* Added the FSF copyright notices.
* Moved all the compatibility interface to the openssl
compatibility library.
+/*
+ * The copyright holder for Gnutls is Free Software Foundation,
+ * Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
+ */
N: Nikos Mavroyanopoulos
A: nmav
+Version 1.1.2
+- Added CRL verification functionality to certtool.
+
Version 1.1.1 (26/12/2003)
- Added PKCS #7 support to certtool utility.
- Added support for reading and generating CRL distribution
dnl Gnutls Version
GNUTLS_MAJOR_VERSION=1
GNUTLS_MINOR_VERSION=1
-GNUTLS_MICRO_VERSION=1
+GNUTLS_MICRO_VERSION=2
GNUTLS_VERSION=$GNUTLS_MAJOR_VERSION.$GNUTLS_MINOR_VERSION.$GNUTLS_MICRO_VERSION
AC_DEFINE_UNQUOTED(GNUTLS_VERSION, "$GNUTLS_VERSION", [version of gnutls])
\begin{center}
\par
Copyright \copyright\ 2001,2002,2003 Nikos Mavroyanopoulos\\
+Copyright \copyright\ 2004 Free Software Foundation\\
\setlength{\parskip}{4mm}
\par
Permission is granted to copy, distribute and/or modify this document
## Process this file with automake to produce Makefile.in
nobase_include_HEADERS = gnutls/extra.h gnutls/gnutls.h $(OPENSSL_H) \
- gnutls/x509.h gnutls/compat8.h gnutls/pkcs12.h \
+ gnutls/x509.h gnutls/pkcs12.h \
gnutls/openpgp.h
if ENABLE_OPENSSL
-EXTRA_DIST = extra.h openssl.h gnutls.h x509.h compat8.h pkcs12.h openpgp.h
+EXTRA_DIST = extra.h openssl.h gnutls.h x509.h pkcs12.h openpgp.h
#include <gnutls/gnutls.h>
#include <gcrypt.h>
+/* Extra definitions that do not longer exist in gnutls.
+ */
+#define GNUTLS_X509_CN_SIZE 256
+#define GNUTLS_X509_C_SIZE 3
+#define GNUTLS_X509_O_SIZE 256
+#define GNUTLS_X509_OU_SIZE 256
+#define GNUTLS_X509_L_SIZE 256
+#define GNUTLS_X509_S_SIZE 256
+#define GNUTLS_X509_EMAIL_SIZE 256
+
+typedef struct {
+ char common_name[GNUTLS_X509_CN_SIZE];
+ char country[GNUTLS_X509_C_SIZE];
+ char organization[GNUTLS_X509_O_SIZE];
+ char organizational_unit_name[GNUTLS_X509_OU_SIZE];
+ char locality_name[GNUTLS_X509_L_SIZE];
+ char state_or_province_name[GNUTLS_X509_S_SIZE];
+ char email[GNUTLS_X509_EMAIL_SIZE];
+} gnutls_x509_dn;
+
+
#define OPENSSL_VERSION_NUMBER (0x0090604F)
#define SSLEAY_VERSION_NUMBER OPENSSL_VERSION_NUMBER
#define OPENSSL_VERSION_TEXT ("GNUTLS " LIBGNUTLS_VERSION " ")
/*
- * Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
- * Copyright (C) 2000,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2000,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
- * Copyright (C) 2001 Nikos Mavroyanopoulos
+ * Copyright (C) 2001 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
* someday was part of gsti
/*
* Copyright (C) 2000,2001,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000,2001 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000,2001 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
- * Copyright (C) 2000 Nikos Mavroyanopoulos
+ * Copyright (C) 2000,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2002 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
#include <gnutls/x509.h>
#include <gnutls/compat8.h>
-/**
- * gnutls_x509_extract_dn - This function parses an RDN sequence
- * @idn: should contain a DER encoded RDN sequence
- * @rdn: a pointer to a structure to hold the name
- *
- * This function will return the name of the given RDN sequence.
- * The name will be returned as a gnutls_x509_dn structure.
- * Returns a negative error code in case of an error.
- *
- **/
-int gnutls_x509_extract_dn(const gnutls_datum * idn, gnutls_x509_dn * rdn)
-{
- ASN1_TYPE dn = ASN1_TYPE_EMPTY;
- int result;
- size_t len;
-
- if ((result =
- asn1_create_element(_gnutls_get_pkix(),
- "PKIX1.Name", &dn
- )) != ASN1_SUCCESS) {
- return _gnutls_asn2err(result);
- }
-
- result = asn1_der_decoding(&dn, idn->data, idn->size, NULL);
- if (result != ASN1_SUCCESS) {
- /* couldn't decode DER */
- asn1_delete_structure(&dn);
- return _gnutls_asn2err(result);
- }
-
- memset( rdn, 0, sizeof(gnutls_x509_dn));
-
- len = sizeof(rdn->country);
- _gnutls_x509_parse_dn_oid( dn, "", GNUTLS_OID_X520_COUNTRY_NAME, 0, 0, rdn->country, &len);
-
- len = sizeof(rdn->organization);
- _gnutls_x509_parse_dn_oid( dn, "", GNUTLS_OID_X520_ORGANIZATION_NAME, 0, 0, rdn->organization, &len);
-
- len = sizeof(rdn->organizational_unit_name);
- _gnutls_x509_parse_dn_oid( dn, "", GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME, 0, 0, rdn->organizational_unit_name, &len);
-
- len = sizeof(rdn->common_name);
- _gnutls_x509_parse_dn_oid( dn, "", GNUTLS_OID_X520_COMMON_NAME, 0, 0, rdn->common_name, &len);
-
- len = sizeof(rdn->locality_name);
- _gnutls_x509_parse_dn_oid( dn, "", GNUTLS_OID_X520_LOCALITY_NAME, 0, 0, rdn->locality_name, &len);
-
- len = sizeof(rdn->state_or_province_name);
- _gnutls_x509_parse_dn_oid( dn, "", GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME, 0, 0, rdn->state_or_province_name, &len);
-
- len = sizeof(rdn->email);
- _gnutls_x509_parse_dn_oid( dn, "", GNUTLS_OID_PKCS9_EMAIL, 0, 0, rdn->email, &len);
-
- asn1_delete_structure(&dn);
-
- return 0;
-}
-
-/**
- * gnutls_x509_extract_certificate_dn - This function returns the certificate's distinguished name
- * @cert: should contain an X.509 DER encoded certificate
- * @ret: a pointer to a structure to hold the peer's name
- *
- * This function will return the name of the certificate holder. The name is gnutls_x509_dn structure and
- * is a obtained by the peer's certificate. If the certificate send by the
- * peer is invalid, or in any other failure this function returns error.
- * Returns a negative error code in case of an error.
- *
- **/
-int gnutls_x509_extract_certificate_dn(const gnutls_datum * cert,
- gnutls_x509_dn * ret)
-{
- gnutls_x509_crt xcert;
- int result;
- size_t len;
-
- result = gnutls_x509_crt_init( &xcert);
- if (result < 0) return result;
-
- result = gnutls_x509_crt_import( xcert, cert, GNUTLS_X509_FMT_DER);
- if (result < 0) {
- gnutls_x509_crt_deinit( xcert);
- return result;
- }
-
- len = sizeof( ret->country);
- gnutls_x509_crt_get_dn_by_oid( xcert, GNUTLS_OID_X520_COUNTRY_NAME, 0, 0,
- ret->country, &len);
-
- len = sizeof( ret->organization);
- gnutls_x509_crt_get_dn_by_oid( xcert, GNUTLS_OID_X520_ORGANIZATION_NAME, 0, 0,
- ret->organization, &len);
-
- len = sizeof( ret->organizational_unit_name);
- gnutls_x509_crt_get_dn_by_oid( xcert, GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME, 0, 0,
- ret->organizational_unit_name, &len);
-
- len = sizeof( ret->common_name);
- gnutls_x509_crt_get_dn_by_oid( xcert, GNUTLS_OID_X520_COMMON_NAME, 0, 0,
- ret->common_name, &len);
-
- len = sizeof( ret->locality_name);
- gnutls_x509_crt_get_dn_by_oid( xcert, GNUTLS_OID_X520_LOCALITY_NAME, 0, 0,
- ret->locality_name, &len);
-
- len = sizeof( ret->state_or_province_name);
- gnutls_x509_crt_get_dn_by_oid( xcert, GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME, 0, 0,
- ret->state_or_province_name, &len);
-
- len = sizeof( ret->email);
- gnutls_x509_crt_get_dn_by_oid( xcert, GNUTLS_OID_PKCS9_EMAIL, 0, 0,
- ret->email, &len);
-
- gnutls_x509_crt_deinit( xcert);
-
- return 0;
-}
-
-/**
- * gnutls_x509_extract_certificate_issuer_dn - This function returns the certificate's issuer distinguished name
- * @cert: should contain an X.509 DER encoded certificate
- * @ret: a pointer to a structure to hold the issuer's name
- *
- * This function will return the name of the issuer stated in the certificate. The name is a gnutls_x509_dn structure and
- * is a obtained by the peer's certificate. If the certificate send by the
- * peer is invalid, or in any other failure this function returns error.
- * Returns a negative error code in case of an error.
- *
- **/
-int gnutls_x509_extract_certificate_issuer_dn(const gnutls_datum * cert,
- gnutls_x509_dn * ret)
-{
- gnutls_x509_crt xcert;
- int result;
- size_t len;
-
- result = gnutls_x509_crt_init( &xcert);
- if (result < 0) return result;
-
- result = gnutls_x509_crt_import( xcert, cert, GNUTLS_X509_FMT_DER);
- if (result < 0) {
- gnutls_x509_crt_deinit( xcert);
- return result;
- }
-
- len = sizeof( ret->country);
- gnutls_x509_crt_get_issuer_dn_by_oid( xcert, GNUTLS_OID_X520_COUNTRY_NAME, 0, 0,
- ret->country, &len);
-
- len = sizeof( ret->organization);
- gnutls_x509_crt_get_issuer_dn_by_oid( xcert, GNUTLS_OID_X520_ORGANIZATION_NAME, 0, 0,
- ret->organization, &len);
-
- len = sizeof( ret->organizational_unit_name);
- gnutls_x509_crt_get_issuer_dn_by_oid( xcert, GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME, 0, 0,
- ret->organizational_unit_name, &len);
-
- len = sizeof( ret->common_name);
- gnutls_x509_crt_get_issuer_dn_by_oid( xcert, GNUTLS_OID_X520_COMMON_NAME, 0, 0,
- ret->common_name, &len);
-
- len = sizeof( ret->locality_name);
- gnutls_x509_crt_get_issuer_dn_by_oid( xcert, GNUTLS_OID_X520_LOCALITY_NAME, 0, 0,
- ret->locality_name, &len);
-
- len = sizeof( ret->state_or_province_name);
- gnutls_x509_crt_get_issuer_dn_by_oid( xcert, GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME, 0, 0,
- ret->state_or_province_name, &len);
-
- len = sizeof( ret->email);
- gnutls_x509_crt_get_issuer_dn_by_oid( xcert, GNUTLS_OID_PKCS9_EMAIL, 0, 0,
- ret->email, &len);
-
- gnutls_x509_crt_deinit( xcert);
-
- return 0;
-}
-
-
-/**
- * gnutls_x509_extract_certificate_subject_alt_name - This function returns the certificate's alternative name, if any
- * @cert: should contain an X.509 DER encoded certificate
- * @seq: specifies the sequence number of the alt name (0 for the first one, 1 for the second etc.)
