Added flag GNUTLS_PKCS11_TOKEN_TRUSTED_UINT that can be used to obtain p11-kit's...

diff --git a/lib/includes/gnutls/pkcs11.h b/lib/includes/gnutls/pkcs11.h
index efd9ecf48559ec98b92d95309d37df48fd5506d7..93445f3abf0674a0159d0f3a51604a80f6c0aa69 100644 (file)
--- a/lib/includes/gnutls/pkcs11.h
+++ b/lib/includes/gnutls/pkcs11.h
@@ -220,10 +220,11 @@ typedef enum {
 
 /**
  * gnutls_pkcs11_token_info_t:
- * @GNUTLS_PKCS11_TOKEN_LABEL: The token's label
- * @GNUTLS_PKCS11_TOKEN_SERIAL: The token's serial number
- * @GNUTLS_PKCS11_TOKEN_MANUFACTURER: The token's manufacturer
- * @GNUTLS_PKCS11_TOKEN_MODEL: The token's model
+ * @GNUTLS_PKCS11_TOKEN_LABEL: The token's label (string)
+ * @GNUTLS_PKCS11_TOKEN_SERIAL: The token's serial number (string)
+ * @GNUTLS_PKCS11_TOKEN_MANUFACTURER: The token's manufacturer (string)
+ * @GNUTLS_PKCS11_TOKEN_MODEL: The token's model (string)
+ * @GNUTLS_PKCS11_TOKEN_TRUSTED: Whether the token is marked as trusted in p11-kit (unsigned int)
  *
  * Enumeration of types for retrieving token information.
  */
@@ -231,7 +232,8 @@ typedef enum {
        GNUTLS_PKCS11_TOKEN_LABEL,
        GNUTLS_PKCS11_TOKEN_SERIAL,
        GNUTLS_PKCS11_TOKEN_MANUFACTURER,
-       GNUTLS_PKCS11_TOKEN_MODEL
+       GNUTLS_PKCS11_TOKEN_MODEL,
+       GNUTLS_PKCS11_TOKEN_TRUSTED_UINT,
 } gnutls_pkcs11_token_info_t;
 
 /**

diff --git a/lib/pkcs11.c b/lib/pkcs11.c
index cf1bd86cb4d08e19cf3e98059520fb2f13489555..67fc0e6c2b10e00f0fe05bdfca5df95cff421e17 100644 (file)
--- a/lib/pkcs11.c
+++ b/lib/pkcs11.c
@@ -1775,6 +1775,9 @@ gnutls_pkcs11_token_get_url(unsigned int seq,
  * This function will return information about the PKCS 11 token such
  * as the label, id, etc.
  *
+ * All types are strings, except the type %GNUTLS_PKCS11_TOKEN_TRUSTED_UINT which
+ * returns an integer with true (1) or false (0) value.
+ *
  * Returns: %GNUTLS_E_SUCCESS (0) on success or a negative error code
  * on error.
  *
@@ -1786,11 +1789,15 @@ gnutls_pkcs11_token_get_info(const char *url,
                             void *output, size_t * output_size)
 {
        struct p11_kit_uri *info = NULL;
+       struct ck_function_list *module;
+       ck_slot_id_t slot;
        const uint8_t *str;
        size_t str_max;
        size_t len;
        int ret;
 
+       PKCS11_CHECK_INIT;
+
        ret = pkcs11_url_to_info(url, &info);
        if (ret < 0) {
                gnutls_assert();
@@ -1814,6 +1821,26 @@ gnutls_pkcs11_token_get_info(const char *url,
                str = p11_kit_uri_get_token_info(info)->model;
                str_max = 16;
                break;
+       case GNUTLS_PKCS11_TOKEN_TRUSTED_UINT:
+               if (*output_size < sizeof(ret)) {
+                       *output_size = sizeof(ret);
+                       return gnutls_assert_val(GNUTLS_E_SHORT_MEMORY_BUFFER);
+               }
+
+               ret = pkcs11_find_slot(&module, &slot, info, NULL);
+               if (ret < 0) {
+                       gnutls_assert();
+                       goto cleanup;
+               }
+
+               if (p11_kit_module_get_flags(module) & P11_KIT_MODULE_TRUSTED) {
+                       ret = 1;
+               } else {
+                       ret = 0;
+               }
+               memcpy(output, &ret, sizeof(ret));
+               ret = 0;
+               goto cleanup;
        default:
                p11_kit_uri_free(info);
                gnutls_assert();
@@ -1832,8 +1859,10 @@ gnutls_pkcs11_token_get_info(const char *url,
 
        *output_size = len;
 
+       ret = 0;
+cleanup:
        p11_kit_uri_free(info);
-       return 0;
+       return ret;
 }
 
 /**