of the certificate).
several other cleanups.
])
-AC_CHECK_TYPE(time_t,,
-AC_DEFINE(NO_TIME_T),
+AC_CHECK_TYPE(time_t,
+ DEFINE_TIME_T="#include <time.h>"
+ AC_SUBST( DEFINE_TIME_T)
+ ,
+ AC_CHECK_TYPE(time_t,
+ DEFINE_TIME_T="#include <sys/time.h>"
+ AC_SUBST( DEFINE_TIME_T)
+ ,
+ DEFINE_TIME_T="typedef unsigned int time_t;"
+ AC_SUBST( DEFINE_TIME_T)
+ AC_DEFINE(NO_TIME_T),
+ [
+ #include <sys/time.h>
+ ]
+ )
+,
[
-#ifdef HAVE_TIME_H
-# include <time.h>
-#endif
-#ifdef HAVE_SYS_TIME_H
-# include <sys/time.h>
-#endif
+ #include <time.h>
]
)
+
AC_C_BIGENDIAN
AC_MSG_RESULT([***
}
/* find the appropriate certificate */
- if ((ret=_gnutls_find_apr_cert( state, &apr_cert_list, &apr_cert_list_length, &apr_pkey))<0) {
+ if ((ret =
+ _gnutls_find_apr_cert(state, &apr_cert_list,
+ &apr_cert_list_length,
+ &apr_pkey)) < 0) {
gnutls_assert();
return ret;
}
return GNUTLS_E_MEMORY_ERROR;
}
- if ( state->gnutls_key->auth_info==NULL) {
+ if (state->gnutls_key->auth_info == NULL) {
state->gnutls_key->auth_info =
gnutls_calloc(1, sizeof(X509PKI_AUTH_INFO_INT));
if (state->gnutls_key->auth_info == NULL)
state->gnutls_key->auth_info_type = GNUTLS_X509PKI;
} else
- if (gnutls_get_auth_type( state) != state->gnutls_key->auth_info_type) {
- gnutls_assert();
- return GNUTLS_E_INVALID_REQUEST;
- }
+ if (gnutls_get_auth_type(state) !=
+ state->gnutls_key->auth_info_type) {
+ gnutls_assert();
+ return GNUTLS_E_INVALID_REQUEST;
+ }
info = state->gnutls_key->auth_info;
-
+
X = gnutls_calc_dh_secret(&x, g, p);
if (X == NULL) {
_gnutls_mpi_release(&g);
if (apr_pkey != NULL) {
if ((ret =
- _gnutls_generate_sig_params(
- state, &apr_cert_list[0], apr_pkey, &ddata, &signature)) < 0) {
+ _gnutls_generate_sig_params(state, &apr_cert_list[0],
+ apr_pkey, &ddata,
+ &signature)) < 0) {
gnutls_assert();
- gnutls_free( *data);
+ gnutls_free(*data);
return ret;
}
} else {
gnutls_assert();
- return data_size; /* do not put a signature - ILLEGAL! */
+ return data_size; /* do not put a signature - ILLEGAL! */
}
- *data = gnutls_realloc( *data, data_size+signature.size+2);
- if (*data==NULL) {
- gnutls_free_datum( &signature);
+ *data = gnutls_realloc(*data, data_size + signature.size + 2);
+ if (*data == NULL) {
+ gnutls_free_datum(&signature);
gnutls_assert();
return GNUTLS_E_MEMORY_ERROR;
}
-
- WRITEdatum16( &(*data)[data_size], signature);
- data_size += signature.size+2;
- gnutls_free_datum( &signature);
+ WRITEdatum16(&(*data)[data_size], signature);
+ data_size += signature.size + 2;
+
+ gnutls_free_datum(&signature);
return data_size;
}
X = gnutls_calc_dh_secret(&x, state->gnutls_key->client_g,
state->gnutls_key->client_p);
- if (X==NULL || x==NULL) {
+ if (X == NULL || x == NULL) {
gnutls_assert();
- _gnutls_mpi_release( &x);
- _gnutls_mpi_release( &X);
+ _gnutls_mpi_release(&x);
+ _gnutls_mpi_release(&X);
return GNUTLS_E_MEMORY_ERROR;
}
-
+
gcry_mpi_print(GCRYMPI_FMT_USG, NULL, &n_X, X);
(*data) = gnutls_malloc(n_X + 2);
if (*data == NULL) {
- _gnutls_mpi_release( &x);
- _gnutls_mpi_release( &X);
+ _gnutls_mpi_release(&x);
+ _gnutls_mpi_release(&X);
return GNUTLS_E_MEMORY_ERROR;
}
-
+
gcry_mpi_print(GCRYMPI_FMT_USG, &(*data)[2], &n_X, X);
_gnutls_mpi_release(&X);
state->gnutls_key->client_p);
_gnutls_mpi_release(&x);
- if (state->gnutls_key->KEY==NULL) {
+ if (state->gnutls_key->KEY == NULL) {
gnutls_assert();
return GNUTLS_E_MEMORY_ERROR;
}
_gnutls_mpi_release(&state->gnutls_key->client_p);
_gnutls_mpi_release(&state->gnutls_key->client_g);
- ret = _gnutls_generate_key( state->gnutls_key);
+ ret = _gnutls_generate_key(state->gnutls_key);
_gnutls_mpi_release(&state->gnutls_key->KEY);
if (ret < 0) {
int i, sigsize;
gnutls_datum vparams, signature;
int ret;
+ X509PKI_AUTH_INFO info = state->gnutls_key->auth_info;
+ gnutls_cert peer_cert;
+
+ if (info == NULL || info->ncerts==0) {
+ gnutls_assert();
+ /* we need this in order to get peer's certificate */
+ return GNUTLS_E_UNKNOWN_ERROR;
+ }
i = 0;
n_p = READuint16(&data[i]);
_n_p = n_p;
if (_gnutls_mpi_scan(&state->gnutls_key->client_Y,
- GCRYMPI_FMT_USG, data_Y, &_n_Y) != 0) {
+ GCRYMPI_FMT_USG, data_Y, &_n_Y) != 0) {
gnutls_assert();
return GNUTLS_E_MPI_SCAN_FAILED;
}
if (_gnutls_mpi_scan(&state->gnutls_key->client_g,
- GCRYMPI_FMT_USG, data_g, &_n_g) != 0) {
+ GCRYMPI_FMT_USG, data_g, &_n_g) != 0) {
gnutls_assert();
return GNUTLS_E_MPI_SCAN_FAILED;
}
if (_gnutls_mpi_scan(&state->gnutls_key->client_p,
- GCRYMPI_FMT_USG, data_p, &_n_p) != 0) {
+ GCRYMPI_FMT_USG, data_p, &_n_p) != 0) {
gnutls_assert();
return GNUTLS_E_MPI_SCAN_FAILED;
}
/* VERIFY SIGNATURE */
-
+
vparams.size = n_Y + n_p + n_g + 6;
vparams.data = data;
- if (data_size-vparams.size-2 <= 0) { /* check if the peer sent enough data */
+ if (data_size - vparams.size - 2 <= 0) { /* check if the peer sent enough data */
gnutls_assert();
return GNUTLS_E_UNEXPECTED_PACKET_LENGTH;
}
-
- sigsize = READuint16( &data[vparams.size]);
- signature.data = &data[vparams.size+2];
- signature.size = GMIN(data_size-vparams.size-2, sigsize);
- ret = _gnutls_verify_sig_params( state, &state->gnutls_internals.peer_cert, &vparams, &signature);
- if (ret<0) {
+ sigsize = READuint16(&data[vparams.size]);
+ signature.data = &data[vparams.size + 2];
+ signature.size = GMIN(data_size - vparams.size - 2, sigsize);
+
+ if ((ret =
+ _gnutls_cert2gnutlsCert( &peer_cert,
+ info->raw_certificate_list[0])) < 0) {
+ gnutls_assert();
+ return ret;
+ }
+
+ ret =
+ _gnutls_verify_sig_params(state,
+ &peer_cert,
+ &vparams, &signature);
