return ret;
}
-#define MAX_CERT_LIST 16
-
/**
* gnutls_certificate_set_x509_simple_pkcs12_mem:
* @res: is a #gnutls_certificate_credentials_t structure.
{
gnutls_pkcs12_t p12;
gnutls_x509_privkey_t key = NULL;
- gnutls_x509_crt_t cert = NULL;
- gnutls_x509_crt_t *extra_certs = NULL;
+ gnutls_x509_crt_t *chain = NULL;
gnutls_x509_crl_t crl = NULL;
- unsigned int extra_certs_size = 0, i;
+ unsigned int chain_size = 0, i;
int ret;
ret = gnutls_pkcs12_init (&p12);
}
}
- ret = gnutls_pkcs12_simple_parse (p12, password, &key, &cert,
- &extra_certs, &extra_certs_size, &crl);
+ ret = gnutls_pkcs12_simple_parse (p12, password, &key, &chain, &chain_size,
+ NULL, NULL, &crl, 0);
gnutls_pkcs12_deinit (p12);
if (ret < 0)
{
return ret;
}
- if (key && cert)
+ if (key && chain)
{
- gnutls_x509_crt_t chain[MAX_CERT_LIST];
- unsigned int chain_size = 1, j;
- unsigned int done = 0;
-
- j = 0;
- chain[j] = cert;
-
- if (extra_certs_size > 0 && extra_certs_size < MAX_CERT_LIST-1)
- {
- do
- {
- for (i=0;i<extra_certs_size;i++)
- {
- if (gnutls_x509_crt_check_issuer(chain[j], extra_certs[i]) != 0 &&
- gnutls_x509_crt_check_issuer(extra_certs[i], chain[j]) == 0)
- {
- if (gnutls_x509_crt_check_issuer(extra_certs[i], extra_certs[i]) != 0)
- { /* we found a self-signed one. We are done. */
- done = 1;
- break;
- }
- chain[++j] = extra_certs[i];
- chain_size++;
- break;
- }
-
- if (i==extra_certs_size - 1)
- done = 1;
- }
- }
- while(done == 0);
- }
-
ret = gnutls_certificate_set_x509_key (res, chain, chain_size, key);
if (ret < 0)
{
goto done;
}
}
+ else
+ {
+ gnutls_assert();
+ ret = GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+ goto done;
+ }
if (crl)
{
ret = 0;
done:
- if (extra_certs)
+ if (chain)
{
- for (i=0;i<extra_certs_size;i++)
- gnutls_x509_crt_deinit (extra_certs[i]);
- gnutls_free(extra_certs);
+ for (i=0;i<chain_size;i++)
+ gnutls_x509_crt_deinit (chain[i]);
+ gnutls_free(chain);
}
- if (cert)
- gnutls_x509_crt_deinit (cert);
if (key)
gnutls_x509_privkey_deinit (key);
if (crl)
int gnutls_pkcs12_bag_decrypt (gnutls_pkcs12_bag_t bag, const char *pass);
int gnutls_pkcs12_bag_encrypt (gnutls_pkcs12_bag_t bag, const char *pass,
unsigned int flags);
- int gnutls_pkcs12_simple_parse (
- gnutls_pkcs12_t p12,
- const char *password,
- gnutls_x509_privkey_t * key,
- gnutls_x509_crt_t * cert,
- gnutls_x509_crt_t ** extra_certs_ret,
- unsigned int * extra_certs_ret_len,
- gnutls_x509_crl_t * crl);
+ int gnutls_pkcs12_simple_parse (gnutls_pkcs12_t p12,
+ const char *password,
+ gnutls_x509_privkey_t * key,
+ gnutls_x509_crt_t ** chain,
+ unsigned int * chain_len,
+ gnutls_x509_crt_t ** extra_certs,
+ unsigned int * extra_certs_len,
+ gnutls_x509_crl_t * crl,
+ unsigned int flags);
/**
* gnutls_pkcs12_bag_type_t:
}
+/* Checks if the extra_certs contain certificates that may form a chain
+ * with the first certificate in chain (it is expected that chain_len==1)
+ * and appends those in the chain.
