Revert "s3: vfs: add user_vfs_evg to connection_struct"
[Samba.git] / lib / mscat / mscat_pkcs7.c
blob55944232205f58b394628c940dc7cbc88710a363
1 /*
2 * Copyright (c) 2016 Andreas Schneider <asn@samba.org>
4 * This program is free software: you can redistribute it and/or modify
5 * it under the terms of the GNU General Public License as published by
6 * the Free Software Foundation, either version 3 of the License, or
7 * (at your option) any later version.
9 * This program is distributed in the hope that it will be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program. If not, see <http://www.gnu.org/licenses/>.
18 #include <errno.h>
19 #include <stdint.h>
20 #include <string.h>
21 #include <sys/types.h>
22 #include <sys/stat.h>
23 #include <unistd.h>
25 #include <util/debug.h>
26 #include <util/data_blob.h>
28 #include "mscat.h"
29 #include "mscat_private.h"
31 #define PKCS7_CTL_OBJID "1.3.6.1.4.1.311.10.1"
33 static int mscat_pkcs7_cleanup(struct mscat_pkcs7 *mp7)
35 if (mp7->c != NULL) {
36 gnutls_pkcs7_deinit(mp7->c);
39 return 0;
42 struct mscat_pkcs7 *mscat_pkcs7_init(TALLOC_CTX *mem_ctx)
44 struct mscat_pkcs7 *pkcs7;
45 int rc;
47 pkcs7 = talloc_zero(mem_ctx, struct mscat_pkcs7);
48 if (pkcs7 == NULL) {
49 return NULL;
51 talloc_set_destructor(pkcs7, mscat_pkcs7_cleanup);
53 rc = gnutls_pkcs7_init(&pkcs7->c);
54 if (rc != 0) {
55 talloc_free(pkcs7);
56 return NULL;
59 return pkcs7;
62 static int mscat_read_file(TALLOC_CTX *mem_ctx,
63 const char *filename,
64 DATA_BLOB *pblob)
66 struct stat sb = {0};
67 size_t alloc_size;
68 size_t count;
69 DATA_BLOB blob;
70 FILE *fp;
71 int rc;
73 fp = fopen(filename, "r");
74 if (fp == NULL) {
75 return -1;
78 rc = fstat(fileno(fp), &sb);
79 if (rc != 0) {
80 goto error;
83 if (!S_ISREG(sb.st_mode)) {
84 errno = EINVAL;
85 goto error;
87 if (SIZE_MAX - 1 < (unsigned long)sb.st_size) {
88 errno = ENOMEM;
89 goto error;
91 alloc_size = sb.st_size + 1;
93 blob = data_blob_talloc_zero(mem_ctx, alloc_size);
94 if (blob.data == NULL) {
95 goto error;
98 count = fread(blob.data, 1, blob.length, fp);
99 if (count != blob.length) {
100 if (ferror(fp)) {
101 goto error;
104 blob.data[count] = '\0';
105 blob.length = count;
106 fclose(fp);
108 *pblob = blob;
110 return 0;
111 error:
112 data_blob_free(&blob);
113 fclose(fp);
114 return rc;
117 int mscat_pkcs7_import_catfile(struct mscat_pkcs7 *mp7,
118 const char *catfile)
120 TALLOC_CTX *tmp_ctx;
121 gnutls_datum_t mscat_data = {
122 .size = 0,
124 DATA_BLOB blob;
125 int rc;
127 tmp_ctx = talloc_new(mp7);
128 if (tmp_ctx == NULL) {
129 return -1;
132 rc = mscat_read_file(tmp_ctx,
133 catfile,
134 &blob);
135 if (rc == -1) {
136 DBG_ERR("Failed to read catalog file '%s' - %s",
137 catfile,
138 strerror(errno));
139 goto done;
142 mscat_data.data = blob.data;
143 mscat_data.size = blob.length;
145 rc = gnutls_pkcs7_import(mp7->c,
146 &mscat_data,
147 GNUTLS_X509_FMT_DER);
148 if (rc < 0) {
