Added gnutls_privkey_sign_raw_data()

diff --git a/NEWS b/NEWS
index d692d31e1f1f5ced733faac58998406c3ceab80e..fcab4fc86f50ef8f49d996d9ae5d473089e1a098 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -26,6 +26,7 @@ gnutls_x509_trust_list_remove_trust_mem: Added
 gnutls_x509_trust_list_remove_trust_file: Added
 gnutls_x509_trust_list_remove_cas: Added
 gnutls_session_get_desc: Added
+gnutls_privkey_sign_raw_data: Added
 
 
 * Version 3.1.9 (released 2013-02-27)

diff --git a/doc/invoke-certtool.texi b/doc/invoke-certtool.texi
index ebdcdedcca2a67c4030ae3943930dd5fd0024c28..fb36c380bd1035127062dd50bb7c0e3dd5b248ca 100644 (file)
--- a/doc/invoke-certtool.texi
+++ b/doc/invoke-certtool.texi
@@ -6,7 +6,7 @@
 # 
 # DO NOT EDIT THIS FILE   (invoke-certtool.texi)
 # 
-# It has been AutoGen-ed  March  7, 2013 at 11:22:22 AM by AutoGen 5.16
+# It has been AutoGen-ed  March 14, 2013 at 04:18:00 PM by AutoGen 5.16
 # From the definitions    ../src/certtool-args.def
 # and the template file   agtexi-cmd.tpl
 @end ignore

diff --git a/doc/invoke-danetool.texi b/doc/invoke-danetool.texi
index b063e56358c9231eb7376d8b2e8225c593294515..527e7a05634905b2956696331731081ef0a574aa 100644 (file)
--- a/doc/invoke-danetool.texi
+++ b/doc/invoke-danetool.texi
@@ -6,7 +6,7 @@
 # 
 # DO NOT EDIT THIS FILE   (invoke-danetool.texi)
 # 
-# It has been AutoGen-ed  March  7, 2013 at 11:03:39 PM by AutoGen 5.16
+# It has been AutoGen-ed  March 14, 2013 at 04:18:00 PM by AutoGen 5.16
 # From the definitions    ../src/danetool-args.def
 # and the template file   agtexi-cmd.tpl
 @end ignore

diff --git a/lib/gnutls_privkey.c b/lib/gnutls_privkey.c
index 6d7bfedb7abbcc7aac6ab740899720afc36ed4c7..6efc8fac98ec5b4eadfb7817396c9d11e39c7db0 100644 (file)
--- a/lib/gnutls_privkey.c
+++ b/lib/gnutls_privkey.c
@@ -417,6 +417,9 @@ cleanup:
  * #gnutls_privkey_t structure. At least one of the two callbacks
  * must be non-null.
  *
+ * Note that the signing function is supposed to "raw" sign data, i.e.,
+ * without any hashing or preprocessing.
+ *
  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
  *   negative error value.
  *
@@ -449,6 +452,9 @@ gnutls_privkey_import_ext (gnutls_privkey_t pkey,
  * must be non-null. If a deinitialization function is provided
  * then flags is assumed to contain %GNUTLS_PRIVKEY_IMPORT_AUTO_RELEASE.
  *
+ * Note that the signing function is supposed to "raw" sign data, i.e.,
+ * without any hashing or preprocessing.
+ *
  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
  *   negative error value.
  *
@@ -728,7 +734,7 @@ gnutls_privkey_sign_data (gnutls_privkey_t signer,
       goto cleanup;
     }
 
-  ret = _gnutls_privkey_sign_hash (signer, &digest, signature);
+  ret = gnutls_privkey_sign_raw_data (signer, flags, &digest, signature);
   _gnutls_free_datum (&digest);
 
   if (ret < 0)
@@ -791,7 +797,7 @@ gnutls_privkey_sign_hash (gnutls_privkey_t signer,
       goto cleanup;
     }
 
-  ret = _gnutls_privkey_sign_hash (signer, &digest, signature);
+  ret = gnutls_privkey_sign_raw_data (signer, flags, &digest, signature);
   if (ret < 0)
     {
       gnutls_assert ();
@@ -805,42 +811,48 @@ cleanup:
   return ret;
 }
 