+ */
+static int make_chain(gnutls_x509_crt_t **chain, unsigned int *chain_len,
+ gnutls_x509_crt_t **extra_certs, unsigned int *extra_certs_len)
+{
+unsigned int i;
+
+ if (*chain_len != 1)
+ return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
+
+ i = 0;
+ while(i<*extra_certs_len)
+ {
+ /* if it is an issuer but not a self-signed one */
+ if (gnutls_x509_crt_check_issuer((*chain)[*chain_len - 1], (*extra_certs)[i]) != 0 &&
+ gnutls_x509_crt_check_issuer((*extra_certs)[i], (*extra_certs)[i]) == 0)
+ {
+ *chain = gnutls_realloc (*chain, sizeof((*chain)[0]) *
+ ++(*chain_len));
+ if (*chain == NULL)
+ {
+ gnutls_assert();
+ return GNUTLS_E_MEMORY_ERROR;
+ }
+ (*chain)[*chain_len - 1] = (*extra_certs)[i];
+
+ (*extra_certs)[i] = (*extra_certs)[*extra_certs_len-1];
+ (*extra_certs_len)--;
+
+ i=0;
+ continue;
+ }
+ i++;
+ }
+ return 0;
+}
+
/**
* gnutls_pkcs12_simple_parse:
* @p12: the PKCS#12 blob.
* @password: optional password used to decrypt PKCS#12 blob, bags and keys.
* @key: a structure to store the parsed private key.
- * @cert: a structure to store the parsed certificate.
- * @extra_certs_ret: optional pointer to receive an array of additional
+ * @chain: the corresponding to key certificate chain
+ * @chain_len: will be updated with the number of additional
+ * @extra_certs: optional pointer to receive an array of additional
* certificates found in the PKCS#12 blob.
- * @extra_certs_ret_len: will be updated with the number of additional
+ * @extra_certs_len: will be updated with the number of additional
* certs.
- * @crl: a structure to store the parsed CRL.
+ * @crl: an optional structure to store the parsed CRL.
+ * @flags: should be zero
*
* This function parses a PKCS#12 blob in @p12blob and extracts the
- * private key, the corresponding certificate, and any additional
+ * private key, the corresponding certificate chain, and any additional
* certificates and a CRL.
*
* The @extra_certs_ret and @extra_certs_ret_len parameters are optional
gnutls_pkcs12_simple_parse (gnutls_pkcs12_t p12,
const char *password,
gnutls_x509_privkey_t * key,
- gnutls_x509_crt_t * cert,
- gnutls_x509_crt_t ** extra_certs_ret,
- unsigned int * extra_certs_ret_len,
- gnutls_x509_crl_t * crl)
+ gnutls_x509_crt_t ** chain,
+ unsigned int * chain_len,
+ gnutls_x509_crt_t ** extra_certs,
+ unsigned int * extra_certs_len,
+ gnutls_x509_crl_t * crl,
+ unsigned int flags)
{
gnutls_pkcs12_bag_t bag = NULL;
- gnutls_x509_crt_t *extra_certs = NULL;
- unsigned int extra_certs_len = 0;
+ gnutls_x509_crt_t *_extra_certs = NULL;
+ unsigned int _extra_certs_len = 0;
+ gnutls_x509_crt_t *_chain = NULL;
+ unsigned int _chain_len = 0;
int idx = 0;
int ret;
size_t cert_id_size = 0;
uint8_t key_id[20];
int privkey_ok = 0;
- *cert = NULL;
*key = NULL;
- *crl = NULL;
+
+ if (crl)
+ *crl = NULL;
/* find the first private key */
for (;;)
}
if (memcmp (cert_id, key_id, cert_id_size) != 0)
- { /* they don't match - skip the certificate */
- if (extra_certs_ret)
+ { /* they don't match - skip the certificate */
+ if (extra_certs)
{
- extra_certs = gnutls_realloc (extra_certs,
