1 /* crlfetch.c - LDAP access
2 * Copyright (C) 2002 Klarälvdalens Datakonsult AB
3 * Copyright (C) 2003, 2004, 2005, 2006, 2007 g10 Code GmbH
5 * This file is part of DirMngr.
7 * DirMngr is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 2 of the License, or
10 * (at your option) any later version.
12 * DirMngr is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <https://www.gnu.org/licenses/>.
33 # include "ldap-wrapper.h"
36 /* For detecting armored CRLs received via HTTP (yes, such CRLS really
37 exits, e.g. http://grid.fzk.de/ca/gridka-crl.pem at least in June
38 2008) we need a context in the reader callback. */
39 struct reader_cb_context_s
41 estream_t fp; /* The stream used with the ksba reader. */
42 int checked:1; /* PEM/binary detection ahs been done. */
43 int is_pem:1; /* The file stream is PEM encoded. */
44 struct b64state b64state; /* The state used for Base64 decoding. */
48 /* We need to associate a reader object with the reader callback
49 context. This table is used for it. */
50 struct file_reader_map_s
53 struct reader_cb_context_s *cb_ctx;
55 #define MAX_FILE_READER 50
56 static struct file_reader_map_s file_reader_map[MAX_FILE_READER];
58 /* Associate FP with READER. If the table is full wait until another
59 thread has removed an entry. */
61 register_file_reader (ksba_reader_t reader, struct reader_cb_context_s *cb_ctx)
67 for (i=0; i < MAX_FILE_READER; i++)
68 if (!file_reader_map[i].reader)
70 file_reader_map[i].reader = reader;
71 file_reader_map[i].cb_ctx = cb_ctx;
74 log_info (_("reader to file mapping table full - waiting\n"));
79 /* Scan the table for an entry matching READER, remove that entry and
80 return the associated file pointer. */
81 static struct reader_cb_context_s *
82 get_file_reader (ksba_reader_t reader)
84 struct reader_cb_context_s *cb_ctx = NULL;
87 for (i=0; i < MAX_FILE_READER; i++)
88 if (file_reader_map[i].reader == reader)
90 cb_ctx = file_reader_map[i].cb_ctx;
91 file_reader_map[i].reader = NULL;
92 file_reader_map[i].cb_ctx = NULL;
101 my_es_read (void *opaque, char *buffer, size_t nbytes, size_t *nread)
103 struct reader_cb_context_s *cb_ctx = opaque;
106 result = es_read (cb_ctx->fp, buffer, nbytes, nread);
109 /* Fixme we should check whether the semantics of es_read are okay
110 and well defined. I have some doubts. */
111 if (nbytes && !*nread && es_feof (cb_ctx->fp))
112 return gpg_error (GPG_ERR_EOF);
113 if (!nread && es_ferror (cb_ctx->fp))
114 return gpg_error (GPG_ERR_EIO);
116 if (!cb_ctx->checked && *nread)
118 int c = *(unsigned char *)buffer;
121 if ( ((c & 0xc0) >> 6) == 0 /* class: universal */
122 && (c & 0x1f) == 16 /* sequence */
123 && (c & 0x20) /* is constructed */ )
128 b64dec_start (&cb_ctx->b64state, "");
131 if (cb_ctx->is_pem && *nread)
135 if (b64dec_proc (&cb_ctx->b64state, buffer, *nread, &nread2))
137 /* EOF from decoder. */
139 result = gpg_error (GPG_ERR_EOF);
149 /* Fetch CRL from URL and return the entire CRL using new ksba reader
150 object in READER. Note that this reader object should be closed
151 only using ldap_close_reader. */
153 crl_fetch (ctrl_t ctrl, const char *url, ksba_reader_t *reader)
157 char *free_this = NULL;
158 int redirects_left = 2; /* We allow for 2 redirect levels. */
163 return gpg_error (GPG_ERR_INV_ARG);
166 err = http_parse_uri (&uri, url, 0);
167 http_release_parsed_uri (uri);
168 if (err && !strncmp (url, "https:", 6))
170 /* Our HTTP code does not support TLS, thus we can't use this
171 scheme and it is frankly not useful for CRL retrieval anyway.
