Fixing win32 custom certificate loading.

Perry Werneck
1 parent 7527a2d7
Showing 4 changed files with 113 additions and 24 deletions Show diff stats
.vscode/c_cpp_properties.json
locale/pt_BR.po
src/network_modules/openssl/context.c
src/testprogram/testprogram.c
@@ -16,7 +16,8 @@
             "compilerPath": "C:/Program Files (x86)/Microsoft Visual Studio/2019/Community/VC/Tools/MSVC/14.23.28105/bin/Hostx64/x64/cl.exe",
             "cStandard": "c11",
             "cppStandard": "c++17",
-            "intelliSenseMode": "msvc-x64"
+            "intelliSenseMode": "msvc-x64",
+            "configurationProvider": "ms-vscode.makefile-tools"
         }
     ],
     "version": 4
@@ -5,7 +5,7 @@ msgid &quot;&quot;
 msgstr ""
 "Project-Id-Version: pw3270 5.0\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2021-09-01 23:49-0300\n"
+"POT-Creation-Date: 2021-11-29 14:31-0300\n"
 "PO-Revision-Date: 2021-09-01 23:53-0300\n"
 "Last-Translator: Perry Werneck <perry.werneck@gmail.com>\n"
 "Language-Team: Português <perry.werneck@gmail.com>\n"
@@ -277,7 +277,7 @@ msgstr &quot;Erro ao inicializar LDAP&quot;
 msgid "Can't initialize the TLS/SSL context."
 msgstr "Erro ao inicializar contexto TLS/SSL"
-#: src/core/session.c:198
+#: src/core/session.c:205
 msgid "Can't load"
 msgstr "Não foi possível carregar"
@@ -285,7 +285,7 @@ msgstr &quot;Não foi possível carregar&quot;
 msgid "Can't open HTTP session"
 msgstr "Não foi possível abrir sessão HTTP"
-#: src/core/session.c:186
+#: src/core/session.c:193
 msgid "Can't print"
 msgstr "Não é possível imprimir"
@@ -293,7 +293,7 @@ msgstr &quot;Não é possível imprimir&quot;
 msgid "Can't read HTTP response size."
 msgstr "Não posso obter tamanho da resposta HTTP"
-#: src/core/session.c:192
+#: src/core/session.c:199
 msgid "Can't save"
 msgstr "Não é possível salvar"
@@ -512,8 +512,8 @@ msgstr &quot;Tipo de dispositivo rejeitado&quot;
 msgid "Disconnect from host"
 msgstr "Desconecta do servidor"
-#: src/core/ft/ft.c:244 src/network_modules/openssl/main.c:99
-#: src/network_modules/openssl/main.c:147
+#: src/core/ft/ft.c:244 src/network_modules/openssl/main.c:100
+#: src/network_modules/openssl/main.c:148
 msgid "Disconnected from host."
 msgstr "Desconectado do servidor."
@@ -593,12 +593,12 @@ msgstr &quot;Apagar campos&quot;
 msgid "Erro sending data to host"
 msgstr "Erro ao enviar dados para o servidor"
-#: src/core/ft/ft_dft.c:413 src/core/ft/ft_cut.c:408
+#: src/core/ft/ft_cut.c:408 src/core/ft/ft_dft.c:413
 #, c-format
 msgid "Error \"%s\" reading from local file (rc=%d)"
 msgstr "Erro \"%s\" lendo arquivo local (rc=%d)"
-#: src/core/ft/ft_dft.c:306 src/core/ft/ft_cut.c:504
+#: src/core/ft/ft_cut.c:504 src/core/ft/ft_dft.c:306
 #, c-format
 msgid "Error \"%s\" writing to local file (rc=%d)"
 msgstr "Erro \"%s\" gravando arquivo local (rc=%d)"
@@ -611,7 +611,7 @@ msgstr &quot;Erro na transferência do arquivo, transferência cancelada&quot;
 msgid "Error reading file from host: file transfer canceled"
 msgstr "Erro ao ler arquivo do host: Transferência cancelada"
-#: src/network_modules/openssl/main.c:169
+#: src/network_modules/openssl/main.c:170
 msgid "Error reading from host"
 msgstr "Erro lendo do servidor"
@@ -631,7 +631,7 @@ msgstr &quot;Erro ao ler ou gravar no host: Transferência cancelada&quot;
 msgid "Error writing file to host: file transfer canceled"
 msgstr "Erro ao gravar arquivo no host, transferência cancelada"
-#: src/network_modules/openssl/main.c:122
+#: src/network_modules/openssl/main.c:123
 msgid "Error writing to host."