- sizeof(extra_certs[0]) *
- ++extra_certs_len);
- if (!extra_certs)
+ _extra_certs = gnutls_realloc (_extra_certs,
+ sizeof(_extra_certs[0]) *
+ ++_extra_certs_len);
+ if (!_extra_certs)
{
gnutls_assert ();
ret = GNUTLS_E_MEMORY_ERROR;
goto done;
}
- extra_certs[extra_certs_len - 1] = this_cert;
+ _extra_certs[_extra_certs_len - 1] = this_cert;
this_cert = NULL;
}
else
{
gnutls_x509_crt_deinit (this_cert);
}
- break;
}
else
{
- if (*cert != NULL) /* no need to set it again */
- {
- gnutls_assert ();
- break;
- }
- *cert = this_cert;
- this_cert = NULL;
+ if (_chain_len == 0)
+ {
+ _chain = gnutls_malloc (sizeof(_chain[0]) * (++_chain_len));
+ if (!_chain)
+ {
+ gnutls_assert ();
+ ret = GNUTLS_E_MEMORY_ERROR;
+ goto done;
+ }
+ _chain[_chain_len - 1] = this_cert;
+ this_cert = NULL;
+ }
+ else
+ {
+ gnutls_x509_crt_deinit (this_cert);
+ }
}
break;
case GNUTLS_BAG_CRL:
- if (*crl != NULL)
+ if (crl == NULL || *crl != NULL)
{
gnutls_assert ();
break;
gnutls_pkcs12_bag_deinit (bag);
}
+ if (_chain_len != 1)
+ {
+ ret = GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+ goto done;
+ }
+
+ ret = make_chain(&_chain, &_chain_len, &_extra_certs, &_extra_certs_len);
+ if (ret < 0)
+ {
+ gnutls_assert();
+ goto done;
+ }
+
ret = 0;
done:
if (bag)
gnutls_pkcs12_bag_deinit (bag);
- if (ret)
+ if (ret < 0)
{
if (*key)
gnutls_x509_privkey_deinit(*key);
- if (*cert)
- gnutls_x509_crt_deinit(*cert);
- if (extra_certs_len)
+ if (_extra_certs_len && _extra_certs != NULL)
+ {
+ unsigned int i;
+ for (i = 0; i < _extra_certs_len; i++)
+ gnutls_x509_crt_deinit(_extra_certs[i]);
+ gnutls_free(_extra_certs);
+ }
+ if (_chain_len && chain != NULL)
{
unsigned int i;
- for (i = 0; i < extra_certs_len; i++)
- gnutls_x509_crt_deinit(extra_certs[i]);
- gnutls_free(extra_certs);
+ for (i = 0; i < _chain_len; i++)
+ gnutls_x509_crt_deinit(_chain[i]);
+ gnutls_free(_chain);
}
}
- else if (extra_certs_ret)
+ else
{
- *extra_certs_ret = extra_certs;
- *extra_certs_ret_len = extra_certs_len;
+ if (extra_certs)
+ {
+ *extra_certs = _extra_certs;
+ *extra_certs_len = _extra_certs_len;
+ }
+
+ *chain = _chain;
+ *chain_len = _chain_len;
}
return ret;
mini-rehandshake rng-fork mini-eagain-dtls resume-dtls \
x509cert x509cert-tl infoaccess rsa-encrypt-decrypt \
mini-loss-time mini-tdb mini-dtls-rehandshake mini-record \
- mini-termination mini-x509-cas mini-x509-2
+ mini-termination mini-x509-cas mini-x509-2 pkcs12_simple
if ENABLE_OCSP
ctests += ocsp
TESTS_ENVIRONMENT = \
CAFILE=$(srcdir)/cert-tests/ca-certs.pem \
+ PKCS12_MANY_CERTS_FILE=$(srcdir)/pkcs12-decode/pkcs12_5certs.p12 \
PKCS12FILE=$(srcdir)/pkcs12-decode/client.p12 \
PKCS12PASSWORD=foobar \
PKCS12FILE_2=$(srcdir)/pkcs12-decode/pkcs12_2certs.p12 \
# along with this file; if not, write to the Free Software Foundation,
# Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
-EXTRA_DIST = client.p12 noclient.p12 unclient.p12 pkcs12_2certs.p12
+EXTRA_DIST = client.p12 noclient.p12 unclient.p12 pkcs12_2certs.p12 \
+ pkcs12_5certs.p12
dist_check_SCRIPTS = pkcs12
--- /dev/null
+/*
+ * Copyright (C) 2005-2012 Free Software Foundation, Inc.
