uui/source/iahndl-ssl.cxx

   1 /* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
   2 /*
   3  * This file is part of the LibreOffice project.
   4  *
   5  * This Source Code Form is subject to the terms of the Mozilla Public
   6  * License, v. 2.0. If a copy of the MPL was not distributed with this
   7  * file, You can obtain one at http://mozilla.org/MPL/2.0/.
   8  *
   9  * This file incorporates work covered by the following license notice:
  10  *
  11  *   Licensed to the Apache Software Foundation (ASF) under one or more
  12  *   contributor license agreements. See the NOTICE file distributed
  13  *   with this work for additional information regarding copyright
  14  *   ownership. The ASF licenses this file to you under the Apache
  15  *   License, Version 2.0 (the "License"); you may not use this file
  16  *   except in compliance with the License. You may obtain a copy of
  17  *   the License at http://www.apache.org/licenses/LICENSE-2.0 .
  18  */
  19
  20
  21 #include <com/sun/star/security/CertificateValidity.hpp>
  22 #include <com/sun/star/security/XCertificateExtension.hpp>
  23 #include <com/sun/star/security/XSanExtension.hpp>
  24 #include <com/sun/star/security/ExtAltNameType.hpp>
  25 #include <com/sun/star/task/XInteractionAbort.hpp>
  26 #include <com/sun/star/task/XInteractionApprove.hpp>
  27 #include <com/sun/star/task/XInteractionRequest.hpp>
  28 #include <com/sun/star/ucb/CertificateValidationRequest.hpp>
  29 #include <com/sun/star/uno/Reference.hxx>
  30
  31 #include <osl/mutex.hxx>
  32 #include <com/sun/star/uno/Sequence.hxx>
  33 #include <svl/zforlist.hxx>
  34 #include <vcl/svapp.hxx>
  35 #include <vcl/settings.hxx>
  36
  37 #include "ids.hrc"
  38 #include "getcontinuations.hxx"
  39 #include "sslwarndlg.hxx"
  40 #include "unknownauthdlg.hxx"
  41
  42 #include "iahndl.hxx"
  43
  44 #include <boost/scoped_ptr.hpp>
  45
  46 #define DESCRIPTION_1 1
  47 #define TITLE 3
  48
  49 #define OID_SUBJECT_ALTERNATIVE_NAME "2.5.29.17"
  50
  51
  52 using namespace com::sun::star;
  53
  54 namespace {
  55
  56 OUString
  57 getContentPart( const OUString& _rRawString )
  58 {
  59     // search over some parts to find a string
  60     static char const * aIDs[] = { "CN=", "OU=", "O=", "E=", NULL };
  61     OUString sPart;
  62     int i = 0;
  63     while ( aIDs[i] )
  64     {
  65         OUString sPartId = OUString::createFromAscii( aIDs[i++] );
  66         sal_Int32 nContStart = _rRawString.indexOf( sPartId );
  67         if ( nContStart != -1 )
  68         {
  69             nContStart += sPartId.getLength();
  70             sal_Int32 nContEnd = _rRawString.indexOf( ',', nContStart );
  71             if ( nContEnd != -1 )
  72                 sPart = _rRawString.copy( nContStart, nContEnd - nContStart );
  73             else
  74                 sPart = _rRawString.copy( nContStart );
  75             break;
  76         }
  77     }
  78     return sPart;
  79 }
  80
  81 bool
  82 isDomainMatch(
  83               const OUString& hostName, const uno::Sequence< OUString >& certHostNames)
  84 {
  85     for ( int i = 0; i < certHostNames.getLength(); i++){
  86         OUString element = certHostNames[i];
  87
  88        if (element.isEmpty())
  89            continue;
  90
  91        if (hostName.equalsIgnoreAsciiCase( element ))
  92            return true;
  93
  94        if (element.startsWith("*") &&
  95            hostName.getLength() >= element.getLength()  )
  96        {
  97            OUString cmpStr = element.copy( 1 );
  98            if ( hostName.matchIgnoreAsciiCase(
  99                     cmpStr, hostName.getLength() - cmpStr.getLength()) )
