Changeset 57572 in vbox for trunk/src/VBox/Runtime/common/crypto

Timestamp:

Aug 28, 2015 1:31:29 AM (10 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

102396

Message:

IPRT: Started on accessing system certificate stores to get SSL roots for cURL.

Location:

trunk/src/VBox/Runtime/common/crypto

Files:

• RTCrStoreCertAddFromDir.cpp (added)
• RTCrStoreCertAddFromFile.cpp (modified) (3 diffs)
• RTCrStoreCertAddFromStore.cpp (added)
• RTCrStoreCertExportAsPem.cpp (added)
• pemfile.cpp (modified) (7 diffs)
• store-inmem.cpp (modified) (3 diffs)
• store-internal.h (modified) (1 diff)
• store.cpp (modified) (1 diff)

trunk/src/VBox/Runtime/common/crypto/RTCrStoreCertAddFromFile.cpp

@@ -100 +100 @@
 RTDECL(int) RTCrStoreCertAddFromFile(RTCRSTORE hStore, uint32_t fFlags, const char *pszFilename, PRTERRINFO pErrInfo)
 {
-    AssertReturn(!fFlags, VERR_INVALID_FLAGS);
-#if 0
-    RTCRX509CERTIFICATES Certs;
-    int rc = RTCrX509Certificates_ReadFromFile(pszFilename, 0, &Certs, pErrInfo);
-    if (RT_SUCCESS(rc))
-    {
-        for (uint32_t i = 0; i < Certs.cCerts; i++)
-        {
-            int rc2 = RTCrStoreCertAddEncoded(hStore, RTCRCERTCTX_F_ENC_X509_DER,
-                                              RTASN1CORE_GET_RAW_ASN1_PTR(&Certs.paCerts[i].SeqCore.Asn1Core),
-                                              RTASN1CORE_GET_RAW_ASN1_SIZE(&Certs.paCerts[i].SeqCore.Asn1Core),
-                                              RT_SUCCESS(rc) ? pErrInfo : NULL);
-            if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
-                rc = rc2;
-        }
-
-        RTAsn1Destroy(&Certs.SetCore.Asn1Core);
-    }
-    return rc;
-#else
+    AssertReturn(!(fFlags & ~(RTCRCERTCTX_F_ADD_IF_NOT_FOUND | RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR)), VERR_INVALID_FLAGS);
 
     PCRTCRPEMSECTION pSectionHead;
-    int rc = RTCrPemReadFile(pszFilename, 0, g_aCertificateMarkers, RT_ELEMENTS(g_aCertificateMarkers), &pSectionHead, pErrInfo);
+    int rc = RTCrPemReadFile(pszFilename,
+                             fFlags & RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR ? RTCRPEMREADFILE_F_CONTINUE_ON_ENCODING_ERROR : 0,
+                             g_aCertificateMarkers, RT_ELEMENTS(g_aCertificateMarkers), &pSectionHead, pErrInfo);
     if (RT_SUCCESS(rc))
     {
@@ -128 +111 @@
         while (pCurSec)
         {
-            int rc2 = RTCrStoreCertAddEncoded(hStore, RTCRCERTCTX_F_ENC_X509_DER, pCurSec->pbData, pCurSec->cbData,
-                                              RT_SUCCESS(rc) ? pErrInfo : NULL);
+            int rc2 = RTCrStoreCertAddEncoded(hStore, RTCRCERTCTX_F_ENC_X509_DER | (fFlags & ~RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR),
+                                              pCurSec->pbData, pCurSec->cbData, !RTErrInfoIsSet(pErrInfo) ? pErrInfo : NULL);
             if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
+            {
                 rc = rc2;
+                if (!(fFlags & RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR))
+                    break;
+            }
             pCurSec = pCurSec->pNext;
         }
@@ -138 +125 @@
     }
     return rc;
-#endif
 }
 

trunk/src/VBox/Runtime/common/crypto/pemfile.cpp

@@ -125 +125 @@
                 uint8_t const  *pbSavedContent = pbContent;
                 size_t  const   cbSavedContent = cbContent;
-                uint32_t        iMarker = 0;
-                while (iMarker < cMarkers)
+                for (uint32_t iMarker = 0; iMarker < cMarkers; iMarker++)
                 {
                     pbContent = pbSavedContent;
@@ -143 +142 @@
                         cbContent -= cchWord;
 
