- Several changes in the temporary (DH/RSA) parameter codebase. No DH
parameters are now included in the library. Also the credentials structure
can now hold only one temporary parameter of a kind.
-- Added a new Certificate and PKCS7 structures handling API, defined
- in gnutls/x509.h
+- Added a new Certificate, CRL, Private key and PKCS7 structures handling
+ API, defined in gnutls/x509.h
- Added support for Certificate Revocation lists. Functions defined
in gnutls/x509.h
- The only functions were removed are:
const char *hostname);
#define gnutls_x509_fingerprint gnutls_fingerprint
-#define gnutls_x509_certificate_format gnutls_x509_crt_format
+#define gnutls_x509_certificate_format gnutls_x509_crt_fmt
+
+int gnutls_x509_extract_key_pk_algorithm( const gnutls_datum * key);
#endif
int gnutls_x509_crt_init(gnutls_x509_crt * cert);
void gnutls_x509_crt_deinit(gnutls_x509_crt cert);
int gnutls_x509_crt_import(gnutls_x509_crt cert, const gnutls_datum * data,
- gnutls_x509_crt_format format);
+ gnutls_x509_crt_fmt format);
int gnutls_x509_crt_get_issuer_dn(gnutls_x509_crt cert, char *buf,
int *sizeof_buf);
int gnutls_x509_crt_get_issuer_dn_by_oid(gnutls_x509_crt cert,
void gnutls_x509_crl_deinit(gnutls_x509_crl crl);
int gnutls_x509_crl_import(gnutls_x509_crl crl, const gnutls_datum * data,
- gnutls_x509_crt_format format);
+ gnutls_x509_crt_fmt format);
int gnutls_x509_crl_get_issuer_dn(const gnutls_x509_crl crl,
char *buf, int *sizeof_buf);
int gnutls_pkcs7_get_certificate_count( gnutls_pkcs7 pkcs7);
int gnutls_pkcs7_import(gnutls_pkcs7 pkcs7, const gnutls_datum * data,
- gnutls_x509_crt_format format);
+ gnutls_x509_crt_fmt format);
int gnutls_pkcs7_get_certificate(gnutls_pkcs7 pkcs7, int indx,
char* certificate, int* certificate_size);
gnutls_digest_algorithm algo, char *buf,
int *sizeof_buf);
+/* Private key handling
+ */
+struct gnutls_x509_privkey_int;
+typedef struct gnutls_x509_privkey_int* gnutls_x509_privkey;
+
+int gnutls_x509_privkey_init(gnutls_x509_privkey * key);
+void gnutls_x509_privkey_deinit(gnutls_x509_privkey key);
+int gnutls_x509_privkey_import(gnutls_x509_privkey key, const gnutls_datum * data,
+ gnutls_x509_crt_fmt format);
+int gnutls_x509_privkey_get_pk_algorithm( gnutls_x509_privkey key);
+
+
#ifdef __cplusplus
}
#endif
typedef enum gnutls_certificate_type { GNUTLS_CRT_X509=1, GNUTLS_CRT_OPENPGP
} gnutls_certificate_type;
-typedef enum gnutls_x509_crt_format { GNUTLS_X509_FMT_DER,
- GNUTLS_X509_FMT_PEM } gnutls_x509_crt_format;
+typedef enum gnutls_x509_crt_fmt { GNUTLS_X509_FMT_DER,
+ GNUTLS_X509_FMT_PEM } gnutls_x509_crt_fmt;
typedef enum gnutls_pk_algorithm { GNUTLS_PK_RSA = 1, GNUTLS_PK_DSA,
GNUTLS_PK_UNKNOWN = 0xff
int gnutls_certificate_set_rsa_params(gnutls_certificate_credentials res, gnutls_rsa_params rsa_params);
int gnutls_certificate_set_x509_trust_file( gnutls_certificate_credentials res, const char* CAFILE,
- gnutls_x509_crt_format);
+ gnutls_x509_crt_fmt);
int gnutls_certificate_set_x509_trust_mem(gnutls_certificate_credentials res,
- const gnutls_datum *CA, gnutls_x509_crt_format);