- * @ret: is the place where the alternative name will be copied to
- * @ret_size: holds the size of ret.
- *
- * This function will return the alternative names, contained in the
- * given certificate.
- *
- * This is specified in X509v3 Certificate Extensions.
- * GNUTLS will return the Alternative name, or a negative
- * error code.
- * Returns GNUTLS_E_SHORT_MEMORY_BUFFER if ret_size is not enough to hold the alternative
- * name, or the type of alternative name if everything was ok. The type is
- * one of the enumerated GNUTLS_X509_SUBJECT_ALT_NAME.
- *
- * If the certificate does not have an Alternative name with the specified
- * sequence number then returns GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
- *
- **/
-int gnutls_x509_extract_certificate_subject_alt_name(const gnutls_datum * cert, int seq, char *ret, int *ret_size)
-{
- gnutls_x509_crt xcert;
- int result;
- size_t size = *ret_size;
-
- result = gnutls_x509_crt_init( &xcert);
- if (result < 0) return result;
-
- result = gnutls_x509_crt_import( xcert, cert, GNUTLS_X509_FMT_DER);
- if (result < 0) {
- gnutls_x509_crt_deinit( xcert);
- return result;
- }
-
- result = gnutls_x509_crt_get_subject_alt_name( xcert, seq, ret, &size, NULL);
- *ret_size = size;
-
- gnutls_x509_crt_deinit( xcert);
-
- return result;
-}
-
-/**
- * gnutls_x509_extract_certificate_ca_status - This function returns the certificate CA status
- * @cert: should contain an X.509 DER encoded certificate
- *
- * This function will return certificates CA status, by reading the
- * basicConstraints X.509 extension. If the certificate is a CA a positive
- * value will be returned, or zero if the certificate does not have
- * CA flag set.
- *
- * A negative value may be returned in case of parsing error.
- * If the certificate does not contain the basicConstraints extension
- * GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
- *
- **/
-int gnutls_x509_extract_certificate_ca_status(const gnutls_datum * cert)
-{
- gnutls_x509_crt xcert;
- int result;
-
- result = gnutls_x509_crt_init( &xcert);
- if (result < 0) return result;
-
- result = gnutls_x509_crt_import( xcert, cert, GNUTLS_X509_FMT_DER);
- if (result < 0) {
- gnutls_x509_crt_deinit( xcert);
- return result;
- }
-
- result = gnutls_x509_crt_get_ca_status( xcert, NULL);
-
- gnutls_x509_crt_deinit( xcert);
-
- return result;
-}
-
/**
* gnutls_x509_extract_certificate_activation_time - This function returns the peer's certificate activation time
* @cert: should contain an X.509 DER encoded certificate
return result;
}
-/**
- * gnutls_x509_extract_certificate_version - This function returns the certificate's version
- * @cert: is an X.509 DER encoded certificate
- *
- * This function will return the X.509 certificate's version (1, 2, 3). This is obtained by the X509 Certificate
- * Version field. Returns a negative value in case of an error.
- *
- **/
-int gnutls_x509_extract_certificate_version(const gnutls_datum * cert)
-{
- gnutls_x509_crt xcert;
- int result;
-
- result = gnutls_x509_crt_init( &xcert);
- if (result < 0) return result;
-
- result = gnutls_x509_crt_import( xcert, cert, GNUTLS_X509_FMT_DER);
- if (result < 0) {
- gnutls_x509_crt_deinit( xcert);
- return result;
- }
-
- result = gnutls_x509_crt_get_version( xcert);
-
- gnutls_x509_crt_deinit( xcert);
-
- return result;
-
-}
-
-/**
- * gnutls_x509_extract_certificate_serial - This function returns the certificate's serial number
- * @cert: is an X.509 DER encoded certificate
- * @result: The place where the serial number will be copied
- * @result_size: Holds the size of the result field.
- *
- * This function will return the X.509 certificate's serial number.
- * This is obtained by the X509 Certificate serialNumber
- * field. Serial is not always a 32 or 64bit number. Some CAs use
- * large serial numbers, thus it may be wise to handle it as something
- * opaque.
- * Returns a negative value in case of an error.
- *
- **/
-int gnutls_x509_extract_certificate_serial(const gnutls_datum * cert, char* result, int* result_size)
-{
- gnutls_x509_crt xcert;
- size_t size = *result_size;
- int ret;
-
- ret = gnutls_x509_crt_init( &xcert);
- if (ret < 0) return ret;
-
- ret = gnutls_x509_crt_import( xcert, cert, GNUTLS_X509_FMT_DER);
- if (ret < 0) {
- gnutls_x509_crt_deinit( xcert);
- return ret;
- }
-
- ret = gnutls_x509_crt_get_serial( xcert, result, &size);
- *result_size = size;
-
- gnutls_x509_crt_deinit( xcert);
-
- return ret;
-}
-
-
-/**
- * gnutls_x509_extract_certificate_pk_algorithm - This function returns the certificate's PublicKey algorithm
- * @cert: is a DER encoded X.509 certificate
- * @bits: if bits is non null it will hold the size of the parameters' in bits
- *
- * This function will return the public key algorithm of an X.509
- * certificate.
- *
- * If bits is non null, it should have enough size to hold the parameters
- * size in bits. For RSA the bits returned is the modulus.
- * For DSA the bits returned are of the public
- * exponent.
- *
- * Returns a member of the gnutls_pk_algorithm enumeration on success,
- * or a negative value on error.
- *
- **/
-int gnutls_x509_extract_certificate_pk_algorithm( const gnutls_datum * cert, int* bits)
-{
- gnutls_x509_crt xcert;
- int result;
-
- result = gnutls_x509_crt_init( &xcert);
- if (result < 0) return result;
-
- result = gnutls_x509_crt_import( xcert, cert, GNUTLS_X509_FMT_DER);
- if (result < 0) {
- gnutls_x509_crt_deinit( xcert);
- return result;
- }
-
- result = gnutls_x509_crt_get_pk_algorithm( xcert, bits);
-
- gnutls_x509_crt_deinit( xcert);
-
- return result;
-}
-
-
-/**
- * gnutls_x509_extract_certificate_dn_string - This function returns the certificate's distinguished name
- * @cert: should contain an X.509 DER encoded certificate
- * @buf: a pointer to a structure to hold the peer's name
- * @sizeof_buf: holds the size of 'buf'
- * @issuer: if non zero, then extract the name of the issuer, instead of the holder
- *
- * This function will copy the name of the certificate holder in the provided buffer. The name
- * will be in the form "C=xxxx,O=yyyy,CN=zzzz" as described in RFC2253.
- *
- * Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not long enough,
- * and 0 on success.
- *
- **/
-int gnutls_x509_extract_certificate_dn_string(char *buf, unsigned int sizeof_buf,
- const gnutls_datum * cert, int issuer)
-{
- gnutls_x509_crt xcert;
- int result;
-
- result = gnutls_x509_crt_init( &xcert);
- if (result < 0) return result;
-
- result = gnutls_x509_crt_import( xcert, cert, GNUTLS_X509_FMT_DER);
- if (result < 0) {
- gnutls_x509_crt_deinit( xcert);
- return result;
- }
-
- if (!issuer)
- result = gnutls_x509_crt_get_dn( xcert, buf, &sizeof_buf);
- else
- result = gnutls_x509_crt_get_issuer_dn( xcert, buf, &sizeof_buf);
-
- gnutls_x509_crt_deinit( xcert);
-
- return result;
-}
-
-/**
- * gnutls_x509_verify_certificate - This function verifies given certificate list
- * @cert_list: is the certificate list to be verified
- * @cert_list_length: holds the number of certificate in cert_list
- * @CA_list: is the CA list which will be used in verification
- * @CA_list_length: holds the number of CA certificate in CA_list
- * @CRL_list: not used
- * @CRL_list_length: not used
- *
- * This function will try to verify the given certificate list and return its status (TRUSTED, EXPIRED etc.).
- * The return value (status) should be one or more of the gnutls_certificate_status
- * enumerated elements bitwise or'd. Note that expiration and activation dates are not checked
- * by this function, you should check them using the appropriate functions.
- *
- * This function understands the basicConstraints (2.5.29.19) PKIX extension.
- * This means that only a certificate authority can sign a certificate.
- *
- * However you must also check the peer's name in order to check if the verified certificate belongs to the
- * actual peer.
- *
- * The return value (status) should be one or more of the gnutls_certificate_status
- * enumerated elements bitwise or'd.
- *
- * GNUTLS_CERT_INVALID\: the peer's certificate is not valid.
- *
- * GNUTLS_CERT_REVOKED\: the certificate has been revoked.
- *
- * A negative error code is returned in case of an error.
- * GNUTLS_E_NO_CERTIFICATE_FOUND is returned to indicate that
- * no certificate was sent by the peer.
- *
- *
- **/
-int gnutls_x509_verify_certificate( const gnutls_datum* cert_list, int cert_list_length,
- const gnutls_datum * CA_list, int CA_list_length,
- const gnutls_datum* CRL_list, int CRL_list_length)
-{
- unsigned int verify;
- gnutls_x509_crt *peer_certificate_list = NULL;
- gnutls_x509_crt *ca_certificate_list = NULL;
- gnutls_x509_crl *crl_list = NULL;
- int peer_certificate_list_size=0, i, x, ret;
- int ca_certificate_list_size=0, crl_list_size=0;
-
- if (cert_list == NULL || cert_list_length == 0)
- return GNUTLS_E_NO_CERTIFICATE_FOUND;
-
- /* generate a list of gnutls_certs based on the auth info
- * raw certs.