+ *
+ * Author: Simon Josefsson
+ *
+ * This file is part of GnuTLS.
+ *
+ * GnuTLS is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * GnuTLS is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with GnuTLS; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <stdlib.h>
+#include <read-file.h>
+#include <gnutls/pkcs12.h>
+#include <gnutls/x509.h>
+#include "utils.h"
+
+void
+doit (void)
+{
+ const char *filename, *password = "1234";
+ gnutls_pkcs12_t pkcs12;
+ unsigned char* file_data;
+ size_t file_size;
+ gnutls_datum_t data;
+ gnutls_x509_crt_t * chain, * extras;
+ unsigned int chain_size, extras_size, i;
+ gnutls_x509_privkey_t pkey;
+ int ret;
+
+ ret = gnutls_global_init ();
+ if (ret < 0)
+ fail ("gnutls_global_init failed %d\n", ret);
+
+ ret = gnutls_pkcs12_init(&pkcs12);
+ if (ret < 0)
+ fail ("initialization failed: %s\n", gnutls_strerror(ret));
+
+ filename = getenv ("PKCS12_MANY_CERTS_FILE");
+
+ if (!filename)
+ filename = "pkcs12-decode/pkcs12_5certs.p12";
+
+ if (debug)
+ success ("Reading PKCS#12 blob from `%s' using password `%s'.\n",
+ filename, password);
+
+ file_data = (void*)read_binary_file( filename, &file_size);
+ if (file_data == NULL)
+ fail("cannot open file");
+
+ data.data = file_data;
+ data.size = file_size;
+ ret = gnutls_pkcs12_import(pkcs12, &data, GNUTLS_X509_FMT_DER, 0);
+ if (ret < 0)
+ fail ("pkcs12_import failed %d: %s\n", ret, gnutls_strerror (ret));
+
+ free(file_data);
+
+ if (debug)
+ success ("Read file OK\n");
+
+ ret = gnutls_pkcs12_simple_parse (pkcs12, password, &pkey, &chain, &chain_size,
+ &extras, &extras_size, NULL, 0);
+ if (ret < 0)
+ fail ("pkcs12_simple_parse failed %d: %s\n", ret, gnutls_strerror (ret));
+
+ if (chain_size != 1)
+ fail("chain size (%u) should have been 1\n", chain_size);
+
+ if (extras_size != 4)
+ fail("extras size (%u) should have been 4\n", extras_size);
+
+ if (debug)
+ {
+ char dn[512];
+ size_t dn_size;
+
+ dn_size = sizeof(dn);
+ ret = gnutls_x509_crt_get_dn(chain[0], dn, &dn_size);
+ if (ret < 0)
+ fail ("crt_get_dn failed %d: %s\n", ret, gnutls_strerror (ret));
+
+ success("dn: %s\n", dn);
+
+ dn_size = sizeof(dn);
+ ret = gnutls_x509_crt_get_issuer_dn(chain[0], dn, &dn_size);
+ if (ret < 0)
+ fail ("crt_get_dn failed %d: %s\n", ret, gnutls_strerror (ret));
+
+ success("issuer dn: %s\n", dn);
+ }
+
+ gnutls_pkcs12_deinit(pkcs12);
+ gnutls_x509_privkey_deinit(pkey);
+
+ for (i=0;i<chain_size;i++)
+ gnutls_x509_crt_deinit(chain[i]);
+ gnutls_free(chain);
+
+ for (i=0;i<extras_size;i++)
+ gnutls_x509_crt_deinit(extras[i]);
+ gnutls_free(extras);
+
+ gnutls_global_deinit ();
+}
projects / thirdparty / gnutls.git / commitdiff
