several cleanups. Removed old unneeded functions.

certificate verification was moved out of the handshake procedure.

diff --git a/lib/auth_dhe_rsa.c b/lib/auth_dhe_rsa.c
index dea2635e39aed3edc53d4c34666ab1c272750e26..ea219ef6d8757ec25093023232354038c525295f 100644 (file)
--- a/lib/auth_dhe_rsa.c
+++ b/lib/auth_dhe_rsa.c
@@ -104,7 +104,6 @@ static int gen_dhe_rsa_server_kx(GNUTLS_STATE state, opaque ** data)
 
                info = state->gnutls_key->auth_info;
                info->dh_bits = gcry_mpi_get_nbits(p);
-               info->peer_certificate_status = GNUTLS_CERT_NONE;
                state->gnutls_key->auth_info_type = GNUTLS_X509PKI;
 
        } else

diff --git a/lib/auth_x509.c b/lib/auth_x509.c
index 95b366b4fc0fcf387809b616f48a4fc2e0021e78..b29adfb52b94e21213121fed30e21ad9e36d043c 100644 (file)
--- a/lib/auth_x509.c
+++ b/lib/auth_x509.c
@@ -41,13 +41,11 @@
 /* Copies data from a internal certificate struct (gnutls_cert) to 
  * exported certificate struct (X509PKI_AUTH_INFO)
  */
-int _gnutls_copy_x509_auth_info( X509PKI_AUTH_INFO info, gnutls_cert* cert, int ncerts, CertificateStatus verify) {
+int _gnutls_copy_x509_auth_info( X509PKI_AUTH_INFO info, gnutls_cert* cert, int ncerts) {
  /* Copy peer's information to AUTH_INFO
   */
 int ret, i, j;
 
-       info->peer_certificate_status = verify;
-
        if (ncerts==0) {
                info->raw_certificate_list = NULL;
                info->ncerts = 0;
@@ -84,140 +82,6 @@ int ret, i, j;
        return ret;
 }
 