 100                return true;
 101        }
 102     }
 103
 104     return false;
 105 }
 106
 107 OUString
 108 getLocalizedDatTimeStr(
 109     uno::Reference< uno::XComponentContext> const & xContext,
 110     util::DateTime const & rDateTime )
 111 {
 112     OUString aDateTimeStr;
 113     Date  aDate( Date::EMPTY );
 114     tools::Time  aTime( tools::Time::EMPTY );
 115
 116     aDate = Date( rDateTime.Day, rDateTime.Month, rDateTime.Year );
 117     aTime = tools::Time( rDateTime.Hours, rDateTime.Minutes, rDateTime.Seconds );
 118
 119     LanguageType eUILang = Application::GetSettings().GetUILanguageTag().getLanguageType();
 120     SvNumberFormatter *pNumberFormatter = new SvNumberFormatter( xContext, eUILang );
 121     OUString      aTmpStr;
 122     Color*      pColor = NULL;
 123     Date*       pNullDate = pNumberFormatter->GetNullDate();
 124     sal_uInt32  nFormat
 125         = pNumberFormatter->GetStandardFormat( css::util::NumberFormat::DATE, eUILang );
 126
 127     pNumberFormatter->GetOutputString( aDate - *pNullDate, nFormat, aTmpStr, &pColor );
 128     aDateTimeStr = aTmpStr + " ";
 129
 130     nFormat = pNumberFormatter->GetStandardFormat( css::util::NumberFormat::TIME, eUILang );
 131     pNumberFormatter->GetOutputString(
 132         aTime.GetTimeInDays(), nFormat, aTmpStr, &pColor );
 133     aDateTimeStr += aTmpStr;
 134
 135     return aDateTimeStr;
 136 }
 137
 138 bool
 139 executeUnknownAuthDialog(
 140     vcl::Window * pParent,
 141     uno::Reference< uno::XComponentContext > const & xContext,
 142     const uno::Reference< security::XCertificate >& rXCert)
 143 {
 144     try
 145     {
 146         SolarMutexGuard aGuard;
 147
 148         ScopedVclPtrInstance< UnknownAuthDialog > xDialog(pParent, rXCert, xContext);
 149
 150         // Get correct resource string
 151         OUString aMessage;
 152
 153         std::vector< OUString > aArguments;
 154         aArguments.push_back( getContentPart( rXCert->getSubjectName()) );
 155
 156         boost::scoped_ptr< ResMgr > xManager(ResMgr::CreateResMgr("uui"));
 157         if (xManager.get())
 158         {
 159             ResId aResId(RID_UUI_ERRHDL, *xManager.get());
 160             if (ErrorResource(aResId).getString(
 161                     ERRCODE_UUI_UNKNOWNAUTH_UNTRUSTED, aMessage))
 162             {
 163                 aMessage = UUIInteractionHelper::replaceMessageWithArguments(
 164                     aMessage, aArguments );
 165                 xDialog->setDescriptionText( aMessage );
 166             }
 167         }
 168
 169         return static_cast<bool>(xDialog->Execute());
 170     }
 171     catch (std::bad_alloc const &)
 172     {
 173         throw uno::RuntimeException("out of memory");
 174     }
 175 }
 176
 177 bool
 178 executeSSLWarnDialog(
 179     vcl::Window * pParent,
 180     uno::Reference< uno::XComponentContext > const & xContext,
 181     const uno::Reference< security::XCertificate >& rXCert,
 182     sal_Int32 const & failure,
 183     const OUString & hostName )
 184 {
 185     try
 186     {
 187         SolarMutexGuard aGuard;
 188
 189         ScopedVclPtrInstance< SSLWarnDialog > xDialog(pParent, rXCert, xContext);
 190
 191         // Get correct resource string
 192         OUString aMessage_1;
 193         std::vector< OUString > aArguments_1;
 194
 195         switch( failure )
 196         {
 197             case SSLWARN_TYPE_DOMAINMISMATCH:
 198                 aArguments_1.push_back( hostName );
 199                 aArguments_1.push_back(
 200                     getContentPart( rXCert->getSubjectName()) );
 201                 aArguments_1.push_back( hostName );
 202                 break;