+
+ gnutls_free_cert( peer_cert);
+ if (ret < 0) {
gnutls_assert();
return ret;
}
_n_Y = n_Y;
if (_gnutls_mpi_scan(&state->gnutls_key->client_Y,
- GCRYMPI_FMT_USG, &data[2], &_n_Y)) {
+ GCRYMPI_FMT_USG, &data[2], &_n_Y)) {
gnutls_assert();
return GNUTLS_E_MPI_SCAN_FAILED;
}
g = gnutls_get_dh_params(&p, bits);
- if (g==NULL || p==NULL) {
+ if (g == NULL || p == NULL) {
gnutls_assert();
- _gnutls_mpi_release( &g);
- _gnutls_mpi_release( &p);
+ _gnutls_mpi_release(&g);
+ _gnutls_mpi_release(&p);
return GNUTLS_E_MEMORY_ERROR;
}
_gnutls_mpi_release(&g);
_gnutls_mpi_release(&p);
- if (state->gnutls_key->KEY==NULL) {
+ if (state->gnutls_key->KEY == NULL) {
return GNUTLS_E_MEMORY_ERROR;
}
_gnutls_mpi_release(&state->gnutls_key->client_Y);
_gnutls_mpi_release(&state->gnutls_key->dh_secret);
- ret = _gnutls_generate_key( state->gnutls_key);
+ ret = _gnutls_generate_key(state->gnutls_key);
_gnutls_mpi_release(&state->gnutls_key->KEY);
if (ret < 0) {
#include <x509_verify.h>
#include <gnutls_sig.h>
#include <ext_dnsname.h>
+#include <x509_extensions.h>
/* Copies data from a internal certificate struct (gnutls_cert) to
* exported certificate struct (X509PKI_AUTH_INFO)
*/
-int _gnutls_copy_x509_client_auth_info( X509PKI_AUTH_INFO info, gnutls_cert* cert, CertificateStatus verify) {
+int _gnutls_copy_x509_auth_info( X509PKI_AUTH_INFO info, gnutls_cert* cert, int ncerts, CertificateStatus verify) {
/* Copy peer's information to AUTH_INFO
*/
-int ret;
+int ret, i, j;
info->peer_certificate_status = verify;
- info->peer_certificate_version = cert->version;
+ if (ncerts==0) {
+ info->raw_certificate_list = NULL;
+ info->ncerts = 0;
+ return 0;
+ }
- if ( cert->subjectAltDNSName[0]!=0)
- strcpy( info->subjectAltDNSName, cert->subjectAltDNSName);
-
- info->keyUsage = cert->keyUsage;
-
- info->peer_certificate_expiration_time = cert->expiration_time;
- info->peer_certificate_activation_time = cert->activation_time;
+ info->raw_certificate_list = gnutls_calloc( 1, sizeof(gnutls_datum)*ncerts);
+ if (info->raw_certificate_list==NULL) {
+ gnutls_assert();
+ return GNUTLS_E_MEMORY_ERROR;
+ }
- if (cert->raw.size > 0) {
- ret = gnutls_set_datum( &info->raw_certificate, cert->raw.data, cert->raw.size);
- if ( ret < 0) {
- gnutls_assert();
- return ret;
+ for (i=0;i<ncerts;i++) {
+ if (cert->raw.size > 0) {
+ ret = gnutls_set_datum( &info->raw_certificate_list[i], cert[i].raw.data, cert[i].raw.size);
+ if ( ret < 0) {
+ gnutls_assert();
+ goto clear;
+ }
}
}
-
+ info->ncerts = ncerts;
+
return 0;
+
+ clear:
+
+ for (j=0;j<i;j++)
+ gnutls_free_datum( &info->raw_certificate_list[j]);
+
+ gnutls_free( info->raw_certificate_list);
+ info->raw_certificate_list = NULL;
+
+ return ret;
}
typedef struct {
gnutls_free(peer_certificate_list);
return ret;
}
- if (j==0) { /* Copy the first certificate in the chain - peer's certificate
- * into the peer_cert. This is needed in order to access these
- * parameters later.
- */
- if ((ret = _gnutls_cert2gnutlsCert(&state->gnutls_internals.peer_cert, tmp)) < 0) {
- gnutls_assert();
- CLEAR_CERTS;
- gnutls_free(peer_certificate_list);
- return ret;
- }
- }
p += len;
i -= len + 3;
/* keep the PK algorithm */
state->gnutls_internals.peer_pk_algorithm = peer_certificate_list[0].subject_pk_algorithm;
- if ( (ret = _gnutls_copy_x509_client_auth_info(info, &peer_certificate_list[0], verify)) < 0) {
+ if ( (ret = _gnutls_copy_x509_auth_info(info, peer_certificate_list, peer_certificate_list_size, verify)) < 0) {
gnutls_assert();
return ret;
}
int dsize = data_size;
opaque* pdata = data;
gnutls_datum sig;
+X509PKI_AUTH_INFO info = state->gnutls_key->auth_info;
+gnutls_cert peer_cert;
+
+ if (info == NULL || info->ncerts==0) {
+ gnutls_assert();
+ /* we need this in order to get peer's certificate */
+ return GNUTLS_E_UNKNOWN_ERROR;
+ }
DECR_LEN(dsize, 2);
size = READuint16( pdata);
sig.data = pdata;
sig.size = size;
- if ( (ret=_gnutls_verify_sig_hdata( state, &state->gnutls_internals.peer_cert, &sig, data_size+HANDSHAKE_HEADER_SIZE))<0) {
+ if ((ret =
+ _gnutls_cert2gnutlsCert( &peer_cert,
+ info->raw_certificate_list[0])) < 0) {
+ gnutls_assert();
+ return ret;
+ }
+
+ if ( (ret=_gnutls_verify_sig_hdata( state, &peer_cert, &sig, data_size+HANDSHAKE_HEADER_SIZE))<0) {
gnutls_assert();
+ gnutls_free_cert( peer_cert);
return ret;
}
+ gnutls_free_cert( peer_cert);
return 0;
}
}
- result = asn1_get_der(c2, info->raw_certificate.data, info->raw_certificate.size);
+ result = asn1_get_der(c2, info->raw_certificate_list[0].data, info->raw_certificate_list[0].size);
if (result != ASN_OK) {
/* couldn't decode DER */
#ifdef DEBUG
return GNUTLS_E_ASN1_ERROR;
}
- result = asn1_get_der(c2, info->raw_certificate.data, info->raw_certificate.size);
+ result = asn1_get_der(c2, info->raw_certificate_list[0].data, info->raw_certificate_list[0].size);
if (result != ASN_OK) {
/* couldn't decode DER */
#ifdef DEBUG
return 0;
}
+
+/**
+ * gnutls_x509pki_get_subject_dns_name - This function returns the peer's dns name, if any
+ * @state: is a gnutls state
+ * @ret: is the place where dns name will be copied to
+ * @ret_size: holds the size of ret.
+ *
+ * This function will return the peer's alternative name (the dns part of it).
+ * This is specified in X509v3 Certificate Extensions.
+ * GNUTLS will only return the dnsName of the Alternative name, or a negative
+ * error code.
+ * Returns GNUTLS_E_MEMORY_ERROR if ret_size is not enough to hold dns name,
+ * or the size of dns name if everything was ok.