- */
- peer_certificate_list_size = cert_list_length;
- peer_certificate_list =
- gnutls_calloc(1,
- peer_certificate_list_size *
- sizeof(gnutls_x509_crt));
- if (peer_certificate_list == NULL) {
- gnutls_assert();
- ret = GNUTLS_E_MEMORY_ERROR;
- goto cleanup;
- }
-
- ca_certificate_list_size = CA_list_length;
- ca_certificate_list =
- gnutls_calloc(1,
- ca_certificate_list_size *
- sizeof(gnutls_x509_crt));
- if (ca_certificate_list == NULL) {
- gnutls_assert();
- ret = GNUTLS_E_MEMORY_ERROR;
- goto cleanup;
- }
-
- /* allocate memory for CRL
- */
- crl_list_size = CRL_list_length;
- crl_list =
- gnutls_calloc(1,
- crl_list_size *
- sizeof(gnutls_x509_crl));
- if (crl_list == NULL) {
- gnutls_assert();
- ret = GNUTLS_E_MEMORY_ERROR;
- goto cleanup;
- }
-
- /* convert certA_list to gnutls_cert* list
- */
- for (i = 0; i < peer_certificate_list_size; i++) {
- ret = gnutls_x509_crt_init( &peer_certificate_list[i]);
- if (ret < 0) {
- gnutls_assert();
- goto cleanup;
- }
-
- ret =
- gnutls_x509_crt_import(peer_certificate_list[i],
- &cert_list[i], GNUTLS_X509_FMT_DER);
- if (ret < 0) {
- gnutls_assert();
- goto cleanup;
- }
- }
-
- /* convert CA_list to gnutls_x509_cert* list
- */
- for (i = 0; i < ca_certificate_list_size; i++) {
- ret = gnutls_x509_crt_init(&ca_certificate_list[i]);
- if (ret < 0) {
- gnutls_assert();
- goto cleanup;
- }
-
- ret =
- gnutls_x509_crt_import(ca_certificate_list[i],
- &CA_list[i], GNUTLS_X509_FMT_DER);
- if (ret < 0) {
- gnutls_assert();
- goto cleanup;
- }
- }
-
-#ifdef ENABLE_PKI
- /* convert CRL_list to gnutls_x509_crl* list
- */
- for (i = 0; i < crl_list_size; i++) {
- ret = gnutls_x509_crl_init( &crl_list[i]);
- if (ret < 0) {
- gnutls_assert();
- goto cleanup;
- }
-
- ret =
- gnutls_x509_crl_import(crl_list[i],
- &CRL_list[i], GNUTLS_X509_FMT_DER);
- if (ret < 0) {
- gnutls_assert();
- goto cleanup;
- }
- }
-#endif
-
- /* Verify certificate
- */
- ret =
- gnutls_x509_crt_list_verify(peer_certificate_list,
- peer_certificate_list_size,
- ca_certificate_list, ca_certificate_list_size,
- crl_list, crl_list_size, 0, &verify);
-
- if (ret < 0) {
- gnutls_assert();
- goto cleanup;
- }
-
- ret = verify;
-
- cleanup:
-
- if (peer_certificate_list != NULL)
- for(x=0;x<peer_certificate_list_size;x++) {
- if (peer_certificate_list[x] != NULL)
- gnutls_x509_crt_deinit(peer_certificate_list[x]);
- }
-
- if (ca_certificate_list != NULL)
- for(x=0;x<ca_certificate_list_size;x++) {
- if (ca_certificate_list[x] != NULL)
- gnutls_x509_crt_deinit(ca_certificate_list[x]);
- }
-
-#ifdef ENABLE_PKI
- if (crl_list != NULL)
- for(x=0;x<crl_list_size;x++) {
- if (crl_list[x] != NULL)
- gnutls_x509_crl_deinit(crl_list[x]);
- }
-
- gnutls_free( crl_list);
-#endif
-
- gnutls_free( ca_certificate_list);
- gnutls_free( peer_certificate_list);
-
- return ret;
-}
-
-/**
- * gnutls_x509_extract_key_pk_algorithm - This function returns the keys's PublicKey algorithm
- * @cert: is a DER encoded private key
- *
- * This function will return the public key algorithm of a DER encoded private
- * key.
- *
- * Returns a member of the gnutls_pk_algorithm enumeration on success,
- * or GNUTLS_E_UNKNOWN_PK_ALGORITHM on error.
- *
- **/
-int gnutls_x509_extract_key_pk_algorithm( const gnutls_datum * key)
-{
- gnutls_x509_privkey pkey;
- int ret, pk;
-
- ret = gnutls_x509_privkey_init( &pkey);
- if (ret < 0) {
- gnutls_assert();
- return ret;
- }
-
- ret = gnutls_x509_privkey_import( pkey, key, GNUTLS_X509_FMT_DER);
- if (ret < 0) {
- gnutls_assert();
- return ret;
- }
-
- pk = gnutls_x509_privkey_get_pk_algorithm( pkey);
-
- gnutls_x509_privkey_deinit( pkey);
- return pk;
-}
-
-#ifdef ENABLE_PKI
-
-/**
- * gnutls_x509_pkcs7_extract_certificate - This function returns a certificate in a PKCS7 certificate set
- * @pkcs7_struct: should contain a PKCS7 DER formatted structure
- * @indx: contains the index of the certificate to extract
- * @certificate: the contents of the certificate will be copied there
- * @certificate_size: should hold the size of the certificate
- *
- * This function will return a certificate of the PKCS7 or RFC2630 certificate set.
- * Returns 0 on success. If the provided buffer is not long enough,
- * then GNUTLS_E_SHORT_MEMORY_BUFFER is returned.
- *
- * After the last certificate has been read GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
- * will be returned.
- *
- **/
-int gnutls_x509_pkcs7_extract_certificate(const gnutls_datum * pkcs7_struct, int indx, char* certificate, int* certificate_size)
-{
- gnutls_pkcs7 pkcs7;
- int result;
- size_t size = *certificate_size;
-
- result = gnutls_pkcs7_init( &pkcs7);
- if (result < 0) return result;
-
- result = gnutls_pkcs7_import( pkcs7, pkcs7_struct, GNUTLS_X509_FMT_DER);
- if (result < 0) {
- gnutls_pkcs7_deinit( pkcs7);
- return result;
- }
-
- result = gnutls_pkcs7_get_crt_raw( pkcs7, indx, certificate, &size);
- *certificate_size = size;
-
- gnutls_pkcs7_deinit( pkcs7);
-
- return result;
-}
-
-
-/**
- * gnutls_x509_pkcs7_extract_certificate_count - This function returns the number of certificates in a PKCS7 certificate set
- * @pkcs7_struct: should contain a PKCS7 DER formatted structure
- *
- * This function will return the number of certifcates in the PKCS7 or
- * RFC2630 certificate set.
- *
- * Returns a negative value on failure.
- *
- **/
-int gnutls_x509_pkcs7_extract_certificate_count(const gnutls_datum * pkcs7_struct)
-{
- gnutls_pkcs7 pkcs7;
- int result;
-
- result = gnutls_pkcs7_init( &pkcs7);
- if (result < 0) return result;
-
- result = gnutls_pkcs7_import( pkcs7, pkcs7_struct, GNUTLS_X509_FMT_DER);
- if (result < 0) {
- gnutls_pkcs7_deinit( pkcs7);
- return result;
- }
-
- result = gnutls_pkcs7_get_crt_count( pkcs7);
-
- gnutls_pkcs7_deinit( pkcs7);
-
- return result;
-}
-
-#endif
time_t gnutls_x509_extract_certificate_activation_time( const gnutls_datum*);
time_t gnutls_x509_extract_certificate_expiration_time( const gnutls_datum*);
-
-int gnutls_x509_extract_certificate_subject_alt_name( const gnutls_datum*, int seq, char*, int*);
-int gnutls_x509_extract_certificate_dn( const gnutls_datum*, gnutls_x509_dn*);
-
-int gnutls_x509_pkcs7_extract_certificate(const gnutls_datum * pkcs7_struct, int indx, char* certificate, int* certificate_size);
-int gnutls_x509_pkcs7_extract_certificate_count(const gnutls_datum * pkcs7_struct);
/*
* Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
-/* This is based on minip12.
- */
-
-/* minip12.c - A minilam pkcs-12 implementation.
+/* minip12.c - A mini pkcs-12 implementation (modified for gnutls)
* Copyright (C) 2002 Free Software Foundation, Inc.
*
* This file some day was part of GnuPG.
/* pkcs5.c Implementation of Password-Based Cryptography as per PKCS#5
* Copyright (C) 2002,2003 Simon Josefsson
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
/*
* Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/* rc2.c - The RC2 stream cipher
* Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2002 Andrew McDonald
* Portions Copyright 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2003 Nikos Mavroyanopoulos <nmav@hellug.gr>
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2003 Nikos Mavroyanopoulos <nmav@hellug.gr>
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000,2001,2003 Nikos Mavroyanopoulos <nmav@hellug.gr>
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
endif
EXTRA_DIST = ext_srp.h gnutls_srp.h libgnutls-extra.vers \
- auth_srp.h auth_srp_passwd.h \
+ auth_srp.h auth_srp_passwd.h openssl_compat.h \
gnutls-extra-api.tex gnutls_extra.h libgnutls-extra-config.in \
libgnutls-extra.m4 lzoconf.h minilzo.h
libgnutls_openssl_la_LDFLAGS = -version-info $(LT_CURRENT):$(LT_REVISION):$(LT_AGE)
-libgnutls_openssl_la_SOURCES = gnutls_openssl.c
+libgnutls_openssl_la_SOURCES = gnutls_openssl.c openssl_compat.c
libgnutls_openssl_la_LIBADD = \
../lib/libgnutls.la
/*
* Copyright (C) 2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001,2002 Nikos Mavroyanopoulos <nmav@hellug.gr>
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001,2002 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2002,2003 Timo Schulz <twoaday@freakmail.de>
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (c) 2002 Andrew McDonald <andrew@mcdonald.org.uk>
+ * Copyright (C) 2004 Free Software Foundation
*
* GNUTLS-EXTRA is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the Free
#include <config.h>
#include <gnutls/gnutls.h>
-#include <gnutls/compat8.h>
+#include <openssl_compat.h>
#include <gcrypt.h>
#include <stdio.h>
#include <stdlib.h>
/*
* Copyright (C) 2001,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2002 Timo Schulz
* Portions Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright 2004 Free Software Foundation
*
* This file is part of GNUTLS-EXTRA.