 203             case SSLWARN_TYPE_EXPIRED:
 204                 aArguments_1.push_back(
 205                     getContentPart( rXCert->getSubjectName()) );
 206                 aArguments_1.push_back(
 207                     getLocalizedDatTimeStr( xContext,
 208                                             rXCert->getNotValidAfter() ) );
 209                 aArguments_1.push_back(
 210                     getLocalizedDatTimeStr( xContext,
 211                                             rXCert->getNotValidAfter() ) );
 212                 break;
 213             case SSLWARN_TYPE_INVALID:
 214                 break;
 215         }
 216
 217         boost::scoped_ptr< ResMgr > xManager(ResMgr::CreateResMgr("uui"));
 218
 219         if (xManager.get())
 220         {
 221             ResId aResId(RID_UUI_ERRHDL, *xManager.get());
 222             if (ErrorResource(aResId).getString(
 223                     ERRCODE_AREA_UUI_UNKNOWNAUTH + failure + DESCRIPTION_1,
 224                     aMessage_1))
 225             {
 226                 aMessage_1 = UUIInteractionHelper::replaceMessageWithArguments(
 227                     aMessage_1, aArguments_1 );
 228                 xDialog->setDescription1Text( aMessage_1 );
 229             }
 230
 231             OUString aTitle;
 232             if (ErrorResource(aResId).getString(
 233                 ERRCODE_AREA_UUI_UNKNOWNAUTH + failure + TITLE, aTitle))
 234             {
 235                 xDialog->SetText(aTitle);
 236             }
 237         }
 238
 239         return static_cast<bool>(xDialog->Execute());
 240     }
 241     catch (std::bad_alloc const &)
 242     {
 243         throw uno::RuntimeException("out of memory");
 244     }
 245 }
 246
 247 void
 248 handleCertificateValidationRequest_(
 249     vcl::Window * pParent,
 250     uno::Reference< uno::XComponentContext > const & xContext,
 251     ucb::CertificateValidationRequest const & rRequest,
 252     uno::Sequence< uno::Reference< task::XInteractionContinuation > > const &
 253         rContinuations)
 254 {
 255     uno::Reference< task::XInteractionApprove > xApprove;
 256     uno::Reference< task::XInteractionAbort > xAbort;
 257     getContinuations(rContinuations, &xApprove, &xAbort);
 258
 259     sal_Int32 failures = rRequest.CertificateValidity;
 260     bool trustCert = true;
 261
 262     if ( ((failures & security::CertificateValidity::UNTRUSTED)
 263              == security::CertificateValidity::UNTRUSTED ) ||
 264          ((failures & security::CertificateValidity::ISSUER_UNTRUSTED)
 265              == security::CertificateValidity::ISSUER_UNTRUSTED) ||
 266          ((failures & security::CertificateValidity::ROOT_UNTRUSTED)
 267              == security::CertificateValidity::ROOT_UNTRUSTED) )
 268     {
 269         trustCert = executeUnknownAuthDialog( pParent,
 270                                               xContext,
 271                                               rRequest.Certificate );
 272     }
 273
 274     uno::Sequence< uno::Reference< security::XCertificateExtension > > extensions = rRequest.Certificate->getExtensions();
 275     uno::Sequence< security::CertAltNameEntry > altNames;
 276     for (sal_Int32 i = 0 ; i < extensions.getLength(); i++){
 277         uno::Reference< security::XCertificateExtension >element = extensions[i];
 278
 279         OString aId ( reinterpret_cast<const char *>(element->getExtensionId().getConstArray()), element->getExtensionId().getLength());
 280         if (aId.equals(OID_SUBJECT_ALTERNATIVE_NAME))
 281         {
 282            uno::Reference< security::XSanExtension > sanExtension ( element, uno::UNO_QUERY );
 283            altNames =  sanExtension->getAlternativeNames();