+ *
+ * If the certificate does not have a DNS name then returns GNUTLS_E_DATA_NOT_AVAILABLE;
+ *
+ **/
+int gnutls_x509pki_get_subject_dns_name(GNUTLS_STATE state, char* ret, int *ret_size)
+{
+ X509PKI_AUTH_INFO info;
+ int result;
+ gnutls_datum dnsname;
+
+ CHECK_AUTH(GNUTLS_X509PKI, GNUTLS_E_INVALID_REQUEST);
+
+ info = _gnutls_get_auth_info(state);
+ if (info == NULL)
+ return GNUTLS_E_INVALID_REQUEST;
+
+
+ memset(ret, 0, *ret_size);
+
+ if ((result =
+ _gnutls_get_extension( &info->raw_certificate_list[0], "2 5 29 17", &dnsname)) < 0) {
+ gnutls_assert();
+ return result;
+ }
+
+ if (dnsname.size==0) {
+ return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+ }
+
+ if ( *ret_size > dnsname.size) {
+ *ret_size = dnsname.size;
+ strcpy( ret, dnsname.data);
+ gnutls_free_datum( &dnsname);
+ } else {
+ *ret_size = dnsname.size;
+ gnutls_free_datum( &dnsname);
+ return GNUTLS_E_MEMORY_ERROR;
+ }
+
+ return *ret_size;
+}
+
+/**
+ * gnutls_x509pki_get_peer_certificate_activation_time - This function returns the peer's certificate activation time
+ * @state: is a gnutls state
+ *
+ * This function will return the peer's certificate activation time in UNIX time
+ * (ie seconds since 00:00:00 UTC January 1, 1970).
+ * Returns a (time_t) -1 in case of an error.
+ *
+ **/
+time_t gnutls_x509pki_get_peer_certificate_activation_time(GNUTLS_STATE
+ state)
+{
+ X509PKI_AUTH_INFO info;
+ node_asn *c2;
+ int result;
+ time_t ret;
+
+ CHECK_AUTH(GNUTLS_X509PKI, -1);
+
+ info = _gnutls_get_auth_info(state);
+ if (info == NULL)
+ return -1;
+
+ if (asn1_create_structure
+ (_gnutls_get_pkix(), "PKIX1Implicit88.Certificate", &c2,
+ "certificate2")
+ != ASN_OK) {
+ gnutls_assert();
+ return -1;
+ }
+
+ result = asn1_get_der(c2, info->raw_certificate_list[0].data, info->raw_certificate_list[0].size);
+ if (result != ASN_OK) {
+ /* couldn't decode DER */
+#ifdef DEBUG
+ _gnutls_log("Decoding error %d\n", result);
+#endif
+ gnutls_assert();
+ return -1;
+ }
+
+ ret = _gnutls_get_time(c2, "certificate2", "notBefore");
+
+ asn1_delete_structure(c2);
+
+ return ret;
+}
+
+/**
+ * gnutls_x509pki_get_peer_certificate_expiration_time - This function returns the peer's certificate expiration time
+ * @state: is a gnutls state
+ *
+ * This function will return the peer's certificate expiration time in UNIX time
+ * (ie seconds since 00:00:00 UTC January 1, 1970).
+ * Returns a (time_t) -1 in case of an error.
+ *
+ **/
+time_t gnutls_x509pki_get_peer_certificate_expiration_time(GNUTLS_STATE
+ state)
+{
+ X509PKI_AUTH_INFO info;
+ node_asn *c2;
+ int result;
+ time_t ret;
+
+ CHECK_AUTH(GNUTLS_X509PKI, -1);
+
+ info = _gnutls_get_auth_info(state);
+ if (info == NULL)
+ return -1;
+
+ if (asn1_create_structure
+ (_gnutls_get_pkix(), "PKIX1Implicit88.Certificate", &c2,
+ "certificate2")
+ != ASN_OK) {
+ gnutls_assert();
+ return -1;
+ }
+
+ result = asn1_get_der(c2, info->raw_certificate_list[0].data, info->raw_certificate_list[0].size);
+ if (result != ASN_OK) {
+ /* couldn't decode DER */
+#ifdef DEBUG
+ _gnutls_log("Decoding error %d\n", result);
+#endif
+ gnutls_assert();
+ return -1;
+ }
+
+ ret = _gnutls_get_time(c2, "certificate2", "notAfter");
+
+ asn1_delete_structure(c2);
+
+ return ret;
+}
+
+/**
+ * gnutls_x509pki_get_peer_certificate_version - This function returns the peer's certificate version
+ * @state: is a gnutls state
+ *
+ * This function will return the peer's certificate version (1, 2, 3). This is obtained by the X509 Certificate
+ * Version field. If the certificate is invalid then version will be zero.
+ * Returns a negative value in case of an error.
+ *
+ **/
+int gnutls_x509pki_get_peer_certificate_version(GNUTLS_STATE state)
+{
+ X509PKI_AUTH_INFO info;
+ node_asn *c2;
+ int result;
+
+ CHECK_AUTH(GNUTLS_X509PKI, GNUTLS_E_INVALID_REQUEST);
+
+ info = _gnutls_get_auth_info(state);
+ if (info == NULL)
+ return GNUTLS_E_INVALID_REQUEST;
+
+ if (asn1_create_structure
+ (_gnutls_get_pkix(), "PKIX1Implicit88.Certificate", &c2,
+ "certificate2")
+ != ASN_OK) {
+ gnutls_assert();
+ return GNUTLS_E_ASN1_ERROR;
+ }
+
+ result = asn1_get_der(c2, info->raw_certificate_list[0].data, info->raw_certificate_list[0].size);
+ if (result != ASN_OK) {
+ /* couldn't decode DER */
+#ifdef DEBUG
+ _gnutls_log("Decoding error %d\n", result);
+#endif
+ gnutls_assert();
+ return GNUTLS_E_ASN1_PARSING_ERROR;
+ }
+
+ result = _gnutls_get_version(c2, "certificate2");
+
+ asn1_delete_structure(c2);
+
+ return result;
+
+}
+
+/**
+ * gnutls_x509pki_get_peer_certificate_status - This function returns the peer's certificate status
+ * @state: is a gnutls state
+ *
+ * This function will return the peer's certificate status (TRUSTED, EXPIRED etc.). This is the output
+ * of the certificate verification function. However you must also check the peer's name in order
+ * to check if the verified certificate belongs to the actual peer.
+ * Returns GNUTLS_CERT_NONE in case of an error, or if no certificate was sent.
+ *
+ **/
+CertificateStatus gnutls_x509pki_get_peer_certificate_status(GNUTLS_STATE
+ state)
+{
+ X509PKI_AUTH_INFO info;
+
+ CHECK_AUTH(GNUTLS_X509PKI, GNUTLS_CERT_NONE);
+
+ info = _gnutls_get_auth_info(state);
+ if (info == NULL)
+ return GNUTLS_CERT_NONE;
+
+ return info->peer_certificate_status;
+}
typedef struct X509PKI_AUTH_INFO_INT {
CertificateStatus peer_certificate_status;
- int peer_certificate_version;
- time_t peer_certificate_activation_time;
- time_t peer_certificate_expiration_time;
- char subjectAltDNSName[X509_CN_SIZE];
- unsigned char keyUsage;
int certificate_requested; /* if the peer requested certificate
* this is non zero;
*/
int dh_bits; /* bits of the DH (if DHE_RSA is used) */
- gnutls_datum raw_certificate; /* holds the raw certificate of the
+ gnutls_datum* raw_certificate_list; /* holds the raw certificate of the
* peer.
