Criticality of an X.509 extension can now be extracted.

diff --git a/includes/gnutls/x509.h b/includes/gnutls/x509.h
index 95fd84a84cbbee6163c43f116a01a0404f08f1e3..6acc72748d310263bab5c421a48eda5b783ae912 100644 (file)
--- a/includes/gnutls/x509.h
+++ b/includes/gnutls/x509.h
@@ -73,10 +73,11 @@ int gnutls_x509_certificate_get_serial(gnutls_x509_certificate cert, char* resul
 
 int gnutls_x509_certificate_get_pk_algorithm( gnutls_x509_certificate cert, int* bits);
 int gnutls_x509_certificate_get_subject_alt_name(gnutls_x509_certificate cert, 
-       int seq, char *ret, int *ret_size);
-int gnutls_x509_certificate_get_ca_status(gnutls_x509_certificate cert);
+       int seq, char *ret, int *ret_size, int* critical);
+int gnutls_x509_certificate_get_ca_status(gnutls_x509_certificate cert, int* critical);
 
-int gnutls_x509_certificate_get_key_usage( gnutls_x509_certificate cert, unsigned int* key_usage);
+int gnutls_x509_certificate_get_key_usage( gnutls_x509_certificate cert, unsigned int* key_usage,
+       int* critical);
 
 /* key_usage will be an OR of the following values:
  */
@@ -91,7 +92,7 @@ int gnutls_x509_certificate_get_key_usage( gnutls_x509_certificate cert, unsigne
 #define GNUTLS_KEY_DECIPHER_ONLY               1
 
 int gnutls_x509_certificate_get_extension_by_oid(gnutls_x509_certificate cert, const char* oid,
-       unsigned char* buf, int * sizeof_buf);
+       unsigned char* buf, int * sizeof_buf, int * critical);
 
 int gnutls_x509_certificate_to_xml(gnutls_x509_certificate cert, gnutls_datum* res, int detail);
 

diff --git a/lib/x509/compat.c b/lib/x509/compat.c
index 739643da476100b4cf3244734e626c0f4ea845d8..7a7bd37ae5604197dbdb199121992b56d89bcd2e 100644 (file)
--- a/lib/x509/compat.c
+++ b/lib/x509/compat.c
@@ -243,7 +243,7 @@ int gnutls_x509_extract_certificate_subject_alt_name(const gnutls_datum * cert,
                return result;
        }
        
-       result = gnutls_x509_certificate_get_subject_alt_name( xcert, seq, ret, ret_size);
+       result = gnutls_x509_certificate_get_subject_alt_name( xcert, seq, ret, ret_size, NULL);
        
        gnutls_x509_certificate_deinit( xcert);
        
@@ -278,7 +278,7 @@ int gnutls_x509_extract_certificate_ca_status(const gnutls_datum * cert)
                return result;
        }
        
-       result = gnutls_x509_certificate_get_ca_status( xcert);
+       result = gnutls_x509_certificate_get_ca_status( xcert, NULL);
        
        gnutls_x509_certificate_deinit( xcert);
        

diff --git a/lib/x509/extensions.c b/lib/x509/extensions.c
index f1724e83b65ca9c4ed25fcfe701c8bfa40e83449..5036cfd476cb677224521245f8866034411159f0 100644 (file)
--- a/lib/x509/extensions.c
+++ b/lib/x509/extensions.c
@@ -32,14 +32,17 @@
 /* This function will attempt to return the requested extension found in
  * the given X509v3 certificate. The return value is allocated and stored into
  * ret.
+ *
+ * Critical will be either 0 or 1.
  */
 int _gnutls_x509_certificate_get_extension( gnutls_x509_certificate cert, const char* extension_id, 
-       gnutls_datum* ret)
+       gnutls_datum* ret, int * _critical)
 {
        int k, result, len;
        char name[128], name2[128], counter[MAX_INT_DIGITS];
        char str[1024];
-       char critical[10];
+       char str_critical[10];
+       int critical = 0;
        char extnID[128];
        char extnValue[256];
 
@@ -85,9 +88,9 @@ int _gnutls_x509_certificate_get_extension( gnutls_x509_certificate cert, const
                        _gnutls_str_cpy(name2, sizeof(name2), name);
                        _gnutls_str_cat(name2, sizeof(name2), ".critical"); 
 
-                       len = sizeof(critical) - 1;
+                       len = sizeof(str_critical);
                        result =
-                           asn1_read_value(cert->cert, name2, critical, &len);
+                           asn1_read_value(cert->cert, name2, str_critical, &len);
 