-typedef struct {
-       gnutls_datum rsa_modulus;
-       gnutls_datum rsa_exponent;
-} RSA_Params;
-
-/* This function extracts the RSA parameters from the given(?) certificate.
- */
-static int _gnutls_get_rsa_params(RSA_Params * params,
-                                 MPI * mod, MPI * exp, gnutls_datum cert)
-{
-       int ret = 0, result;
-       opaque str[5 * 1024];
-       int len = sizeof(str);
-       node_asn *srsa, *spk;
-
-       if (asn1_create_structure(_gnutls_get_pkix(), "PKIX1Implicit88.Certificate", &srsa, "rsa_params")
-           != ASN_OK) {
-               gnutls_assert();
-               return GNUTLS_E_ASN1_ERROR;
-       }
-       result = asn1_get_der(srsa, cert.data, cert.size);
-       if (result != ASN_OK) {
-               /* couldn't decode DER */
-               gnutls_assert();
-               return GNUTLS_E_ASN1_PARSING_ERROR;
-       }
-       len = sizeof(str) - 1;
-       result =
-           asn1_read_value
-           (srsa, "rsa_params.tbsCertificate.subjectPublicKeyInfo.algorithm.algorithm",
-            str, &len);
-
-       if (result != ASN_OK) {
-               gnutls_assert();
-               asn1_delete_structure(srsa);
-               return GNUTLS_E_ASN1_PARSING_ERROR;
-       }
-       if (!strcmp(str, "1 2 840 113549 1 1 1")) {     /* pkix-1 1 - RSA */
-               len = sizeof(str) - 1;
-               result =
-                   asn1_read_value
-                   (srsa, "rsa_params.tbsCertificate.subjectPublicKeyInfo.subjectPublicKey",
-                    str, &len);
-               asn1_delete_structure(srsa);
-
-               if (result != ASN_OK) {
-                       gnutls_assert();
-                       return GNUTLS_E_ASN1_PARSING_ERROR;
-               }
-               if (asn1_create_structure
-                   (_gnutls_get_pkcs(),
-                    "PKCS-1.RSAPublicKey", &spk, "rsa_public_key") != ASN_OK) {
-                       gnutls_assert();
-                       return GNUTLS_E_ASN1_ERROR;
-               }
-               if (len % 8 != 0) {
-                       gnutls_assert();
-                       asn1_delete_structure(spk);
-                       return GNUTLS_E_UNIMPLEMENTED_FEATURE;
-               }
-               result = asn1_get_der(spk, str, len / 8);
-
-               if (result != ASN_OK) {
-                       gnutls_assert();
-                       asn1_delete_structure(spk);
-                       return GNUTLS_E_ASN1_PARSING_ERROR;
-               }
-               len = sizeof(str) - 1;
-               result = asn1_read_value(spk, "rsa_public_key.modulus", str, &len);
-               if (result != ASN_OK) {
-                       gnutls_assert();
-                       asn1_delete_structure(spk);
-                       return GNUTLS_E_ASN1_PARSING_ERROR;
-               }
-               if (_gnutls_mpi_scan(mod, GCRYMPI_FMT_USG, str, &len) != 0) {
-                       gnutls_assert();
-                       asn1_delete_structure(spk);
-                       return GNUTLS_E_MPI_SCAN_FAILED;
-               }
-               if (params != NULL)
-                       if (gnutls_set_datum
-                           (&params->rsa_modulus, str, len) < 0) {
-                               gnutls_assert();
-                               asn1_delete_structure(spk);
-                               return GNUTLS_E_MEMORY_ERROR;
-                       }
-               len = sizeof(str) - 1;
-               result =
-                   asn1_read_value(spk, "rsa_public_key.publicExponent", str, &len);
-               if (result != ASN_OK) {
-                       gnutls_assert();
-                       asn1_delete_structure(spk);
-                       if (params != NULL)
-                               gnutls_free_datum(&params->rsa_modulus);
-                       _gnutls_mpi_release(mod);
-                       return GNUTLS_E_ASN1_PARSING_ERROR;
-               }
-               if (_gnutls_mpi_scan(exp, GCRYMPI_FMT_USG, str, &len) != 0) {
-                       gnutls_assert();
-                       _gnutls_mpi_release(mod);
-                       if (params != NULL)
-                               gnutls_free_datum(&params->rsa_modulus);
-                       asn1_delete_structure(spk);
-                       return GNUTLS_E_MPI_SCAN_FAILED;
-               }
-               if (params != NULL)
-                       if (gnutls_set_datum
-                           (&params->rsa_exponent, str, len) < 0) {
-                               _gnutls_mpi_release(mod);
-                               _gnutls_mpi_release(exp);
-                               if (params != NULL)
-                                       gnutls_free_datum(&params->
-                                                         rsa_modulus);
-                               asn1_delete_structure(spk);
-                               return GNUTLS_E_MEMORY_ERROR;
-                       }
-               asn1_delete_structure(spk);
-
-               ret = 0;
-
-       } else {
-               /* The certificate that was sent was not
-                * supported by the ciphersuite
-                */
-               gnutls_assert();
-               ret = GNUTLS_E_X509_CERTIFICATE_ERROR;
-
-               asn1_delete_structure(srsa);
-       }
-
-
-       return ret;
-}
-
 /* This function reads the RSA parameters from the given private key
  * cert is not a certificate but a der structure containing the private
  * key(s).
@@ -545,7 +409,6 @@ int _gnutls_proc_x509_server_certificate(GNUTLS_STATE state, opaque * data, int
        gnutls_cert *peer_certificate_list;
        int peer_certificate_list_size = 0;
        gnutls_datum tmp;
-       CertificateStatus verify;
 
        cred = _gnutls_get_cred(state->gnutls_key, GNUTLS_X509PKI, NULL);
        if (cred == NULL) {
@@ -563,7 +426,6 @@ int _gnutls_proc_x509_server_certificate(GNUTLS_STATE state, opaque * data, int
                state->gnutls_key->auth_info_size = sizeof(X509PKI_AUTH_INFO_INT);
 
                info = state->gnutls_key->auth_info;
-               info->peer_certificate_status = GNUTLS_CERT_NONE;
 
                state->gnutls_key->auth_info_type = GNUTLS_X509PKI;
        } else
@@ -582,7 +444,6 @@ int _gnutls_proc_x509_server_certificate(GNUTLS_STATE state, opaque * data, int
        if (size == 0) {
                gnutls_assert();
                /* no certificate was sent */
-               info->peer_certificate_status = GNUTLS_CERT_NONE;
                return GNUTLS_E_NO_CERTIFICATE_FOUND;
        }
        i = dsize;
@@ -637,32 +498,27 @@ int _gnutls_proc_x509_server_certificate(GNUTLS_STATE state, opaque * data, int
                j++;
        }
 
