From cbbdb6250744154bf9b5d0718ec68f2b63dfaff0 Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Mon, 22 Jun 2015 16:36:36 +0200
Subject: [PATCH 30/37] utils: add NSS version of cert utils
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
---
Makefile.am | 29 ++++-
configure.ac | 4 +-
contrib/sssd.spec.in | 1 -
src/tests/cmocka/test_cert_utils.c | 4 +
src/util/cert/nss/cert.c | 212 +++++++++++++++++++++++++++++++++++++
5 files changed, 244 insertions(+), 6 deletions(-)
create mode 100644 src/util/cert/nss/cert.c
diff --git a/Makefile.am b/Makefile.am
index 912bfc6641465ef5cd2ff2cce9975b4027c3218d..277166ec66b3d67101e628990e68704c886b0c59 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -709,6 +709,17 @@ if HAVE_NSS
src/util/crypto/nss/nss_util.c
SSS_CRYPT_CFLAGS = $(NSS_CFLAGS)
SSS_CRYPT_LIBS = $(NSS_LIBS)
+
+ SSS_CERT_SOURCES = \
+ src/util/cert/cert_common.c \
+ src/util/cert/nss/cert.c \
+ $(NULL)
+ SSS_CERT_CFLAGS = \
+ $(NSS_CFLAGS) \
+ $(NULL)
+ SSS_CERT_LIBS = \
+ $(NSS_LIBS) \
+ $(NULL)
else
SSS_CRYPT_SOURCES = src/util/crypto/libcrypto/crypto_base64.c \
src/util/crypto/libcrypto/crypto_hmac_sha1.c \
@@ -716,6 +727,17 @@ else
src/util/crypto/libcrypto/crypto_obfuscate.c
SSS_CRYPT_CFLAGS = $(CRYPTO_CFLAGS)
SSS_CRYPT_LIBS = $(CRYPTO_LIBS)
+
+ SSS_CERT_SOURCES = \
+ src/util/cert/cert_common.c \
+ src/util/cert/libcrypto/cert.c \
+ $(NULL)
+ SSS_CERT_CFLAGS = \
+ $(CRYPTO_CFLAGS) \
+ $(NULL)
+ SSS_CERT_LIBS = \
+ $(CRYPTO_LIBS) \
+ $(NULL)
endif
libsss_crypt_la_SOURCES = \
@@ -735,14 +757,13 @@ libsss_crypt_la_LDFLAGS = \
pkglib_LTLIBRARIES += libsss_cert.la
libsss_cert_la_SOURCES = \
- src/util/cert/cert_common.c \
- src/util/cert/libcrypto/cert.c \
+ $(SSS_CERT_SOURCES) \
$(NULL)
libsss_cert_la_CFLAGS = \
- $(CRYPTO_CFLAGS) \
+ $(SSS_CERT_CFLAGS) \
$(NULL)
libsss_cert_la_LIBADD = \
- $(CRYPTO_LIBS) \
+ $(SSS_CERT_LIBS) \
$(TALLOC_LIBS) \
libsss_crypt.la \
libsss_debug.la \
diff --git a/configure.ac b/configure.ac
index 29bedf74db6594b5788d51570514a07e082d5e42..4b4f8f3228bf13c594c86e1e39474a1d02ffd984 100644
--- a/configure.ac
+++ b/configure.ac
@@ -341,7 +341,9 @@ if test x$cryptolib = xnss; then
AM_CHECK_NSS
fi
-AM_CHECK_LIBCRYPTO
+if test x$cryptolib = xlibcrypto; then
+ AM_CHECK_LIBCRYPTO
+fi
AM_CHECK_INOTIFY
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in
index f050501ff9d0711a0da7f094ee968cae87a3f49b..54260e32e24ece372ed7130ab29d766bb1923f77 100644
--- a/contrib/sssd.spec.in
+++ b/contrib/sssd.spec.in
@@ -106,7 +106,6 @@ BuildRequires: dbus-libs
BuildRequires: openldap-devel
BuildRequires: pam-devel
BuildRequires: nss-devel
-BuildRequires: openssl-devel
BuildRequires: nspr-devel
BuildRequires: pcre-devel
BuildRequires: libxslt
diff --git a/src/tests/cmocka/test_cert_utils.c b/src/tests/cmocka/test_cert_utils.c