*
/*
* Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright 2004 Free Software Foundation
*
* This file is part of GNUTLS-EXTRA.
*
/*
- * Copyright (C) 2002 Timo Schulz
- * Portions Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2002 Timo Schulz
+ * Portions Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
- * Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2002 Timo Schulz
* Portions Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright 2004 Free Software Foundation
*
* This file is part of GNUTLS-EXTRA.
*
/*
* Copyright (C) 2002 Timo Schulz <twoaday@freakmail.de>
* Portions Copyright 2003 Nikos Mavroyanopoulos <nmav@gnutls.org>
+ * Copyright 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
--- /dev/null
+/*
+ * Copyright (C) 2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
+ *
+ * This file is part of GNUTLS.
+ *
+ * The GNUTLS library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
+ *
+ */
+
+/* This file includes all functions that were in the 0.5.x and 0.8.x
+ * gnutls API. They are now implemented over the new certificate parsing
+ * API.
+ */
+
+#include <gnutls_global.h>
+#include <gnutls_errors.h>
+#include <string.h> /* memset */
+#include <x509/dn.h>
+#include <libtasn1.h>
+#include <gnutls/x509.h>
+#include <openssl_compat.h>
+
+/**
+ * gnutls_x509_extract_dn - This function parses an RDN sequence
+ * @idn: should contain a DER encoded RDN sequence
+ * @rdn: a pointer to a structure to hold the name
+ *
+ * This function will return the name of the given RDN sequence.
+ * The name will be returned as a gnutls_x509_dn structure.
+ * Returns a negative error code in case of an error.
+ *
+ **/
+int gnutls_x509_extract_dn(const gnutls_datum * idn, gnutls_x509_dn * rdn)
+{
+ ASN1_TYPE dn = ASN1_TYPE_EMPTY;
+ int result;
+ size_t len;
+
+ if ((result =
+ asn1_create_element(_gnutls_get_pkix(),
+ "PKIX1.Name", &dn
+ )) != ASN1_SUCCESS) {
+ return _gnutls_asn2err(result);
+ }
+
+ result = asn1_der_decoding(&dn, idn->data, idn->size, NULL);
+ if (result != ASN1_SUCCESS) {
+ /* couldn't decode DER */
+ asn1_delete_structure(&dn);
+ return _gnutls_asn2err(result);
+ }
+
+ memset( rdn, 0, sizeof(gnutls_x509_dn));
+
+ len = sizeof(rdn->country);
+ _gnutls_x509_parse_dn_oid( dn, "", GNUTLS_OID_X520_COUNTRY_NAME, 0, 0, rdn->country, &len);
+
+ len = sizeof(rdn->organization);
+ _gnutls_x509_parse_dn_oid( dn, "", GNUTLS_OID_X520_ORGANIZATION_NAME, 0, 0, rdn->organization, &len);
+
+ len = sizeof(rdn->organizational_unit_name);
+ _gnutls_x509_parse_dn_oid( dn, "", GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME, 0, 0, rdn->organizational_unit_name, &len);
+
+ len = sizeof(rdn->common_name);
+ _gnutls_x509_parse_dn_oid( dn, "", GNUTLS_OID_X520_COMMON_NAME, 0, 0, rdn->common_name, &len);
+
+ len = sizeof(rdn->locality_name);
+ _gnutls_x509_parse_dn_oid( dn, "", GNUTLS_OID_X520_LOCALITY_NAME, 0, 0, rdn->locality_name, &len);
+
+ len = sizeof(rdn->state_or_province_name);
+ _gnutls_x509_parse_dn_oid( dn, "", GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME, 0, 0, rdn->state_or_province_name, &len);
+
+ len = sizeof(rdn->email);
+ _gnutls_x509_parse_dn_oid( dn, "", GNUTLS_OID_PKCS9_EMAIL, 0, 0, rdn->email, &len);
+
+ asn1_delete_structure(&dn);
+
+ return 0;
+}
+
+/**
+ * gnutls_x509_extract_certificate_dn - This function returns the certificate's distinguished name
+ * @cert: should contain an X.509 DER encoded certificate
+ * @ret: a pointer to a structure to hold the peer's name
+ *
+ * This function will return the name of the certificate holder. The name is gnutls_x509_dn structure and
+ * is a obtained by the peer's certificate. If the certificate send by the
+ * peer is invalid, or in any other failure this function returns error.
+ * Returns a negative error code in case of an error.
+ *
+ **/
+int gnutls_x509_extract_certificate_dn(const gnutls_datum * cert,
+ gnutls_x509_dn * ret)
+{
+ gnutls_x509_crt xcert;
+ int result;
+ size_t len;
+
+ result = gnutls_x509_crt_init( &xcert);
+ if (result < 0) return result;
+
+ result = gnutls_x509_crt_import( xcert, cert, GNUTLS_X509_FMT_DER);
+ if (result < 0) {
+ gnutls_x509_crt_deinit( xcert);
+ return result;
+ }
+
+ len = sizeof( ret->country);
+ gnutls_x509_crt_get_dn_by_oid( xcert, GNUTLS_OID_X520_COUNTRY_NAME, 0, 0,
+ ret->country, &len);
+
+ len = sizeof( ret->organization);
+ gnutls_x509_crt_get_dn_by_oid( xcert, GNUTLS_OID_X520_ORGANIZATION_NAME, 0, 0,
+ ret->organization, &len);
+
+ len = sizeof( ret->organizational_unit_name);
+ gnutls_x509_crt_get_dn_by_oid( xcert, GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME, 0, 0,
+ ret->organizational_unit_name, &len);
+
+ len = sizeof( ret->common_name);
+ gnutls_x509_crt_get_dn_by_oid( xcert, GNUTLS_OID_X520_COMMON_NAME, 0, 0,
+ ret->common_name, &len);
+
+ len = sizeof( ret->locality_name);
+ gnutls_x509_crt_get_dn_by_oid( xcert, GNUTLS_OID_X520_LOCALITY_NAME, 0, 0,
+ ret->locality_name, &len);
+
+ len = sizeof( ret->state_or_province_name);
+ gnutls_x509_crt_get_dn_by_oid( xcert, GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME, 0, 0,
+ ret->state_or_province_name, &len);
+
+ len = sizeof( ret->email);
+ gnutls_x509_crt_get_dn_by_oid( xcert, GNUTLS_OID_PKCS9_EMAIL, 0, 0,
+ ret->email, &len);
+
+ gnutls_x509_crt_deinit( xcert);
+
+ return 0;
+}
+
+/**
+ * gnutls_x509_extract_certificate_issuer_dn - This function returns the certificate's issuer distinguished name
+ * @cert: should contain an X.509 DER encoded certificate
+ * @ret: a pointer to a structure to hold the issuer's name
+ *
+ * This function will return the name of the issuer stated in the certificate. The name is a gnutls_x509_dn structure and
+ * is a obtained by the peer's certificate. If the certificate send by the
+ * peer is invalid, or in any other failure this function returns error.
+ * Returns a negative error code in case of an error.
+ *
+ **/
+int gnutls_x509_extract_certificate_issuer_dn(const gnutls_datum * cert,
+ gnutls_x509_dn * ret)
+{
+ gnutls_x509_crt xcert;
+ int result;
+ size_t len;
+
+ result = gnutls_x509_crt_init( &xcert);
+ if (result < 0) return result;
+
+ result = gnutls_x509_crt_import( xcert, cert, GNUTLS_X509_FMT_DER);
+ if (result < 0) {
+ gnutls_x509_crt_deinit( xcert);
+ return result;
+ }
+
+ len = sizeof( ret->country);
+ gnutls_x509_crt_get_issuer_dn_by_oid( xcert, GNUTLS_OID_X520_COUNTRY_NAME, 0, 0,
+ ret->country, &len);
+
+ len = sizeof( ret->organization);
+ gnutls_x509_crt_get_issuer_dn_by_oid( xcert, GNUTLS_OID_X520_ORGANIZATION_NAME, 0, 0,
+ ret->organization, &len);
+
+ len = sizeof( ret->organizational_unit_name);
+ gnutls_x509_crt_get_issuer_dn_by_oid( xcert, GNUTLS_OID_X520_ORGANIZATIONAL_UNIT_NAME, 0, 0,
+ ret->organizational_unit_name, &len);
+
+ len = sizeof( ret->common_name);
+ gnutls_x509_crt_get_issuer_dn_by_oid( xcert, GNUTLS_OID_X520_COMMON_NAME, 0, 0,
+ ret->common_name, &len);
+
+ len = sizeof( ret->locality_name);
+ gnutls_x509_crt_get_issuer_dn_by_oid( xcert, GNUTLS_OID_X520_LOCALITY_NAME, 0, 0,
+ ret->locality_name, &len);
+
+ len = sizeof( ret->state_or_province_name);
+ gnutls_x509_crt_get_issuer_dn_by_oid( xcert, GNUTLS_OID_X520_STATE_OR_PROVINCE_NAME, 0, 0,
+ ret->state_or_province_name, &len);
+
+ len = sizeof( ret->email);
+ gnutls_x509_crt_get_issuer_dn_by_oid( xcert, GNUTLS_OID_PKCS9_EMAIL, 0, 0,
+ ret->email, &len);
+
+ gnutls_x509_crt_deinit( xcert);
+
+ return 0;
+}
+
+
+/**
+ * gnutls_x509_extract_certificate_subject_alt_name - This function returns the certificate's alternative name, if any
+ * @cert: should contain an X.509 DER encoded certificate
+ * @seq: specifies the sequence number of the alt name (0 for the first one, 1 for the second etc.)
+ * @ret: is the place where the alternative name will be copied to
+ * @ret_size: holds the size of ret.
+ *
+ * This function will return the alternative names, contained in the
+ * given certificate.
+ *
+ * This is specified in X509v3 Certificate Extensions.
+ * GNUTLS will return the Alternative name, or a negative
+ * error code.
+ * Returns GNUTLS_E_SHORT_MEMORY_BUFFER if ret_size is not enough to hold the alternative
+ * name, or the type of alternative name if everything was ok. The type is
+ * one of the enumerated GNUTLS_X509_SUBJECT_ALT_NAME.