*/
+ int ncerts; /* holds the size of the list above */
} *X509PKI_AUTH_INFO;
typedef struct X509PKI_AUTH_INFO_INT X509PKI_AUTH_INFO_INT;
#define LIBGNUTLS_VERSION "@VERSION@"
@DEFINE_SIZE_T@
+@DEFINE_TIME_T@
#define GNUTLS_AES GNUTLS_RIJNDAEL
break;
case GNUTLS_X509PKI: {
+ int i;
X509PKI_AUTH_INFO info =
_gnutls_get_auth_info(state);
- if (info==NULL) break;
- gnutls_free( info->raw_certificate.data);
-
+ if (info==NULL) break;
+ for (i=0;i<info->ncerts;i++) {
+ gnutls_free( info->raw_certificate_list[0].data);
+ }
+
+ gnutls_free( info->raw_certificate_list);
+ info->raw_certificate_list = NULL;
+ info->ncerts = 0;
}
+
+
break;
default:
return;
#define MAX_TIME 1024
-static time_t _gnutls_get_time(node_asn * c2, char *root, char *when)
+time_t _gnutls_get_time(node_asn * c2, char *root, char *when)
{
opaque ttime[MAX_TIME];
char name[1024];
return ctime;
}
-static int _gnutls_get_version(node_asn * c2, char *root)
+int _gnutls_get_version(node_asn * c2, char *root)
{
opaque gversion[5];
char name[1024];
opaque str[MAX_X509_CERT_SIZE];
int len = sizeof(str);
+ memset( gCert, 0, sizeof(gnutls_cert));
+
gCert->valid = 1;
if (asn1_create_structure
gCert->subject_pk_algorithm = GNUTLS_PK_UNKNOWN;
}
-
+
len = sizeof(gCert->signature);
result =
asn1_read_value
gCert->signature_size = len;
- memset(&gCert->subjectAltDNSName, 0,
- sizeof(gCert->subjectAltDNSName));
+ gCert->expiration_time =
+ _gnutls_get_time(c2, "certificate2", "notAfter");
+ gCert->activation_time =
+ _gnutls_get_time(c2, "certificate2", "notBefore");
+ gCert->version = _gnutls_get_version(c2, "certificate2");
+
if ((result =
_gnutls_get_ext_type(c2,
"certificate2.tbsCertificate.extensions",
return result;
}
- gCert->expiration_time =
- _gnutls_get_time(c2, "certificate2", "notAfter");
- gCert->activation_time =
- _gnutls_get_time(c2, "certificate2", "notBefore");
-
- gCert->version = _gnutls_get_version(c2, "certificate2");
-
asn1_delete_structure(c2);
if (gnutls_set_datum(&gCert->raw, derCert.data, derCert.size) < 0) {
#define MAX_PARAMS_SIZE 2 /* ok for RSA */
typedef struct gnutls_cert {
- MPI params[MAX_PARAMS_SIZE]; /* the size of params depends on the public
+ MPI params[MAX_PARAMS_SIZE]; /* the size of params depends on the public
* key algorithm
*/
PKAlgorithm subject_pk_algorithm;
- opaque subjectAltDNSName[X509_CN_SIZE];
- int subjectAltDNSName_size;
-
opaque signature[1024];
int signature_size;
int _gnutls_get_name_type( node_asn *rasn, char *root, gnutls_DN * dn);
void gnutls_free_cert(gnutls_cert cert);
int _gnutls_check_x509_key_usage( const gnutls_cert * cert, KXAlgorithm alg);
+int _gnutls_get_version(node_asn * c2, char *root);
+time_t _gnutls_get_time(node_asn * c2, char *root, char *when);
#endif
GNUTLS_ERROR_ENTRY( GNUTLS_E_EXPIRED, 1),
GNUTLS_ERROR_ENTRY( GNUTLS_E_HASH_FAILED, 1),
GNUTLS_ERROR_ENTRY( GNUTLS_E_PARSING_ERROR, 1),
+ GNUTLS_ERROR_ENTRY( GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE, 0),
GNUTLS_ERROR_ENTRY( GNUTLS_E_PULL_ERROR, 1),
GNUTLS_ERROR_ENTRY( GNUTLS_E_PUSH_ERROR, 1),
GNUTLS_ERROR_ENTRY( GNUTLS_E_NO_CERTIFICATE_FOUND, 1),
#define GNUTLS_E_PK_SIGNATURE_FAILED -46
#define GNUTLS_E_X509_UNSUPPORTED_CRITICAL_EXTENSION -47
#define GNUTLS_E_X509_KEY_USAGE_VIOLATION -48
-#define GNUTLS_E_PKCS1_WRONG_PAD -48
#define GNUTLS_E_NO_CERTIFICATE_FOUND -49
#define GNUTLS_E_INVALID_PARAMETERS -50
#define GNUTLS_E_INVALID_REQUEST -51
#define GNUTLS_E_PUSH_ERROR -53
#define GNUTLS_E_PULL_ERROR -54
#define GNUTLS_E_ILLEGAL_PARAMETER -55
+#define GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE -56
+#define GNUTLS_E_PKCS1_WRONG_PAD -57
#define GNUTLS_E_UNIMPLEMENTED_FEATURE -250
* client certificates were found.
*/
x509_cert_callback_func* x509_client_cert_callback;
- gnutls_cert peer_cert;
int max_handshake_data_buffer_size;
/* PUSH & PULL functions.
}
/* certificate was required */
if (optional==MANDATORY_PACKET) {
-#ifdef DEBUG
-# warning FIX THIS ALERT
- gnutls_send_alert( state, GNUTLS_FATAL, GNUTLS_BAD_CERTIFICATE);
-#endif
gnutls_assert();
}
return ret;
if (ret==0 && datasize == 0 && state->gnutls_internals.send_cert_req == GNUTLS_CERT_REQUIRE) {
/* certificate was required */
-#ifdef DEBUG
-# warning FIX THIS ALERT
- gnutls_send_alert( state, GNUTLS_FATAL, GNUTLS_BAD_CERTIFICATE);
-#endif
gnutls_assert();
return GNUTLS_E_NO_CERTIFICATE_FOUND;
}
_gnutls_free(state->gnutls_internals.CompressionMethodPriority.algorithm_priority);
_gnutls_free(state->gnutls_internals.db_name);
- gnutls_free_cert( state->gnutls_internals.peer_cert);
memset( state, 0, sizeof(struct GNUTLS_STATE_INT));
gnutls_free(state);
ret = gnutls_send_alert( state, GNUTLS_FATAL, GNUTLS_ILLEGAL_PARAMETER);
break;
case GNUTLS_E_ASN1_PARSING_ERROR:
+ case GNUTLS_E_NO_CERTIFICATE_FOUND:
ret = gnutls_send_alert( state, GNUTLS_FATAL, GNUTLS_BAD_CERTIFICATE);
break;
case GNUTLS_E_UNKNOWN_CIPHER_SUITE:
#include <gnutls_num.h>
#define PACK_HEADER_SIZE 1
-int _gnutls_pack_x509pki_auth_info(X509PKI_AUTH_INFO info,
+int _gnutls_pack_x509pki_auth_info( X509PKI_AUTH_INFO info,
gnutls_datum * packed_session);
int _gnutls_unpack_x509pki_auth_info(X509PKI_AUTH_INFO info,
const gnutls_datum * packed_session);
-static int _gnutls_pack_x509pki_auth_info_size();
+static int _gnutls_pack_x509pki_auth_info_size( X509PKI_AUTH_INFO info);
/* Since auth_info structures contain malloced data, this function
return GNUTLS_E_UNIMPLEMENTED_FEATURE;
}
+
switch (gnutls_get_auth_type(state)) {
case GNUTLS_SRP:{
SRP_SERVER_AUTH_INFO info =
_gnutls_get_auth_info(state);
- if (info == NULL || info->username[0] == 0)
+
+
+ if (info == NULL && state->gnutls_key->auth_info_size!=0) {
+ gnutls_assert();
return GNUTLS_E_INVALID_PARAMETERS;
+ }
- pack_size = sizeof(SRP_SERVER_AUTH_INFO_INT);
+ pack_size = state->gnutls_key->auth_info_size;
packed_session->size =
PACK_HEADER_SIZE + pack_size + sizeof(uint32);
WRITEuint32(pack_size,
&packed_session->
data[PACK_HEADER_SIZE]);
- memcpy(&packed_session->
- data[PACK_HEADER_SIZE + sizeof(uint32)],
- info, sizeof(SRP_SERVER_AUTH_INFO_INT));
+
+ if (state->gnutls_key->auth_info_size > 0)
+ memcpy(&packed_session->
+ data[PACK_HEADER_SIZE + sizeof(uint32)],
+ info, state->gnutls_key->auth_info_size);
}
+
break;
case GNUTLS_ANON:{
ANON_CLIENT_AUTH_INFO info =
_gnutls_get_auth_info(state);
- if (info == NULL)
