateChain.hpp" - - -namespace vmime { -namespace net { -namespace tls { - - -certificateChain::certificateChain(const std::vector >& certs) - : m_certs(certs) -{ -} - - -const unsigned int certificateChain::getCount() const -{ - return static_cast (m_certs.size()); -} - - -ref certificateChain::getAt(const unsigned int index) -{ - return m_certs[index]; -} - - -} // tls -} // net -} // vmime - diff --git a/src/net/tls/defaultCertificateVerifier.cpp b/src/net/tls/defaultCertificateVerifier.cpp deleted file mode 100644 index de0c6e45..00000000 --- a/src/net/tls/defaultCertificateVerifier.cpp +++ /dev/null @@ -1,164 +0,0 @@ -// -// VMime library (http://www.vmime.org) -// Copyright (C) 2002-2005 Vincent Richard -// -// This program is free software; you can redistribute it and/or -// modify it under the terms of the GNU General Public License as -// published by the Free Software Foundation; either version 2 of -// the License, or (at your option) any later version. -// -// This program is distributed in the hope that it will be useful, -// but WITHOUT ANY WARRANTY; without even the implied warranty of -// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -// General Public License for more details. -// -// You should have received a copy of the GNU General Public License along -// with this program; if not, write to the Free Software Foundation, Inc., -// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. -// -// Linking this library statically or dynamically with other modules is making -// a combined work based on this library. Thus, the terms and conditions of -// the GNU General Public License cover the whole combination. -// - -#include "vmime/net/tls/defaultCertificateVerifier.hpp" - -#include "vmime/net/tls/X509Certificate.hpp" - -#include "vmime/exception.hpp" - - -namespace vmime { -namespace net { -namespace tls { - - -defaultCertificateVerifier::defaultCertificateVerifier() -{ -} - - -defaultCertificateVerifier::~defaultCertificateVerifier() -{ -} - - -defaultCertificateVerifier::defaultCertificateVerifier(const defaultCertificateVerifier&) - : certificateVerifier() -{ - // Not used -} - - -void defaultCertificateVerifier::verify(ref chain) -{ - if (chain->getCount() == 0) - return; - - const string type = chain->getAt(0)->getType(); - - if (type == "X.509") - verifyX509(chain); - else - throw exceptions::unsupported_certificate_type(type); -} - - -void defaultCertificateVerifier::verifyX509(ref chain) -{ - // For every certificate in the chain, verify that the certificate - // has been issued by the next certificate in the chain - if (chain->getCount() >= 2) - { - for (unsigned int i = 0 ; i < chain->getCount() - 1 ; ++i) - { - ref cert = - chain->getAt(i).dynamicCast (); - - ref next = - chain->getAt(i + 1).dynamicCast (); - - if (!cert->checkIssuer(next)) - { - throw exceptions::certificate_verification_exception - ("Subject/issuer verification failed."); - } - } - } - - // For every certificate in the chain, verify that the certificate - // is valid at the current time - const datetime now = datetime::now(); - - for (unsigned int i = 0 ; i < chain->getCount() ; ++i) - { - ref cert = - chain->getAt(i).dynamicCast (); - - const datetime begin = cert->getActivationDate(); - const datetime end = cert->getExpirationDate(); - - if (now < begin || now > end) - { - throw exceptions::certificate_verification_exception - ("Validity date check failed."); - } - } - - // Check whether the certificate can be trusted - - // -- First, verify that the the last certificate in the chain was - // -- issued by a third-party that we trust - ref lastCert = - chain->getAt(chain->getCount() - 1).dynamicCast (); - - bool trusted = false; - - for (unsigned int i = 0 ; !trusted && i < m_x509RootCAs.size() ; ++i) - { - ref rootCa = m_x509RootCAs[i]; - - if (lastCert->verify(rootCa)) - trusted = true; - } - - // -- Next, if the issuer certificate cannot be verified against - // -- root CAs, compare the subject's certificate against the - // -- trusted certificates - ref firstCert = - chain->getAt(0).dynamicCast (); - - for (unsigned int i = 0 ; !trusted && i < m_x509TrustedCerts.size() ; ++i) - { - ref cert = m_x509TrustedCerts[i]; - - if (firstCert->equals(cert)) - trusted = true; - } - - if (!trusted) - { - throw exceptions::certificate_verification_exception - ("Cannot verify certificate against trusted certificates."); - } -} - - -void defaultCertificateVerifier::setX509RootCAs - (const std::vector >& caCerts) -{ - m_x509RootCAs = caCerts; -} - - -void defaultCertificateVerifier::setX509TrustedCerts - (const std::vector >& trustedCerts) -{ - m_x509TrustedCerts = trustedCerts; -} - - -} // tls -} // net -} // vmime - diff --git a/src/security/cert/X509Certificate.cpp b/src/security/cert/X509Certificate.cpp new file mode 100644 index 00000000..a1310f51 --- /dev/null +++ b/src/security/cert/X509Certificate.cpp @@ -0,0 +1,273 @@ +// +// VMime library (http://www.vmime.org) +// Copyright (C) 2002-2005 Vincent Richard +// +// This program is free software; you can redistribute it and/or +// modify it under the terms of the GNU General Public License as +// published by the Free Software Foundation; either version 2 of +// the License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// Linking this library statically or dynamically with other modules is making +// a combined work based on this library. Thus, the terms and conditions of +// the GNU General Public License cover the whole combination. +// + +#include +#include + +#include + +#include "vmime/security/cert/X509Certificate.hpp" + + +namespace vmime { +namespace security { +namespace cert { + + +#ifndef VMIME_BUILDING_DOC + +struct X509CertificateInternalData +{ + X509CertificateInternalData() + { + gnutls_x509_crt_init(&cert); + } + + ~X509CertificateInternalData() + { + gnutls_x509_crt_deinit(cert); + } + + + gnutls_x509_crt cert; +}; + +#endif // VMIME_BUILDING_DOC + + +X509Certificate::X509Certificate() + : m_data(new X509CertificateInternalData) +{ +} + + +X509Certificate::X509Certificate(const X509Certificate&) + : certificate(), m_data(NULL) +{ + // Not used +} + + +X509Certificate::~X509Certificate() +{ + delete m_data; +} + + +// static +ref X509Certificate::import(utility::inputStream& is) +{ + byteArray bytes; + utility::stream::value_type chunk[4096]; + + while (!is.eof()) + { + const int len = is.read(chunk, sizeof(chunk)); + bytes.insert(bytes.end(), chunk, chunk + len); + } + + return import(&bytes[0], bytes.size()); +} + + +// static +ref X509Certificate::import + (const byte* data, const unsigned int length) +{ + ref cert = vmime::create (); + + gnutls_datum buffer; + buffer.data = const_cast (data); + buffer.size = length; + + // Try DER format + if (gnutls_x509_crt_import(cert->m_data->cert, &buffer, GNUTLS_X509_FMT_DER) >= 0) + return cert; + + // Try PEM format + if (gnutls_x509_crt_import(cert->m_data->cert, &buffer, GNUTLS_X509_FMT_PEM) >= 0) + return cert; + + return NULL; +} + + +void X509Certificate::write + (utility::outputStream& os, const Format format) const +{ + size_t dataSize = 0; + gnutls_x509_crt_fmt fmt = GNUTLS_X509_FMT_DER; + + switch (format) + { + case FORMAT_DER: fmt = GNUTLS_X509_FMT_DER; break; + case FORMAT_PEM: fmt = GNUTLS_X509_FMT_PEM; break; + } + + gnutls_x509_crt_export(m_data->cert, fmt, NULL, &dataSize); + + byte* data = new byte[dataSize]; + + gnutls_x509_crt_export(m_data->cert, fmt, data, &dataSize); + + try + { + os.write(reinterpret_cast (data), dataSize); + } + catch (...) + { + delete [] data; + throw; + } +} + + +const byteArray X509Certificate::getSerialNumber() const +{ + char serial[64]; + size_t serialSize = sizeof(serial); + + gnutls_x509_crt_get_serial(m_data->cert, serial, &serialSize); + + return byteArray(serial, serial + serialSize); +} + + +const bool X509Certificate::checkIssuer + (ref issuer) const +{ + return (gnutls_x509_crt_check_issuer + (m_data->cert, issuer->m_data->cert) >= 1); +} + + +const bool X509Certificate::verify(ref caCert) const +{ + unsigned int verify = 0; + + const int res = gnutls_x509_crt_verify + (m_data->cert, &(caCert->m_data->cert), 1, + GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT, + &verify); + + return (res == 0 && verify == 0); +} + + +const datetime X509Certificate::getActivationDate() const +{ + const time_t t = gnutls_x509_crt_get_activation_time(m_data->cert); + return datetime(t); +} + + +const datetime X509Certificate::getExpirationDate() const +{ + const time_t t = gnutls_x509_crt_get_expiration_time(m_data->cert); + return datetime(t); +} + + +const byteArray X509Certificate::getFingerprint(const DigestAlgorithm algo) const +{ + gnutls_digest_algorithm galgo; + + switch (algo) + { + case DIGEST_MD5: + + galgo = GNUTLS_DIG_MD5; + break; + + default: + case DIGEST_SHA1: + + galgo = GNUTLS_DIG_SHA; + break; + } + + size_t bufferSize = 0; + gnutls_x509_crt_get_fingerprint + (m_data->cert, galgo, NULL, &bufferSize); + + byte* buffer = new byte[bufferSize]; + + if (gnutls_x509_crt_get_fingerprint + (m_data->cert, galgo, buffer, &bufferSize) == 0) + { + byteArray res; + res.insert(res.end(), buffer, buffer + bufferSize); + + delete [] buffer; + + return res; + } + + delete [] buffer; + + return byteArray(); +} + + +const byteArray X509Certificate::getEncoded() const +{ + byteArray bytes; + utility::outputStreamByteArrayAdapter os(bytes); + + write(os, FORMAT_DER); + + return bytes; +} + + +const string X509Certificate::getType() const +{ + return "X.509"; +} + + +const int X509Certificate::getVersion() const +{ + return gnutls_x509_crt_get_version(m_data->cert); +} + + +const bool X509Certificate::equals(ref other) const +{ + ref otherX509 = + other.dynamicCast (); + + if (!otherX509) + return false; + + const byteArray fp1 = getFingerprint(DIGEST_MD5); + const byteArray fp2 = otherX509->getFingerprint(DIGEST_MD5); + + return fp1 == fp2; +} + + +} // cert +} // security +} // vmime + diff --git a/src/security/cert/certificateChain.cpp b/src/security/cert/certificateChain.cpp new file mode 100644 index 00000000..2ac25258 --- /dev/null +++ b/src/security/cert/certificateChain.cpp @@ -0,0 +1,53 @@ +// +// VMime library (http://www.vmime.org) +// Copyright (C) 2002-2005 Vincent Richard +// +// This program is free software; you can redistribute it and/or +// modify it under the terms of the GNU General Public License as +// published by the Free Software Foundation; either version 2 of +// the License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// Linking this library statically or dynamically with other modules is making +// a combined work based on this library. Thus, the terms and conditions of +// the GNU General Public License cover the whole combination. +// + +#include "vmime/security/cert/certificateChain.hpp" + + +namespace vmime { +namespace security { +namespace cert { + + +certificateChain::certificateChain(const std::vector >& certs) + : m_certs(certs) +{ +} + + +const unsigned int certificateChain::getCount() const +{ + return static_cast (m_certs.size()); +} + + +ref certificateChain::getAt(const unsigned int index) +{ + return m_certs[index]; +} + + +} // cert +} // security +} // vmime + diff --git a/src/security/cert/defaultCertificateVerifier.cpp b/src/security/cert/defaultCertificateVerifier.cpp new file mode 100644 index 00000000..b125d3e4 --- /dev/null +++ b/src/security/cert/defaultCertificateVerifier.cpp @@ -0,0 +1,164 @@ +// +// VMime library (http://www.vmime.org) +// Copyright (C) 2002-2005 Vincent Richard +// +// This program is free software; you can redistribute it and/or +// modify it under the terms of the GNU General Public License as +// published by the Free Software Foundation; either version 2 of +// the License, or (at your option) any later version. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +// General Public License for more details. +// +// You should have received a copy of the GNU General Public License along +// with this program; if not, write to the Free Software Foundation, Inc., +// 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. +// +// Linking this library statically or dynamically with other modules is making +// a combined work based on this library. Thus, the terms and conditions of +// the GNU General Public License cover the whole combination. +// + +#include "vmime/security/cert/defaultCertificateVerifier.hpp" + +#include "vmime/security/cert/X509Certificate.hpp" + +#include "vmime/exception.hpp" + + +namespace vmime { +namespace security { +namespace cert { + + +defaultCertificateVerifier::defaultCertificateVerifier() +{ +} + + +defaultCertificateVerifier::~defaultCertificateVerifier() +{ +} + + +defaultCertificateVerifier::defaultCertificateVerifier(const defaultCertificateVerifier&) + : certificateVerifier() +{ + // Not used +} + + +void defaultCertificateVerifier::verify(ref chain) +{ + if (chain->getCount() == 0) + return; + + const string type = chain->getAt(0)->getType(); + + if (type == "X.509") + verifyX509(chain); + else + throw exceptions::unsupported_certificate_type(type); +} + + +void defaultCertificateVerifier::verifyX509(ref chain) +{ + // For every certificate in the chain, verify that the certificate + // has been issued by the next certificate in the chain + if (chain->getCount() >= 2) + { + for (unsigned int i = 0 ; i < chain->getCount() - 1 ; ++i) + { + ref cert = + chain->getAt(i).dynamicCast (); + + ref next = + chain->getAt(i + 1).dynamicCast (); + + if (!cert->checkIssuer(next)) + { + throw exceptions::certificate_verification_exception + ("Subject/issuer verification failed."); + } + } + } + + // For every certificate in the chain, verify that the certificate + // is valid at the current time + const datetime now = datetime::now(); + + for (unsigned int i = 0 ; i < chain->getCount() ; ++i) + { + ref cert = + chain->getAt(i).dynamicCast (); + + const datetime begin = cert->getActivationDate(); + const datetime end = cert->getExpirationDate(); + + if (now < begin || now > end) + { + throw exceptions::certificate_verification_exception + ("Validity date check failed."); + } + } + + // Check whether the certificate can be trusted + + // -- First, verify that the the last certificate in the chain was + // -- issued by a third-party that we trust + ref lastCert = + chain->getAt(chain->getCount() - 1).dynamicCast (); + + bool trusted = false; + + for (unsigned int i = 0 ; !trusted && i < m_x509RootCAs.size() ; ++i) + { + ref rootCa = m_x509RootCAs[i]; + + if (lastCert->verify(rootCa)) + trusted = true; + } + + // -- Next, if the issuer certificate cannot be verified against + // -- root CAs, compare the subject's certificate against the + // -- trusted certificates + ref firstCert = + chain->getAt(0).dynamicCast (); + + for (unsigned int i = 0 ; !trusted && i < m_x509TrustedCerts.size() ; ++i) + { + ref cert = m_x509TrustedCerts[i]; + + if (firstCert->equals(cert)) + trusted = true; + } + + if (!trusted) + { + throw exceptions::certificate_verification_exception + ("Cannot verify certificate against trusted certificates."); + } +} + + +void defaultCertificateVerifier::setX509RootCAs + (const std::vector >& caCerts) +{ + m_x509RootCAs = caCerts; +} + + +void defaultCertificateVerifier::setX509TrustedCerts + (const std::vector >& trustedCerts) +{ + m_x509TrustedCerts = trustedCerts; +} + + +} // cert +} // security +} // vmime + -- cgit