comparison patches/0002-Add-CURLOPT_PEERCERT-option-to-pin-a-peer-cert.patch @ 1008:2fb6071c6669

Merged
author Emanuel Schuetze <emanuel@intevation.de>
date Tue, 02 Sep 2014 11:55:15 +0200
parents 0570b1e562c2
children 93325618ac7b
comparison
equal deleted inserted replaced
1007:b75bd6686f43 1008:2fb6071c6669
1 From c57d951c3bda8b1ca66cac45dfd6270fa34b01d3 Mon Sep 17 00:00:00 2001
2 From: Andre Heinecke <aheinecke@intevation.de>
3 Date: Mon, 1 Sep 2014 16:55:40 +0200
4 Subject: [PATCH 2/3] Add CURLOPT_PEERCERT option to pin a peer cert
5
6 Only implemented for a specific usecase with polarssl
7 ---
8 include/curl/curl.h | 3 +++
9 include/curl/typecheck-gcc.h | 1 +
10 lib/url.c | 8 ++++++++
11 lib/urldata.h | 1 +
12 lib/vtls/polarssl.c | 42 ++++++++++++++++++++++++++++++++++++++++--
13 5 files changed, 53 insertions(+), 2 deletions(-)
14
15 diff --git a/include/curl/curl.h b/include/curl/curl.h
16 index d40b2db..20a9d82 100644
17 --- a/include/curl/curl.h
18 +++ b/include/curl/curl.h
19 @@ -1611,6 +1611,9 @@ typedef enum {
20 /* Pass in a bitmask of "header options" */
21 CINIT(HEADEROPT, LONG, 229),
22
23 + /* Peer certificate */
24 + CINIT(PEERCERT, OBJECTPOINT, 230),
25 +
26 CURLOPT_LASTENTRY /* the last unused */
27 } CURLoption;
28
29 diff --git a/include/curl/typecheck-gcc.h b/include/curl/typecheck-gcc.h
30 index 69d41a2..241529d 100644
31 --- a/include/curl/typecheck-gcc.h
32 +++ b/include/curl/typecheck-gcc.h
33 @@ -258,6 +258,7 @@ _CURL_WARNING(_curl_easy_getinfo_err_curl_slist,
34 (option) == CURLOPT_SSH_PRIVATE_KEYFILE || \
35 (option) == CURLOPT_CRLFILE || \
36 (option) == CURLOPT_ISSUERCERT || \
37 + (option) == CURLOPT_PEERCERT || \
38 (option) == CURLOPT_SOCKS5_GSSAPI_SERVICE || \
39 (option) == CURLOPT_SSH_KNOWNHOSTS || \
40 (option) == CURLOPT_MAIL_FROM || \
41 diff --git a/lib/url.c b/lib/url.c
42 index 89c3fd5..b089cdf 100644
43 --- a/lib/url.c
44 +++ b/lib/url.c
45 @@ -2015,6 +2015,14 @@ CURLcode Curl_setopt(struct SessionHandle *data, CURLoption option,
46 result = setstropt(&data->set.str[STRING_SSL_ISSUERCERT],
47 va_arg(param, char *));
48 break;
49 + case CURLOPT_PEERCERT:
50 + /*
51 + * Set peer certificate file
52 + * to check peer certificate against
53 + */
54 + result = setstropt(&data->set.str[STRING_SSL_PEERCERT],
55 + va_arg(param, char *));
56 + break;
57 case CURLOPT_TELNETOPTIONS:
58 /*
59 * Set a linked list of telnet options
60 diff --git a/lib/urldata.h b/lib/urldata.h
61 index 8594c2f..a6dc1ae 100644
62 --- a/lib/urldata.h
63 +++ b/lib/urldata.h
64 @@ -1391,6 +1391,7 @@ enum dupstring {
65 STRING_USERAGENT, /* User-Agent string */
66 STRING_SSL_CRLFILE, /* crl file to check certificate */
67 STRING_SSL_ISSUERCERT, /* issuer cert file to check certificate */
68 + STRING_SSL_PEERCERT, /* issuer cert file to check certificate */
69 STRING_USERNAME, /* <username>, if used */
70 STRING_PASSWORD, /* <password>, if used */
71 STRING_OPTIONS, /* <options>, if used */
72 diff --git a/lib/vtls/polarssl.c b/lib/vtls/polarssl.c
73 index e18cadf..2c40e36 100644
74 --- a/lib/vtls/polarssl.c
75 +++ b/lib/vtls/polarssl.c
76 @@ -360,6 +360,7 @@ polarssl_connect_step2(struct connectdata *conn,
77 #ifdef HAS_ALPN
78 const char* next_protocol;
79 #endif
80 + const x509_crt *peer_cert = NULL;
81
82 char errorbuf[128];
83 memset(errorbuf, 0, sizeof(errorbuf));
84 @@ -419,12 +420,49 @@ polarssl_connect_step2(struct connectdata *conn,
85 return CURLE_PEER_FAILED_VERIFICATION;
86 }
87
88 - if(ssl_get_peer_cert(&(connssl->ssl))) {
89 + peer_cert = ssl_get_peer_cert(&(connssl->ssl));
90 + if(peer_cert) {
91 + if(data->set.str[STRING_SSL_PEERCERT]) {
92 + x509_crt pinned_cert;
93 + unsigned int i;
94 +
95 + /* Handle pinned certificate */
96 + x509_crt_init(&pinned_cert);
97 + ret = x509_crt_parse_file(&pinned_cert,
98 + data->set.str[STRING_SSL_PEERCERT]);
99 +
100 + if(ret) {
101 +#ifdef POLARSSL_ERROR_C
102 + error_strerror(ret, errorbuf, sizeof(errorbuf));
103 +#endif /* POLARSSL_ERROR_C */
104 + failf(data, "Error reading peer cert file %s - PolarSSL: (-0x%04X) %s",
105 + data->set.str[STRING_SSL_PEERCERT], -ret, errorbuf);
106 +
107 + x509_crt_free(&pinned_cert);
108 + return CURLE_PEER_FAILED_VERIFICATION;
109 + }
110 +
111 + if (peer_cert->raw.len == 0 ||
112 + peer_cert->raw.len != pinned_cert.raw.len) {
113 + failf(data, "Error validating peer certificate. Size does "
114 + "not match the certificate set with PEERCERT option.\n");
115 + x509_crt_free(&pinned_cert);
116 + return CURLE_PEER_FAILED_VERIFICATION;
117 + }
118 + for (i = 0; i < peer_cert->raw.len; i++) {
119 + if (peer_cert->raw.p[i] != pinned_cert.raw.p[i]) {
120 + failf(data, "Error validating peer certificate. Does "
121 + "not match the certificate set with PEERCERT option.\n");
122 + return CURLE_PEER_FAILED_VERIFICATION;
123 + }
124 + }
125 + }
126 +
127 /* If the session was resumed, there will be no peer certs */
128 memset(buffer, 0, sizeof(buffer));
129
130 if(x509_crt_info(buffer, sizeof(buffer), (char *)"* ",
131 - ssl_get_peer_cert(&(connssl->ssl))) != -1)
132 + peer_cert) != -1)
133 infof(data, "Dumping cert info:\n%s\n", buffer);
134 }
135
136 --
137 1.9.1
138

http://wald.intevation.org/projects/trustbridge/