tlscertificate: add support for certificate chains

This patch changes the behavior of the following functions:

   g_tls_certificate_new_from_pem
   g_tls_certificate_new_from_file
   g_tls_certificate_new_from_files

If more than one certificate is found it will try to load the chain.

It is assumed that the chain will be in the right order (top-level
certificate will be the last one in the file). If the chain cannot be
verified, the first certificate in the file will be returned as before.

https://bugzilla.gnome.org/show_bug.cgi?id=729739

1 files changed, 184 insertions, 46 deletions

diff --git a/gio/gtlscertificate.c b/gio/gtlscertificate.c
index 47de03df7..9e3faf26f 100644
--- a/gio/gtlscertificate.c
+++ b/gio/gtlscertificate.c
@@ -196,9 +196,10 @@ g_tls_certificate_class_init (GTlsCertificateClass *class)
 }
 
 static GTlsCertificate *
-g_tls_certificate_new_internal (const gchar  *certificate_pem,
-				const gchar  *private_key_pem,
-				GError      **error)
+g_tls_certificate_new_internal (const gchar      *certificate_pem,
+				const gchar      *private_key_pem,
+				GTlsCertificate  *issuer,
+				GError          **error)
 {
   GObject *cert;
   GTlsBackend *backend;
@@ -209,7 +210,9 @@ g_tls_certificate_new_internal (const gchar  *certificate_pem,
 			 NULL, error,
 			 "certificate-pem", certificate_pem,
 			 "private-key-pem", private_key_pem,
+			 "issuer", issuer,
 			 NULL);
+
   return G_TLS_CERTIFICATE (cert);
 }
 
@@ -305,20 +308,153 @@ parse_next_pem_certificate (const gchar **data,
   return g_strndup (start, end - start);
 }
 