172 We resort to using http, assuming that the server also
173 provides plain http access. */
174 free_this = xtrymalloc (strlen (url) + 1);
177 strcpy (stpcpy (free_this,"http:"), url+6);
178 err = http_parse_uri (&uri, free_this, 0);
179 http_release_parsed_uri (uri);
182 log_info (_("using \"http\" instead of \"https\"\n"));
187 if (!err) /* Yes, our HTTP code groks that. */
191 if (opt.disable_http)
193 log_error (_("CRL access not possible due to disabled %s\n"),
195 err = gpg_error (GPG_ERR_NOT_SUPPORTED);
198 err = http_open_document (&hd, url, NULL,
199 ((opt.honor_http_proxy? HTTP_FLAG_TRY_PROXY:0)
200 |(DBG_LOOKUP? HTTP_FLAG_LOG_RESP:0)
201 |(opt.use_tor? HTTP_FLAG_FORCE_TOR:0)),
202 ctrl->http_proxy, NULL, NULL, NULL);
204 switch ( err? 99999 : http_get_status_code (hd) )
208 estream_t fp = http_get_read_ptr (hd);
209 struct reader_cb_context_s *cb_ctx;
211 cb_ctx = xtrycalloc (1, sizeof *cb_ctx);
213 err = gpg_error_from_syserror ();
215 err = ksba_reader_new (reader);
219 err = ksba_reader_set_cb (*reader, &my_es_read, cb_ctx);
223 log_error (_("error initializing reader object: %s\n"),
225 ksba_reader_release (*reader);
231 /* The ksba reader misses a user pointer thus we need
232 to come up with our own way of associating a file
233 pointer (or well the callback context) with the
234 reader. It is only required when closing the
235 reader thus there is no performance issue doing it
236 this way. FIXME: We now have a close notification
237 which might be used here. */
238 register_file_reader (*reader, cb_ctx);
244 case 301: /* Redirection (perm.). */
245 case 302: /* Redirection (temp.). */
247 const char *s = http_get_header (hd, "Location");
249 log_info (_("URL '%s' redirected to '%s' (%u)\n"),
250 url, s?s:"[none]", http_get_status_code (hd));
251 if (s && *s && redirects_left-- )
253 xfree (free_this); url = NULL;
254 free_this = xtrystrdup (s);
256 err = gpg_error_from_errno (errno);
261 /* Note, that our implementation of redirection
262 actually handles a redirect to LDAP. */
267 err = gpg_error (GPG_ERR_NO_DATA);
268 log_error (_("too many redirections\n")); /* Or no "Location". */
273 case 99999: /* Made up status code for error reporting. */
274 log_error (_("error retrieving '%s': %s\n"),
275 url, gpg_strerror (err));
279 log_error (_("error retrieving '%s': http status %u\n"),
280 url, http_get_status_code (hd));
281 err = gpg_error (GPG_ERR_NO_DATA);
285 else /* Let the LDAP code try other schemes. */
287 if (opt.disable_ldap)
289 log_error (_("CRL access not possible due to disabled %s\n"),
291 err = gpg_error (GPG_ERR_NOT_SUPPORTED);
293 else if (opt.use_tor)
295 /* For now we do not support LDAP over Tor. */
296 log_error (_("CRL access not possible due to Tor mode\n"));
297 err = gpg_error (GPG_ERR_NOT_SUPPORTED);
302 err = url_fetch_ldap (ctrl, url, NULL, 0, reader);
304 err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
305 # endif /*!USE_LDAP*/
314 /* Fetch CRL for ISSUER using a default server. Return the entire CRL
315 as a newly opened stream returned in R_FP. */
317 crl_fetch_default (ctrl_t ctrl, const char *issuer, ksba_reader_t *reader)
321 /* For now we do not support LDAP over Tor. */
322 log_error (_("CRL access not possible due to Tor mode\n"));
323 return gpg_error (GPG_ERR_NOT_SUPPORTED);
325 if (opt.disable_ldap)
327 log_error (_("CRL access not possible due to disabled %s\n"),
329 return gpg_error (GPG_ERR_NOT_SUPPORTED);
333 return attr_fetch_ldap (ctrl, issuer, "certificateRevocationList",
339 return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