-/*-
- * _gnutls_privkey_sign_hash:
+/**
+ * gnutls_privkey_sign_raw_data:
  * @key: Holds the key
+ * @flags: should be zero
  * @data: holds the data to be signed
  * @signature: will contain the signature allocate with gnutls_malloc()
  *
  * This function will sign the given data using a signature algorithm
- * supported by the private key.
+ * supported by the private key. Note that this is a low-level function
+ * and does not apply any preprocessing or hash on the signed data. Use
+ * it only if you know what are you doing.
  *
  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
  * negative error value.
- -*/
+ *
+ * Since: 3.1.10
+ **/
 int
-_gnutls_privkey_sign_hash (gnutls_privkey_t key,
-                           const gnutls_datum_t * hash,
-                           gnutls_datum_t * signature)
+gnutls_privkey_sign_raw_data (gnutls_privkey_t key,
+                               unsigned flags,
+                                const gnutls_datum_t * data,
+                                gnutls_datum_t * signature)
 {
   switch (key->type)
     {
 #ifdef ENABLE_OPENPGP
     case GNUTLS_PRIVKEY_OPENPGP:
       return gnutls_openpgp_privkey_sign_hash (key->key.openpgp,
-                                                hash, signature);
+                                                data, signature);
 #endif
 #ifdef ENABLE_PKCS11
     case GNUTLS_PRIVKEY_PKCS11:
       return _gnutls_pkcs11_privkey_sign_hash (key->key.pkcs11,
-                                               hash, signature);
+                                               data, signature);
 #endif
     case GNUTLS_PRIVKEY_X509:
       return _gnutls_pk_sign (key->key.x509->pk_algorithm,
-                              signature, hash, &key->key.x509->params);
+                              signature, data, &key->key.x509->params);
     case GNUTLS_PRIVKEY_EXT:
       if (key->key.ext.sign_func == NULL)
         return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
-      return key->key.ext.sign_func(key, key->key.ext.userdata, hash, signature);
+      return key->key.ext.sign_func(key, key->key.ext.userdata, data, signature);
     default:
       gnutls_assert ();
       return GNUTLS_E_INVALID_REQUEST;

diff --git a/lib/gnutls_sig.c b/lib/gnutls_sig.c
index 1458dd55c2fd9ba2d8061caece60c7f0ee5d53c9..572795b773fce9e6a00dcbe88bc896296bc2dde8 100644 (file)
--- a/lib/gnutls_sig.c
+++ b/lib/gnutls_sig.c
@@ -226,7 +226,7 @@ es_cleanup:
     }
 
    if (!_gnutls_version_has_selectable_sighash (ver))
-    return _gnutls_privkey_sign_hash (pkey, hash_concat, signature);
+    return gnutls_privkey_sign_raw_data (pkey, 0, hash_concat, signature);
   else
     return gnutls_privkey_sign_hash (pkey, hash_algo, 0, hash_concat, signature);
 }

diff --git a/lib/gnutls_sig.h b/lib/gnutls_sig.h
index e25879dd82b39e3db28dd48cef48947713bf39fa..6b0993cca33ca0f3a08e0dda51783650ecc30f35 100644 (file)
--- a/lib/gnutls_sig.h
+++ b/lib/gnutls_sig.h
@@ -54,10 +54,4 @@ int pk_hash_data (gnutls_pk_algorithm_t pk, gnutls_digest_algorithm_t hash,
                   gnutls_pk_params_st * params, const gnutls_datum_t * data,
                   gnutls_datum_t * digest);
 
-int
-_gnutls_privkey_sign_hash (gnutls_privkey_t key,
-                           const gnutls_datum_t * hash,
-                           gnutls_datum_t * signature);
-
-
 #endif

diff --git a/lib/includes/gnutls/abstract.h b/lib/includes/gnutls/abstract.h
index de4ed4ce3424f2085d4de9b60768ce11165926ba..d675ea8702978dc82811045c91b62acb502ae823 100644 (file)
--- a/lib/includes/gnutls/abstract.h
+++ b/lib/includes/gnutls/abstract.h
@@ -284,6 +284,12 @@ int gnutls_privkey_sign_hash (gnutls_privkey_t signer,
                              const gnutls_datum_t * hash_data,
                              gnutls_datum_t * signature);
 
+int
+gnutls_privkey_sign_raw_data (gnutls_privkey_t key,
+                             unsigned flags,
+                              const gnutls_datum_t * data,
+                              gnutls_datum_t * signature);
+
 int gnutls_privkey_decrypt_data (gnutls_privkey_t key,
                                  unsigned int flags,
                                  const gnutls_datum_t * ciphertext,

diff --git a/lib/libgnutls.map b/lib/libgnutls.map
index a762d189aaae6ab6cc66c31c49989df349dae7d3..f40119db0714c0594d0e1a96ee37280b0a36bed4 100644 (file)
--- a/lib/libgnutls.map
+++ b/lib/libgnutls.map
@@ -901,6 +901,7 @@ GNUTLS_3_1_0 {
        gnutls_x509_trust_list_remove_trust_file;
        gnutls_x509_trust_list_remove_cas;
        gnutls_session_get_desc;
+       gnutls_privkey_sign_raw_data;
 } GNUTLS_3_0_0;
 
 GNUTLS_PRIVATE {