 284            break;
 285         }
 286     }
 287
 288     OUString certHostName = getContentPart( rRequest.Certificate->getSubjectName() );
 289     uno::Sequence< OUString > certHostNames(altNames.getLength() + 1);
 290
 291     certHostNames[0] = certHostName;
 292
 293     for(int n = 0; n < altNames.getLength(); ++n)
 294     {
 295         if (altNames[n].Type ==  security::ExtAltNameType_DNS_NAME){
 296            altNames[n].Value >>= certHostNames[n+1];
 297         }
 298     }
 299
 300     if ( (!isDomainMatch(
 301               rRequest.HostName,
 302               certHostNames )) &&
 303           trustCert )
 304     {
 305         trustCert = executeSSLWarnDialog( pParent,
 306                                           xContext,
 307                                           rRequest.Certificate,
 308                                           SSLWARN_TYPE_DOMAINMISMATCH,
 309                                           rRequest.HostName );
 310     }
 311
 312     else if ( (((failures & security::CertificateValidity::TIME_INVALID)
 313                 == security::CertificateValidity::TIME_INVALID) ||
 314                ((failures & security::CertificateValidity::NOT_TIME_NESTED)
 315                 == security::CertificateValidity::NOT_TIME_NESTED)) &&
 316               trustCert )
 317     {
 318         trustCert = executeSSLWarnDialog( pParent,
 319                                           xContext,
 320                                           rRequest.Certificate,
 321                                           SSLWARN_TYPE_EXPIRED,
 322                                           rRequest.HostName );
 323     }
 324
 325     else if ( (((failures & security::CertificateValidity::REVOKED)
 326                 == security::CertificateValidity::REVOKED) ||
 327                ((failures & security::CertificateValidity::SIGNATURE_INVALID)
 328                 == security::CertificateValidity::SIGNATURE_INVALID) ||
 329                ((failures & security::CertificateValidity::EXTENSION_INVALID)
 330                 == security::CertificateValidity::EXTENSION_INVALID) ||
 331                ((failures & security::CertificateValidity::INVALID)
 332                 == security::CertificateValidity::INVALID)) &&
 333               trustCert )
 334     {
 335         trustCert = executeSSLWarnDialog( pParent,
 336                                           xContext,
 337                                           rRequest.Certificate,
 338                                           SSLWARN_TYPE_INVALID,
 339                                           rRequest.HostName );
 340     }
 341
 342     if ( trustCert )
 343     {
 344         if (xApprove.is())
 345             xApprove->select();
 346     }
 347     else
 348     {
 349         if (xAbort.is())
 350             xAbort->select();
 351     }
 352 }
 353
 354 } // namespace
 355
 356 bool
 357 UUIInteractionHelper::handleCertificateValidationRequest(
 358     uno::Reference< task::XInteractionRequest > const & rRequest)
 359 {
 360     uno::Any aAnyRequest(rRequest->getRequest());
 361
 362     ucb::CertificateValidationRequest aCertificateValidationRequest;
 363     if (aAnyRequest >>= aCertificateValidationRequest)
 364     {
 365         handleCertificateValidationRequest_(getParentProperty(),
 366                                             m_xContext,
 367                                             aCertificateValidationRequest,
 368                                             rRequest->getContinuations());
 369         return true;
 370     }
 371
 372     return false;
 373 }
 374
 375 /* vim:set shiftwidth=4 softtabstop=4 expandtab: */