Combined object flags. No implicit login any more. Login has to be specified with...

on every call that could use it.

diff --git a/lib/includes/gnutls/pkcs11.h b/lib/includes/gnutls/pkcs11.h
index e7ae57a5b76ff547407a5f62ec4ea240e5649215..e7548042464382d74beff148213892148f4bb58b 100644 (file)
--- a/lib/includes/gnutls/pkcs11.h
+++ b/lib/includes/gnutls/pkcs11.h
@@ -49,6 +49,7 @@ int gnutls_pkcs11_add_provider (const char * name, const char * params);
 int gnutls_pkcs11_obj_init ( gnutls_pkcs11_obj_t *certificate);
 
 #define GNUTLS_PKCS11_OBJ_FLAG_LOGIN 1 /* force login in the token for the operation */
+#define GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED 1 /* object marked as trusted */
 
 int gnutls_pkcs11_obj_import_url (gnutls_pkcs11_obj_t, const char * url,
        unsigned int flags/* GNUTLS_PKCS11_OBJ_FLAG_* */);
@@ -59,14 +60,13 @@ int gnutls_pkcs11_obj_export(gnutls_pkcs11_obj_t obj,
                     void *output_data, size_t * output_data_size);
 
 
-#define GNUTLS_PKCS11_COPY_FLAG_MARK_TRUSTED 1 /* object marked as trusted */
-
 int gnutls_pkcs11_copy_x509_crt(const char* token_url, gnutls_x509_crt_t crt, 
-       const char* label, unsigned int flags /* GNUTLS_PKCS11_COPY_FLAG_* */);
+       const char* label, unsigned int flags /* GNUTLS_PKCS11_OBJ_FLAG_* */);
 int gnutls_pkcs11_copy_x509_privkey(const char* token_url, 
        gnutls_x509_privkey_t crt, const char* label, unsigned int key_usage /*GNUTLS_KEY_* */,
-       unsigned int flags /* GNUTLS_PKCS11_COPY_FLAG_* */);
-int gnutls_pkcs11_delete_url(const char* object_url);
+       unsigned int flags /* GNUTLS_PKCS11_OBJ_FLAG_* */);
+int gnutls_pkcs11_delete_url(const char* object_url, 
+       unsigned int flags/* GNUTLS_PKCS11_OBJ_FLAG_* */);
 
 typedef enum {
        GNUTLS_PKCS11_OBJ_ID_HEX=1,

diff --git a/lib/pkcs11.c b/lib/pkcs11.c
index f4ae85d02678ad819836f292445e8e35362bf809..0d1d8d43bbd94b4972272a99ad51b8199cc776f6 100644 (file)
--- a/lib/pkcs11.c
+++ b/lib/pkcs11.c
@@ -1517,7 +1517,7 @@ static int find_obj_url(pakchois_session_t * pks, struct token_info *info,
        return ret;
 }
 
-inline static unsigned int pkcs11_obj_flags_to_int(unsigned int flags)
+unsigned int pkcs11_obj_flags_to_int(unsigned int flags)
 {
         switch(flags) {
                 case GNUTLS_PKCS11_OBJ_FLAG_LOGIN:

diff --git a/lib/pkcs11_int.h b/lib/pkcs11_int.h
index f177183b8f3ee934a71d68f9d7bd6b63f1a96b15..783478d0533588d53d467384fc051e46364a9cd8 100644 (file)
--- a/lib/pkcs11_int.h
+++ b/lib/pkcs11_int.h
@@ -89,4 +89,6 @@ int pkcs11_find_object(pakchois_session_t ** _pks,
                       struct pkcs11_url_info *info, token_creds_st *,
                       unsigned int flags);
 