+ const gnutls_datum *CA, gnutls_x509_crt_fmt);
int gnutls_certificate_set_x509_crl_file(gnutls_certificate_credentials res,
- const char *crlfile, gnutls_x509_crt_format type);
+ const char *crlfile, gnutls_x509_crt_fmt type);
int gnutls_certificate_set_x509_crl_mem(gnutls_certificate_credentials res,
- const gnutls_datum *CRL, gnutls_x509_crt_format type);
+ const gnutls_datum *CRL, gnutls_x509_crt_fmt type);
int gnutls_certificate_set_x509_key_file( gnutls_certificate_credentials res,
- const char *CERTFILE, const char* KEYFILE, gnutls_x509_crt_format);
+ const char *CERTFILE, const char* KEYFILE, gnutls_x509_crt_fmt);
int gnutls_certificate_set_x509_key_mem(gnutls_certificate_credentials res,
const gnutls_datum* CERT, const gnutls_datum* KEY,
- gnutls_x509_crt_format);
+ gnutls_x509_crt_fmt);
/* global state functions
*/
*
**/
int gnutls_pkcs3_extract_dh_params(const gnutls_datum * params,
- gnutls_x509_crt_format format,
+ gnutls_x509_crt_fmt format,
gnutls_datum * prime,
gnutls_datum * generator, int *bits)
{
**/
int gnutls_pkcs3_export_dh_params( const gnutls_datum * prime,
const gnutls_datum * generator,
- gnutls_x509_crt_format format,
+ gnutls_x509_crt_fmt format,
unsigned char* params_data, int* params_data_size)
{
ASN1_TYPE c2;
GNUTLS_HANDSHAKE, GNUTLS_APPLICATION_DATA
} ContentType;
-typedef enum gnutls_x509_crt_format { GNUTLS_X509_FMT_DER,
- GNUTLS_X509_FMT_PEM } gnutls_x509_crt_format;
+typedef enum gnutls_x509_crt_fmt { GNUTLS_X509_FMT_DER,
+ GNUTLS_X509_FMT_PEM } gnutls_x509_crt_fmt;
typedef enum gnutls_pk_algorithm { GNUTLS_PK_RSA = 1, GNUTLS_PK_DSA,
GNUTLS_PK_UNKNOWN = 0xff
return;
}
-/**
- * gnutls_x509_extract_key_pk_algorithm - This function returns the keys's PublicKey algorithm
- * @cert: is a DER encoded private key
- *
- * This function will return the public key algorithm of a DER encoded private
- * key.
- *
- * Returns a member of the gnutls_pk_algorithm enumeration on success,
- * or GNUTLS_E_UNKNOWN_PK_ALGORITHM on error.
- *
- **/
-int gnutls_x509_extract_key_pk_algorithm( const gnutls_datum * key)
-{
-int cv, pk;
-
- pk = GNUTLS_E_UNKNOWN_PK_ALGORITHM;
-
- /* The only way to distinguish the keys
- * is to count the sequence of integers.
- */
- cv = _gnutls_der_check_if_rsa_key( key);
- if (cv==0)
- pk = GNUTLS_PK_RSA;
- else {
- cv = _gnutls_der_check_if_dsa_key( key);
- if (cv==0)
- pk = GNUTLS_PK_DSA;
- }
-
- return pk;
-
-}
-
*/
int gnutls_pkcs3_extract_dh_params(const gnutls_datum * params,
- gnutls_x509_crt_format format, gnutls_datum * prime,
+ gnutls_x509_crt_fmt format, gnutls_datum * prime,
gnutls_datum * generator, int* prime_bits);
int gnutls_pkcs3_export_dh_params( const gnutls_datum * prime,
- const gnutls_datum * generator, gnutls_x509_crt_format format,
+ const gnutls_datum * generator, gnutls_x509_crt_fmt format,
unsigned char* params_data, int* params_data_size);
/* get data from the session
*/
static
int read_cert_mem(gnutls_certificate_credentials res, const char *cert, int cert_size,
- gnutls_x509_crt_format type)
+ gnutls_x509_crt_fmt type)
{
int ret;
* type indicates the certificate format.