+ if (info == NULL && state->gnutls_key->auth_info_size!=0)
return GNUTLS_E_INVALID_PARAMETERS;
- pack_size = sizeof(ANON_CLIENT_AUTH_INFO_INT);
+ pack_size = state->gnutls_key->auth_info_size;
packed_session->size =
PACK_HEADER_SIZE + pack_size + sizeof(uint32);
WRITEuint32(pack_size,
&packed_session->
data[PACK_HEADER_SIZE]);
- memcpy(&packed_session->
- data[PACK_HEADER_SIZE + sizeof(uint32)],
- info, sizeof(ANON_CLIENT_AUTH_INFO_INT));
+
+ if (state->gnutls_key->auth_info_size > 0)
+ memcpy(&packed_session->
+ data[PACK_HEADER_SIZE + sizeof(uint32)],
+ info, state->gnutls_key->auth_info_size);
}
break;
data[packed_session->size - sizeof(SecurityParameters)],
&state->security_parameters, sizeof(SecurityParameters));
+
return 0;
}
case GNUTLS_SRP:
case GNUTLS_ANON:
pack_size += state->gnutls_key->auth_info_size;
- case GNUTLS_X509PKI:
- pack_size += _gnutls_pack_x509pki_auth_info_size( state);
+ break;
+ case GNUTLS_X509PKI: {
+ X509PKI_AUTH_INFO info =
+ _gnutls_get_auth_info(state);
+
+ if (info == NULL)
+ return GNUTLS_E_INVALID_PARAMETERS;
+
+ pack_size += _gnutls_pack_x509pki_auth_info_size( info);
+ }
+ break;
}
/* Auth_info structures copied. Now copy SecurityParameters.
_gnutls_free_auth_info( state);
}
- switch (packed_session->data[0]) {
+ switch ( packed_session->data[0]) {
case GNUTLS_SRP:{
pack_size =
READuint32(&packed_session->
data[PACK_HEADER_SIZE]);
-
if (pack_size == 0) break;
if (pack_size != sizeof(SRP_SERVER_AUTH_INFO_INT)) {
gnutls_assert();
gnutls_calloc(1,
sizeof
(SRP_SERVER_AUTH_INFO_INT));
- if (state->gnutls_key->auth_info == NULL)
+ if (state->gnutls_key->auth_info == NULL) {
+ gnutls_assert();
return GNUTLS_E_MEMORY_ERROR;
+ }
state->gnutls_key->auth_info_size =
sizeof(SRP_SERVER_AUTH_INFO_INT);
gnutls_calloc(1,
sizeof
(ANON_CLIENT_AUTH_INFO_INT));
- if (state->gnutls_key->auth_info == NULL)
+ if (state->gnutls_key->auth_info == NULL) {
+ gnutls_assert();
return GNUTLS_E_MEMORY_ERROR;
+ }
state->gnutls_key->auth_info_size =
sizeof(ANON_CLIENT_AUTH_INFO_INT);
state->gnutls_key->auth_info =
gnutls_calloc(1,
sizeof(X509PKI_AUTH_INFO_INT));
- if (state->gnutls_key->auth_info == NULL)
+ if (state->gnutls_key->auth_info == NULL) {
+ gnutls_assert();
return GNUTLS_E_MEMORY_ERROR;
+ }
state->gnutls_key->auth_info_size =
sizeof(X509PKI_AUTH_INFO_INT);
return ret;
}
- pack_size += ret;
-
}
break;
default:
+ gnutls_assert();
return GNUTLS_E_UNIMPLEMENTED_FEATURE;
}
memcpy( &state->gnutls_internals.resumed_security_parameters, &sp, sizeof(SecurityParameters));
} else {
_gnutls_free_auth_info( state);
-
+ gnutls_assert();
return GNUTLS_E_EXPIRED;
}
return 0;
}
-int _gnutls_pack_x509pki_auth_info(X509PKI_AUTH_INFO info,
+int _gnutls_pack_x509pki_auth_info( X509PKI_AUTH_INFO info,
gnutls_datum * packed_session)
{
- uint32 pack_size = sizeof(X509PKI_AUTH_INFO_INT) + info->raw_certificate.size;
- packed_session->size =
- pack_size + PACK_HEADER_SIZE + sizeof(uint32);
+ uint32 pos, i;
+ packed_session->size = _gnutls_pack_x509pki_auth_info_size( info);
packed_session->data[0] = GNUTLS_X509PKI;
- WRITEuint32(pack_size, &packed_session->data[PACK_HEADER_SIZE]);
+ WRITEuint32( packed_session->size-PACK_HEADER_SIZE-sizeof(uint32), &packed_session->data[PACK_HEADER_SIZE]);
+
+
memcpy(&packed_session->data[PACK_HEADER_SIZE + sizeof(uint32)],
info, sizeof(X509PKI_AUTH_INFO_INT));
- if (info->raw_certificate.size > 0)
- memcpy(&packed_session->data[PACK_HEADER_SIZE + sizeof(uint32) +
- sizeof(X509PKI_AUTH_INFO_INT)], info->raw_certificate.data,
- info->raw_certificate.size);
+ pos = PACK_HEADER_SIZE + sizeof(uint32) + sizeof(X509PKI_AUTH_INFO_INT);
+
+ for (i=0;i<info->ncerts;i++) {
+ WRITEuint32( info->raw_certificate_list[i].size, &packed_session->data[pos]);
+ pos += sizeof(uint32);
+
+ memcpy(&packed_session->data[pos], info->raw_certificate_list[i].data, info->raw_certificate_list[i].size);
+ pos += info->raw_certificate_list[i].size;
+ }
+
return 0;
}
-static int _gnutls_pack_x509pki_auth_info_size( GNUTLS_STATE state)
+static int _gnutls_pack_x509pki_auth_info_size( X509PKI_AUTH_INFO info)
{
- X509PKI_AUTH_INFO info =
- _gnutls_get_auth_info(state);
uint32 pack_size = sizeof(X509PKI_AUTH_INFO_INT);
+ int i;
if (info == NULL)
return 0;
-
- return pack_size + PACK_HEADER_SIZE + sizeof(uint32) + info->raw_certificate.size;
+
+ for (i=0;i<info->ncerts;i++) {
+ pack_size += sizeof(uint32) + info->raw_certificate_list[i].size;
+ }
+
+ return pack_size + PACK_HEADER_SIZE + sizeof(uint32);
}
int _gnutls_unpack_x509pki_auth_info(X509PKI_AUTH_INFO info,
const gnutls_datum * packed_session)
{
-int ret;
+int ret, i, pos, j;
+uint32 size;
memcpy(info,
&packed_session->data[PACK_HEADER_SIZE + sizeof(uint32)],
sizeof(X509PKI_AUTH_INFO_INT));
- if (info->raw_certificate.size > 0) {
- ret = gnutls_set_datum( &info->raw_certificate,
- &packed_session->data[PACK_HEADER_SIZE + sizeof(uint32) + sizeof(X509PKI_AUTH_INFO_INT)],
- info->raw_certificate.size);
-
- if (ret < 0) {
+ pos = PACK_HEADER_SIZE + sizeof(uint32) + sizeof(X509PKI_AUTH_INFO_INT);
+ if (info->ncerts > 0) {
+ info->raw_certificate_list = gnutls_calloc( 1, info->ncerts * sizeof( gnutls_datum));
+ if (info->raw_certificate_list == NULL) {
gnutls_assert();
- return ret;
+ return GNUTLS_E_MEMORY_ERROR;
+ }
+
+ for (i=0;i<info->ncerts;i++) {
+ size = READuint32( &packed_session->data[ pos]);
+ pos += sizeof(uint32);
+
+ ret = gnutls_set_datum( &info->raw_certificate_list[i], &packed_session->data[ pos], size);
+ pos += size;
+
+ if (ret < 0) {
+ gnutls_assert();
+ goto clear;
+ }
}
}
return 0;
+
+ clear:
+ for (j=0;j<i;j++)
+ gnutls_free_datum( &info->raw_certificate_list[j]);
+
+ gnutls_free( info->raw_certificate_list);
+ return GNUTLS_E_MEMORY_ERROR;
+
}
/* X509PKI */
/**
- * gnutls_x509pki_get_peer_certificate_status - This function returns the peer's certificate status
+ * gnutls_x509pki_get_peer_certificate_list - This function returns the peer's raw (DER encoded) certificate
* @state: is a gnutls state
+ * @list_size: is the length of the certificate list
*
- * This function will return the peer's certificate status (TRUSTED, EXPIRED etc.). This is the output
- * of the certificate verification function. However you must also check the peer's name in order
- * to check if the verified certificate belongs to the actual peer.