 msgstr "Erro enviando para o servidor"
@@ -989,8 +989,8 @@ msgstr &quot;Move para o próximo campo desprotegido&quot;
 msgid "Move to the previous unprotected field on screen"
 msgstr "Move para o campo desprotegido anterior"
-#: src/core/telnet.c:304 src/core/windows/event_dispatcher.c:135
-#: src/core/windows/connect.c:223
+#: src/core/telnet.c:304 src/core/windows/connect.c:223
+#: src/core/windows/event_dispatcher.c:135
 msgid "Network error"
 msgstr "Erro de rede"
@@ -1500,8 +1500,8 @@ msgstr &quot;&quot;
 "A lista de revogação de certificados (CRL) de um certificado não pôde ser "
 "encontrada."
-#: src/network_modules/openssl/main.c:123
-#: src/network_modules/openssl/main.c:170
+#: src/network_modules/openssl/main.c:124
+#: src/network_modules/openssl/main.c:171
 #, c-format
 msgid "The SSL error message was %s"
 msgstr "A mensagem de erro SSL foi \"%s\""
@@ -1723,8 +1723,8 @@ msgstr &quot;&quot;
 "O Certificado raiz não está marcado como confiável para os fins "
 "especificados."
-#: src/network_modules/openssl/main.c:101
-#: src/network_modules/openssl/main.c:149
+#: src/network_modules/openssl/main.c:102
+#: src/network_modules/openssl/main.c:150
 msgid "The secure connection has been closed cleanly."
 msgstr "A conexão segura foi fechada corretamente"
@@ -1774,7 +1774,7 @@ msgstr &quot;O erro do sistema operacional foi \&quot;%s\&quot; (rc=%d)&quot;
 msgid "The system error was %s"
 msgstr "O erro do sistema operacional foi \"%s\""
-#: src/core/util.c:260
+#: src/core/util.c:264
 #, c-format
 msgid "The system error was '%s' (rc=%d)"
 msgstr "O erro do sistema foi \"%s\" (rc=%d)"
@@ -1857,8 +1857,8 @@ msgstr &quot;Mostrar posição do cursor&quot;
 msgid "Transfer cancelled by host"
 msgstr "Transferência cancelada pelo host"
-#: src/core/ft/ft_dft.c:213 src/core/ft/ft_dft.c:344 src/core/ft/ft_cut.c:387
-#: src/core/ft/ft_cut.c:475
+#: src/core/ft/ft_cut.c:387 src/core/ft/ft_cut.c:475 src/core/ft/ft_dft.c:213
+#: src/core/ft/ft_dft.c:344
 msgid "Transfer cancelled by user"
 msgstr "Transferência cancelada pelo usuário"
@@ -1915,7 +1915,7 @@ msgstr &quot;Não foi possível obter emissor do certificado&quot;
 msgid "Unable to get local issuer certificate"
 msgstr "Unable to get local issuer certificate"
-#: src/core/session.c:198
+#: src/core/session.c:205
 msgid "Unable to load from file"
 msgstr "Não foi possível ler do arquivo"
@@ -1927,11 +1927,11 @@ msgstr &quot;Incapaz de negociar uma conexão segura com o host&quot;
 msgid "Unable to paste text"
 msgstr "Incapaz de colar texto"
-#: src/core/session.c:186
+#: src/core/session.c:193
 msgid "Unable to print"
 msgstr "Incapaz de imprimir"
-#: src/core/session.c:192
+#: src/core/session.c:199
 msgid "Unable to save"
 msgstr "Incapaz de salvar"
@@ -193,6 +193,94 @@ SSL_CTX * lib3270_openssl_get_context(H3270 *hSession) {
 #endif // SSL_ENABLE_CRL_CHECK
+#ifdef _WIN32
+	{
+		// Load certs
+		// https://stackoverflow.com/questions/9507184/can-openssl-on-windows-use-the-system-certificate-store