+ *
+ * If the certificate does not have an Alternative name with the specified
+ * sequence number then returns GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+ *
+ **/
+int gnutls_x509_extract_certificate_subject_alt_name(const gnutls_datum * cert, int seq, char *ret, int *ret_size)
+{
+ gnutls_x509_crt xcert;
+ int result;
+ size_t size = *ret_size;
+
+ result = gnutls_x509_crt_init( &xcert);
+ if (result < 0) return result;
+
+ result = gnutls_x509_crt_import( xcert, cert, GNUTLS_X509_FMT_DER);
+ if (result < 0) {
+ gnutls_x509_crt_deinit( xcert);
+ return result;
+ }
+
+ result = gnutls_x509_crt_get_subject_alt_name( xcert, seq, ret, &size, NULL);
+ *ret_size = size;
+
+ gnutls_x509_crt_deinit( xcert);
+
+ return result;
+}
+
+/**
+ * gnutls_x509_extract_certificate_ca_status - This function returns the certificate CA status
+ * @cert: should contain an X.509 DER encoded certificate
+ *
+ * This function will return certificates CA status, by reading the
+ * basicConstraints X.509 extension. If the certificate is a CA a positive
+ * value will be returned, or zero if the certificate does not have
+ * CA flag set.
+ *
+ * A negative value may be returned in case of parsing error.
+ * If the certificate does not contain the basicConstraints extension
+ * GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned.
+ *
+ **/
+int gnutls_x509_extract_certificate_ca_status(const gnutls_datum * cert)
+{
+ gnutls_x509_crt xcert;
+ int result;
+
+ result = gnutls_x509_crt_init( &xcert);
+ if (result < 0) return result;
+
+ result = gnutls_x509_crt_import( xcert, cert, GNUTLS_X509_FMT_DER);
+ if (result < 0) {
+ gnutls_x509_crt_deinit( xcert);
+ return result;
+ }
+
+ result = gnutls_x509_crt_get_ca_status( xcert, NULL);
+
+ gnutls_x509_crt_deinit( xcert);
+
+ return result;
+}
+
+/**
+ * gnutls_x509_extract_certificate_activation_time - This function returns the peer's certificate activation time
+ * @cert: should contain an X.509 DER encoded certificate
+ *
+ * This function will return the certificate's activation time in UNIX time
+ * (ie seconds since 00:00:00 UTC January 1, 1970).
+ * Returns a (time_t) -1 in case of an error.
+ *
+ **/
+time_t gnutls_x509_extract_certificate_activation_time(const
+ gnutls_datum *
+ cert)
+{
+ gnutls_x509_crt xcert;
+ time_t result;
+
+ result = gnutls_x509_crt_init( &xcert);
+ if (result < 0) return result;
+
+ result = gnutls_x509_crt_import( xcert, cert, GNUTLS_X509_FMT_DER);
+ if (result < 0) {
+ gnutls_x509_crt_deinit( xcert);
+ return result;
+ }
+
+ result = gnutls_x509_crt_get_activation_time( xcert);
+
+ gnutls_x509_crt_deinit( xcert);
+
+ return result;
+}
+
+/**
+ * gnutls_x509_extract_certificate_expiration_time - This function returns the certificate's expiration time
+ * @cert: should contain an X.509 DER encoded certificate
+ *
+ * This function will return the certificate's expiration time in UNIX time
+ * (ie seconds since 00:00:00 UTC January 1, 1970).
+ * Returns a (time_t) -1 in case of an error.
+ *
+ **/
+time_t gnutls_x509_extract_certificate_expiration_time(const
+ gnutls_datum *
+ cert)
+{
+ gnutls_x509_crt xcert;
+ time_t result;
+
+ result = gnutls_x509_crt_init( &xcert);
+ if (result < 0) return result;
+
+ result = gnutls_x509_crt_import( xcert, cert, GNUTLS_X509_FMT_DER);
+ if (result < 0) {
+ gnutls_x509_crt_deinit( xcert);
+ return result;
+ }
+
+ result = gnutls_x509_crt_get_expiration_time( xcert);
+
+ gnutls_x509_crt_deinit( xcert);
+
+ return result;
+}
+
+/**
+ * gnutls_x509_extract_certificate_version - This function returns the certificate's version
+ * @cert: is an X.509 DER encoded certificate
+ *
+ * This function will return the X.509 certificate's version (1, 2, 3). This is obtained by the X509 Certificate
+ * Version field. Returns a negative value in case of an error.
+ *
+ **/
+int gnutls_x509_extract_certificate_version(const gnutls_datum * cert)
+{
+ gnutls_x509_crt xcert;
+ int result;
+
+ result = gnutls_x509_crt_init( &xcert);
+ if (result < 0) return result;
+
+ result = gnutls_x509_crt_import( xcert, cert, GNUTLS_X509_FMT_DER);
+ if (result < 0) {
+ gnutls_x509_crt_deinit( xcert);
+ return result;
+ }
+
+ result = gnutls_x509_crt_get_version( xcert);
+
+ gnutls_x509_crt_deinit( xcert);
+
+ return result;
+
+}
+
+/**
+ * gnutls_x509_extract_certificate_serial - This function returns the certificate's serial number
+ * @cert: is an X.509 DER encoded certificate
+ * @result: The place where the serial number will be copied
+ * @result_size: Holds the size of the result field.
+ *
+ * This function will return the X.509 certificate's serial number.
+ * This is obtained by the X509 Certificate serialNumber
+ * field. Serial is not always a 32 or 64bit number. Some CAs use
+ * large serial numbers, thus it may be wise to handle it as something
+ * opaque.
+ * Returns a negative value in case of an error.
+ *
+ **/
+int gnutls_x509_extract_certificate_serial(const gnutls_datum * cert, char* result, int* result_size)
+{
+ gnutls_x509_crt xcert;
+ size_t size = *result_size;
+ int ret;
+
+ ret = gnutls_x509_crt_init( &xcert);
+ if (ret < 0) return ret;
+
+ ret = gnutls_x509_crt_import( xcert, cert, GNUTLS_X509_FMT_DER);
+ if (ret < 0) {
+ gnutls_x509_crt_deinit( xcert);
+ return ret;
+ }
+
+ ret = gnutls_x509_crt_get_serial( xcert, result, &size);
+ *result_size = size;
+
+ gnutls_x509_crt_deinit( xcert);
+
+ return ret;
+}
+
+
+/**
+ * gnutls_x509_extract_certificate_pk_algorithm - This function returns the certificate's PublicKey algorithm
+ * @cert: is a DER encoded X.509 certificate
+ * @bits: if bits is non null it will hold the size of the parameters' in bits
+ *
+ * This function will return the public key algorithm of an X.509
+ * certificate.
+ *
+ * If bits is non null, it should have enough size to hold the parameters
+ * size in bits. For RSA the bits returned is the modulus.
+ * For DSA the bits returned are of the public
+ * exponent.
+ *
+ * Returns a member of the gnutls_pk_algorithm enumeration on success,
+ * or a negative value on error.
+ *
+ **/
+int gnutls_x509_extract_certificate_pk_algorithm( const gnutls_datum * cert, int* bits)
+{
+ gnutls_x509_crt xcert;
+ int result;
+
+ result = gnutls_x509_crt_init( &xcert);
+ if (result < 0) return result;
+
+ result = gnutls_x509_crt_import( xcert, cert, GNUTLS_X509_FMT_DER);
+ if (result < 0) {
+ gnutls_x509_crt_deinit( xcert);
+ return result;
+ }
+
+ result = gnutls_x509_crt_get_pk_algorithm( xcert, bits);
+
+ gnutls_x509_crt_deinit( xcert);
+
+ return result;
+}
+
+
+/**
+ * gnutls_x509_extract_certificate_dn_string - This function returns the certificate's distinguished name
+ * @cert: should contain an X.509 DER encoded certificate
+ * @buf: a pointer to a structure to hold the peer's name
+ * @sizeof_buf: holds the size of 'buf'
+ * @issuer: if non zero, then extract the name of the issuer, instead of the holder
+ *
+ * This function will copy the name of the certificate holder in the provided buffer. The name
+ * will be in the form "C=xxxx,O=yyyy,CN=zzzz" as described in RFC2253.
+ *
+ * Returns GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is not long enough,
+ * and 0 on success.
+ *
+ **/
+int gnutls_x509_extract_certificate_dn_string(char *buf, unsigned int sizeof_buf,
+ const gnutls_datum * cert, int issuer)
+{
+ gnutls_x509_crt xcert;
+ int result;
+
+ result = gnutls_x509_crt_init( &xcert);
+ if (result < 0) return result;
+
+ result = gnutls_x509_crt_import( xcert, cert, GNUTLS_X509_FMT_DER);
+ if (result < 0) {
+ gnutls_x509_crt_deinit( xcert);
+ return result;
+ }
+
+ if (!issuer)
+ result = gnutls_x509_crt_get_dn( xcert, buf, &sizeof_buf);
+ else
+ result = gnutls_x509_crt_get_issuer_dn( xcert, buf, &sizeof_buf);
+
+ gnutls_x509_crt_deinit( xcert);
+
+ return result;
+}
+
+/**
+ * gnutls_x509_verify_certificate - This function verifies given certificate list
+ * @cert_list: is the certificate list to be verified
+ * @cert_list_length: holds the number of certificate in cert_list
+ * @CA_list: is the CA list which will be used in verification
+ * @CA_list_length: holds the number of CA certificate in CA_list
+ * @CRL_list: not used
+ * @CRL_list_length: not used
+ *
+ * This function will try to verify the given certificate list and return its status (TRUSTED, EXPIRED etc.).
+ * The return value (status) should be one or more of the gnutls_certificate_status
+ * enumerated elements bitwise or'd. Note that expiration and activation dates are not checked
+ * by this function, you should check them using the appropriate functions.
+ *
+ * This function understands the basicConstraints (2.5.29.19) PKIX extension.
+ * This means that only a certificate authority can sign a certificate.
+ *
+ * However you must also check the peer's name in order to check if the verified certificate belongs to the
+ * actual peer.
+ *
+ * The return value (status) should be one or more of the gnutls_certificate_status
+ * enumerated elements bitwise or'd.
+ *
+ * GNUTLS_CERT_INVALID\: the peer's certificate is not valid.
+ *
+ * GNUTLS_CERT_REVOKED\: the certificate has been revoked.