                        if (result == ASN1_ELEMENT_NOT_FOUND) {
                                gnutls_assert();
@@ -97,6 +100,10 @@ int _gnutls_x509_certificate_get_extension( gnutls_x509_certificate cert, const
                                return _gnutls_asn2err(result);
                        }
 
+                       if (strcmp( str_critical, "TRUE")==0)
+                               critical = 1;
+                       else critical = 0;
+
                        _gnutls_str_cpy(name2, sizeof(name2), name);
                        _gnutls_str_cat(name2, sizeof(name2), ".extnValue"); 
 
@@ -108,7 +115,7 @@ int _gnutls_x509_certificate_get_extension( gnutls_x509_certificate cert, const
                                break;
                        else {
                                if (result == ASN1_MEM_ERROR
-                                   && strcmp(critical, "FALSE") == 0) {
+                                   && critical == 0) {
 
                                        _gnutls_x509_log
                                            ("X509_EXT: Cannot parse extension: %s. Too small buffer.",
@@ -131,6 +138,9 @@ int _gnutls_x509_certificate_get_extension( gnutls_x509_certificate cert, const
                                ret->size = len;
                                memcpy( ret->data, extnValue, len);
                                
+                               if (_critical)
+                                       *_critical = critical;
+                               
                                return 0;
                        }
 

diff --git a/lib/x509/extensions.h b/lib/x509/extensions.h
index 73c5c987873a5057249fd611fb245689fc35b3d3..b14c828b2bcb20e691d5842062b5ef36d832db27 100644 (file)
--- a/lib/x509/extensions.h
+++ b/lib/x509/extensions.h
@@ -1,5 +1,5 @@
 int _gnutls_x509_certificate_get_extension( gnutls_x509_certificate cert, const char* extension_id, 
-       gnutls_datum* ret);
+       gnutls_datum* ret, int* critical);
 int _gnutls_x509_ext_extract_keyUsage(uint16 *keyUsage, opaque * extnValue,
                             int extnValueLen);
 int _gnutls_x509_ext_extract_basicConstraints(int *CA, opaque * extnValue,

diff --git a/lib/x509/rfc2818_hostname.c b/lib/x509/rfc2818_hostname.c
index ba95634569c75c3c842d59fac8efea46d0d93a51..669dfafb59d2a9b915d0b805b818f96752b6b1e5 100644 (file)
--- a/lib/x509/rfc2818_hostname.c
+++ b/lib/x509/rfc2818_hostname.c
@@ -179,8 +179,7 @@ int gnutls_x509_certificate_check_hostname(gnutls_x509_certificate cert,
       dnsnamesize = sizeof(dnsname);
       ret =
           gnutls_x509_certificate_get_subject_alt_name(cert, i,
-                                                           dnsname,
-                                                           &dnsnamesize);
+                                        dnsname, &dnsnamesize, NULL);
 
       if (ret == GNUTLS_SAN_DNSNAME) {
          found_dnsname = 1;

diff --git a/lib/x509/x509.c b/lib/x509/x509.c
index 407bb0b63214d599c69d7c64fc672635af834f20..db89b4512ce280076098a81e6a630692073c8987 100644 (file)
--- a/lib/x509/x509.c
+++ b/lib/x509/x509.c
@@ -561,6 +561,7 @@ int gnutls_x509_certificate_get_pk_algorithm( gnutls_x509_certificate cert, int*
   * @seq: specifies the sequence number of the alt name (0 for the first one, 1 for the second etc.)
   * @ret: is the place where the alternative name will be copied to
   * @ret_size: holds the size of ret.
+  * @critical: will be non zero if the extension is marked as critical (may be null)
   *
   * This function will return the alternative names, contained in the
   * given certificate.
@@ -577,7 +578,7 @@ int gnutls_x509_certificate_get_pk_algorithm( gnutls_x509_certificate cert, int*
   *
   **/
 int gnutls_x509_certificate_get_subject_alt_name(gnutls_x509_certificate cert, 
-       int seq, char *ret, int *ret_size)
+       int seq, char *ret, int *ret_size, int *critical)
 {
        int result;
        gnutls_datum dnsname;
@@ -591,7 +592,7 @@ int gnutls_x509_certificate_get_subject_alt_name(gnutls_x509_certificate cert,
        memset(ret, 0, *ret_size);
 