index 5bcbafb27dbdff596c07b8aad10ca15a35ff4ef5..8063b1a65e8692142cbb3cf82fe41afa6567bc91 100644
--- a/src/tests/cmocka/test_cert_utils.c
+++ b/src/tests/cmocka/test_cert_utils.c
@@ -23,7 +23,9 @@
*/
#include <popt.h>
+#ifdef HAVE_LIBCRYPTO
#include <openssl/objects.h>
+#endif
#include "util/cert.h"
#include "tests/cmocka/common_mock.h"
@@ -349,7 +351,9 @@ int main(int argc, const char *argv[])
ret = cmocka_run_group_tests(tests, NULL, NULL);
+#ifdef HAVE_LIBCRYPTO
CRYPTO_cleanup_all_ex_data(); /* to make valgrind happy */
+#endif
#ifdef HAVE_NSS
/* Cleanup NSS and NSPR to make valgrind happy. */
diff --git a/src/util/cert/nss/cert.c b/src/util/cert/nss/cert.c
new file mode 100644
index 0000000000000000000000000000000000000000..a20abf63a10de9a5e9810f1c7d56686d063d60c7
--- /dev/null
+++ b/src/util/cert/nss/cert.c
@@ -0,0 +1,212 @@
+
+/*
+ SSSD - certificate handling utils - NSS version
+
+ Copyright (C) Sumit Bose <sbose@redhat.com> 2015
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "util/util.h"
+
+#include <cert.h>
+#include <base64.h>
+
+#include "util/crypto/nss/nss_util.h"
+
+#define NS_CERT_HEADER "-----BEGIN CERTIFICATE-----"
+#define NS_CERT_TRAILER "-----END CERTIFICATE-----"
+#define NS_CERT_HEADER_LEN ((sizeof NS_CERT_HEADER) - 1)
+#define NS_CERT_TRAILER_LEN ((sizeof NS_CERT_TRAILER) - 1)
+
+errno_t sss_cert_der_to_pem(TALLOC_CTX *mem_ctx, const uint8_t *der_blob,
+ size_t der_size, char **pem, size_t *pem_size)
+{
+
+ CERTCertDBHandle *handle;
+ CERTCertificate *cert = NULL;
+ SECItem der_item;
+ char *ascii_crlf = NULL;
+ size_t ascii_crlf_len;
+ char *ascii_lf = NULL;
+ char *pem_cert_str = NULL;
+ int ret;
+ size_t c;
+ size_t d;
+
+ /* initialize NSS if needed */
+ ret = nspr_nss_init();
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, "nspr_nss_init failed.\n");
+ return ret;
+ }
+
+ handle = CERT_GetDefaultCertDB();
+
+ der_item.len = der_size;
+ der_item.data = discard_const(der_blob);
+
+ cert = CERT_NewTempCertificate(handle, &der_item, NULL, PR_FALSE, PR_TRUE);
+ if (cert == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, "CERT_NewTempCertificate failed.\n");
+ return EINVAL;
+ }
+
+ ascii_crlf = BTOA_DataToAscii(cert->derCert.data, cert->derCert.len);
+ if (ascii_crlf == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, "BTOA_DataToAscii failed.\n");
+ ret = EIO;
+ goto done;
+ }
+
+ ascii_crlf_len = strlen(ascii_crlf) + 1;
+ ascii_lf = talloc_size(mem_ctx, ascii_crlf_len * sizeof(char));
+ if (ascii_lf == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, "malloc failed.\n");
+ ret = ENOMEM;
+ goto done;
+ }
+
+ d = 0;
+ for (c = 0; c < ascii_crlf_len; c++) {
+ if (ascii_crlf[c] != '\r') {
+ ascii_lf[d++] = ascii_crlf[c];
+ }
+ }
+
+ pem_cert_str = talloc_asprintf(mem_ctx, "%s\n%s\n%s\n", NS_CERT_HEADER,
+ ascii_lf,
+ NS_CERT_TRAILER);