+unsigned int pkcs11_obj_flags_to_int(unsigned int flags);
+
 #endif

diff --git a/lib/pkcs11_write.c b/lib/pkcs11_write.c
index 09d32a7fb205ab8e7c9b5c0fa8dd5062b93d174b..7ed62b4f05055710a54c1b21531dee19f8fcb27c 100644 (file)
--- a/lib/pkcs11_write.c
+++ b/lib/pkcs11_write.c
@@ -33,7 +33,7 @@
  * @token_url: A PKCS #11 URL specifying a token
  * @crt: A certificate
  * @label: A name to be used for the stored data
- * @flags: One of GNUTLS_PKCS11_COPY_FLAG_*
+ * @flags: One of GNUTLS_PKCS11_OBJ_FLAG_*
  *
  * This function will copy a certificate into a PKCS #11 token specified by
  * a URL. The certificate can be marked as trusted or not.
@@ -67,7 +67,7 @@ int gnutls_pkcs11_copy_x509_crt(const char *token_url,
 
        ret =
            pkcs11_open_session(&pks, &info, NULL,
-                               SESSION_WRITE | SESSION_LOGIN);
+                               SESSION_WRITE | pkcs11_obj_flags_to_int(flags));
        if (ret < 0) {
                gnutls_assert();
                return ret;
@@ -128,7 +128,7 @@ int gnutls_pkcs11_copy_x509_crt(const char *token_url,
                a_val++;
        }
 
-       if (flags & GNUTLS_PKCS11_COPY_FLAG_MARK_TRUSTED) {
+       if (flags & GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED) {
                a[a_val].type = CKA_TRUSTED;
                a[a_val].value = &tval;
                a[a_val].value_len = sizeof(tval);
@@ -162,7 +162,7 @@ int gnutls_pkcs11_copy_x509_crt(const char *token_url,
  * @key: A private key
  * @label: A name to be used for the stored data
  * @key_usage: One of GNUTLS_KEY_*
- * @flags: One of GNUTLS_PKCS11_COPY_* flags
+ * @flags: One of GNUTLS_PKCS11_OBJ_* flags
  *
  * This function will copy a private key into a PKCS #11 token specified by
  * a URL. 
@@ -208,7 +208,7 @@ int gnutls_pkcs11_copy_x509_privkey(const char *token_url,
 
        ret =
            pkcs11_open_session(&pks, &info, NULL,
-                               SESSION_WRITE | SESSION_LOGIN);
+                               SESSION_WRITE | pkcs11_obj_flags_to_int(flags));
        if (ret < 0) {
                gnutls_assert();
                return ret;
@@ -418,12 +418,6 @@ static int delete_obj_url(pakchois_session_t * pks,
                }
        }
 
-       ret = pkcs11_login(pks, info, NULL);
-       if (ret < 0) {
-               gnutls_assert();
-               return ret;
-       }
-
        a_vals = 0;
 
        /* Find objects with given class and type */
@@ -494,13 +488,14 @@ static int delete_obj_url(pakchois_session_t * pks,
 /**
  * gnutls_pkcs11_delete_url:
  * @object_url: The URL of the object to delete.
+ * @flags: One of GNUTLS_PKCS11_OBJ_* flags
  * 
  * This function will delete objects matching the given URL.
  *
  * Returns: On success, the number of objects deleted is returned, otherwise a
  *   negative error value.
  **/
-int gnutls_pkcs11_delete_url(const char *object_url)
+int gnutls_pkcs11_delete_url(const char *object_url, unsigned int flags)
 {
        int ret;
        struct delete_data_st find_data;
@@ -515,7 +510,7 @@ int gnutls_pkcs11_delete_url(const char *object_url)
 
        ret =
            _pkcs11_traverse_tokens(delete_obj_url, &find_data,
-                                   SESSION_WRITE);
+                                   SESSION_WRITE|pkcs11_obj_flags_to_int(flags));
        if (ret < 0) {
                gnutls_assert();
                return ret;

diff --git a/src/certtool-common.h b/src/certtool-common.h
index 010eac0142f4f58b703c0ff623d9ee7acf81f8ce..093ceef86964cb765c04a2fc812266258aeacb41 100644 (file)
--- a/src/certtool-common.h
+++ b/src/certtool-common.h
@@ -41,8 +41,8 @@ void certtool_version (void);
 void pkcs11_list( FILE*outfile, const char* url, int type, unsigned int login);
 void pkcs11_export(FILE* outfile, const char *pkcs11_url, unsigned int login);
 void pkcs11_token_list(FILE* outfile);
-void pkcs11_write(FILE* outfile, const char *pkcs11_url, const char* label, int trusted);
-void pkcs11_delete(FILE* outfile, const char *pkcs11_url, int batch);
+void pkcs11_write(FILE* outfile, const char *pkcs11_url, const char* label, int trusted, unsigned int login);
+void pkcs11_delete(FILE* outfile, const char *pkcs11_url, int batch, unsigned int login);
 
