Changeset 57584 in vbox

Timestamp:

Aug 29, 2015 8:02:02 PM (9 years ago)

Author:

vboxsync

Message:

IPRT: Implemented reading lib/Security/cacerts from JRE.

Location:

trunk

Files:

• include/iprt/crypto/store.h (modified) (2 diffs)
• include/iprt/log.h (modified) (2 diffs)
• include/iprt/mangling.h (modified) (1 diff)
• src/VBox/Runtime/common/crypto/RTCrStoreCertAddFromFile.cpp (modified) (2 diffs)
• src/VBox/Runtime/common/crypto/RTCrStoreCertAddFromJavaKeyStore.cpp (added)

trunk/include/iprt/crypto/store.h

@@ -144 +144 @@
 
 /**
- * Adds certificates from the specified file.
- *
- * @returns IPRT status code.  Even when RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR is
- *          used, an error is returned as an error (and not a warning).
- *
- * @param   hStore              The store to add the certificate(s) to.
- * @param   fFlags              RTCRCERTCTX_F_ADD_IF_NOT_FOUND and/or
- *                              RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR.
- * @param   pszFilename         The filename.
- * @param   pErrInfo            Where to return additional error/warning info.
- *                              Optional.
- */
-RTDECL(int) RTCrStoreCertAddFromFile(RTCRSTORE hStore, uint32_t fFlags, const char *pszFilename, PRTERRINFO pErrInfo);
-
-/**
  * Adds certificates from files in the specified directory.
  *
@@ -176 +161 @@
 RTDECL(int) RTCrStoreCertAddFromDir(RTCRSTORE hStore, uint32_t fFlags, const char *pszDir,
                                     PCRTSTRTUPLE paSuffixes, size_t cSuffixes, PRTERRINFO pErrInfo);
+
+/**
+ * Adds certificates from the specified file.
+ *
+ * The supported file formats are:
+ *      - PEM (base 64 blobs wrapped in -----BEGIN / END----).  Support multiple
+ *        certificates in one file.
+ *      - Binary DER ASN.1 certificate. Only one per file.
+ *      - Java key store version 2.
+ *
+ * @returns IPRT status code.  Even when RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR is
+ *          used, an error is returned as an error (and not a warning).
+ *
+ * @param   hStore              The store to add the certificate(s) to.
+ * @param   fFlags              RTCRCERTCTX_F_ADD_IF_NOT_FOUND and/or
+ *                              RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR.
+ * @param   pszFilename         The filename.
+ * @param   pErrInfo            Where to return additional error/warning info.
+ *                              Optional.
+ */
+RTDECL(int) RTCrStoreCertAddFromFile(RTCRSTORE hStore, uint32_t fFlags, const char *pszFilename, PRTERRINFO pErrInfo);
+
+/**
+ * Adds certificates from the specified java key store file.
+ *
+ * @returns IPRT status code.  Even when RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR is
+ *          used, an error is returned as an error (and not a warning).
+ *
+ * @param   hStore              The store to add the certificate(s) to.
+ * @param   fFlags              RTCRCERTCTX_F_ADD_IF_NOT_FOUND and/or
+ *                              RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR.
+ * @param   pszFilename         The path to the JKS file.
+ * @param   pErrInfo            Where to return additional error/warning info.
+ *                              Optional.
+ */
+RTDECL(int) RTCrStoreCertAddFromJavaKeyStore(RTCRSTORE hStore, uint32_t fFlags, const char *pszFilename, PRTERRINFO pErrInfo);
+
+/**
+ * Adds certificates from an in-memory java key store.
+ *
+ * @returns IPRT status code.  Even when RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR is
+ *          used, an error is returned as an error (and not a warning).
+ *
+ * @param   hStore              The store to add the certificate(s) to.
+ * @param   fFlags              RTCRCERTCTX_F_ADD_IF_NOT_FOUND and/or
+ *                              RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR.
+ * @param   pvContent           Pointer to the key store bytes.
+ * @param   cbContent           The size of the key store.
+ * @param   pszErrorName        The file name or whatever helpful indicator the
+ *                              caller want in the error messages.
+ * @param   pErrInfo            Where to return additional error/warning info.
+ *                              Optional.
+ */
+RTDECL(int) RTCrStoreCertAddFromJavaKeyStoreInMem(RTCRSTORE hStore, uint32_t fFlags, void const *pvContent, size_t cbContent,
+                                                  const char *pszErrorName, PRTERRINFO pErrInfo);
 