+static GSList *
+parse_and_create_certificate_list (const gchar  *data,
+                                   gsize         data_len,
+                                   GError      **error)
+{
+  GSList *first_pem_list = NULL, *pem_list = NULL;
+  gchar *first_pem;
+  const gchar *p, *end;
+
+  p = data;
+  end = p + data_len;
+
+  /* Make sure we can load, at least, one certificate. */
+  first_pem = parse_next_pem_certificate (&p, end, TRUE, error);
+  if (!first_pem)
+    return NULL;
+
+  /* Create a list with a single element. If we load more certificates
+   * below, we will concatenate the two lists at the end. */
+  first_pem_list = g_slist_prepend (first_pem_list, first_pem);
+
+  /* If we read one certificate successfully, let's see if we can read
+   * some more. If not, we will simply return a list with the first one.
+   */
+  while (p && *p)
+    {
+      gchar *cert_pem;
+
+      cert_pem = parse_next_pem_certificate (&p, end, FALSE, NULL);
+      if (!cert_pem)
+        {
+          g_slist_free_full (pem_list, g_free);
+          return first_pem_list;
+        }
+
+      pem_list = g_slist_prepend (pem_list, cert_pem);
+    }
+
+  pem_list = g_slist_concat (pem_list, first_pem_list);
+
+  return pem_list;
+}
+
+static GTlsCertificate *
+create_certificate_chain_from_list (GSList       *pem_list,
+                                    const gchar  *key_pem)
+{
+  GTlsCertificate *cert = NULL, *issuer = NULL, *root = NULL;
+  GTlsCertificateFlags flags;
+  GSList *pem;
+
+  pem = pem_list;
+  while (pem)
+    {
+      const gchar *key = NULL;
+
+      /* Private key belongs only to the first certificate. */
+      if (!pem->next)
+        key = key_pem;
+
+      /* We assume that the whole file is a certificate chain, so we use
+       * each certificate as the issuer of the next one (list is in
+       * reverse order).
+       */
+      issuer = cert;
+      cert = g_tls_certificate_new_internal (pem->data, key, issuer, NULL);
+      if (issuer)
+        g_object_unref (issuer);
+
+      if (!cert)
+        return NULL;
+
+      /* root will point to the last certificate in the file. */
+      if (!root)
+        root = cert;
+
+      pem = g_slist_next (pem);
+    }
+
+  /* Verify the certificate chain and return NULL if it doesn't
+   * verify. */
+  flags = g_tls_certificate_verify (cert, NULL, root);
+  if (flags)
+    {
+      /* Couldn't verify the certificate chain, so unref it. */
+      g_object_unref (cert);
+      cert = NULL;
+    }
+
+  return cert;
+}
+
+static GTlsCertificate *
+parse_and_create_certificate (const gchar  *data,
+                              gsize         data_len,
+                              const gchar  *key_pem,
+                              GError      **error)
+
+{
+  GSList *pem_list;
+  GTlsCertificate *cert;
+
+  pem_list = parse_and_create_certificate_list (data, data_len, error);
+  if (!pem_list)
+    return NULL;
+
+  /* We don't pass the error here because, if it fails, we still want to
+   * load and return the first certificate.
+   */
+  cert = create_certificate_chain_from_list (pem_list, key_pem);
+  if (!cert)
+    {
+      GSList *last = NULL;
+
+      /* Get the first certificate (which is the last one as the list is
+       * in reverse order).
+       */
+      last = g_slist_last (pem_list);
+
+      cert = g_tls_certificate_new_internal (last->data, key_pem, NULL, error);
+    }
+
+  g_slist_free_full (pem_list, g_free);
+
+  return cert;
+}
+
 /**
  * g_tls_certificate_new_from_pem:
  * @data: PEM-encoded certificate data
  * @length: the length of @data, or -1 if it's 0-terminated.
  * @error: #GError for error reporting, or %NULL to ignore.
  *
- * Creates a new #GTlsCertificate from the PEM-encoded data in @data.
- * If @data includes both a certificate and a private key, then the
+ * Creates a #GTlsCertificate from the PEM-encoded data in @data. If
+ * @data includes both a certificate and a private key, then the
  * returned certificate will include the private key data as well. (See
  * the #GTlsCertificate:private-key-pem property for information about
  * supported formats.)
  *
- * If @data includes multiple certificates, only the first one will be
- * parsed.
+ * The returned certificate will be the first certificate found in
+ * @data. As of GLib 2.44, if @data contains more certificates it will
+ * try to load a certificate chain. All certificates will be verified in
+ * the order found (top-level certificate should be the last one in the
+ * file) and the #GTlsCertificate:issuer property of each certificate
+ * will be set accordingly if the verification succeeds. If any
+ * certificate in the chain cannot be verified, the first certificate in
+ * the file will still be returned.
  *
  * Returns: the new certificate, or %NULL if @data is invalid
  *
@@ -329,8 +465,7 @@ g_tls_certificate_new_from_pem  (const gchar  *data,
 				 gssize        length,
 				 GError      **error)
 {
-  const gchar *data_end;
-  gchar *key_pem, *cert_pem;
+  gchar *key_pem;
   GTlsCertificate *cert;
 
   g_return_val_if_fail (data != NULL, NULL);
@@ -338,22 +473,12 @@ g_tls_certificate_new_from_pem  (const gchar  *data,
   if (length == -1)
     length = strlen (data);
 
-  data_end = data + length;
-
   key_pem = parse_private_key (data, length, FALSE, error);
   if (error && *error)
     return NULL;
 
-  cert_pem = parse_next_pem_certificate (&data, data_end, TRUE, error);
-  if (error && *error)
-    {
-      g_free (key_pem);
-      return NULL;
-    }
-
-  cert = g_tls_certificate_new_internal (cert_pem, key_pem, error);
+  cert = parse_and_create_certificate (data, length, key_pem, error);
   g_free (key_pem);
-  g_free (cert_pem);
 