+		X509_STORE * store = SSL_CTX_get_cert_store(context);
+
+		lib3270_autoptr(char) certpath = lib3270_build_data_filename("certs","*.der",NULL);
+
+		trace_ssl(hSession,"Loading SSL certs from %s\n",certpath);
+
+		WIN32_FIND_DATA ffd;
+		HANDLE hFind = FindFirstFile(certpath, &ffd);
+
+		if(hFind == INVALID_HANDLE_VALUE)
+		{
+			static const LIB3270_SSL_MESSAGE message = {
+				.type = LIB3270_NOTIFY_SECURE,
+				.icon = "dialog-error",
+				.summary = N_( "Cant open custom certificate directory." ),
+			};
+
+			hSession->ssl.message = &message;
+
+			trace_ssl(hSession, _( "Can't open \"%s\" (The Windows error code was %ld)" ), certpath, (long) GetLastError());
+		}
+		else
+		{
+			do
+			{
+				char * filename = lib3270_build_data_filename("certs", ffd.cFileName, NULL);
+
+				debug("Loading \"%s\"",filename);
+
+				FILE *fp = fopen(filename,"r");
+				if(!fp) {
+
+					trace_ssl(hSession, _( "Can't open \"%s\": %s" ), filename, strerror(errno));
+
+				}
+				else
+				{
+					X509 * cert = d2i_X509_fp(fp, NULL);
+
+					if(!cert)
+					{
+						static const LIB3270_SSL_MESSAGE message = {
+							.type = LIB3270_NOTIFY_SECURE,
+							.icon = "dialog-error",
+							.summary = N_( "Cant read custom certificate file." ),
+						};
+
+						hSession->ssl.message = &message;
+						hSession->network.context->state.error = ERR_get_error();
+
+						trace_ssl(hSession, _( "Can't read \"%s\": %s" ), filename, ERR_lib_error_string(hSession->ssl.error));
+					}
+					else
+					{
+
+						if(X509_STORE_add_cert(store, cert) != 1)
+						{
+							static const LIB3270_SSL_MESSAGE message = {
+								.type = LIB3270_NOTIFY_SECURE,
+								.icon = "dialog-error",
+								.summary = N_( "Cant load custom certificate file." ),
+							};
+
+							hSession->ssl.message = &message;
+							hSession->network.context->state.error = ERR_get_error();
+
+							trace_ssl(hSession, _( "Can't load \"%s\": %s" ), filename, ERR_lib_error_string(hSession->ssl.error));
+						}
+
+						X509_free(cert);
+					}
+
+					fclose(fp);
+				}
+
+				lib3270_free(filename);
+
+			}
+			while (FindNextFile(hFind, &ffd) != 0);
+
+		}
+	}
+#endif // _WIN32
+
 	return context;
 }
@@ -78,7 +78,7 @@ int main(int argc, char *argv[]) {
 	{
 		lib3270_autoptr(char) testfilename = lib3270_build_data_filename("test",NULL);
 		printf("\n\nFilename: '%s'\n\n", testfilename);
-		return 0;
+//		return 0;
 	}
 //	#pragma GCC diagnostic push
	@@ -193,6 +193,94 @@ SSL_CTX * lib3270_openssl_get_context(H3270 *hSession) {		@@ -193,6 +193,94 @@ SSL_CTX * lib3270_openssl_get_context(H3270 *hSession) {
193		193
194	#endif // SSL_ENABLE_CRL_CHECK	194	#endif // SSL_ENABLE_CRL_CHECK
195		195
		196	+#ifdef _WIN32
		197	+ {
		198	+ // Load certs
		199	+ // https://stackoverflow.com/questions/9507184/can-openssl-on-windows-use-the-system-certificate-store
		200	+ X509_STORE * store = SSL_CTX_get_cert_store(context);