 /**

trunk/include/iprt/log.h

@@ -65 +65 @@
     RTLOGGROUP_TIME,
     RTLOGGROUP_TIMER,
+    RTLOGGROUP_CRYPTO,
     RTLOGGROUP_ZIP = 31,
     RTLOGGROUP_FIRST_USER = 32
@@ -96 +97 @@
     "RT_TIME",      \
     "RT_TIMER",     \
-    "RT_13", \
+    "RT_CRYPTO",    \
     "RT_14", \
     "RT_15", \

trunk/include/iprt/mangling.h

@@ -2902 +2902 @@
 # define RTCrStoreCreateInMem                           RT_MANGLER(RTCrStoreCreateInMem)
 # define RTCrStoreCreateSnapshotById                    RT_MANGLER(RTCrStoreCreateSnapshotById)
+# define RTCrStoreCertAddFromDir                        RT_MANGLER(RTCrStoreCertAddFromDir)
 # define RTCrStoreCertAddFromFile                       RT_MANGLER(RTCrStoreCertAddFromFile)
-# define RTCrStoreCertAddFromDir                        RT_MANGLER(RTCrStoreCertAddFromDir)
+# define RTCrStoreCertAddFromJavaKeyStore               RT_MANGLER(RTCrStoreCertAddFromJavaKeyStore)
+# define RTCrStoreCertAddFromJavaKeyStoreInMem          RT_MANGLER(RTCrStoreCertAddFromJavaKeyStoreInMem)
 # define RTCrStoreCertAddFromStore                      RT_MANGLER(RTCrStoreCertAddFromStore)
 # define RTCrStoreCertExportAsPem                       RT_MANGLER(RTCrStoreCertExportAsPem)

trunk/src/VBox/Runtime/common/crypto/RTCrStoreCertAddFromFile.cpp

@@ -34 +34 @@
 #include <iprt/assert.h>
 #include <iprt/err.h>
+#include <iprt/file.h>
 #include <iprt/crypto/pem.h>
 
@@ -102 +103 @@
     AssertReturn(!(fFlags & ~(RTCRCERTCTX_F_ADD_IF_NOT_FOUND | RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR)), VERR_INVALID_FLAGS);
 
-    PCRTCRPEMSECTION pSectionHead;
-    int rc = RTCrPemReadFile(pszFilename,
-                             fFlags & RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR ? RTCRPEMREADFILE_F_CONTINUE_ON_ENCODING_ERROR : 0,
-                             g_aCertificateMarkers, RT_ELEMENTS(g_aCertificateMarkers), &pSectionHead, pErrInfo);
+    size_t      cbContent;
+    void        *pvContent;
+    int rc = RTFileReadAllEx(pszFilename, 0, 64U*_1M, RTFILE_RDALL_O_DENY_WRITE, &pvContent, &cbContent);
     if (RT_SUCCESS(rc))
     {
-        PCRTCRPEMSECTION pCurSec = pSectionHead;
-        while (pCurSec)
+        /*
+         * Is it a java key store file?
+         */
+        if (   cbContent > 32
+            && ((uint32_t const *)pvContent)[0] == RT_H2BE_U32_C(UINT32_C(0xfeedfeed)) /* magic */
+            && ((uint32_t const *)pvContent)[1] == RT_H2BE_U32_C(UINT32_C(0x00000002)) /* version */ )
+            rc = RTCrStoreCertAddFromJavaKeyStoreInMem(hStore, fFlags, pvContent, cbContent, pszFilename, pErrInfo);
+        /*
+         * No assume PEM or DER encoded binary certificate.
+         */
+        else
         {
-            int rc2 = RTCrStoreCertAddEncoded(hStore, RTCRCERTCTX_F_ENC_X509_DER | (fFlags & ~RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR),
-                                              pCurSec->pbData, pCurSec->cbData, !RTErrInfoIsSet(pErrInfo) ? pErrInfo : NULL);
-            if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
+            PCRTCRPEMSECTION pSectionHead;
+            rc = RTCrPemParseContent(pvContent, cbContent, fFlags, g_aCertificateMarkers, RT_ELEMENTS(g_aCertificateMarkers),
+                                     &pSectionHead, pErrInfo);
+            if (RT_SUCCESS(rc))
             {
-                rc = rc2;
-                if (!(fFlags & RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR))
-                    break;
+                PCRTCRPEMSECTION pCurSec = pSectionHead;
+                while (pCurSec)
+                {
+                    int rc2 = RTCrStoreCertAddEncoded(hStore,
+                                                      RTCRCERTCTX_F_ENC_X509_DER | (fFlags & RTCRCERTCTX_F_ADD_IF_NOT_FOUND),
+                                                      pCurSec->pbData, pCurSec->cbData,
+                                                      !RTErrInfoIsSet(pErrInfo) ? pErrInfo : NULL);
+                    if (RT_FAILURE(rc2) && RT_SUCCESS(rc))
+                    {
+                        rc = rc2;
+                        if (!(fFlags & RTCRCERTCTX_F_ADD_CONTINUE_ON_ERROR))
+                            break;
+                    }
+                    pCurSec = pCurSec->pNext;
+                }
+
+                RTCrPemFreeSections(pSectionHead);
             }
-            pCurSec = pCurSec->pNext;
         }
-
-        RTCrPemFreeSections(pSectionHead);
+        RTFileReadAllFree(pvContent, cbContent);
     }
+    else
+        rc = RTErrInfoSetF(pErrInfo, rc, "RTFileReadAllEx failed with %Rrc on '%s'", rc, pszFilename);
     return rc;
 }