-                        if (!cbContent || !RT_C_IS_BLANK(*pbContent))
-                            break;
-                        do
-                        {
-                            pbContent++;
-                            cbContent--;
-                        } while (cbContent > 0 && RT_C_IS_BLANK(*pbContent));
+                        if (!cbContent)
+                            break;
+                        if (RT_C_IS_BLANK(*pbContent))
+                            do
+                            {
+                                pbContent++;
+                                cbContent--;
+                            } while (cbContent > 0 && RT_C_IS_BLANK(*pbContent));
+                        else if (cWords > 1 || pbContent[0] != '-')
+                            break;
 
                         cWords--;
@@ -175 +177 @@
                                 if (poffEnd)
                                     *poffEnd = pbContent - pbStart;
-                                if (*ppMatch)
+                                if (ppMatch)
                                     *ppMatch = &paMarkers[iMarker];
                                 return true;
@@ -265 +267 @@
 {
     /*
-     * Assume a well formed PEM file contains only 7-bit ASCII and restricts
-     * itself to the following control characters:
+     * Well formed PEM files should probably only contain 7-bit ASCII and
+     * restrict thenselfs to the following control characters:
      *      tab, newline, return, form feed
+     *
+     * However, if we wan't to read PEM files which contains human readable
+     * certificate details before or after each base-64 section, we can't stick
+     * to 7-bit ASCII.  We could say it must be UTF-8, but that's probably to
+     * limited too.  So, we'll settle for detecting binary files by control
+     * characters alone (safe enough for DER encoded stuff, I think).
      */
     while (cbFile-- > 0)
     {
         uint8_t const b = *pbFile++;
-        if (   b >= 0x7f
-            || (b < 32 && b != '\t' && b != '\n' && b != '\r' && b != '\f') )
+        if (b < 32 && b != '\t' && b != '\n' && b != '\r' && b != '\f')
         {
             /* Ignore EOT (4), SUB (26) and NUL (0) at the end of the file. */
@@ -280 +287 @@
                     || (   cbFile == 1
                         && *pbFile == '\0')))
-                return true;
+                return false;
+
             if (b == 0 && cbFile == 0)
-                return true;
-            return false;
-        }
-    }
-    return true;
+                return false;
+
+            return true;
+        }
+    }
+    return false;
 }
 
@@ -328 +337 @@
                             PCRTCRPEMSECTION *ppSectionHead, PRTERRINFO pErrInfo)
 {
-    AssertReturn(!fFlags, VERR_INVALID_FLAGS);
+    AssertReturn(!(fFlags & ~RTCRPEMREADFILE_F_CONTINUE_ON_ENCODING_ERROR), VERR_INVALID_FLAGS);
 
     size_t      cbContent;
@@ -362 +371 @@
                     /* Decode the section. */
                     /** @todo copy the preamble as well. */
-                    rc = rtCrPemDecodeBase64(pbContent + offBegin, offEnd - offBegin,
-                                             (void **)&pSection->pbData, &pSection->cbData);
-                    if (RT_FAILURE(rc))
+                    int rc2 = rtCrPemDecodeBase64(pbContent + offBegin, offEnd - offBegin,
+                                                  (void **)&pSection->pbData, &pSection->cbData);
+                    if (RT_FAILURE(rc2))
                     {
                         pSection->pbData = NULL;
                         pSection->cbData = 0;
-                        break;
+                        if (   rc2 == VERR_INVALID_BASE64_ENCODING
+                            && (fFlags & RTCRPEMREADFILE_F_CONTINUE_ON_ENCODING_ERROR))
+                            rc = -rc2;
+                        else
+                        {
+                            rc = rc2;
+                            break;
+                        }
                     }
 

trunk/src/VBox/Runtime/common/crypto/store-inmem.cpp

@@ -282 +282 @@
     int rc;
 