 #define PKCS11_TYPE_CRT_ALL 1
 #define PKCS11_TYPE_TRUSTED 2

diff --git a/src/certtool.c b/src/certtool.c
index 02a44173ce995fc7f78a33db075026b5b39191bc..dcca2fa28f72baf26714473833a3cf8eb3b63eb4 100644 (file)
--- a/src/certtool.c
+++ b/src/certtool.c
@@ -1136,10 +1136,10 @@ gaa_parser (int argc, char **argv)
       pkcs11_export(outfile, info.pkcs11_url, info.pkcs11_login);
       break;
     case ACTION_PKCS11_WRITE_URL:
-      pkcs11_write(outfile, info.pkcs11_url, info.pkcs11_label, info.pkcs11_trusted);
+      pkcs11_write(outfile, info.pkcs11_url, info.pkcs11_label, info.pkcs11_trusted, info.pkcs11_login);
       break;
     case ACTION_PKCS11_DELETE_URL:
-      pkcs11_delete(outfile, info.pkcs11_url, batch);
+      pkcs11_delete(outfile, info.pkcs11_url, batch, info.pkcs11_login);
       break;
 #ifdef ENABLE_OPENPGP
     case ACTION_PGP_INFO:

diff --git a/src/pkcs11.c b/src/pkcs11.c
index f4275b940a580f42329d02f7e6a17dadcd40135b..ae28a84e2f79285e9aa9381b032f148899c7cf38 100644 (file)
--- a/src/pkcs11.c
+++ b/src/pkcs11.c
@@ -44,18 +44,23 @@ static void pkcs11_common(void)
 
 }
 
-void pkcs11_delete(FILE* outfile, const char* url, int batch)
+void pkcs11_delete(FILE* outfile, const char* url, int batch, unsigned int login)
 {
 int ret;
+unsigned int obj_flags = 0;
+
+       if (login)
+               obj_flags = GNUTLS_PKCS11_OBJ_FLAG_LOGIN;
+
        if (!batch) {
-               pkcs11_list(outfile, url, PKCS11_TYPE_ALL, 1/*login*/);
+               pkcs11_list(outfile, url, PKCS11_TYPE_ALL, login);
                ret = read_yesno("Are you sure you want to delete those objects? (Y/N): ");
                if (ret == 0) {
                        exit(1);
                }
        }
        
-       ret = gnutls_pkcs11_delete_url(url);
+       ret = gnutls_pkcs11_delete_url(url, obj_flags);
        if (ret < 0) {
                fprintf(stderr, "Error in %s:%d: %s\n", __func__, __LINE__, gnutls_strerror(ret));
                exit(1);
@@ -375,7 +380,7 @@ size_t size;
        return;
 }
 
-void pkcs11_write(FILE* outfile, const char* url, const char* label, int trusted)
+void pkcs11_write(FILE* outfile, const char* url, const char* label, int trusted, unsigned int login)
 {
 gnutls_x509_crt_t xcrt;
 gnutls_x509_privkey_t xkey;
@@ -383,6 +388,9 @@ int ret;
 unsigned int flags = 0;
 unsigned int key_usage;
 
+       if (login)
+               flags = GNUTLS_PKCS11_OBJ_FLAG_LOGIN;
+
        pkcs11_common();
 
        if (url == NULL)
@@ -391,7 +399,7 @@ unsigned int key_usage;
        xcrt = load_cert(0);
        if (xcrt != NULL) {
                if (trusted)
-                       flags |= GNUTLS_PKCS11_COPY_FLAG_MARK_TRUSTED;
+                       flags |= GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED;
                ret = gnutls_pkcs11_copy_x509_crt(url, xcrt, label, flags);
                if (ret < 0) {
                        fprintf(stderr, "Error in %s:%d: %s\n", __func__, __LINE__, gnutls_strerror(ret));