*/
static int read_key_mem(gnutls_certificate_credentials res, const char *key, int key_size,
- gnutls_x509_crt_format type)
+ gnutls_x509_crt_fmt type)
{
int ret;
opaque *b64 = NULL;
/* Reads a certificate file
*/
static int read_cert_file(gnutls_certificate_credentials res, const char *certfile,
- gnutls_x509_crt_format type)
+ gnutls_x509_crt_fmt type)
{
int siz;
char x[MAX_FILE_SIZE];
* stores it).
*/
static int read_key_file(gnutls_certificate_credentials res, const char *keyfile,
- gnutls_x509_crt_format type)
+ gnutls_x509_crt_fmt type)
{
int siz;
char x[MAX_FILE_SIZE];
*
**/
int gnutls_certificate_set_x509_key_mem(gnutls_certificate_credentials res, const gnutls_datum* CERT,
- const gnutls_datum* KEY, gnutls_x509_crt_format type)
+ const gnutls_datum* KEY, gnutls_x509_crt_fmt type)
{
int ret;
*
**/
int gnutls_certificate_set_x509_key_file(gnutls_certificate_credentials res, const char *CERTFILE,
- const char *KEYFILE, gnutls_x509_crt_format type)
+ const char *KEYFILE, gnutls_x509_crt_fmt type)
{
int ret;
*
**/
int gnutls_certificate_set_x509_trust_mem(gnutls_certificate_credentials res,
- const gnutls_datum *CA, gnutls_x509_crt_format type)
+ const gnutls_datum *CA, gnutls_x509_crt_fmt type)
{
int ret, ret2;
*
**/
int gnutls_certificate_set_x509_trust_file(gnutls_certificate_credentials res,
- const char *CAFILE, gnutls_x509_crt_format type)
+ const char *CAFILE, gnutls_x509_crt_fmt type)
{
int ret, ret2;
int siz;
*/
static
int read_crl_mem(gnutls_certificate_credentials res, const char *crl, int crl_size,
- gnutls_x509_crt_format type)
+ gnutls_x509_crt_fmt type)
{
int ret;
*
**/
int gnutls_certificate_set_x509_crl_mem(gnutls_certificate_credentials res,
- const gnutls_datum *CRL, gnutls_x509_crt_format type)
+ const gnutls_datum *CRL, gnutls_x509_crt_fmt type)
{
int ret;
*
**/
int gnutls_certificate_set_x509_crl_file(gnutls_certificate_credentials res,
- const char *crlfile, gnutls_x509_crt_format type)
+ const char *crlfile, gnutls_x509_crt_fmt type)
{
int ret;
int siz;
noinst_LTLIBRARIES = libx509.la
COBJECTS = crl.c dn.c common.c x509.c extensions.c \
- pkcs7.c xml.c rfc2818_hostname.c verify.c mpi.c
+ pkcs7.c xml.c rfc2818_hostname.c verify.c mpi.c privkey.c
COMPAT_OBJECTS = compat.c
return ret;
}
+
+/**
+ * gnutls_x509_extract_key_pk_algorithm - This function returns the keys's PublicKey algorithm
+ * @cert: is a DER encoded private key
+ *
+ * This function will return the public key algorithm of a DER encoded private
+ * key.
+ *
+ * Returns a member of the gnutls_pk_algorithm enumeration on success,
+ * or GNUTLS_E_UNKNOWN_PK_ALGORITHM on error.