        if ((result =
-            _gnutls_x509_certificate_get_extension(cert, "2 5 29 17", &dnsname)) < 0) {
+            _gnutls_x509_certificate_get_extension(cert, "2 5 29 17", &dnsname, critical)) < 0) {
                gnutls_assert();
                return result;
        }
@@ -671,6 +672,7 @@ int gnutls_x509_certificate_get_subject_alt_name(gnutls_x509_certificate cert,
 /**
   * gnutls_x509_certificate_get_ca_status - This function returns the certificate CA status
   * @cert: should contain a gnutls_x509_certificate structure
+  * @critical: will be non zero if the extension is marked as critical
   *
   * This function will return certificates CA status, by reading the 
   * basicConstraints X.509 extension. If the certificate is a CA a positive
@@ -682,14 +684,14 @@ int gnutls_x509_certificate_get_subject_alt_name(gnutls_x509_certificate cert,
   * GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
   *
   **/
-int gnutls_x509_certificate_get_ca_status(gnutls_x509_certificate cert)
+int gnutls_x509_certificate_get_ca_status(gnutls_x509_certificate cert, int* critical)
 {
        int result;
        gnutls_datum basicConstraints;
        int ca;
 
        if ((result =
-            _gnutls_x509_certificate_get_extension(cert, "2 5 29 19", &basicConstraints)) < 0) {
+            _gnutls_x509_certificate_get_extension(cert, "2 5 29 19", &basicConstraints, critical)) < 0) {
                gnutls_assert();
                return result;
        }
@@ -715,6 +717,7 @@ int gnutls_x509_certificate_get_ca_status(gnutls_x509_certificate cert)
   * gnutls_x509_certificate_get_key_usage - This function returns the certificate's key usage
   * @cert: should contain a gnutls_x509_certificate structure
   * @key_usage: where the key usage bits will be stored
+  * @critical: will be non zero if the extension is marked as critical
   *
   * This function will return certificate's key usage, by reading the 
   * keyUsage X.509 extension. The key usage value will ORed values of the:
@@ -729,14 +732,15 @@ int gnutls_x509_certificate_get_ca_status(gnutls_x509_certificate cert)
   * GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
   *
   **/
-int gnutls_x509_certificate_get_key_usage(gnutls_x509_certificate cert, unsigned int *key_usage)
+int gnutls_x509_certificate_get_key_usage(gnutls_x509_certificate cert, unsigned int *key_usage,
+       int *critical)
 {
        int result;
        gnutls_datum keyUsage;
        uint16 _usage;
 
        if ((result =
-            _gnutls_x509_certificate_get_extension(cert, "2 5 29 15", &keyUsage)) < 0) {
+            _gnutls_x509_certificate_get_extension(cert, "2 5 29 15", &keyUsage, critical)) < 0) {
                gnutls_assert();
                return result;
        }
@@ -766,6 +770,7 @@ int gnutls_x509_certificate_get_key_usage(gnutls_x509_certificate cert, unsigned
   * @oid: holds an Object Identified in null terminated string
   * @buf: a pointer to a structure to hold the name (may be null)
   * @sizeof_buf: initialy holds the size of 'buf'
+  * @critical: will be non zero if the extension is marked as critical
   *
   * This function will return the extension specified by the OID in the certificate.
   * The extensions will be returned as binary data DER encoded, in the provided
@@ -777,13 +782,13 @@ int gnutls_x509_certificate_get_key_usage(gnutls_x509_certificate cert, unsigned
   *
   **/
 int gnutls_x509_certificate_get_extension_by_oid(gnutls_x509_certificate cert, const char* oid,
-       unsigned char* buf, int * sizeof_buf)
+       unsigned char* buf, int * sizeof_buf, int * critical)
 {
        int result;
        gnutls_datum output;
 
        if ((result =
-            _gnutls_x509_certificate_get_extension(cert, oid, &output)) < 0) {
+            _gnutls_x509_certificate_get_extension(cert, oid, &output, critical)) < 0) {
                gnutls_assert();
                return result;
        }

diff --git a/lib/x509/x509.h b/lib/x509/x509.h
index 0dfbb57d68b4e0ba71d080196834869a42628ca5..c4bce3652d98733a7d25c724314186f820bfdc82 100644 (file)
--- a/lib/x509/x509.h
+++ b/lib/x509/x509.h
@@ -12,6 +12,6 @@ typedef struct gnutls_x509_certificate_int *gnutls_x509_certificate;
 int gnutls_x509_certificate_get_issuer_dn_by_oid(gnutls_x509_certificate cert, const char* oid, char *buf,
                                         int *sizeof_buf);
 int gnutls_x509_certificate_get_subject_alt_name(gnutls_x509_certificate cert, 
-       int seq, char *ret, int *ret_size);
+       int seq, char *ret, int *ret_size, int* critical);
 int gnutls_x509_certificate_get_dn_by_oid(gnutls_x509_certificate cert, const char* oid, char *buf,
                                         int *sizeof_buf);