2 * Verify established TLS connections.
4 * Copyright (C) 2011-2013 Simon Ruderich
6 * This program is free software: you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation, either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include <gnutls/x509.h>
28 static int get_certificate_path(const char *format,
29 const char *hostname, char *buffer, size_t size);
32 int verify_tls_connection(gnutls_session_t session, const char *hostname) {
34 char path[TLSPROXY_MAX_PATH_LENGTH];
38 gnutls_x509_crt_t cert;
39 const gnutls_datum_t *cert_list;
40 unsigned int cert_list_size;
42 char buffer[66]; /* one line in a PEM file is 64 bytes + '\n' + '\0' */
43 char server_cert[8192];
44 char stored_cert[8192];
46 result = gnutls_certificate_verify_peers2(session, &status);
47 /* Verification failed (!= invalid certificate but worse), no need for any
51 "verify_tls_connection(): gnutls_certificate_verify_peers2() failed: %s",
52 gnutls_strerror(result));
55 /* Definitely an invalid certificate, abort. */
56 if (status & GNUTLS_CERT_EXPIRED
57 || status & GNUTLS_CERT_REVOKED
58 || status & GNUTLS_CERT_NOT_ACTIVATED
59 || status & GNUTLS_CERT_INSECURE_ALGORITHM) {
61 "verify_tls_connection(): invalid server certificate");
65 /* We only handle X509 certificates for now. Let validation fail to
66 * prevent an attacker from changing the certificate type to prevent
68 if (gnutls_certificate_type_get(session) != GNUTLS_CRT_X509) {
70 "verify_tls_connection(): no X509 server certificate");
74 /* Get server certificate. */
76 result = gnutls_x509_crt_init(&cert);
79 "verify_tls_connection(): gnutls_x509_crt_init() failed: %s",
80 gnutls_strerror(result));
84 cert_list = gnutls_certificate_get_peers(session, &cert_list_size);
85 if (cert_list == NULL) {
87 "verify_tls_connection(): gnutls_certificate_get_peers() failed");
88 gnutls_x509_crt_deinit(cert);
92 result = gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER);
95 "verify_tls_connection(): gnutls_x509_crt_import() failed: %s",
96 gnutls_strerror(result));
97 gnutls_x509_crt_deinit(cert);
101 /* Export the certificate as PEM to compare it with the known certificate
103 size = sizeof(server_cert);
104 result = gnutls_x509_crt_export(cert, GNUTLS_X509_FMT_PEM,
106 if (result != GNUTLS_E_SUCCESS) {
108 "verify_tls_connection(): gnutls_x509_crt_export() failed: %s",
109 gnutls_strerror(result));
110 gnutls_x509_crt_deinit(cert);
113 /* We got the certificate as PEM, free the crt struct. */
114 gnutls_x509_crt_deinit(cert);
116 /* Open stored server certificate file. */
117 if (server_certificate_file(&file, hostname, path, sizeof(path)) != 0) {
118 LOG(LOG_DEBUG, "server certificate:\n%s", server_cert);
123 stored_cert[0] = '\0'; /* for strcat() */
125 while (fgets(buffer, sizeof(buffer), file) != NULL) {
126 size += strlen(buffer);
127 /* Make sure the buffer is big enough. */
128 if (size >= sizeof(stored_cert)) {
129 LOG(LOG_WARNING, "verify_tls_connection(): '%s' too big", path);
132 LOG(LOG_DEBUG, "server certificate:\n%s", server_cert);
136 strcat(stored_cert, buffer);
141 "verify_tls_connection(): failed to read from '%s': %s",
142 path, strerror(errno));
144 LOG(LOG_DEBUG, "server certificate:\n%s", server_cert);
149 /* Check if the server certificate matches our stored certificate. */
150 if (strcmp(stored_cert, server_cert)) {
152 "verify_tls_connection(): server certificate changed!",
153 path, strerror(errno));
155 LOG(LOG_WARNING, "server certificate:\n%s", server_cert);
159 /* Check that the proxy certificate file exists and is readable for this
160 * domain. This ensures we send an "invalid" certificate even if the proxy
161 * certificate doesn't exist. */
162 if (proxy_certificate_path(hostname, path, sizeof(path)) != 0) {
165 file = fopen(path, "r");
168 "verify_tls_connection(): proxy certificate doesn't exist: '%s'",
178 static int get_certificate_path(const char *format,
179 const char *hostname, char *buffer, size_t size) {
182 /* Hostname too long. */
183 if (size - strlen(format) <= strlen(hostname)) {
185 "get_certificate_path(): hostname too long: '%s'",
189 /* Try to prevent path traversals in hostnames. */
190 if (strstr(hostname, "..") != NULL) {
192 "get_certificate_path(): possible path traversal: '%s'",
196 /* Safe as format is no user input. */
197 result = snprintf(buffer, size, format, hostname);
199 LOG_PERROR(LOG_ERROR, "get_certificate_path(): snprintf failed");
201 } else if ((size_t)result >= size) {
202 LOG(LOG_ERROR, "get_certificate_path(): snprintf buffer too short");
209 int proxy_certificate_path(const char *hostname, char *path, size_t size) {
210 return get_certificate_path(PROXY_SERVER_CERT_FORMAT,
211 hostname, path, size);
214 int server_certificate_file(FILE **file, const char *hostname,
215 char *path, size_t size) {
216 if (get_certificate_path(STORED_SERVER_CERT_FORMAT,
217 hostname, path, size) != 0) {
218 LOG_PERROR(LOG_ERROR,
219 "server_certificate_file(): failed to get path");
223 /* Open the stored certificate file. */
224 *file = fopen(path, "rb");
226 if (global_passthrough_unknown) {
228 "server_certificate_file(): failed to open '%s': %s",
229 path, strerror(errno));
232 "server_certificate_file(): failed to open '%s': %s",
233 path, strerror(errno));
235 /* Couldn't open the file, special case. */