ssl_server_trust_providers.c revision 299742 
1/*
2 * ssl_server_trust_providers.c: providers for
3 * SVN_AUTH_CRED_SSL_SERVER_TRUST
4 *
5 * ====================================================================
6 *    Licensed to the Apache Software Foundation (ASF) under one
7 *    or more contributor license agreements.  See the NOTICE file
8 *    distributed with this work for additional information
9 *    regarding copyright ownership.  The ASF licenses this file
10 *    to you under the Apache License, Version 2.0 (the
11 *    "License"); you may not use this file except in compliance
12 *    with the License.  You may obtain a copy of the License at
13 *
14 *      http://www.apache.org/licenses/LICENSE-2.0
15 *
16 *    Unless required by applicable law or agreed to in writing,
17 *    software distributed under the License is distributed on an
18 *    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
19 *    KIND, either express or implied.  See the License for the
20 *    specific language governing permissions and limitations
21 *    under the License.
22 * ====================================================================
23 */
24
25#include <apr_pools.h>
26
27#include "svn_hash.h"
28#include "svn_auth.h"
29#include "svn_error.h"
30#include "svn_config.h"
31#include "svn_string.h"
32
33
34/*-----------------------------------------------------------------------*/
35/* File provider                                                         */
36/*-----------------------------------------------------------------------*/
37
38/* retrieve ssl server CA failure overrides (if any) from servers
39   config */
40static svn_error_t *
41ssl_server_trust_file_first_credentials(void **credentials,
42                                        void **iter_baton,
43                                        void *provider_baton,
44                                        apr_hash_t *parameters,
45                                        const char *realmstring,
46                                        apr_pool_t *pool)
47{
48  apr_uint32_t *failures = svn_hash_gets(parameters,
49                                         SVN_AUTH_PARAM_SSL_SERVER_FAILURES);
50  const svn_auth_ssl_server_cert_info_t *cert_info =
51    svn_hash_gets(parameters, SVN_AUTH_PARAM_SSL_SERVER_CERT_INFO);
52  apr_hash_t *creds_hash = NULL;
53  const char *config_dir;
54  svn_error_t *error = SVN_NO_ERROR;
55
56  *credentials = NULL;
57  *iter_baton = NULL;
58
59  /* Check if this is a permanently accepted certificate */
60  config_dir = svn_hash_gets(parameters, SVN_AUTH_PARAM_CONFIG_DIR);
61  error =
62    svn_config_read_auth_data(&creds_hash, SVN_AUTH_CRED_SSL_SERVER_TRUST,
63                              realmstring, config_dir, pool);
64  svn_error_clear(error);
65  if (! error && creds_hash)
66    {
67      svn_string_t *trusted_cert, *this_cert, *failstr;
68      apr_uint32_t last_failures = 0;
69
70      trusted_cert = svn_hash_gets(creds_hash, SVN_CONFIG_AUTHN_ASCII_CERT_KEY);
71      this_cert = svn_string_create(cert_info->ascii_cert, pool);
72      failstr = svn_hash_gets(creds_hash, SVN_CONFIG_AUTHN_FAILURES_KEY);
73
74      if (failstr)
75        SVN_ERR(svn_cstring_atoui(&last_failures, failstr->data));
76
77      /* If the cert is trusted and there are no new failures, we
78       * accept it by clearing all failures. */
79      if (trusted_cert &&
80          svn_string_compare(this_cert, trusted_cert) &&
81          (*failures & ~last_failures) == 0)
82        {
83          *failures = 0;
84        }
85    }
86
87  /* If all failures are cleared now, we return the creds */
88  if (! *failures)
89    {
90      svn_auth_cred_ssl_server_trust_t *creds =
91        apr_pcalloc(pool, sizeof(*creds));
92      creds->may_save = FALSE; /* No need to save it again... */
93      *credentials = creds;
94    }
95
96  return SVN_NO_ERROR;
97}
98
99
100static svn_error_t *
101ssl_server_trust_file_save_credentials(svn_boolean_t *saved,
102                                       void *credentials,
103                                       void *provider_baton,
104                                       apr_hash_t *parameters,
105                                       const char *realmstring,
106                                       apr_pool_t *pool)