   return cert;
 }
@@ -363,8 +488,17 @@ g_tls_certificate_new_from_pem  (const gchar  *data,
  * @file: file containing a PEM-encoded certificate to import
  * @error: #GError for error reporting, or %NULL to ignore.
  *
- * Creates a #GTlsCertificate from the PEM-encoded data in @file. If
- * @file cannot be read or parsed, the function will return %NULL and
+ * Creates a #GTlsCertificate from the PEM-encoded data in @file. The
+ * returned certificate will be the first certificate found in @file. As
+ * of GLib 2.44, if @file contains more certificates it will try to load
+ * a certificate chain. All certificates will be verified in the order
+ * found (top-level certificate should be the last one in the file) and
+ * the #GTlsCertificate:issuer property of each certificate will be set
+ * accordingly if the verification succeeds. If any certificate in the
+ * chain cannot be verified, the first certificate in the file will
+ * still be returned.
+ *
+ * If @file cannot be read or parsed, the function will return %NULL and
  * set @error. Otherwise, this behaves like
  * g_tls_certificate_new_from_pem().
  *
@@ -390,14 +524,26 @@ g_tls_certificate_new_from_file (const gchar  *file,
 
 /**
  * g_tls_certificate_new_from_files:
- * @cert_file: file containing a PEM-encoded certificate to import
+
+ * @cert_file: file containing one or more PEM-encoded certificates to
+ * import
  * @key_file: file containing a PEM-encoded private key to import
  * @error: #GError for error reporting, or %NULL to ignore.
  *
  * Creates a #GTlsCertificate from the PEM-encoded data in @cert_file
- * and @key_file. If either file cannot be read or parsed, the
- * function will return %NULL and set @error. Otherwise, this behaves
- * like g_tls_certificate_new_from_pem().
+ * and @key_file. The returned certificate will be the first certificate
+ * found in @cert_file. As of GLib 2.44, if @cert_file contains more
+ * certificates it will try to load a certificate chain. All
+ * certificates will be verified in the order found (top-level
+ * certificate should be the last one in the file) and the
+ * #GTlsCertificate:issuer property of each certificate will be set
+ * accordingly if the verification succeeds. If any certificate in the
+ * chain cannot be verified, the first certificate in the file will
+ * still be returned.
+ *
+ * If either file cannot be read or parsed, the function will return
+ * %NULL and set @error. Otherwise, this behaves like
+ * g_tls_certificate_new_from_pem().
  *
  * Returns: the new certificate, or %NULL on error
  *
@@ -405,38 +551,30 @@ g_tls_certificate_new_from_file (const gchar  *file,
  */
 GTlsCertificate *
 g_tls_certificate_new_from_files (const gchar  *cert_file,
-				  const gchar  *key_file,
-				  GError      **error)
+                                  const gchar  *key_file,
+                                  GError      **error)
 {
   GTlsCertificate *cert;
   gchar *cert_data, *key_data;
   gsize cert_len, key_len;
-  gchar *cert_pem, *key_pem;
-  const gchar *p;
+  gchar *key_pem;
 
-  if (!g_file_get_contents (cert_file, &cert_data, &cert_len, error))
-    return NULL;
-  p = cert_data;
-  cert_pem = parse_next_pem_certificate (&p, p + cert_len, TRUE, error);
-  g_free (cert_data);
-  if (error && *error)
+  if (!g_file_get_contents (key_file, &key_data, &key_len, error))
     return NULL;
 
-  if (!g_file_get_contents (key_file, &key_data, &key_len, error))
-    {
-      g_free (cert_pem);
-      return NULL;
-    }
   key_pem = parse_private_key (key_data, key_len, TRUE, error);
   g_free (key_data);
-  if (error && *error)
+  if (!key_pem)
+    return NULL;
+
+  if (!g_file_get_contents (cert_file, &cert_data, &cert_len, error))
     {
-      g_free (cert_pem);
+      g_free (key_pem);
       return NULL;
     }
 
-  cert = g_tls_certificate_new_internal (cert_pem, key_pem, error);
-  g_free (cert_pem);
+  cert = parse_and_create_certificate (cert_data, cert_len, key_pem, error);
+  g_free (cert_data);
   g_free (key_pem);
   return cert;
 }
@@ -481,7 +619,7 @@ g_tls_certificate_list_new_from_file (const gchar  *file,
       cert_pem = parse_next_pem_certificate (&p, end, FALSE, &parse_error);
       if (cert_pem)
         {
-          cert = g_tls_certificate_new_internal (cert_pem, NULL, &parse_error);
+          cert = g_tls_certificate_new_internal (cert_pem, NULL, NULL, &parse_error);
           g_free (cert_pem);
         }
       if (!cert)