+ if (pem_cert_str == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, "talloc_asprintf failed.\n");
+ ret = ENOMEM;
+ goto done;
+ }
+
+ if (pem_size != NULL) {
+ *pem_size = strlen(pem_cert_str);
+ }
+
+ if (pem != NULL) {
+ *pem = pem_cert_str;
+ pem_cert_str = NULL;
+ }
+
+ ret = EOK;
+done:
+ talloc_free(pem_cert_str);
+ talloc_free(ascii_lf);
+ PORT_Free(ascii_crlf);
+ CERT_DestroyCertificate(cert);
+
+ return ret;
+}
+
+errno_t sss_cert_pem_to_der(TALLOC_CTX *mem_ctx, const char *pem,
+ uint8_t **_der_blob, size_t *_der_size)
+{
+ const char *ps;
+ const char *pe;
+ size_t pem_len;
+ uint8_t *der_blob = NULL;
+ unsigned int der_size; /* unsigned int to match 2nd parameter of
+ ATOB_AsciiToData */
+ CERTCertDBHandle *handle;
+ CERTCertificate *cert = NULL;
+ SECItem der_item;
+ int ret;
+ char *b64 = NULL;
+
+ /* initialize NSS if needed */
+ ret = nspr_nss_init();
+ if (ret != EOK) {
+ DEBUG(SSSDBG_OP_FAILURE, "nspr_nss_init failed.\n");
+ return ret;
+ }
+
+ if (pem == NULL || *pem == '\0') {
+ return EINVAL;
+ }
+
+ pem_len = strlen(pem);
+ if (pem_len <= NS_CERT_HEADER_LEN + NS_CERT_TRAILER_LEN) {
+ DEBUG(SSSDBG_CRIT_FAILURE, "PEM data too short.\n");
+ return EINVAL;
+ }
+
+ if (strncmp(pem, NS_CERT_HEADER, NS_CERT_HEADER_LEN) != 0) {
+ DEBUG(SSSDBG_CRIT_FAILURE, "Wrong PEM header.\n");
+ return EINVAL;
+ }
+ if (pem[NS_CERT_HEADER_LEN] != '\n') {
+ DEBUG(SSSDBG_CRIT_FAILURE, "Missing newline in PEM data.\n");
+ return EINVAL;
+ }
+
+ pe = pem + pem_len - NS_CERT_TRAILER_LEN;
+ if (pem[pem_len - 1] == '\n') {
+ pe--;
+ }
+ if (strncmp(pe, NS_CERT_TRAILER, NS_CERT_TRAILER_LEN) != 0) {
+ DEBUG(SSSDBG_CRIT_FAILURE, "Wrong PEM trailer.\n");
+ return EINVAL;
+ }
+
+ ps = pem + NS_CERT_HEADER_LEN + 1;
+
+ b64 = talloc_strndup(mem_ctx, ps, pe - ps);
+ if(b64 == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, "talloc_strndup failed.\n");
+ ret = ENOMEM;
+ goto done;
+ }
+
+ der_blob = ATOB_AsciiToData(b64, &der_size);
+ if (der_blob == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, "ATOB_AsciiToData failed.\n");
+ return EIO;
+ }
+
+ handle = CERT_GetDefaultCertDB();
+
+ der_item.len = der_size;
+ der_item.data = der_blob;
+
+ cert = CERT_NewTempCertificate(handle, &der_item, NULL, PR_FALSE, PR_TRUE);
+ if (cert == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, "CERT_NewTempCertificate failed.\n");
+ ret = EINVAL;
+ goto done;
+ }
+
+ if (_der_blob != NULL) {
+ *_der_blob = talloc_memdup(mem_ctx, cert->derCert.data,
+ cert->derCert.len);
+ if (*_der_blob == NULL) {
+ DEBUG(SSSDBG_OP_FAILURE, "talloc_memdup failed.\n");
+ ret = ENOMEM;
+ goto done;
+ }
+ }
+
+ if (_der_size != NULL) {
+ *_der_size = cert->derCert.len;
+ }
+done:
+ PORT_Free(der_blob);
+ talloc_free(b64);
+ CERT_DestroyCertificate(cert);
+
+ return ret;
+}
--
2.4.3