149 DBG_ERR("Failed to import PKCS7 from '%s' - %s",
150 catfile,
151 gnutls_strerror(rc));
152 goto done;
155 rc = 0;
156 done:
157 talloc_free(tmp_ctx);
158 return rc;
161 int mscat_pkcs7_verify(struct mscat_pkcs7 *mp7,
162 const char *ca_file)
164 TALLOC_CTX *tmp_ctx = NULL;
165 gnutls_x509_trust_list_t tl = NULL;
166 gnutls_datum_t ca_data;
167 DATA_BLOB blob;
168 uint32_t flags = 0;
169 const char *oid;
170 int count;
171 int cmp;
172 int rc;
173 int i;
175 oid = gnutls_pkcs7_get_embedded_data_oid(mp7->c);
176 if (oid == NULL) {
177 DBG_ERR("Failed to get oid - %s",
178 gnutls_strerror(errno));
179 return -1;
182 cmp = strcmp(oid, PKCS7_CTL_OBJID);
183 if (cmp != 0) {
184 DBG_ERR("Invalid oid in catalog file! oid: %s, expected: %s",
185 oid,
186 PKCS7_CTL_OBJID);
187 return -1;
190 tmp_ctx = talloc_new(mp7);
191 if (tmp_ctx == NULL) {
192 return -1;
195 rc = gnutls_x509_trust_list_init(&tl,
196 0); /* default size */
197 if (rc != 0) {
198 DBG_ERR("Failed to create trust list - %s",
199 gnutls_strerror(rc));
200 goto done;
204 /* Load the system trust list */
205 rc = gnutls_x509_trust_list_add_system_trust(tl, 0, 0);
206 if (rc < 0) {
207 DBG_ERR("Failed to add system trust list - %s",
208 gnutls_strerror(rc));
209 goto done;
211 DBG_INFO("Loaded %d CAs", rc);
213 if (ca_file != NULL) {
214 rc = mscat_read_file(tmp_ctx,
215 ca_file,
216 &blob);
217 if (rc != 0) {
218 DBG_ERR("Failed to read CA file '%s' - %s",
219 ca_file,
220 strerror(errno));
221 goto done;
224 ca_data.data = blob.data;
225 ca_data.size = blob.length;
227 rc = gnutls_x509_trust_list_add_trust_mem(tl,
228 &ca_data,
229 NULL, /* crls */
230 GNUTLS_X509_FMT_DER,
231 0, /* tl_flags */
232 0); /* tl_vflags */
233 if (rc < 0) {
234 DBG_ERR("Failed to add '%s' to trust list - %s (%d)",
235 ca_file,
236 gnutls_strerror(rc),
237 rc);
238 goto done;
240 DBG_INFO("Loaded %d additional CAs", rc);
244 * Drivers often exist for quite some time, so it is possible that one
245 * of the certificates in the trust list expired.
246 * This is not a big deal, but we need to disable the time checks
247 * or the verification will fail.
249 flags = GNUTLS_VERIFY_DISABLE_TRUSTED_TIME_CHECKS|
250 GNUTLS_VERIFY_DISABLE_TIME_CHECKS;
252 #if GNUTLS_VERSION_NUMBER >= 0x030600
253 /* The "Microsoft Root Authority" certificate uses SHA1 */
254 flags |= GNUTLS_VERIFY_ALLOW_SIGN_WITH_SHA1;
255 #endif
257 count = gnutls_pkcs7_get_signature_count(mp7->c);
258 if (count == 0) {
259 DBG_ERR("Failed to verify catalog file, no signatures found");
260 goto done;
263 for (i = 0; i < count; i++) {
264 rc = gnutls_pkcs7_verify(mp7->c,
266 NULL, /* vdata */
267 0, /* vdata_size */
268 i, /* index */
269 NULL, /* data */
270 flags); /* flags */
271 if (rc < 0) {
272 DBG_ERR("Failed to verify catalog file - %s (%d)",
273 gnutls_strerror(rc),
274 rc);
275 goto done;
279 rc = 0;
280 done:
281 gnutls_x509_trust_list_deinit(tl, 1);
282 talloc_free(tmp_ctx);
283 return rc;