-       /* store the required parameters for the handshake
+       /* move RSA parameters to gnutls_key (state).
         */
-       if ((ret =
-            _gnutls_get_rsa_params(NULL, &state->gnutls_key->a, &state->gnutls_key->x,
-                                   peer_certificate_list[0].raw)) < 0) {
-               gnutls_assert();
-               CLEAR_CERTS;
-               gnutls_free(peer_certificate_list);
-               return ret;
-       }
-       /* Verify certificate 
-        */
-       verify = gnutls_verify_certificate(peer_certificate_list, peer_certificate_list_size,
-                                    cred->ca_list, cred->ncas, NULL, 0);
-       if (verify < 0) {
+       state->gnutls_key->a = gcry_mpi_copy(peer_certificate_list[0].params[0]);
+       state->gnutls_key->x = gcry_mpi_copy(peer_certificate_list[0].params[1]);
+
+       if (state->gnutls_key->a==NULL || state->gnutls_key->x==NULL) {
+               _gnutls_mpi_release( &state->gnutls_key->a);
+               _gnutls_mpi_release( &state->gnutls_key->x);
                gnutls_assert();
                CLEAR_CERTS;
                gnutls_free(peer_certificate_list);
-               return verify;
+               return GNUTLS_E_MEMORY_ERROR;
        }
 
        /* keep the PK algorithm */
        state->gnutls_internals.peer_pk_algorithm = peer_certificate_list[0].subject_pk_algorithm;
 
-       if ( (ret = _gnutls_copy_x509_auth_info(info, peer_certificate_list, peer_certificate_list_size, verify)) < 0) {
+       if ( (ret = _gnutls_copy_x509_auth_info(info, peer_certificate_list, peer_certificate_list_size)) < 0) {
                gnutls_assert();
+               CLEAR_CERTS;
+               gnutls_free(peer_certificate_list);
                return ret;
        }
 
@@ -721,7 +577,6 @@ int _gnutls_proc_x509_cert_req(GNUTLS_STATE state, opaque * data, int data_size)
                state->gnutls_key->auth_info_size = sizeof(X509PKI_AUTH_INFO_INT);
 
                info = state->gnutls_key->auth_info;
-               info->peer_certificate_status = GNUTLS_CERT_NONE;
        }
        info = state->gnutls_key->auth_info;
        
@@ -1110,7 +965,6 @@ int gnutls_x509pki_get_subject_dns_name(GNUTLS_STATE state, char* ret, int *ret_
 
        if ((result =
             _gnutls_get_extension( &info->raw_certificate_list[0], "2 5 29 17", &dnsname)) < 0) {
-               gnutls_assert();
                return result;
        }
 
@@ -1278,22 +1132,66 @@ int gnutls_x509pki_get_peer_certificate_version(GNUTLS_STATE state)
   * gnutls_x509pki_get_peer_certificate_status - This function returns the peer's certificate status
   * @state: is a gnutls state
   *
-  * This function will return the peer's certificate status (TRUSTED, EXPIRED etc.). This is the output
-  * of the certificate verification function. However you must also check the peer's name in order
-  * to check if the verified certificate belongs to the actual peer.
-  * Returns GNUTLS_CERT_NONE in case of an error, or if no certificate was sent.
+  * This function will try to verify the peer's certificate and return it's status (TRUSTED, EXPIRED etc.). 
+  * Status should be one of the CertificateStatus enumerated elements.
+  * However you must also check the peer's name in order to check if the verified certificate belongs to the 
+  * actual peer. Returns a negative error code in case of an error, or GNUTLS_CERT_NONE if no certificate was sent.
   *
   **/
-CertificateStatus gnutls_x509pki_get_peer_certificate_status(GNUTLS_STATE
-                                                            state)
+int gnutls_x509pki_get_peer_certificate_status(GNUTLS_STATE state)
 {
        X509PKI_AUTH_INFO info;
+       const X509PKI_CREDENTIALS cred;
+       CertificateStatus verify;
+       gnutls_cert* peer_certificate_list;
+       int peer_certificate_list_size, i, x, ret;
 
-       CHECK_AUTH(GNUTLS_X509PKI, GNUTLS_CERT_NONE);
+       CHECK_AUTH(GNUTLS_X509PKI, GNUTLS_E_INVALID_REQUEST);
 
        info = _gnutls_get_auth_info(state);
        if (info == NULL)
+               return GNUTLS_E_INVALID_REQUEST;
+
+       cred = _gnutls_get_cred(state->gnutls_key, GNUTLS_X509PKI, NULL);
+       if (cred == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_INSUFICIENT_CRED;
+       }
+
+       if (info->raw_certificate_list==NULL || info->ncerts==0)
                return GNUTLS_CERT_NONE;
 