344 /* Fetch a CA certificate for DN using the default server. This
345 function only initiates the fetch; fetch_next_cert must be used to
346 actually read the certificate; end_cert_fetch to end the
349 ca_cert_fetch (ctrl_t ctrl, cert_fetch_context_t *context, const char *dn)
353 /* For now we do not support LDAP over Tor. */
354 log_error (_("CRL access not possible due to Tor mode\n"));
355 return gpg_error (GPG_ERR_NOT_SUPPORTED);
357 if (opt.disable_ldap)
359 log_error (_("CRL access not possible due to disabled %s\n"),
361 return gpg_error (GPG_ERR_NOT_SUPPORTED);
364 return start_default_fetch_ldap (ctrl, context, dn, "cACertificate");
369 return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
375 start_cert_fetch (ctrl_t ctrl, cert_fetch_context_t *context,
376 strlist_t patterns, const ldap_server_t server)
380 /* For now we do not support LDAP over Tor. */
381 log_error (_("CRL access not possible due to Tor mode\n"));
382 return gpg_error (GPG_ERR_NOT_SUPPORTED);
384 if (opt.disable_ldap)
386 log_error (_("certificate search not possible due to disabled %s\n"),
388 return gpg_error (GPG_ERR_NOT_SUPPORTED);
391 return start_cert_fetch_ldap (ctrl, context, patterns, server);
397 return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
403 fetch_next_cert (cert_fetch_context_t context,
404 unsigned char **value, size_t * valuelen)
407 return fetch_next_cert_ldap (context, value, valuelen);
412 return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
417 /* Fetch the next data from CONTEXT, assuming it is a certificate and return
418 it as a cert object in R_CERT. */
420 fetch_next_ksba_cert (cert_fetch_context_t context, ksba_cert_t *r_cert)
423 unsigned char *value;
430 err = fetch_next_cert_ldap (context, &value, &valuelen);
432 err = gpg_error (GPG_ERR_BUG);
435 err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
440 err = ksba_cert_new (&cert);
447 err = ksba_cert_init_from_mem (cert, value, valuelen);
451 ksba_cert_release (cert);
460 end_cert_fetch (cert_fetch_context_t context)
463 end_cert_fetch_ldap (context);
470 /* Lookup a cert by it's URL. */
472 fetch_cert_by_url (ctrl_t ctrl, const char *url,
473 unsigned char **value, size_t *valuelen)
475 const unsigned char *cert_image;
477 ksba_reader_t reader;
488 err = url_fetch_ldap (ctrl, url, NULL, 0, &reader);
492 err = gpg_error (GPG_ERR_NOT_IMPLEMENTED);
497 err = ksba_cert_new (&cert);
501 err = ksba_cert_read_der (cert, reader);
505 cert_image = ksba_cert_get_image (cert, &cert_image_n);
506 if (!cert_image || !cert_image_n)
508 err = gpg_error (GPG_ERR_INV_CERT_OBJ);
512 *value = xtrymalloc (cert_image_n);
515 err = gpg_error_from_syserror ();
519 memcpy (*value, cert_image, cert_image_n);
520 *valuelen = cert_image_n;
524 ksba_cert_release (cert);
526 ldap_wrapper_release_context (reader);
532 /* This function is to be used to close the reader object. In
533 addition to running ksba_reader_release it also releases the LDAP
534 or HTTP contexts associated with that reader. */
536 crl_close_reader (ksba_reader_t reader)
538 struct reader_cb_context_s *cb_ctx;
543 /* Check whether this is a HTTP one. */
544 cb_ctx = get_file_reader (reader);
547 /* This is an HTTP context. */
549 es_fclose (cb_ctx->fp);
550 /* Release the base64 decoder state. */
552 b64dec_finish (&cb_ctx->b64state);
553 /* Release the callback context. */
556 else /* This is an ldap wrapper context (Currently not used). */
559 ldap_wrapper_release_context (reader);
563 /* Now get rid of the reader object. */
564 ksba_reader_release (reader);