+ *
+ **/
+int gnutls_x509_extract_key_pk_algorithm( const gnutls_datum * key)
+{
+ gnutls_x509_privkey pkey;
+ int ret, pk;
+
+ ret = gnutls_x509_privkey_init( &pkey);
+ if (ret < 0) {
+ gnutls_assert();
+ return ret;
+ }
+
+ ret = gnutls_x509_privkey_import( pkey, key, GNUTLS_X509_FMT_DER);
+ if (ret < 0) {
+ gnutls_assert();
+ return ret;
+ }
+
+ pk = gnutls_x509_privkey_get_pk_algorithm( pkey);
+
+ gnutls_x509_privkey_deinit( pkey);
+ return pk;
+}
+
*
**/
int gnutls_x509_crl_import(gnutls_x509_crl crl, const gnutls_datum * data,
- gnutls_x509_crt_format format)
+ gnutls_x509_crt_fmt format)
{
int result = 0, need_free = 0;
int start, end;
*
**/
int gnutls_pkcs7_import(gnutls_pkcs7 pkcs7, const gnutls_datum * data,
- gnutls_x509_crt_format format)
+ gnutls_x509_crt_fmt format)
{
int result = 0, need_free = 0;
gnutls_datum _data = { data->data, data->size };
int gnutls_pkcs7_init(gnutls_pkcs7 * pkcs7);
void gnutls_pkcs7_deinit(gnutls_pkcs7 pkcs7);
int gnutls_pkcs7_import(gnutls_pkcs7 pkcs7, const gnutls_datum * data,
- gnutls_x509_crt_format format);
+ gnutls_x509_crt_fmt format);
int gnutls_pkcs7_get_certificate(gnutls_pkcs7 pkcs7,
int indx, char* certificate, int* certificate_size);
int gnutls_pkcs7_get_certificate_count(gnutls_pkcs7 pkcs7);
--- /dev/null
+/*
+ * Copyright (C) 2003 Nikos Mavroyanopoulos
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ */
+
+#include <gnutls_int.h>
+#include <gnutls_datum.h>
+#include <gnutls_global.h>
+#include <gnutls_errors.h>
+#include <common.h>
+#include <gnutls_x509.h>
+#include <x509_b64.h>
+#include <x509.h>
+#include <dn.h>
+#include <extensions.h>
+#include <gnutls_privkey.h>
+
+/**
+ * gnutls_x509_privkey_init - This function initializes a gnutls_crl structure
+ * @key: The structure to be initialized
+ *
+ * This function will initialize an private key structure.
+ *
+ * Returns 0 on success.
+ *
+ **/
+int gnutls_x509_privkey_init(gnutls_x509_privkey * key)
+{
+ *key = gnutls_calloc( 1, sizeof(gnutls_x509_privkey_int));
+
+ if (*key) {
+ return 0; /* success */
+ }
+ return GNUTLS_E_MEMORY_ERROR;
+}
+
+/**
+ * gnutls_x509_privkey_deinit - This function deinitializes memory used by a gnutls_x509_privkey structure
+ * @key: The structure to be initialized
+ *
+ * This function will deinitialize a CRL structure.
+ *
+ **/
+void gnutls_x509_privkey_deinit(gnutls_x509_privkey key)
+{
+ _gnutls_free_datum(&key->raw);
+
+ gnutls_free(key);
+}
+
+#define PEM_KEY_DSA "DSA PRIVATE"
+#define PEM_KEY_RSA "RSA PRIVATE"
+
+/**
+ * gnutls_x509_privkey_import - This function will import a DER or PEM encoded Certificate
+ * @key: The structure to store the parsed key
+ * @data: The DER or PEM encoded certificate.
+ * @format: One of DER or PEM
+ *
+ * This function will convert the given DER or PEM encoded Certificate
+ * to the native gnutls_x509_privkey format. The output will be stored in 'key'.
+ *
+ * If the Certificate is PEM encoded it should have a header of "X509 CERTIFICATE", or
+ * "CERTIFICATE" and must be a null terminated string.
+ *
+ * Returns 0 on success.