-    AssertMsgReturn(   fFlags == RTCRCERTCTX_F_ENC_X509_DER
-                    || fFlags == RTCRCERTCTX_F_ENC_TAF_DER
+    AssertMsgReturn(   (fFlags & RTCRCERTCTX_F_ENC_MASK) == RTCRCERTCTX_F_ENC_X509_DER
+                    || (fFlags & RTCRCERTCTX_F_ENC_MASK) == RTCRCERTCTX_F_ENC_TAF_DER
                     , ("Only X.509 and TAF DER are supported: %#x\n", fFlags), VERR_INVALID_FLAGS);
 
-    if (pThis->cCerts + 1 > pThis->cCertsAlloc)
+    /*
+     * Check for duplicates if specified.
+     */
+    if (fFlags & RTCRCERTCTX_F_ADD_IF_NOT_FOUND)
+    {
+        uint32_t iCert = pThis->cCerts;
+        while (iCert-- > 0)
+        {
+            PRTCRSTOREINMEMCERT pCert = pThis->papCerts[iCert];
+            if (   pCert->Core.Public.cbEncoded == cbEncoded
+                && pCert->Core.Public.fFlags == (fFlags & RTCRCERTCTX_F_ENC_MASK)
+                && memcmp(pCert->Core.Public.pabEncoded, pbEncoded, cbEncoded) == 0)
+                return VWRN_ALREADY_EXISTS;
+        }
+    }
+
+    /*
+     * Add it.
+     */
+    if (pThis->cCerts + 1 <= pThis->cCertsAlloc)
+    { /* likely */ }
+    else
     {
         rc = rtCrStoreInMemGrow(pThis, pThis->cCerts + 1);
@@ -293 +314 @@
     }
 
-    rc = rtCrStoreInMemCreateCertEntry(pThis, fFlags, pbEncoded, cbEncoded, pErrInfo, &pThis->papCerts[pThis->cCerts]);
+    rc = rtCrStoreInMemCreateCertEntry(pThis, fFlags & RTCRCERTCTX_F_ENC_MASK, pbEncoded, cbEncoded,
+                                       pErrInfo, &pThis->papCerts[pThis->cCerts]);
     if (RT_SUCCESS(rc))
     {
@@ -360 +382 @@
     return rc;
 }
-
+RT_EXPORT_SYMBOL(RTCrStoreCreateInMem);
+

trunk/src/VBox/Runtime/common/crypto/store-internal.h

@@ -125 +125 @@
      * Adds a certificate to the store.
      *
+     * @returns IPRT status.
+     * @retval  VWRN_ALREADY_EXISTS if the certificate is already present and
+     *          RTCRCERTCTX_F_ADD_IF_NOT_FOUND was specified.
      * @param   pvProvider      The provider specific data.
      * @param   fFlags          RTCRCERTCTX_F_XXX.

trunk/src/VBox/Runtime/common/crypto/store.cpp

@@ -174 +174 @@
     AssertPtrReturn(pvSrc, VERR_INVALID_POINTER);
     AssertReturn(cbSrc > 16 && cbSrc < _1M, VERR_OUT_OF_RANGE);
-    AssertMsgReturn(   fFlags == RTCRCERTCTX_F_ENC_X509_DER
-                    || fFlags == RTCRCERTCTX_F_ENC_TAF_DER
+    AssertReturn(!(fFlags & ~(RTCRCERTCTX_F_ADD_IF_NOT_FOUND | RTCRCERTCTX_F_ENC_MASK)), VERR_INVALID_FLAGS);
+    AssertMsgReturn(   (fFlags & RTCRCERTCTX_F_ENC_MASK) == RTCRCERTCTX_F_ENC_X509_DER
+                    || (fFlags & RTCRCERTCTX_F_ENC_MASK) == RTCRCERTCTX_F_ENC_TAF_DER
                     , ("Only X.509 and TAF DER supported: %#x\n", fFlags), VERR_INVALID_FLAGS);