[ssl] use win32 apis to verify certificates

Apprentice-Alchemist · Apprentice-Alchemist · commit 4d590124f91e · 2024-11-23T10:20:37.000+01:00
diff --git a/libs/ssl/ssl.c b/libs/ssl/ssl.c
@@ -234,6 +234,46 @@ DEFINE_PRIM(_I32, ssl_send, TSSL _BYTES _I32 _I32);
 DEFINE_PRIM(_I32, ssl_recv_char, TSSL);
 DEFINE_PRIM(_I32, ssl_recv, TSSL _BYTES _I32 _I32);
 
+static int verify_callback(void* param, mbedtls_x509_crt *crt, int depth, uint32_t *flags) {
+	if(depth == 0) {
+		HCERTSTORE store = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0, CERT_STORE_DEFER_CLOSE_UNTIL_LAST_FREE_FLAG, NULL);
+		if(store == NULL) {
+			// handle error
+		}
+		PCCERT_CONTEXT primary_context = {0};
+		if(!CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING, crt->raw.p, crt->raw.len, CERT_STORE_ADD_ALWAYS, &primary_context)) {
+			return MBEDTLS_ERR_X509_FATAL_ERROR;
+		}
+		while(crt->next) {
+			crt = crt->next;
+			PCCERT_CONTEXT ctx = {0};
+			if (!CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING, crt->raw.p, crt->raw.len, CERT_STORE_ADD_ALWAYS, &ctx))
+			{
+				return MBEDTLS_ERR_X509_FATAL_ERROR;
+			}
+			CertFreeCertificateContext(ctx);
+		}
+		PCCERT_CHAIN_CONTEXT chain_context = {0};
+		PCERT_CHAIN_PARA parameters = {0};
+		if(!CertGetCertificateChain(NULL, primary_context, NULL, store, parameters, 0, NULL, &chain_context)) {
+			return MBEDTLS_ERR_X509_FATAL_ERROR;
+		}
+		PCERT_CHAIN_POLICY_PARA policy_parameters = {0};
+		CERT_CHAIN_POLICY_STATUS policy_status = {0};
+		if(!CertVerifyCertificateChainPolicy(CERT_CHAIN_POLICY_SSL, chain_context, policy_parameters, &policy_status)) {
+			return MBEDTLS_ERR_X509_FATAL_ERROR;
+		}
+		if(policy_status.dwError != 0) {
+			// TODO: properly map errors
+			*flags |= MBEDTLS_X509_BADCERT_OTHER; 
+		}
+		CertFreeCertificateChain(chain_context);
+		CertFreeCertificateContext(primary_context);
+		CertCloseStore(store, 0);
+	}
+	return 0;
+}
+
 HL_PRIM mbedtls_ssl_config *HL_NAME(conf_new)(bool server) {
 	int ret;
 	mbedtls_ssl_config *conf;
@@ -245,6 +285,7 @@ HL_PRIM mbedtls_ssl_config *HL_NAME(conf_new)(bool server) {
 		ssl_error(ret);
 		return NULL;
 	}
+	mbedtls_ssl_conf_verify(conf, verify_callback, NULL);
 	mbedtls_ssl_conf_rng(conf, mbedtls_ctr_drbg_random, &ctr_drbg);
 	return conf;
 }