+ *
+ * A negative error code is returned in case of an error.
+ * GNUTLS_E_NO_CERTIFICATE_FOUND is returned to indicate that
+ * no certificate was sent by the peer.
+ *
+ *
+ **/
+int gnutls_x509_verify_certificate( const gnutls_datum* cert_list, int cert_list_length,
+ const gnutls_datum * CA_list, int CA_list_length,
+ const gnutls_datum* CRL_list, int CRL_list_length)
+{
+ unsigned int verify;
+ gnutls_x509_crt *peer_certificate_list = NULL;
+ gnutls_x509_crt *ca_certificate_list = NULL;
+ gnutls_x509_crl *crl_list = NULL;
+ int peer_certificate_list_size=0, i, x, ret;
+ int ca_certificate_list_size=0, crl_list_size=0;
+
+ if (cert_list == NULL || cert_list_length == 0)
+ return GNUTLS_E_NO_CERTIFICATE_FOUND;
+
+ /* generate a list of gnutls_certs based on the auth info
+ * raw certs.
+ */
+ peer_certificate_list_size = cert_list_length;
+ peer_certificate_list =
+ gnutls_calloc(1,
+ peer_certificate_list_size *
+ sizeof(gnutls_x509_crt));
+ if (peer_certificate_list == NULL) {
+ gnutls_assert();
+ ret = GNUTLS_E_MEMORY_ERROR;
+ goto cleanup;
+ }
+
+ ca_certificate_list_size = CA_list_length;
+ ca_certificate_list =
+ gnutls_calloc(1,
+ ca_certificate_list_size *
+ sizeof(gnutls_x509_crt));
+ if (ca_certificate_list == NULL) {
+ gnutls_assert();
+ ret = GNUTLS_E_MEMORY_ERROR;
+ goto cleanup;
+ }
+
+ /* allocate memory for CRL
+ */
+ crl_list_size = CRL_list_length;
+ crl_list =
+ gnutls_calloc(1,
+ crl_list_size *
+ sizeof(gnutls_x509_crl));
+ if (crl_list == NULL) {
+ gnutls_assert();
+ ret = GNUTLS_E_MEMORY_ERROR;
+ goto cleanup;
+ }
+
+ /* convert certA_list to gnutls_cert* list
+ */
+ for (i = 0; i < peer_certificate_list_size; i++) {
+ ret = gnutls_x509_crt_init( &peer_certificate_list[i]);
+ if (ret < 0) {
+ gnutls_assert();
+ goto cleanup;
+ }
+
+ ret =
+ gnutls_x509_crt_import(peer_certificate_list[i],
+ &cert_list[i], GNUTLS_X509_FMT_DER);
+ if (ret < 0) {
+ gnutls_assert();
+ goto cleanup;
+ }
+ }
+
+ /* convert CA_list to gnutls_x509_cert* list
+ */
+ for (i = 0; i < ca_certificate_list_size; i++) {
+ ret = gnutls_x509_crt_init(&ca_certificate_list[i]);
+ if (ret < 0) {
+ gnutls_assert();
+ goto cleanup;
+ }
+
+ ret =
+ gnutls_x509_crt_import(ca_certificate_list[i],
+ &CA_list[i], GNUTLS_X509_FMT_DER);
+ if (ret < 0) {
+ gnutls_assert();
+ goto cleanup;
+ }
+ }
+
+#ifdef ENABLE_PKI
+ /* convert CRL_list to gnutls_x509_crl* list
+ */
+ for (i = 0; i < crl_list_size; i++) {
+ ret = gnutls_x509_crl_init( &crl_list[i]);
+ if (ret < 0) {
+ gnutls_assert();
+ goto cleanup;
+ }
+
+ ret =
+ gnutls_x509_crl_import(crl_list[i],
+ &CRL_list[i], GNUTLS_X509_FMT_DER);
+ if (ret < 0) {
+ gnutls_assert();
+ goto cleanup;
+ }
+ }
+#endif
+
+ /* Verify certificate
+ */
+ ret =
+ gnutls_x509_crt_list_verify(peer_certificate_list,
+ peer_certificate_list_size,
+ ca_certificate_list, ca_certificate_list_size,
+ crl_list, crl_list_size, 0, &verify);
+
+ if (ret < 0) {
+ gnutls_assert();
+ goto cleanup;
+ }
+
+ ret = verify;
+
+ cleanup:
+
+ if (peer_certificate_list != NULL)
+ for(x=0;x<peer_certificate_list_size;x++) {
+ if (peer_certificate_list[x] != NULL)
+ gnutls_x509_crt_deinit(peer_certificate_list[x]);
+ }
+
+ if (ca_certificate_list != NULL)
+ for(x=0;x<ca_certificate_list_size;x++) {
+ if (ca_certificate_list[x] != NULL)
+ gnutls_x509_crt_deinit(ca_certificate_list[x]);
+ }
+
+#ifdef ENABLE_PKI
+ if (crl_list != NULL)
+ for(x=0;x<crl_list_size;x++) {
+ if (crl_list[x] != NULL)
+ gnutls_x509_crl_deinit(crl_list[x]);
+ }
+
+ gnutls_free( crl_list);
+#endif
+
+ gnutls_free( ca_certificate_list);
+ gnutls_free( peer_certificate_list);
+
+ return ret;
+}
+
+/**
+ * gnutls_x509_extract_key_pk_algorithm - This function returns the keys's PublicKey algorithm
+ * @cert: is a DER encoded private key
+ *
+ * This function will return the public key algorithm of a DER encoded private
+ * key.
+ *
+ * Returns a member of the gnutls_pk_algorithm enumeration on success,
+ * or GNUTLS_E_UNKNOWN_PK_ALGORITHM on error.
+ *
+ **/
+int gnutls_x509_extract_key_pk_algorithm( const gnutls_datum * key)
+{
+ gnutls_x509_privkey pkey;
+ int ret, pk;
+
+ ret = gnutls_x509_privkey_init( &pkey);
+ if (ret < 0) {
+ gnutls_assert();
+ return ret;
+ }
+
+ ret = gnutls_x509_privkey_import( pkey, key, GNUTLS_X509_FMT_DER);
+ if (ret < 0) {
+ gnutls_assert();
+ return ret;
+ }
+
+ pk = gnutls_x509_privkey_get_pk_algorithm( pkey);
+
+ gnutls_x509_privkey_deinit( pkey);
+ return pk;
+}
+
+#ifdef ENABLE_PKI
+
+/**
+ * gnutls_x509_pkcs7_extract_certificate - This function returns a certificate in a PKCS7 certificate set
+ * @pkcs7_struct: should contain a PKCS7 DER formatted structure
+ * @indx: contains the index of the certificate to extract
+ * @certificate: the contents of the certificate will be copied there
+ * @certificate_size: should hold the size of the certificate
+ *
+ * This function will return a certificate of the PKCS7 or RFC2630 certificate set.
+ * Returns 0 on success. If the provided buffer is not long enough,
+ * then GNUTLS_E_SHORT_MEMORY_BUFFER is returned.
+ *
+ * After the last certificate has been read GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE
+ * will be returned.
+ *
+ **/
+int gnutls_x509_pkcs7_extract_certificate(const gnutls_datum * pkcs7_struct, int indx, char* certificate, int* certificate_size)
+{
+ gnutls_pkcs7 pkcs7;
+ int result;
+ size_t size = *certificate_size;
+
+ result = gnutls_pkcs7_init( &pkcs7);
+ if (result < 0) return result;
+
+ result = gnutls_pkcs7_import( pkcs7, pkcs7_struct, GNUTLS_X509_FMT_DER);
+ if (result < 0) {
+ gnutls_pkcs7_deinit( pkcs7);
+ return result;
+ }
+
+ result = gnutls_pkcs7_get_crt_raw( pkcs7, indx, certificate, &size);
+ *certificate_size = size;
+
+ gnutls_pkcs7_deinit( pkcs7);
+
+ return result;
+}
+
+
+/**
+ * gnutls_x509_pkcs7_extract_certificate_count - This function returns the number of certificates in a PKCS7 certificate set
+ * @pkcs7_struct: should contain a PKCS7 DER formatted structure
+ *
+ * This function will return the number of certifcates in the PKCS7 or
+ * RFC2630 certificate set.
+ *
+ * Returns a negative value on failure.