- * Returns GNUTLS_CERT_NONE in case of an error, or if no certificate was sent.
- *
- **/
-CertificateStatus gnutls_x509pki_get_peer_certificate_status(GNUTLS_STATE
- state)
-{
- X509PKI_AUTH_INFO info;
-
- CHECK_AUTH(GNUTLS_X509PKI, GNUTLS_CERT_NONE);
-
- info = _gnutls_get_auth_info(state);
- if (info == NULL)
- return GNUTLS_CERT_NONE;
- return info->peer_certificate_status;
-}
-
-/**
- * gnutls_x509pki_get_peer_certificate - This function returns the peer's raw (DER encoded) certificate
- * @state: is a gnutls state
- *
- * This function will return the peer's raw certificate as sent by the peer.
- * This certificate is DER encoded.
+ * This function will return the peer's raw certificate list as sent by the peer.
+ * These certificates are DER encoded.
* Returns NULL in case of an error, or if no certificate was sent.
*
**/
-const gnutls_datum *gnutls_x509pki_get_peer_certificate(GNUTLS_STATE state)
+const gnutls_datum *gnutls_x509pki_get_peer_certificate_list(GNUTLS_STATE state, int *list_size)
{
X509PKI_AUTH_INFO info;
info = _gnutls_get_auth_info(state);
if (info == NULL)
return NULL;
- return &info->raw_certificate;
-}
-
-/**
- * gnutls_x509pki_get_peer_certificate_version - This function returns the peer's certificate version
- * @state: is a gnutls state
- *
- * This function will return the peer's certificate version (1, 2, 3). This is obtained by the X509 Certificate
- * Version field. If the certificate is invalid then version will be zero.
- * Returns a negative value in case of an error.
- *
- **/
-int gnutls_x509pki_get_peer_certificate_version(GNUTLS_STATE state)
-{
- X509PKI_AUTH_INFO info;
-
- CHECK_AUTH(GNUTLS_X509PKI, GNUTLS_E_INVALID_REQUEST);
- info = _gnutls_get_auth_info(state);
- if (info == NULL)
- return GNUTLS_E_UNKNOWN_ERROR;
- return info->peer_certificate_version;
+ *list_size = info->ncerts;
+ return info->raw_certificate_list;
}
+
/**
* gnutls_x509pki_get_dh_bits - This function returns the number of bits used in a DHE handshake
* @state: is a gnutls state
return info->dh_bits;
}
-/**
- * gnutls_x509pki_get_peer_certificate_activation_time - This function returns the peer's certificate activation time
- * @state: is a gnutls state
- *
- * This function will return the peer's certificate activation time in UNIX time
- * (ie seconds since 00:00:00 UTC January 1, 1970).
- * Returns a (time_t) -1 in case of an error.
- *
- **/
-time_t gnutls_x509pki_get_peer_certificate_activation_time(GNUTLS_STATE
- state)
-{
- X509PKI_AUTH_INFO info;
-
- CHECK_AUTH(GNUTLS_X509PKI, -1);
- info = _gnutls_get_auth_info(state);
- if (info == NULL)
- return -1;
- return info->peer_certificate_activation_time;
-}
-
-/**
- * gnutls_x509pki_get_peer_certificate_expiration_time - This function returns the peer's certificate expiration time
- * @state: is a gnutls state
- *
- * This function will return the peer's certificate expiration time in UNIX time
- * (ie seconds since 00:00:00 UTC January 1, 1970).
- * Returns a (time_t) -1 in case of an error.
- *
- **/
-time_t gnutls_x509pki_get_peer_certificate_expiration_time(GNUTLS_STATE
- state)
-{
- X509PKI_AUTH_INFO info;
-
- CHECK_AUTH(GNUTLS_X509PKI, -1);
-
- info = _gnutls_get_auth_info(state);
- if (info == NULL)
- return -1;
- return info->peer_certificate_expiration_time;
-}
-
-
-/**
- * gnutls_x509pki_get_key_usage - This function returns the peer's certificate key usage
- * @state: is a gnutls state
- *
- * This function will return the peer's certificate key usage. This is specified in X509v3 Certificate
- * Extensions and is an 8bit string.
- * Returns zero in case of an error.
- *
- **/
-unsigned char gnutls_x509pki_get_key_usage(GNUTLS_STATE state)
-{
- X509PKI_AUTH_INFO info;
-
- CHECK_AUTH(GNUTLS_X509PKI, 0);
-
- info = _gnutls_get_auth_info(state);
- if (info == NULL)
- return 0;
- return info->keyUsage;
-}
/**
* gnutls_x509pki_get_certificate_request_status - This function returns the certificate request status
}
-/**
- * gnutls_x509pki_get_subject_dns_name - This function returns the peer's dns name, if any
- * @state: is a gnutls state
- *
- * This function will return the peer's alternative name (the dns part of it).
- * This is specified in X509v3 Certificate Extensions.
- * GNUTLS will only return the dnsName of the Alternative name, or a null
- * string.
- * Returns NULL in case of an error.
- *
- **/
-const char *gnutls_x509pki_get_subject_dns_name(GNUTLS_STATE state)
-{
- X509PKI_AUTH_INFO info;
-
- CHECK_AUTH(GNUTLS_X509PKI, NULL);
-
- info = _gnutls_get_auth_info(state);
- if (info == NULL)
- return NULL;
- return info->subjectAltDNSName;
-}
int gnutls_x509pki_get_certificate_request_status( GNUTLS_STATE);
int gnutls_x509pki_get_peer_dn( GNUTLS_STATE, gnutls_DN*);
-const gnutls_datum* gnutls_x509pki_get_peer_certificate( GNUTLS_STATE);
+const gnutls_datum* gnutls_x509pki_get_peer_certificate_list( GNUTLS_STATE, int* list_size);
int gnutls_x509pki_get_issuer_dn( GNUTLS_STATE, gnutls_DN *);
CertificateStatus gnutls_x509pki_get_peer_certificate_status( GNUTLS_STATE);
int gnutls_x509pki_get_peer_certificate_version( GNUTLS_STATE);
time_t gnutls_x509pki_get_peer_certificate_activation_time( GNUTLS_STATE);
time_t gnutls_x509pki_get_peer_certificate_expiration_time( GNUTLS_STATE);
unsigned char gnutls_x509pki_get_key_usage( GNUTLS_STATE);
-const char* gnutls_x509pki_get_subject_dns_name( GNUTLS_STATE);
+int gnutls_x509pki_get_subject_dns_name( GNUTLS_STATE, char*, int*);
int gnutls_x509pki_get_dh_bits( GNUTLS_STATE);
#define gnutls_x509pki_server_get_dh_bits gnutls_x509pki_get_dh_bits
#include <gnutls_cert.h>
#include <gnutls_errors.h>
#include <gnutls_global.h>
+#include "debug.h"
-/* Here we only read subjectAltDNSName, in case of
- * dnsName. Otherwise we read nothing.
