/*
* Copyright (C) 2003-2012 Free Software Foundation, Inc.
* Copyright (C) 2002 Andrew McDonald
*
* This file is part of GnuTLS.
*
* The GnuTLS is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public License
* as published by the Free Software Foundation; either version 2.1 of
* the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with this program. If not, see
*
*/
#include "gnutls_int.h"
#include
#include
#include
#include "errors.h"
#include
static int has_embedded_null(const char *str, unsigned size)
{
if (strlen(str) != size)
return 1;
return 0;
}
/**
* gnutls_x509_crt_check_email:
* @cert: should contain an gnutls_x509_crt_t type
* @email: A null terminated string that contains an email address (RFC822)
* @flags: should be zero
*
* This function will check if the given certificate's subject matches
* the given email address.
*
* Returns: non-zero for a successful match, and zero on failure.
**/
unsigned
gnutls_x509_crt_check_email(gnutls_x509_crt_t cert,
const char *email, unsigned int flags)
{
char rfc822name[MAX_CN];
size_t rfc822namesize;
int found_rfc822name = 0;
int ret = 0;
int i = 0;
char *a_email;
gnutls_datum_t out;
/* convert the provided email to ACE-Labels domain. */
ret = _gnutls_idna_email_map(email, strlen(email), &out);
if (ret < 0) {
_gnutls_debug_log("unable to convert email %s to IDNA format\n", email);
a_email = (char*)email;
} else {
a_email = (char*)out.data;
}
/* try matching against:
* 1) an address as an alternative name (subjectAltName) extension
* in the certificate
* 2) the EMAIL field in the certificate
*
* only try (2) if there is no subjectAltName extension of
* type RFC822Name, and there is a single EMAIL.
*/
/* Check through all included subjectAltName extensions, comparing
* against all those of type RFC822Name.
*/
for (i = 0; !(ret < 0); i++) {
rfc822namesize = sizeof(rfc822name);
ret = gnutls_x509_crt_get_subject_alt_name(cert, i,
rfc822name,
&rfc822namesize,
NULL);
if (ret == GNUTLS_SAN_RFC822NAME) {
found_rfc822name = 1;
if (has_embedded_null(rfc822name, rfc822namesize)) {
_gnutls_debug_log("certificate has %s with embedded null in rfc822name\n", rfc822name);
continue;
}
if (!_gnutls_str_is_print(rfc822name, rfc822namesize)) {
_gnutls_debug_log("invalid (non-ASCII) email in certificate %.*s", (int)rfc822namesize, rfc822name);
continue;
}
ret = _gnutls_hostname_compare(rfc822name, rfc822namesize, a_email, GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS);
if (ret != 0) {
ret = 1;
goto cleanup;
}
}
}
if (!found_rfc822name) {
/* did not get the necessary extension, use CN instead
*/
/* enforce the RFC6125 (ยง1.8) requirement that only
* a single CN must be present */
rfc822namesize = sizeof(rfc822name);
ret = gnutls_x509_crt_get_dn_by_oid
(cert, GNUTLS_OID_PKCS9_EMAIL, 1, 0, rfc822name,
&rfc822namesize);
if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
ret = 0;
goto cleanup;
}
rfc822namesize = sizeof(rfc822name);
ret = gnutls_x509_crt_get_dn_by_oid
(cert, GNUTLS_OID_PKCS9_EMAIL, 0, 0, rfc822name,
&rfc822namesize);
if (ret < 0) {
ret = 0;
goto cleanup;
}
if (has_embedded_null(rfc822name, rfc822namesize)) {
_gnutls_debug_log("certificate has EMAIL %s with embedded null in name\n", rfc822name);
ret = 0;
goto cleanup;
}
if (!_gnutls_str_is_print(rfc822name, rfc822namesize)) {
_gnutls_debug_log("invalid (non-ASCII) email in certificate DN %.*s", (int)rfc822namesize, rfc822name);
ret = 0;
goto cleanup;
}
ret = _gnutls_hostname_compare(rfc822name, rfc822namesize, a_email, GNUTLS_VERIFY_DO_NOT_ALLOW_WILDCARDS);
if (ret != 0) {
ret = 1;
goto cleanup;
}
}
/* not found a matching name
*/
ret = 0;
cleanup:
if (a_email != email) {
gnutls_free(a_email);
}
return ret;
}