+ *
+ **/
+int gnutls_x509_pkcs7_extract_certificate_count(const gnutls_datum * pkcs7_struct)
+{
+ gnutls_pkcs7 pkcs7;
+ int result;
+
+ result = gnutls_pkcs7_init( &pkcs7);
+ if (result < 0) return result;
+
+ result = gnutls_pkcs7_import( pkcs7, pkcs7_struct, GNUTLS_X509_FMT_DER);
+ if (result < 0) {
+ gnutls_pkcs7_deinit( pkcs7);
+ return result;
+ }
+
+ result = gnutls_pkcs7_get_crt_count( pkcs7);
+
+ gnutls_pkcs7_deinit( pkcs7);
+
+ return result;
+}
+
+#endif
# define GNUTLS_COMPAT8_H
/* Extra definitions */
+#include <gnutls/openssl.h>
-#define GNUTLS_X509_CN_SIZE 256
-#define GNUTLS_X509_C_SIZE 3
-#define GNUTLS_X509_O_SIZE 256
-#define GNUTLS_X509_OU_SIZE 256
-#define GNUTLS_X509_L_SIZE 256
-#define GNUTLS_X509_S_SIZE 256
-#define GNUTLS_X509_EMAIL_SIZE 256
-
-#ifdef __GNUC__
-
-#define _GT_GCC_VERSION (__GNUC__ * 10000 \
- + __GNUC_MINOR__ * 100 \
- + __GNUC_PATCHLEVEL__)
-
-#if _GT_GCC_VERSION >= 30100
-# ifndef DEPRECATED
-# define DEPRECATED __attribute__ ((__deprecated__))
-# endif
-#endif
-
-#endif
-
-#ifndef DEPRECATED
-# define DEPRECATED
-#endif
-
-typedef struct {
- char common_name[GNUTLS_X509_CN_SIZE];
- char country[GNUTLS_X509_C_SIZE];
- char organization[GNUTLS_X509_O_SIZE];
- char organizational_unit_name[GNUTLS_X509_OU_SIZE];
- char locality_name[GNUTLS_X509_L_SIZE];
- char state_or_province_name[GNUTLS_X509_S_SIZE];
- char email[GNUTLS_X509_EMAIL_SIZE];
-} gnutls_x509_dn;
-
-typedef struct {
- char name[GNUTLS_X509_CN_SIZE];
- char email[GNUTLS_X509_CN_SIZE];
-} gnutls_openpgp_name;
-
-int gnutls_x509_extract_dn( const gnutls_datum*, gnutls_x509_dn*) DEPRECATED;
+int gnutls_x509_extract_dn( const gnutls_datum*, gnutls_x509_dn*);
int gnutls_x509_extract_dn_string(const gnutls_datum * idn,
- char *buf, unsigned int sizeof_buf) DEPRECATED;
-int gnutls_x509_extract_certificate_dn( const gnutls_datum*, gnutls_x509_dn*) DEPRECATED;
+ char *buf, unsigned int sizeof_buf);
+int gnutls_x509_extract_certificate_dn( const gnutls_datum*, gnutls_x509_dn*);
int gnutls_x509_extract_certificate_dn_string(char *buf, unsigned int sizeof_buf,
- const gnutls_datum * cert, int issuer) DEPRECATED;
-int gnutls_x509_extract_certificate_issuer_dn( const gnutls_datum*, gnutls_x509_dn *) DEPRECATED;
-int gnutls_x509_extract_certificate_version( const gnutls_datum*) DEPRECATED;
-int gnutls_x509_extract_certificate_serial(const gnutls_datum * cert, char* result, int* result_size) DEPRECATED;
+ const gnutls_datum * cert, int issuer);
+int gnutls_x509_extract_certificate_issuer_dn( const gnutls_datum*, gnutls_x509_dn *);
+int gnutls_x509_extract_certificate_version( const gnutls_datum*);
+int gnutls_x509_extract_certificate_serial(const gnutls_datum * cert, char* result, int* result_size);
time_t gnutls_x509_extract_certificate_activation_time( const gnutls_datum*);
time_t gnutls_x509_extract_certificate_expiration_time( const gnutls_datum*);
-int gnutls_x509_extract_certificate_subject_alt_name( const gnutls_datum*, int seq, char*, int*) DEPRECATED;
-int gnutls_x509_pkcs7_extract_certificate(const gnutls_datum * pkcs7_struct, int indx, char* certificate, int* certificate_size) DEPRECATED;
-int gnutls_x509_extract_certificate_pk_algorithm( const gnutls_datum * cert, int* bits) DEPRECATED;
-int gnutls_x509_extract_certificate_ca_status(const gnutls_datum * cert) DEPRECATED;
-int gnutls_x509_extract_key_pk_algorithm( const gnutls_datum * key) DEPRECATED;
+int gnutls_x509_extract_certificate_subject_alt_name( const gnutls_datum*, int seq, char*, int*);
+int gnutls_x509_pkcs7_extract_certificate(const gnutls_datum * pkcs7_struct, int indx, char* certificate, int* certificate_size);
+int gnutls_x509_extract_certificate_pk_algorithm( const gnutls_datum * cert, int* bits);
+int gnutls_x509_extract_certificate_ca_status(const gnutls_datum * cert);
+int gnutls_x509_extract_key_pk_algorithm( const gnutls_datum * key);
-int gnutls_x509_verify_certificate( const gnutls_datum* cert_list, int cert_list_length, const gnutls_datum * CA_list, int CA_list_length, const gnutls_datum* CRL_list, int CRL_list_length) DEPRECATED;
+int gnutls_x509_verify_certificate( const gnutls_datum* cert_list, int cert_list_length, const gnutls_datum * CA_list, int CA_list_length, const gnutls_datum* CRL_list, int CRL_list_length);
#define gnutls_x509_fingerprint gnutls_fingerprint
#define gnutls_x509_certificate_format gnutls_x509_crt_fmt
-int gnutls_x509_extract_key_pk_algorithm( const gnutls_datum * key) DEPRECATED;
+int gnutls_x509_extract_key_pk_algorithm( const gnutls_datum * key);
#define gnutls_certificate_set_rsa_params gnutls_certificate_set_rsa_export_params
__gaa_helpsingle('p', "generate-privkey", "", "Generate a private key.");
__gaa_helpsingle('q', "generate-request", "", "Generate a PKCS #10 certificate request.");
__gaa_helpsingle('e', "verify-chain", "", "Verify a PEM encoded certificate chain. The last certificate in the chain must be a self signed one.");
+ __gaa_helpsingle(0, "verify-crl", "", "Verify a CRL.");
__gaa_helpsingle(0, "generate-dh-params", "", "Generate PKCS #3 encoded Diffie Hellman parameters.");
__gaa_helpsingle(0, "load-privkey", "FILE ", "Private key file to use.");
__gaa_helpsingle(0, "load-request", "FILE ", "Certificate request file to use.");
struct _gaainfo
{
-#line 88 "certtool.gaa"
+#line 90 "certtool.gaa"
int debug;
-#line 85 "certtool.gaa"
+#line 87 "certtool.gaa"
char *infile;
-#line 82 "certtool.gaa"
+#line 84 "certtool.gaa"
char *outfile;
-#line 79 "certtool.gaa"
+#line 81 "certtool.gaa"
int bits;
-#line 76 "certtool.gaa"
+#line 78 "certtool.gaa"
int outcert_format;
-#line 73 "certtool.gaa"
+#line 75 "certtool.gaa"
int incert_format;
-#line 70 "certtool.gaa"
+#line 72 "certtool.gaa"
int export;
-#line 67 "certtool.gaa"
+#line 69 "certtool.gaa"
int dsa;
-#line 64 "certtool.gaa"
+#line 66 "certtool.gaa"
int pkcs8;
-#line 49 "certtool.gaa"
+#line 51 "certtool.gaa"
char *pass;
-#line 46 "certtool.gaa"
+#line 48 "certtool.gaa"
char *ca;
-#line 43 "certtool.gaa"
+#line 45 "certtool.gaa"
char *ca_privkey;
-#line 40 "certtool.gaa"
+#line 42 "certtool.gaa"
char *cert;
-#line 37 "certtool.gaa"
+#line 39 "certtool.gaa"
char *request;
-#line 34 "certtool.gaa"
+#line 36 "certtool.gaa"
char *privkey;
#line 17 "certtool.gaa"
int action;
#define GAA_MULTIPLE_OPTION 3
#define GAA_REST 0
-#define GAA_NB_OPTION 32
+#define GAA_NB_OPTION 33
#define GAAOPTID_copyright 1
#define GAAOPTID_version 2
#define GAAOPTID_help 3
#define GAAOPTID_load_request 23
#define GAAOPTID_load_privkey 24
#define GAAOPTID_generate_dh_params 25
-#define GAAOPTID_verify_chain 26
-#define GAAOPTID_generate_request 27
-#define GAAOPTID_generate_privkey 28
-#define GAAOPTID_update_certificate 29
-#define GAAOPTID_generate_crl 30
-#define GAAOPTID_generate_certificate 31
-#define GAAOPTID_generate_self_signed 32
+#define GAAOPTID_verify_crl 26
+#define GAAOPTID_verify_chain 27
+#define GAAOPTID_generate_request 28
+#define GAAOPTID_generate_privkey 29
+#define GAAOPTID_update_certificate 30
+#define GAAOPTID_generate_crl 31
+#define GAAOPTID_generate_certificate 32
+#define GAAOPTID_generate_self_signed 33
#line 168 "gaa.skel"
GAA_CHECK1STR("l", GAAOPTID_crl_info);
GAA_CHECK1STR("i", GAAOPTID_certificate_info);
GAA_CHECK1STR("", GAAOPTID_generate_dh_params);
+ GAA_CHECK1STR("", GAAOPTID_verify_crl);
GAA_CHECK1STR("e", GAAOPTID_verify_chain);
GAA_CHECK1STR("q", GAAOPTID_generate_request);
GAA_CHECK1STR("p", GAAOPTID_generate_privkey);
GAA_CHECKSTR("load-request", GAAOPTID_load_request);
GAA_CHECKSTR("load-privkey", GAAOPTID_load_privkey);
GAA_CHECKSTR("generate-dh-params", GAAOPTID_generate_dh_params);
+ GAA_CHECKSTR("verify-crl", GAAOPTID_verify_crl);
GAA_CHECKSTR("verify-chain", GAAOPTID_verify_chain);
GAA_CHECKSTR("generate-request", GAAOPTID_generate_request);
GAA_CHECKSTR("generate-privkey", GAAOPTID_generate_privkey);
{
case GAAOPTID_copyright:
OK = 0;
-#line 94 "certtool.gaa"
+#line 96 "certtool.gaa"
{ print_license(); exit(0); ;};
return GAA_OK;
break;
case GAAOPTID_version:
OK = 0;
-#line 93 "certtool.gaa"
+#line 95 "certtool.gaa"
{ certtool_version(); exit(0); ;};
return GAA_OK;
break;
case GAAOPTID_help:
OK = 0;
-#line 91 "certtool.gaa"
+#line 93 "certtool.gaa"
{ gaa_help(); exit(0); ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_debug.arg1, gaa_getint, GAATMP_debug.size1);
gaa_index++;
-#line 89 "certtool.gaa"
+#line 91 "certtool.gaa"
{ gaaval->debug = GAATMP_debug.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_infile.arg1, gaa_getstr, GAATMP_infile.size1);