-       return info->peer_certificate_status;
+       /* generate a list of gnutls_certs based on the auth info
+        * raw certs.
+        */
+       peer_certificate_list_size = info->ncerts;
+       peer_certificate_list = gnutls_calloc( 1, peer_certificate_list_size*sizeof(gnutls_cert));
+       if (peer_certificate_list==NULL) {
+               gnutls_assert();
+               return GNUTLS_E_MEMORY_ERROR;
+       }
+       
+       for (i=0;i<peer_certificate_list_size;i++) {
+               if ( (ret=_gnutls_cert2gnutlsCert( &peer_certificate_list[i], info->raw_certificate_list[i])) < 0) {
+                       gnutls_assert();
+                       CLEAR_CERTS;
+                       gnutls_free( peer_certificate_list);
+                       return ret;
+               }
+       }
+       
+       /* Verify certificate 
+        */
+       verify = gnutls_verify_certificate( peer_certificate_list, peer_certificate_list_size, cred->ca_list, cred->ncas, NULL, 0);
+
+       CLEAR_CERTS;
+       gnutls_free( peer_certificate_list);
+
+       if (verify < 0) {
+               gnutls_assert();
+               return GNUTLS_CERT_INVALID;
+       }
+
+
+       return verify;
 }

diff --git a/lib/auth_x509.h b/lib/auth_x509.h
index 774b8e7df91e5efbf2fb7390a9a2d1d75aa26663..3083f2e7b06ca76dae227f22d7aa5618a454ed35 100644 (file)
--- a/lib/auth_x509.h
+++ b/lib/auth_x509.h
@@ -44,14 +44,13 @@ typedef struct {
 #define X509PKI_CREDENTIALS X509PKI_CREDENTIALS_INT*
 
 typedef struct X509PKI_AUTH_INFO_INT {
-       CertificateStatus peer_certificate_status;
        int               certificate_requested; /* if the peer requested certificate
                                                  * this is non zero;
                                                  */
        int               dh_bits; /* bits of the DH (if DHE_RSA is used) */
        gnutls_datum*     raw_certificate_list; /* holds the raw certificate of the
-                                           * peer.
-                                           */
+                                                * peer.
+                                                */
        int               ncerts; /* holds the size of the list above */
 } *X509PKI_AUTH_INFO;
 

diff --git a/lib/gnutls_cert.h b/lib/gnutls_cert.h
index 1e3013bc4d90a567f1f602e0a8b816c30be18587..587530347e29eddaa655495389839fc234fd54fd 100644 (file)
--- a/lib/gnutls_cert.h
+++ b/lib/gnutls_cert.h
@@ -9,6 +9,8 @@
 typedef struct gnutls_cert {
        MPI params[MAX_PARAMS_SIZE];    /* the size of params depends on the public 
                                 * key algorithm 
+                                * RSA: [0] is modulus
+                                *      [1] is public exponent
                                 */
        PKAlgorithm subject_pk_algorithm;
 

diff --git a/lib/gnutls_ui.h b/lib/gnutls_ui.h
index 7c268a1be250076298ecb00430aa9a1970c07422..0f017729b41c181a25353d4d3a1f3937f57fd943 100644 (file)
--- a/lib/gnutls_ui.h
+++ b/lib/gnutls_ui.h
@@ -63,7 +63,7 @@ int gnutls_x509pki_get_certificate_request_status(  GNUTLS_STATE);
 int gnutls_x509pki_get_peer_dn( GNUTLS_STATE, gnutls_DN*);
 const gnutls_datum* gnutls_x509pki_get_peer_certificate_list( GNUTLS_STATE, int* list_size);
 int gnutls_x509pki_get_issuer_dn(  GNUTLS_STATE, gnutls_DN *);
-CertificateStatus gnutls_x509pki_get_peer_certificate_status( GNUTLS_STATE);
+int gnutls_x509pki_get_peer_certificate_status( GNUTLS_STATE);
 int gnutls_x509pki_get_peer_certificate_version( GNUTLS_STATE);
 time_t gnutls_x509pki_get_peer_certificate_activation_time( GNUTLS_STATE);
 time_t gnutls_x509pki_get_peer_certificate_expiration_time( GNUTLS_STATE);

diff --git a/src/serv.c b/src/serv.c
index 763da05504e1c33f0868d4a2922b3790d70c407d..6d9122d992d58752af5f7765c826e02aa5618f0b 100644 (file)
--- a/src/serv.c
+++ b/src/serv.c
@@ -169,11 +169,11 @@ void print_info(GNUTLS_STATE state)
                                printf(" - Certificate info:\n");
                                printf(" - Certificate version: #%d\n", gnutls_x509pki_client_get_peer_certificate_version(state));
 
-                               if (gnutls_x509pki_client_get_peer_dn( state, &dn) > 0) {
+                               if ( gnutls_x509pki_client_get_peer_dn( state, &dn) >= 0) {
                                        PRINT_DN( dn);
                                }
                                
-                               if (gnutls_x509pki_client_get_issuer_dn( state, &dn) > 0) {
+                               if (gnutls_x509pki_client_get_issuer_dn( state, &dn) >= 0) {
                                        printf(" - Certificate Issuer's info:\n");
                                        PRINT_DN( dn);
                                }