- */
-static int _extract_subjectAltDNSName( char* subjectAltDNSName, opaque* extnValue, int extnValueLen) {
-node_asn* ext;
-char counter[MAX_INT_DIGITS];
-char name[1024];
-char str[1024];
-int len, k, result;
-
- subjectAltDNSName[0] = 0;
-
- if (asn1_create_structure
- ( _gnutls_get_pkix(), "PKIX1Implicit88.GeneralNames", &ext,
- "san") != ASN_OK) {
- gnutls_assert();
- return GNUTLS_E_ASN1_PARSING_ERROR;
- }
-
- result = asn1_get_der ( ext, extnValue, extnValueLen);
-
- if (result != ASN_OK) {
- gnutls_assert();
- asn1_delete_structure(ext);
- return GNUTLS_E_ASN1_PARSING_ERROR;
- }
-
- k = 1;
- for (;;) {
- strcpy(name, "san.?");
- _gnutls_int2str(k, counter);
- strcat(name, counter);
-
- len = sizeof(str) - 1;
- result = asn1_read_value(ext, name, str, &len);
- if (result == ASN_ELEMENT_NOT_FOUND) break;
-
- if (strcmp( str, "dNSName") == 0) {
- strcat( name, "dNSName");
- len = sizeof( str) -1;
- result = asn1_read_value(ext, name, str, &len);
-
- if (result != ASN_OK) {
- gnutls_assert();
- asn1_delete_structure(ext);
- return GNUTLS_E_ASN1_PARSING_ERROR;
- }
-
- strncpy( subjectAltDNSName, str, GMIN( len, X509_CN_SIZE-1));
- subjectAltDNSName[X509_CN_SIZE-1] = 0;
-
- break;
- }
- k++;
- }
-
- asn1_delete_structure(ext);
- return 0;
-}
/* Here we only extract the KeyUsage field
*/
-static int _extract_keyUsage( char* keyUsage, opaque* extnValue, int extnValueLen) {
-node_asn* ext;
-char str[128];
-int len, result;
+static int _extract_keyUsage(char *keyUsage, opaque * extnValue,
+ int extnValueLen)
+{
+ node_asn *ext;
+ char str[10];
+ int len, result;
+ keyUsage[0] = 0;
if (asn1_create_structure
- ( _gnutls_get_pkix(), "PKIX1Implicit88.KeyUsage", &ext,
- "ku") != ASN_OK) {
+ (_gnutls_get_pkix(), "PKIX1Implicit88.KeyUsage", &ext,
+ "ku") != ASN_OK) {
gnutls_assert();
return GNUTLS_E_ASN1_PARSING_ERROR;
}
- result = asn1_get_der ( ext, extnValue, extnValueLen);
+ result = asn1_get_der(ext, extnValue, extnValueLen);
if (result != ASN_OK) {
gnutls_assert();
asn1_delete_structure(ext);
- return GNUTLS_E_ASN1_PARSING_ERROR;
+ return 0;
}
len = sizeof(str) - 1;
if (result != ASN_OK) {
gnutls_assert();
asn1_delete_structure(ext);
- return GNUTLS_E_ASN1_PARSING_ERROR;
+ return 0;
}
keyUsage[0] = str[0];
return 0;
}
-static int _extract_basicConstraints( int* CA, opaque* extnValue, int extnValueLen) {
-node_asn* ext;
-char str[128];
-int len, result;
+static int _extract_basicConstraints(int *CA, opaque * extnValue,
+ int extnValueLen)
+{
+ node_asn *ext;
+ char str[128];
+ int len, result;
*CA = 0;
-
+
if (asn1_create_structure
- ( _gnutls_get_pkix(), "PKIX1Implicit88.BasicConstraints", &ext,
- "bc") != ASN_OK) {
+ (_gnutls_get_pkix(), "PKIX1Implicit88.BasicConstraints", &ext,
+ "bc") != ASN_OK) {
gnutls_assert();
return GNUTLS_E_ASN1_PARSING_ERROR;
}
- result = asn1_get_der ( ext, extnValue, extnValueLen);
+ result = asn1_get_der(ext, extnValue, extnValueLen);
if (result != ASN_OK) {
gnutls_assert();
asn1_delete_structure(ext);
- return 0; /* GNUTLS_E_ASN1_PARSING_ERROR may be better
- * but we want to continue even if the
- * certificate is badly formated.
- */
+ return 0;
}
len = sizeof(str) - 1;
if (result != ASN_OK) {
gnutls_assert();
asn1_delete_structure(ext);
- return 0; /* see above.
- */
+ return 0;
}
asn1_delete_structure(ext);
- if ( strcmp(str, "TRUE")==0) *CA = 1;
- else *CA = 0;
+ if (strcmp(str, "TRUE") == 0)
+ *CA = 1;
+ else
+ *CA = 0;
return 0;
}
-static int _parse_extension( gnutls_cert* cert, char* extnID, char* critical, char* extnValue, int extnValueLen) {
+static int _parse_extension(gnutls_cert * cert, char *extnID,
+ char *critical, char *extnValue,
+ int extnValueLen)
+{
- if (strcmp( extnID, "2 5 29 14")==0) { /* subject Key ID */
+ if (strcmp(extnID, "2 5 29 14") == 0) { /* subject Key ID */
/* we don't use it */
return 0;
}
- if (strcmp( extnID, "2 5 29 15")==0) { /* Key Usage */
- return _extract_keyUsage( &cert->keyUsage, extnValue, extnValueLen);
+ if (strcmp(extnID, "2 5 29 15") == 0) { /* Key Usage */
+fprintf(stderr, "key USAGE FOUND\n");
+ return _extract_keyUsage(&cert->keyUsage, extnValue, extnValueLen);
}
- if (strcmp( extnID, "2 5 29 19")==0) { /* Basic Constraints */
+ if (strcmp(extnID, "2 5 29 19") == 0) { /* Basic Constraints */
/* actually checks if a certificate belongs to
* a Certificate Authority.