107{
108  svn_auth_cred_ssl_server_trust_t *creds = credentials;
109  const svn_auth_ssl_server_cert_info_t *cert_info;
110  apr_hash_t *creds_hash = NULL;
111  const char *config_dir;
112
113  if (! creds->may_save)
114    return SVN_NO_ERROR;
115
116  config_dir = svn_hash_gets(parameters, SVN_AUTH_PARAM_CONFIG_DIR);
117
118  cert_info = svn_hash_gets(parameters, SVN_AUTH_PARAM_SSL_SERVER_CERT_INFO);
119
120  creds_hash = apr_hash_make(pool);
121  svn_hash_sets(creds_hash, SVN_CONFIG_AUTHN_ASCII_CERT_KEY,
122                svn_string_create(cert_info->ascii_cert, pool));
123  svn_hash_sets(creds_hash, SVN_CONFIG_AUTHN_FAILURES_KEY,
124                svn_string_createf(pool, "%lu",
125                                   (unsigned long)creds->accepted_failures));
126
127  SVN_ERR(svn_config_write_auth_data(creds_hash,
128                                     SVN_AUTH_CRED_SSL_SERVER_TRUST,
129                                     realmstring,
130                                     config_dir,
131                                     pool));
132  *saved = TRUE;
133  return SVN_NO_ERROR;
134}
135
136
137static const svn_auth_provider_t ssl_server_trust_file_provider = {
138  SVN_AUTH_CRED_SSL_SERVER_TRUST,
139  ssl_server_trust_file_first_credentials,
140  NULL,
141  ssl_server_trust_file_save_credentials,
142};
143
144
145/*** Public API to SSL file providers. ***/
146void
147svn_auth_get_ssl_server_trust_file_provider
148  (svn_auth_provider_object_t **provider, apr_pool_t *pool)
149{
150  svn_auth_provider_object_t *po = apr_pcalloc(pool, sizeof(*po));
151
152  po->vtable = &ssl_server_trust_file_provider;
153  *provider = po;
154}
155
156
157/*-----------------------------------------------------------------------*/
158/* Prompt provider                                                       */
159/*-----------------------------------------------------------------------*/
160
161/* Baton type for prompting to verify server ssl creds.
162   There is no iteration baton type. */
163typedef struct ssl_server_trust_prompt_provider_baton_t
164{
165  svn_auth_ssl_server_trust_prompt_func_t prompt_func;
166  void *prompt_baton;
167} ssl_server_trust_prompt_provider_baton_t;
168
169
170static svn_error_t *
171ssl_server_trust_prompt_first_cred(void **credentials_p,
172                                   void **iter_baton,
173                                   void *provider_baton,
174                                   apr_hash_t *parameters,
175                                   const char *realmstring,
176                                   apr_pool_t *pool)
177{
178  ssl_server_trust_prompt_provider_baton_t *pb = provider_baton;
179  apr_uint32_t *failures = svn_hash_gets(parameters,
180                                         SVN_AUTH_PARAM_SSL_SERVER_FAILURES);
181  const char *no_auth_cache = svn_hash_gets(parameters,
182                                            SVN_AUTH_PARAM_NO_AUTH_CACHE);
183  const svn_auth_ssl_server_cert_info_t *cert_info =
184    svn_hash_gets(parameters, SVN_AUTH_PARAM_SSL_SERVER_CERT_INFO);
185  svn_boolean_t may_save = (!no_auth_cache
186                            && !(*failures & SVN_AUTH_SSL_OTHER));
187
188  SVN_ERR(pb->prompt_func((svn_auth_cred_ssl_server_trust_t **)credentials_p,
189                          pb->prompt_baton, realmstring, *failures, cert_info,
190                          may_save, pool));
191
192  *iter_baton = NULL;
193  return SVN_NO_ERROR;
194}
195
196
197static const svn_auth_provider_t ssl_server_trust_prompt_provider = {
198  SVN_AUTH_CRED_SSL_SERVER_TRUST,
199  ssl_server_trust_prompt_first_cred,
200  NULL,
201  NULL
202};
203
204
205/*** Public API to SSL prompting providers. ***/
206void
207svn_auth_get_ssl_server_trust_prompt_provider
208  (svn_auth_provider_object_t **provider,
209   svn_auth_ssl_server_trust_prompt_func_t prompt_func,
210   void *prompt_baton,
211   apr_pool_t *pool)
212{
213  svn_auth_provider_object_t *po = apr_pcalloc(pool, sizeof(*po));
214  ssl_server_trust_prompt_provider_baton_t *pb =
215    apr_palloc(pool, sizeof(*pb));
216  pb->prompt_func = prompt_func;
217  pb->prompt_baton = prompt_baton;
218  po->vtable = &ssl_server_trust_prompt_provider;
219  po->provider_baton = pb;
220  *provider = po;
221}
222