use the pass argument on PKCS #11 keys.

diff --git a/lib/auth/cert.h b/lib/auth/cert.h
index 48168291b9dea16b7346a9ada6992f93205dd2db..03fd3e97b6513eec44993c511a60ef2deac88f03 100644 (file)
--- a/lib/auth/cert.h
+++ b/lib/auth/cert.h
@@ -86,6 +86,8 @@ typedef struct gnutls_certificate_credentials_st
   gnutls_certificate_verify_function *verify_callback;
 
   struct pin_info_st pin;
+  /* temporarily hold the PIN if set_key_file2() is used with a PIN */
+  char pin_tmp[GNUTLS_PKCS11_MAX_PIN_LEN];
   
   /* OCSP */
   gnutls_status_request_ocsp_func ocsp_func;

diff --git a/lib/gnutls_cert.c b/lib/gnutls_cert.c
index dbfec96b3e4e2143e15ecee05457f8dbd8b96456..dffd6c16a45e666e639a1d12a5df4c78f6b03431 100644 (file)
--- a/lib/gnutls_cert.c
+++ b/lib/gnutls_cert.c
@@ -157,7 +157,7 @@ gnutls_certificate_free_credentials (gnutls_certificate_credentials_t sc)
   gnutls_certificate_free_keys (sc);
   gnutls_certificate_free_ca_names (sc);
   gnutls_free(sc->ocsp_response_file);
-
+  memset(sc->pin_tmp, 0, sizeof(sc->pin_tmp));
 #ifdef ENABLE_OPENPGP
   gnutls_openpgp_keyring_deinit (sc->keyring);
 #endif

diff --git a/lib/gnutls_x509.c b/lib/gnutls_x509.c
index acdd5b92367120ed9c8d0493866d06fcdba4cb79..d67ad5bf239b16bf46df5bc0543c287c7afcfe9b 100644 (file)
--- a/lib/gnutls_x509.c
+++ b/lib/gnutls_x509.c
@@ -626,6 +626,20 @@ read_cert_mem (gnutls_certificate_credentials_t res, const void *cert,
   return ret;
 }
 
+static int tmp_pin_cb(void* userdata, int attempt, const char *token_url, const char *token_label,
+       unsigned int flags, char *pin, size_t pin_max)
+{
+const char* tmp_pin = userdata;
+
+  if (attempt == 0) 
+    {
+      snprintf(pin, pin_max, "%s", tmp_pin);
+      return 0;
+    }
+  
+  return -1;
+}
+
 /* Reads a PEM encoded PKCS-1 RSA/DSA private key from memory.  Type
  * indicates the certificate format.  KEY can be NULL, to indicate
  * that GnuTLS doesn't know the private key.
@@ -653,6 +667,11 @@ read_key_mem (gnutls_certificate_credentials_t res,
       
       if (res->pin.cb)
         gnutls_privkey_set_pin_function(privkey, res->pin.cb, res->pin.data);
+      else if (pass != NULL)
+        {
+          snprintf(res->pin_tmp, sizeof(res->pin_tmp), "%s", pass);
+          gnutls_privkey_set_pin_function(privkey, tmp_pin_cb, res->pin_tmp);
+        }
 
       ret = gnutls_privkey_import_x509_raw (privkey, &tmp, type, pass, flags);
       if (ret < 0)