		201	+
		202	+ lib3270_autoptr(char) certpath = lib3270_build_data_filename("certs","*.der",NULL);
		203	+
		204	+ trace_ssl(hSession,"Loading SSL certs from %s\n",certpath);
		205	+
		206	+ WIN32_FIND_DATA ffd;
		207	+ HANDLE hFind = FindFirstFile(certpath, &ffd);
		208	+
		209	+ if(hFind == INVALID_HANDLE_VALUE)
		210	+ {
		211	+ static const LIB3270_SSL_MESSAGE message = {
		212	+ .type = LIB3270_NOTIFY_SECURE,
		213	+ .icon = "dialog-error",
		214	+ .summary = N_( "Cant open custom certificate directory." ),
		215	+ };
		216	+
		217	+ hSession->ssl.message = &message;
		218	+
		219	+ trace_ssl(hSession, _( "Can't open \"%s\" (The Windows error code was %ld)" ), certpath, (long) GetLastError());
		220	+ }
		221	+ else
		222	+ {
		223	+ do
		224	+ {
		225	+ char * filename = lib3270_build_data_filename("certs", ffd.cFileName, NULL);
		226	+
		227	+ debug("Loading \"%s\"",filename);
		228	+
		229	+ FILE *fp = fopen(filename,"r");
		230	+ if(!fp) {
		231	+
		232	+ trace_ssl(hSession, _( "Can't open \"%s\": %s" ), filename, strerror(errno));
		233	+
		234	+ }
		235	+ else
		236	+ {
		237	+ X509 * cert = d2i_X509_fp(fp, NULL);
		238	+
		239	+ if(!cert)
		240	+ {
		241	+ static const LIB3270_SSL_MESSAGE message = {
		242	+ .type = LIB3270_NOTIFY_SECURE,
		243	+ .icon = "dialog-error",
		244	+ .summary = N_( "Cant read custom certificate file." ),
		245	+ };
		246	+
		247	+ hSession->ssl.message = &message;
		248	+ hSession->network.context->state.error = ERR_get_error();
		249	+
		250	+ trace_ssl(hSession, _( "Can't read \"%s\": %s" ), filename, ERR_lib_error_string(hSession->ssl.error));
		251	+ }
		252	+ else
		253	+ {
		254	+
		255	+ if(X509_STORE_add_cert(store, cert) != 1)
		256	+ {
		257	+ static const LIB3270_SSL_MESSAGE message = {
		258	+ .type = LIB3270_NOTIFY_SECURE,
		259	+ .icon = "dialog-error",
		260	+ .summary = N_( "Cant load custom certificate file." ),
		261	+ };
		262	+
		263	+ hSession->ssl.message = &message;
		264	+ hSession->network.context->state.error = ERR_get_error();
		265	+
		266	+ trace_ssl(hSession, _( "Can't load \"%s\": %s" ), filename, ERR_lib_error_string(hSession->ssl.error));
		267	+ }
		268	+
		269	+ X509_free(cert);
		270	+ }
		271	+
		272	+ fclose(fp);
		273	+ }
		274	+
		275	+ lib3270_free(filename);
		276	+
		277	+ }
		278	+ while (FindNextFile(hFind, &ffd) != 0);
		279	+
		280	+ }
		281	+ }
		282	+#endif // _WIN32
		283	+
196	return context;	284	return context;
197		285
198	}	286	}
	@@ -78,7 +78,7 @@ int main(int argc, char *argv[]) {		@@ -78,7 +78,7 @@ int main(int argc, char *argv[]) {
78	{	78	{
79	lib3270_autoptr(char) testfilename = lib3270_build_data_filename("test",NULL);	79	lib3270_autoptr(char) testfilename = lib3270_build_data_filename("test",NULL);
80	printf("\n\nFilename: '%s'\n\n", testfilename);	80	printf("\n\nFilename: '%s'\n\n", testfilename);
81	- return 0;	81	+// return 0;
82	}	82	}
83		83
84	// #pragma GCC diagnostic push	84	// #pragma GCC diagnostic push