2 * Verify established TLS connections.
4 * Copyright (C) 2011 Simon Ruderich
6 * This program is free software: you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation, either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include <gnutls/x509.h>
29 static int get_certificate_path(const char *format,
30 const char *hostname, char *buffer, size_t size);
33 int verify_tls_connection(gnutls_session_t session, const char *hostname) {
39 gnutls_x509_crt_t cert;
40 const gnutls_datum_t *cert_list;
41 unsigned int cert_list_size;
43 char buffer[66]; /* one line in a PEM file is 64 bytes + '\n' + '\0' */
44 char server_cert[8192];
45 char stored_cert[8192];
47 result = gnutls_certificate_verify_peers2(session, &status);
48 /* Verification failed (!= invalid certificate but worse), no need for any
52 "verify_tls_connection(): gnutls_certificate_verify_peers2() failed: %s",
53 gnutls_strerror(result));
56 /* Definitely an invalid certificate, abort. */
57 if (status & GNUTLS_CERT_EXPIRED
58 || status & GNUTLS_CERT_REVOKED
59 || status & GNUTLS_CERT_NOT_ACTIVATED
60 || status & GNUTLS_CERT_INSECURE_ALGORITHM) {
62 "verify_tls_connection(): invalid server certificate");
66 /* We only handle X509 certificates for now. Let validation fail to
67 * prevent an attacker from changing the certificate type to prevent
69 if (GNUTLS_CRT_X509 != gnutls_certificate_type_get(session)) {
71 "verify_tls_connection(): no X509 server certificate");
75 /* Get server certificate. */
77 if (0 > (result = gnutls_x509_crt_init(&cert))) {
79 "verify_tls_connection(): gnutls_x509_crt_init() failed: %s",
80 gnutls_strerror(result));
84 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
85 if (NULL == cert_list) {
87 "verify_tls_connection(): gnutls_certificate_get_peers() failed");
88 gnutls_x509_crt_deinit(cert);
92 if (0 > (result = gnutls_x509_crt_import(cert, &cert_list[0],
93 GNUTLS_X509_FMT_DER))) {
95 "verify_tls_connection(): gnutls_x509_crt_import() failed: %s",
96 gnutls_strerror(result));
97 gnutls_x509_crt_deinit(cert);
101 /* Export the certificate as PEM to compare it with the known certificate
103 size = sizeof(server_cert);
104 result = gnutls_x509_crt_export(cert, GNUTLS_X509_FMT_PEM,
106 if (GNUTLS_E_SUCCESS != result) {
108 "verify_tls_connection(): gnutls_x509_crt_export() failed: %s",
109 gnutls_strerror(result));
110 gnutls_x509_crt_deinit(cert);
113 /* We got the certificate as PEM, free the crt struct. */
114 gnutls_x509_crt_deinit(cert);
116 /* Open stored server certificate file. */
117 if (0 != server_certificate_file(&file, hostname, path, sizeof(path))) {
118 LOG(LOG_DEBUG, "server certificate:\n%s", server_cert);
123 stored_cert[0] = '\0'; /* for strcat() */
125 while (NULL != fgets(buffer, sizeof(buffer), file)) {
126 size += strlen(buffer);
127 /* Make sure the buffer is big enough. */
128 if (sizeof(stored_cert) <= size) {
129 LOG(LOG_WARNING, "verify_tls_connection(): '%s' too big", path);
132 LOG(LOG_DEBUG, "server certificate:\n%s", server_cert);
136 strcat(stored_cert, buffer);
141 "verify_tls_connection(): failed to read from '%s': %s",
142 path, strerror(errno));
144 LOG(LOG_DEBUG, "server certificate:\n%s", server_cert);
149 /* Check if the server certificate matches our stored certificate. */
150 if (0 != strcmp(stored_cert, server_cert)) {
152 "verify_tls_connection(): server certificate changed!",
153 path, strerror(errno));
155 LOG(LOG_WARNING, "server certificate:\n%s", server_cert);
159 /* Check that the proxy certificate file exists and is readable for this
160 * domain. This ensures we send an "invalid" certificate even if the proxy
161 * certificate doesn't exist. */
162 if (0 != proxy_certificate_path(hostname, path, sizeof(path))) {
165 file = fopen(path, "r");
168 "verify_tls_connection(): proxy certificate doesn't exist: '%s'",
178 static int get_certificate_path(const char *format,
179 const char *hostname, char *buffer, size_t size) {
182 /* Hostname too long. */
183 if (size - strlen(format) <= strlen(hostname)) {
185 "get_certificate_path(): hostname too long: '%s'",
189 /* Try to prevent path traversals in hostnames. */
190 if (NULL != strstr(hostname, "..")) {
192 "get_certificate_path(): possible path traversal: '%s'",
196 /* Safe as format is no user input. */
197 result = snprintf(buffer, size, format, hostname);
199 LOG_PERROR(LOG_ERROR, "get_certificate_path(): snprintf failed");
201 } else if ((size_t)result >= size) {
202 LOG(LOG_ERROR, "get_certificate_path(): snprintf buffer too short");
209 int proxy_certificate_path(const char *hostname, char *path, size_t size) {
210 return get_certificate_path(PROXY_SERVER_CERT_FORMAT,
211 hostname, path, size);
214 int server_certificate_file(FILE **file, const char *hostname,
215 char *path, size_t size) {
216 if (0 != get_certificate_path(STORED_SERVER_CERT_FORMAT,
217 hostname, path, size)) {
218 LOG_PERROR(LOG_ERROR,
219 "server_certificate_file(): failed to get path");
223 /* Open the stored certificate file. */
224 *file = fopen(path, "rb");
226 if (global_passthrough_unknown) {
228 "server_certificate_file(): failed to open '%s': %s",
229 path, strerror(errno));
232 "server_certificate_file(): failed to open '%s': %s",
233 path, strerror(errno));
235 /* Couldn't open the file, special case. */