tlsutils.c

Go to the documentation of this file.

/* SPDX-FileCopyrightText: 2009-2023 Greenbone AG
 *
 * SPDX-License-Identifier: GPL-2.0-or-later
 */

 
#include "tlsutils.h"
 
#include <string.h>
 
#undef G_LOG_DOMAIN
#define G_LOG_DOMAIN "libgvm util"

gnutls_x509_crt_fmt_t
gvm_x509_format_from_data (const char *cert_data, size_t cert_len)
{
  static const gchar *begin_str = "-----BEGIN ";
  if (g_strstr_len (cert_data, cert_len, begin_str))
    return GNUTLS_X509_FMT_PEM;
  else
    return GNUTLS_X509_FMT_DER;
}

int
gvm_base64_to_gnutls_datum (const char *encoded, gnutls_datum_t *decoded_datum)
{
  gnutls_datum_t encoded_datum;
  decoded_datum->data = NULL;
  decoded_datum->size = 0;
  encoded_datum.data = (unsigned char *) encoded;
  encoded_datum.size = strlen (encoded);
 
  return gnutls_base64_decode2 (&encoded_datum, decoded_datum);
}

void
gvm_x509_cert_list_free (gnutls_x509_crt_t *certs, unsigned int certs_count)
{
  if (certs == NULL)
    return;
  for (unsigned int i = 0; i < certs_count; i++)
    gnutls_x509_crt_deinit (certs[i]);
  gnutls_free (certs);
}

gchar *
gvm_x509_privkey_to_pem (gnutls_x509_privkey_t privkey)
{
  gchar *pem_str = NULL;
  int ret;
  gnutls_datum_t export_datum = {.data = NULL, .size = 0};
 
  ret =
    gnutls_x509_privkey_export2 (privkey, GNUTLS_X509_FMT_PEM, &export_datum);
  if (ret)
    g_warning ("%s: Error exporting private key: %s", __func__,
               gnutls_strerror (ret));
  else
    pem_str = g_strdup ((const char *) export_datum.data);
 
  gnutls_free (export_datum.data);
 
  return pem_str;
}

gchar *
gvm_x509_cert_list_to_pem (gnutls_x509_crt_t *certs, unsigned int certs_count)
{
  int ret;
  GString *certs_string = g_string_new ("");
  for (unsigned int i = 0; i < certs_count; i++)
    {
      gnutls_x509_crt_t cert;
      gnutls_datum_t export_datum = {.data = NULL, .size = 0};
 
      cert = certs[i];
      ret = gnutls_x509_crt_export2 (cert, GNUTLS_X509_FMT_PEM, &export_datum);
      if (ret)
        {
          g_warning ("%s: Error exporting certificate: %s", __func__,
                     gnutls_strerror (ret));
        }
      else
        g_string_append_printf (certs_string, "%s\n",
                                (char *) export_datum.data);
      gnutls_free (export_datum.data);
    }
  return g_string_free (certs_string, FALSE);
}

gchar *
gvm_x509_crl_to_pem (gnutls_x509_crl_t crl)
{
  gchar *crl_str = NULL;
  int ret;
  gnutls_datum_t export_datum = {.data = NULL, .size = 0};
 
  ret = gnutls_x509_crl_export2 (crl, GNUTLS_X509_FMT_PEM, &export_datum);
  if (ret)
    {
      g_warning ("%s: Error exporting CRL: %s", __func__,
                 gnutls_strerror (ret));
    }
  else
    crl_str = g_strdup ((char *) export_datum.data);
 
  gnutls_free (export_datum.data);
  return crl_str;
}

int
gvm_pkcs12_to_pem (gnutls_pkcs12_t pkcs12, const char *passphrase,
                   gchar **privkey_out, gchar **cert_chain_out,
                   gchar **extra_certs_out, gchar **crl_out)
{
  gnutls_x509_privkey_t privkey;
  gnutls_x509_crt_t *chain_certs, *extra_certs;
  gnutls_x509_crl_t crl;
  unsigned int chain_certs_count, extra_certs_count;
  int ret;
 
  if (privkey_out)
    *privkey_out = NULL;
  if (cert_chain_out)
    *cert_chain_out = NULL;
  if (extra_certs_out)
    *extra_certs_out = NULL;
  if (crl_out)
    *crl_out = NULL;
 
  chain_certs = extra_certs = NULL;
 
  gnutls_x509_privkey_init (&privkey);
  gnutls_x509_crl_init (&crl);
  ret = gnutls_pkcs12_simple_parse (pkcs12, passphrase, &privkey, &chain_certs,
                                    &chain_certs_count, &extra_certs,
                                    &extra_certs_count, &crl, 0);
  if (ret != GNUTLS_E_SUCCESS)
    {
      gnutls_x509_privkey_deinit (privkey);
      gnutls_x509_crl_deinit (crl);
      return ret;
    }
 
  if (privkey_out && privkey)
    *privkey_out = gvm_x509_privkey_to_pem (privkey);
 
  gnutls_x509_privkey_deinit (privkey);
 
  if (cert_chain_out && chain_certs_count)
    *cert_chain_out =
      gvm_x509_cert_list_to_pem (chain_certs, chain_certs_count);
 
  if (extra_certs_out && extra_certs_count)
    *extra_certs_out =
      gvm_x509_cert_list_to_pem (extra_certs, extra_certs_count);
 
  if (crl_out && crl)
    *crl_out = gvm_x509_crl_to_pem (crl);
 
  gvm_x509_cert_list_free (chain_certs, chain_certs_count);
  gvm_x509_cert_list_free (extra_certs, extra_certs_count);
  gnutls_x509_crl_deinit (crl);
 
  return GNUTLS_E_SUCCESS;
}