Improved the certificate and key read functions. They can now read a PEM encoded...

diff --git a/NEWS b/NEWS
index 027684980e5f3d5ed7b8f6b17c0a3c605668b8b3..e14f8873d0302385e0a177f0462a4814f0ef301d 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,7 @@ Version 0.5.5
   for other hash algorithms except for the srpsha. 
 - Renamed all the constructed types in order to have more consistent
   names. 
+- Improved the certificate and key read functions.
 
 Version 0.5.4 (27/08/2002)
 - Fixes in TLS 1.0 PRF and SSL3 random functions.

diff --git a/lib/gnutls_x509.c b/lib/gnutls_x509.c
index 8e2da47d6711d14a67312d644a264dcd7d77872f..7484957899299e90dbaaa8f77eac03ad9e88abdf 100644 (file)
--- a/lib/gnutls_x509.c
+++ b/lib/gnutls_x509.c
@@ -1207,11 +1207,11 @@ static int parse_pem_cert_mem( gnutls_cert** cert_list, int* ncerts,
        gnutls_datum tmp;
        int ret, count;
 
-       ptr = input_cert;
-       siz = input_cert_size;
+       if ( (ptr = strstr( input_cert, PEM_PKCS7_SEP)) != NULL) 
+       {
+               siz = strlen( ptr);
 
-       if (strstr( input_cert, "-----BEGIN PKCS7")!=NULL) {
-               siz2 = _gnutls_fbase64_decode(ptr, siz, &b64);
+               siz2 = _gnutls_fbase64_decode( ptr, siz, &b64);
 
                ret = parse_pkcs7_cert_mem( cert_list, ncerts, b64,
                        siz2);
@@ -1221,6 +1221,15 @@ static int parse_pem_cert_mem( gnutls_cert** cert_list, int* ncerts,
                return ret;
        }
 
+       /* move to the certificate
+        */
+       ptr = strstr( input_cert, PEM_CERT_SEP);
+       if (ptr == NULL) {
+               gnutls_assert();
+               return GNUTLS_E_PARSING_ERROR;
+       }
+       siz = strlen( ptr);
+
        i = *ncerts + 1;
        count = 0;
 
@@ -1274,7 +1283,7 @@ static int parse_pem_cert_mem( gnutls_cert** cert_list, int* ncerts,
 
 
 
-/* Reads a base64 encoded certificate from memory
+/* Reads a DER or PEM certificate from memory
  */
 static int read_cert_mem(GNUTLS_CERTIFICATE_CREDENTIALS res, const char *cert, int cert_size, 
        gnutls_x509_certificate_fmt type)
@@ -1412,10 +1421,23 @@ static int read_key_mem(GNUTLS_CERTIFICATE_CREDENTIALS res, const char *key, int
                /* If we find the "DSA PRIVATE" string in the
                 * pem encoded certificate then it's a DSA key.
                 */
-               if (strstr( key, "DSA PRIVATE")!=NULL) 
+               if (strstr( key, "DSA PRIVATE")!=NULL) {
                        pk = GNUTLS_PK_DSA;
-               else
+                       key = strstr( key, PEM_KEY_DSA_SEP);
+                       if (key == NULL) {
+                               gnutls_assert();
+                               return GNUTLS_E_PARSING_ERROR;
+                       }                       key_size = strlen( key);
+               } else {
                        pk = GNUTLS_PK_RSA;
+                       key = strstr( key, PEM_KEY_RSA_SEP);
+                       if (key == NULL) {
+                               gnutls_assert();
+                               return GNUTLS_E_PARSING_ERROR;
+                       }
+                       key_size = strlen( key);
+               }
+                       
 
                ret = _gnutls_fbase64_decode(key, key_size, &b64);
 
@@ -1692,6 +1714,9 @@ int gnutls_certificate_set_x509_trust_file(GNUTLS_CERTIFICATE_CREDENTIALS res,
   * DSA private keys are encoded the OpenSSL way, which is an ASN.1
   * DER sequence of 6 INTEGERs - version, p, q, g, pub, priv.
   *
+  * If the certificate and the private key are given in PEM encoding
+  * then the strings that hold their values must be null terminated.
+  *
   **/
 int gnutls_certificate_set_x509_key_mem(GNUTLS_CERTIFICATE_CREDENTIALS res, const gnutls_datum* CERT,
                           const gnutls_datum* KEY, gnutls_x509_certificate_fmt type)

diff --git a/lib/gnutls_x509.h b/lib/gnutls_x509.h
index 8fe3398e76b3ae3e8b04ad35878280eddf1771d4..a692b3cfdd2668fc2e92d12af45cb9e87d193b60 100644 (file)
--- a/lib/gnutls_x509.h
+++ b/lib/gnutls_x509.h
@@ -13,7 +13,11 @@ int _gnutls_x509_cert2gnutls_cert(gnutls_cert * gCert, gnutls_datum derCert, Con
 #define MAX_INT_DIGITS 4
 void _gnutls_int2str(unsigned int k, char *data);
 
-#define PEM_CERT_SEP "-----BEGIN"
+#define PEM_CERT_SEP "-----BEGIN CERTIFICATE"
+#define PEM_PKCS7_SEP "-----BEGIN PKCS7"
+
+#define PEM_KEY_RSA_SEP "-----BEGIN RSA"
+#define PEM_KEY_DSA_SEP "-----BEGIN DSA"
 
 int _gnutls_check_x509_key_usage( const gnutls_cert * cert, gnutls_kx_algorithm alg);
 time_t gnutls_x509_extract_certificate_activation_time( const gnutls_datum*);