gaa_index++;
-#line 86 "certtool.gaa"
+#line 88 "certtool.gaa"
{ gaaval->infile = GAATMP_infile.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_outfile.arg1, gaa_getstr, GAATMP_outfile.size1);
gaa_index++;
-#line 83 "certtool.gaa"
+#line 85 "certtool.gaa"
{ gaaval->outfile = GAATMP_outfile.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_bits.arg1, gaa_getint, GAATMP_bits.size1);
gaa_index++;
-#line 80 "certtool.gaa"
+#line 82 "certtool.gaa"
{ gaaval->bits = GAATMP_bits.arg1 ;};
return GAA_OK;
break;
case GAAOPTID_outder:
OK = 0;
-#line 77 "certtool.gaa"
+#line 79 "certtool.gaa"
{ gaaval->outcert_format=1 ;};
return GAA_OK;
break;
case GAAOPTID_inder:
OK = 0;
-#line 74 "certtool.gaa"
+#line 76 "certtool.gaa"
{ gaaval->incert_format=1 ;};
return GAA_OK;
break;
case GAAOPTID_export_ciphers:
OK = 0;
-#line 71 "certtool.gaa"
+#line 73 "certtool.gaa"
{ gaaval->export=1 ;};
return GAA_OK;
break;
case GAAOPTID_dsa:
OK = 0;
-#line 68 "certtool.gaa"
+#line 70 "certtool.gaa"
{ gaaval->dsa=1 ;};
return GAA_OK;
break;
case GAAOPTID_pkcs8:
OK = 0;
-#line 65 "certtool.gaa"
+#line 67 "certtool.gaa"
{ gaaval->pkcs8=1 ;};
return GAA_OK;
break;
case GAAOPTID_to_p12:
OK = 0;
-#line 62 "certtool.gaa"
+#line 64 "certtool.gaa"
{ gaaval->action = 8; ;};
return GAA_OK;
break;
case GAAOPTID_key_info:
OK = 0;
-#line 60 "certtool.gaa"
+#line 62 "certtool.gaa"
{ gaaval->action = 6; ;};
return GAA_OK;
break;
case GAAOPTID_p7_info:
OK = 0;
-#line 58 "certtool.gaa"
+#line 60 "certtool.gaa"
{ gaaval->action = 12; ;};
return GAA_OK;
break;
case GAAOPTID_p12_info:
OK = 0;
-#line 56 "certtool.gaa"
+#line 58 "certtool.gaa"
{ gaaval->action = 9; ;};
return GAA_OK;
break;
case GAAOPTID_crl_info:
OK = 0;
-#line 54 "certtool.gaa"
+#line 56 "certtool.gaa"
{ gaaval->action = 11; ;};
return GAA_OK;
break;
case GAAOPTID_certificate_info:
OK = 0;
-#line 52 "certtool.gaa"
+#line 54 "certtool.gaa"
{ gaaval->action = 2; ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_password.arg1, gaa_getstr, GAATMP_password.size1);
gaa_index++;
-#line 50 "certtool.gaa"
+#line 52 "certtool.gaa"
{ gaaval->pass = GAATMP_password.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_load_ca_certificate.arg1, gaa_getstr, GAATMP_load_ca_certificate.size1);
gaa_index++;
-#line 47 "certtool.gaa"
+#line 49 "certtool.gaa"
{ gaaval->ca = GAATMP_load_ca_certificate.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_load_ca_privkey.arg1, gaa_getstr, GAATMP_load_ca_privkey.size1);
gaa_index++;
-#line 44 "certtool.gaa"
+#line 46 "certtool.gaa"
{ gaaval->ca_privkey = GAATMP_load_ca_privkey.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_load_certificate.arg1, gaa_getstr, GAATMP_load_certificate.size1);
gaa_index++;
-#line 41 "certtool.gaa"
+#line 43 "certtool.gaa"
{ gaaval->cert = GAATMP_load_certificate.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_load_request.arg1, gaa_getstr, GAATMP_load_request.size1);
gaa_index++;
-#line 38 "certtool.gaa"
+#line 40 "certtool.gaa"
{ gaaval->request = GAATMP_load_request.arg1 ;};
return GAA_OK;
GAA_TESTMOREARGS;
GAA_FILL(GAATMP_load_privkey.arg1, gaa_getstr, GAATMP_load_privkey.size1);
gaa_index++;
-#line 35 "certtool.gaa"
+#line 37 "certtool.gaa"
{ gaaval->privkey = GAATMP_load_privkey.arg1 ;};
return GAA_OK;
break;
case GAAOPTID_generate_dh_params:
OK = 0;
-#line 32 "certtool.gaa"
+#line 34 "certtool.gaa"
{ gaaval->action=10; ;};
+ return GAA_OK;
+ break;
+ case GAAOPTID_verify_crl:
+ OK = 0;
+#line 32 "certtool.gaa"
+{ gaaval->action=14; ;};
+
return GAA_OK;
break;
case GAAOPTID_verify_chain:
if(inited == 0)
{
-#line 96 "certtool.gaa"
+#line 98 "certtool.gaa"
{ gaaval->bits = 1024; gaaval->pkcs8 = 0; gaaval->privkey = NULL; gaaval->ca=NULL; gaaval->ca_privkey = NULL;
gaaval->debug=1; gaaval->request = NULL; gaaval->infile = NULL; gaaval->outfile = NULL; gaaval->cert = NULL;
gaaval->incert_format = 0; gaaval->outcert_format = 0; gaaval->action=-1; gaaval->pass = NULL;
struct _gaainfo
{
-#line 88 "certtool.gaa"
+#line 90 "certtool.gaa"
int debug;
-#line 85 "certtool.gaa"
+#line 87 "certtool.gaa"
char *infile;
-#line 82 "certtool.gaa"
+#line 84 "certtool.gaa"
char *outfile;
-#line 79 "certtool.gaa"
+#line 81 "certtool.gaa"
int bits;
-#line 76 "certtool.gaa"
+#line 78 "certtool.gaa"
int outcert_format;
-#line 73 "certtool.gaa"
+#line 75 "certtool.gaa"
int incert_format;
-#line 70 "certtool.gaa"
+#line 72 "certtool.gaa"
int export;
-#line 67 "certtool.gaa"
+#line 69 "certtool.gaa"
int dsa;
-#line 64 "certtool.gaa"
+#line 66 "certtool.gaa"
int pkcs8;
-#line 49 "certtool.gaa"
+#line 51 "certtool.gaa"
char *pass;
-#line 46 "certtool.gaa"
+#line 48 "certtool.gaa"
char *ca;
-#line 43 "certtool.gaa"
+#line 45 "certtool.gaa"
char *ca_privkey;
-#line 40 "certtool.gaa"
+#line 42 "certtool.gaa"
char *cert;
-#line 37 "certtool.gaa"
+#line 39 "certtool.gaa"
char *request;
-#line 34 "certtool.gaa"
+#line 36 "certtool.gaa"
char *privkey;
#line 17 "certtool.gaa"
int action;
/*
* Copyright (C) 2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
void pkcs12_info( void);
void generate_pkcs12( void);
void verify_chain(void);
+void verify_crl(void);
gnutls_x509_privkey load_private_key(int mand);
gnutls_x509_crq load_request(void);
gnutls_x509_privkey load_ca_private_key(void);
case 13:
generate_signed_crl();
break;
+ case 14:
+ verify_crl();
+ break;
default:
fprintf(stderr, "GnuTLS' certtool utility.\n");
fprintf(stderr, "Please use the --help to get help on this program.\n");
char *print, dn[256];
const char* cprint;
+ fprintf(out, "CRL information:\n");
fprintf(out, "Version: %d\n", gnutls_x509_crl_get_version(crl));
/* Issuer
char* ptr;
int ret, i;
gnutls_datum dat;
-size_t size, ptr_size;
+size_t size;
+int ptr_size;
*crt_size = 0;
fprintf(stderr, "Loading certificate list...\n");
ptr++;
ptr_size = size;
- ptr_size -= ((void*)ptr - (void*)buffer);
+ ptr_size -= (unsigned int)((unsigned char*)ptr - (unsigned char*)buffer);
+
+ if (ptr_size < 0) break;
(*crt_size)++;
}
comma = 1;
fprintf(outfile, "Revoked");
}
-
-
}
void verify_chain( void)
size_t size;
size = fread( buffer, 1, sizeof(buffer)-1, infile);
+ buffer[size] = 0;
_verify_x509_mem( buffer, size);
}
+void verify_crl( void)
+{
+size_t size, dn_size;
+char dn[128];
+unsigned int output;
+int comma=0;
+int ret;
+gnutls_datum pem;
+gnutls_x509_crl crl;
+time_t now = time(0);
+gnutls_x509_crt issuer;
+
+ issuer = load_ca_cert();
+
+ fprintf(outfile, "\nCA certificate:\n");
+ dn_size = sizeof(dn);
+ ret = gnutls_x509_crt_get_dn(issuer, dn, &dn_size);
+ if (ret >= 0)
+ fprintf(outfile, "\tSubject: %s\n\n", dn);
+
+ size = fread( buffer, 1, sizeof(buffer)-1, infile);
+ buffer[size] = 0;
+
+ pem.data = buffer;
+ pem.size = size;
+
+ gnutls_x509_crl_init( &crl);
+
+ ret = gnutls_x509_crl_import(crl, &pem, in_cert_format);
+ if (ret < 0) {
+ fprintf(stderr, "CRL decoding error: %s\n", gnutls_strerror(ret));
+ exit(1);
+ }
+
+ print_crl_info( crl, outfile, 1);
+
+
+ fprintf(outfile, "Verification output: ");
+ ret = gnutls_x509_crl_verify( crl, &issuer, 1, 0, &output);
+ if (ret < 0) {
+ fprintf(stderr, "Error in verification: %s\n", gnutls_strerror(ret));
+ exit(1);
+ }
+
+ if (output&GNUTLS_CERT_NOT_TRUSTED) {
+ fprintf(outfile, "Not verified");
+ comma = 1;
+ } else {
+ fprintf(outfile, "Verified");
+ comma = 1;
+ }
+
+ if (output&GNUTLS_CERT_SIGNER_NOT_CA) {
+ if (comma) fprintf(outfile, ", ");
+ fprintf(outfile, "Issuer is not a CA");
+ comma = 1;
+ }
+
+ /* Check expiration dates.
+ */
+
+ if (gnutls_x509_crl_get_this_update(crl) > now) {
+ if (comma) fprintf(outfile, ", ");
+ comma = 1;
+ fprintf(outfile, "Issued in the future!");
+ }
+
+ if (gnutls_x509_crl_get_next_update(crl) < now) {
+ if (comma) fprintf(outfile, ", ");
+ comma = 1;
+ fprintf(outfile, "CRL is not up to date");
+ }
+
+ fprintf(outfile, "\n");
+
+}
+
#include <gnutls/pkcs12.h>
#include <unistd.h>
option (e, verify-chain) { $action=5; } "Verify a PEM encoded certificate chain. The last certificate in the chain must be a self signed one."
+option (verify-crl) { $action=14; } "Verify a CRL."
+
option (generate-dh-params) { $action=10; } "Generate PKCS #3 encoded Diffie Hellman parameters."
#char *privkey;
/*
* Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2001,2002 Paul Sheer
* Portions Copyright (C) 2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
/*
* Copyright (C) 2000,2001,2002,2003 Nikos Mavroyanopoulos
+ * Copyright (C) 2004 Free Software Foundation
*
* This file is part of GNUTLS.
*
projects / thirdparty / gnutls.git / commitdiff