+ *
+ **/
+int gnutls_x509_privkey_import(gnutls_x509_privkey key, const gnutls_datum * data,
+ gnutls_x509_crt_fmt format)
+{
+ int result = 0, need_free = 0;
+ gnutls_datum _data = { data->data, data->size };
+
+ /* If the Certificate is in PEM format then decode it
+ */
+ if (format == GNUTLS_X509_FMT_PEM) {
+ opaque *out;
+
+ /* Try the first header */
+ result = _gnutls_fbase64_decode(PEM_KEY_RSA, data->data, data->size,
+ &out);
+
+ if (result <= 0) {
+ /* try for the second header */
+ result = _gnutls_fbase64_decode(PEM_KEY_DSA, data->data, data->size,
+ &out);
+
+ if (result <= 0) {
+ if (result==0) result = GNUTLS_E_INTERNAL_ERROR;
+ gnutls_assert();
+ return result;
+ }
+ }
+
+ _data.data = out;
+ _data.size = result;
+
+ need_free = 1;
+ }
+
+ result =
+ _gnutls_set_datum(&key->raw, _data.data, _data.size);
+ if (result < 0) {
+ gnutls_assert();
+ goto cleanup;
+ }
+
+ if (need_free) _gnutls_free_datum( &_data);
+
+ return 0;
+
+ cleanup:
+ _gnutls_free_datum(&key->raw);
+ if (need_free) _gnutls_free_datum( &_data);
+ return result;
+}
+
+
+
+/**
+ * gnutls_x509_privkey_get_pk_algorithm - This function returns the key's PublicKey algorithm
+ * @cert: should contain a gnutls_x509_privkey structure
+ *
+ * This function will return the public key algorithm of a private
+ * key.
+ *
+ * Returns a member of the gnutls_pk_algorithm enumeration on success,
+ * or a negative value on error.
+ *
+ **/
+int gnutls_x509_privkey_get_pk_algorithm( gnutls_x509_privkey key)
+{
+int cv, pk;
+
+ pk = GNUTLS_PK_UNKNOWN;
+
+ /* The only way to distinguish the keys
+ * is to count the sequence of integers.
+ */
+ cv = _gnutls_der_check_if_rsa_key( &key->raw);
+ if (cv==0)
+ pk = GNUTLS_PK_RSA;
+ else {
+ cv = _gnutls_der_check_if_dsa_key( &key->raw);
+ if (cv==0)
+ pk = GNUTLS_PK_DSA;
+ }
+
+ return pk;
+
+}
*
**/
int gnutls_x509_crt_import(gnutls_x509_crt cert, const gnutls_datum * data,
- gnutls_x509_crt_format format)
+ gnutls_x509_crt_fmt format)
{
int result = 0, need_free = 0;
int start, end;
gnutls_pk_algorithm signature_algorithm;
} gnutls_x509_crt_int;
+typedef struct gnutls_x509_privkey_int {
+ gnutls_datum raw; /* we only keep raw data for the moment */
+} gnutls_x509_privkey_int;
+
typedef struct gnutls_x509_crt_int *gnutls_x509_crt;
typedef struct gnutls_x509_crl_int *gnutls_x509_crl;
+typedef struct gnutls_x509_privkey_int *gnutls_x509_privkey;
int gnutls_x509_crt_get_issuer_dn_by_oid(gnutls_x509_crt cert, const char* oid,
int indx, char *buf, int *sizeof_buf);
void gnutls_x509_crl_deinit(gnutls_x509_crl crl);
int gnutls_x509_crl_init(gnutls_x509_crl * crl);
int gnutls_x509_crl_import(gnutls_x509_crl crl, const gnutls_datum * data,
- gnutls_x509_crt_format format);
+ gnutls_x509_crt_fmt format);
int gnutls_x509_crt_init(gnutls_x509_crt * cert);
void gnutls_x509_crt_deinit(gnutls_x509_crt cert);
int gnutls_x509_crt_import(gnutls_x509_crt cert, const gnutls_datum * data,
- gnutls_x509_crt_format format);
+ gnutls_x509_crt_fmt format);
int gnutls_x509_crt_get_key_usage(gnutls_x509_crt cert, unsigned int *key_usage,
int *critical);
int gnutls_x509_crt_get_version(gnutls_x509_crt cert);
+int gnutls_x509_privkey_init(gnutls_x509_privkey * key);
+void gnutls_x509_privkey_deinit(gnutls_x509_privkey key);
+int gnutls_x509_privkey_import(gnutls_x509_privkey key, const gnutls_datum * data,
+ gnutls_x509_crt_fmt format);
+int gnutls_x509_privkey_get_pk_algorithm( gnutls_x509_privkey key);
+
#endif
projects / thirdparty / gnutls.git / commitdiff