*/
- return _extract_basicConstraints( &cert->CA, extnValue, extnValueLen);
- }
-
- if (strcmp( extnID, "2 5 29 17")==0) { /* subjectAltDNSName */
- return _extract_subjectAltDNSName( cert->subjectAltDNSName, extnValue, extnValueLen);
+ return _extract_basicConstraints(&cert->CA, extnValue,
+ extnValueLen);
}
#ifdef DEBUG
- _gnutls_log("CERT[%s]: Unsupported Extension: %s, %s\n", GET_CN(cert->raw), extnID, critical);
+ _gnutls_log("CERT[%s]: Unsupported Extension: %s, %s\n",
+ GET_CN(cert->raw), extnID, critical);
#endif
-
- if (strcmp( critical, "TRUE")==0) {
+
+ if (strcmp(critical, "TRUE") == 0) {
gnutls_assert();
return GNUTLS_E_X509_UNSUPPORTED_CRITICAL_EXTENSION;
}
/* This function will attempt to parse Extensions in
* an X509v3 certificate
*/
-int _gnutls_get_ext_type( node_asn *rasn, char *root, gnutls_cert *cert)
+int _gnutls_get_ext_type(node_asn * rasn, char *root, gnutls_cert * cert)
{
int k, result, len;
char name[128], name2[128], counter[MAX_INT_DIGITS];
k = 0;
do {
k++;
-
+
strcpy(name, root);
strcat(name, ".?");
_gnutls_int2str(k, counter);
strcat(name, counter);
len = sizeof(str) - 1;
- result = asn1_read_value( rasn, name, str, &len);
-
+ result = asn1_read_value(rasn, name, str, &len);
+
/* move to next
*/
- if (result==ASN_ELEMENT_NOT_FOUND) break;
+ if (result == ASN_ELEMENT_NOT_FOUND)
+ break;
do {
strcat(name2, ".extnID");
len = sizeof(extnID) - 1;
- result = asn1_read_value( rasn, name2, extnID, &len);
+ result =
+ asn1_read_value(rasn, name2, extnID, &len);
- if (result==ASN_ELEMENT_NOT_FOUND) break;
- else
- if (result != ASN_OK) {
- gnutls_assert();
- return GNUTLS_E_ASN1_PARSING_ERROR;
- }
+ if (result == ASN_ELEMENT_NOT_FOUND)
+ break;
+ else if (result != ASN_OK) {
+ gnutls_assert();
+ return GNUTLS_E_ASN1_PARSING_ERROR;
+ }
strcpy(name2, name);
strcat(name2, ".critical");
-
+
len = sizeof(critical) - 1;
- result = asn1_read_value( rasn, name2, critical, &len);
+ result =
+ asn1_read_value(rasn, name2, critical, &len);
- if (result==ASN_ELEMENT_NOT_FOUND) break;
- else
+ if (result == ASN_ELEMENT_NOT_FOUND)
+ break;
+ else if (result != ASN_OK) {
+ gnutls_assert();
+ return GNUTLS_E_ASN1_PARSING_ERROR;
+ }
+
+ strcpy(name2, name);
+ strcat(name2, ".extnValue");
+
+ len = sizeof(extnValue) - 1;
+ result =
+ asn1_read_value(rasn, name2, extnValue, &len);
+
+ if (result == ASN_ELEMENT_NOT_FOUND)
+ break;
+ else {
+ if (result == ASN_MEM_ERROR
+ && strcmp(critical, "FALSE") == 0) {
+#ifdef DEBUG
+ _gnutls_log
+ ("Cannot parse extension: %s. Too small buffer.",
+ extnID);
+#endif
+ continue;
+ }
if (result != ASN_OK) {
gnutls_assert();
return GNUTLS_E_ASN1_PARSING_ERROR;
}
-
+ }
+
+ /* Handle Extension */
+ if ((result =
+ _parse_extension(cert, extnID, critical,
+ extnValue, len)) < 0) {
+ gnutls_assert();
+ return result;
+ }
+
+
+ } while (0);
+ } while (1);
+
+ if (result == ASN_ELEMENT_NOT_FOUND)
+ return 0;
+ else
+ return GNUTLS_E_ASN1_PARSING_ERROR;
+}
+
+/* This function will attempt to return the requested extension found in
+ * the given X509v3 certificate. The return value is allocated and stored into
+ * ret.
+ */
+int _gnutls_get_extension( const gnutls_datum * cert, const char* extension_id, gnutls_datum* ret)
+{
+ int k, result, len;
+ char name[128], name2[128], counter[MAX_INT_DIGITS];
+ char str[1024];
+ char critical[10];
+ char extnID[128];
+ char extnValue[256];
+ node_asn* rasn;
+
+ ret->data = NULL;
+ ret->size = 0;
+
+ if (asn1_create_structure
+ (_gnutls_get_pkix(), "PKIX1Implicit88.Certificate", &rasn,
+ "certificate2")
+ != ASN_OK) {
+ gnutls_assert();
+ return GNUTLS_E_ASN1_ERROR;
+ }
+
+ result =
+ asn1_get_der(rasn, cert->data, cert->size);
+ if (result != ASN_OK) {
+ /* couldn't decode DER */
+#ifdef DEBUG
+ _gnutls_log("Decoding error %d\n", result);
+#endif
+ gnutls_assert();
+ asn1_delete_structure(rasn);
+ return GNUTLS_E_ASN1_PARSING_ERROR;
+ }
+
+ k = 0;
+ do {
+ k++;
+
+ strcpy(name, "certificate2");
+ strcat(name, ".?");
+ _gnutls_int2str(k, counter);
+ strcat(name, counter);
+
+ len = sizeof(str) - 1;
+ result = asn1_read_value(rasn, name, str, &len);
+
+ /* move to next
+ */
+
+ if (result == ASN_ELEMENT_NOT_FOUND)
+ break;
+
+ do {
+
+ strcpy(name2, name);
+ strcat(name2, ".extnID");
+
+ len = sizeof(extnID) - 1;
+ result =
+ asn1_read_value(rasn, name2, extnID, &len);
+
+ if (result == ASN_ELEMENT_NOT_FOUND)
+ break;
+ else if (result != ASN_OK) {
+ gnutls_assert();
+ return GNUTLS_E_ASN1_PARSING_ERROR;
+ }
+
+ strcpy(name2, name);
+ strcat(name2, ".critical");
+
+ len = sizeof(critical) - 1;
+ result =
+ asn1_read_value(rasn, name2, critical, &len);
+
+ if (result == ASN_ELEMENT_NOT_FOUND)
+ break;
+ else if (result != ASN_OK) {
+ gnutls_assert();
+ asn1_delete_structure(rasn);
+ return GNUTLS_E_ASN1_PARSING_ERROR;
+ }
+
strcpy(name2, name);
strcat(name2, ".extnValue");
- len = sizeof( extnValue) - 1;
- result = asn1_read_value( rasn, name2, extnValue, &len);
+ len = sizeof(extnValue) - 1;
+ result =
+ asn1_read_value(rasn, name2, extnValue, &len);
- if (result==ASN_ELEMENT_NOT_FOUND) break;
+ if (result == ASN_ELEMENT_NOT_FOUND)
+ break;
else {
- if (result==ASN_MEM_ERROR && strcmp(critical, "FALSE")==0) {
+ if (result == ASN_MEM_ERROR
+ && strcmp(critical, "FALSE") == 0) {
#ifdef DEBUG
- _gnutls_log("Cannot parse extension: %s. Too small buffer.", extnID);
+ _gnutls_log
+ ("Cannot parse extension: %s. Too small buffer.",
+ extnID);
#endif
continue;
}
if (result != ASN_OK) {
gnutls_assert();
+ asn1_delete_structure(rasn);
return GNUTLS_E_ASN1_PARSING_ERROR;
}
}
-
+
/* Handle Extension */
- if ( (result=_parse_extension( cert, extnID, critical, extnValue, len)) < 0) {
- gnutls_assert();
- return result;
+ if ( strcmp(extnID, extension_id)==0) { /* extension was found */
+ asn1_delete_structure(rasn);
+ ret->data = gnutls_malloc( len);
+ if (ret->data==NULL)
+ return GNUTLS_E_MEMORY_ERROR;
+
+ ret->size = len;
+ memcpy( ret->data, extnValue, len);
+
+ return 0;
}
-
-
+
+
} while (0);
} while (1);
- if (result==ASN_ELEMENT_NOT_FOUND)
- return 0;
- else
+ asn1_delete_structure(rasn);
+
+
+ if (result == ASN_ELEMENT_NOT_FOUND)
+ return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
+ else
return GNUTLS_E_ASN1_PARSING_ERROR;
}
int _gnutls_get_ext_type( node_asn *rasn, char *root, gnutls_cert *cert);
+int _gnutls_get_extension( const gnutls_datum * cert, const char* extension_id, gnutls_datum* ret);
-EXTRA_DIST = port.h prime.gaa crypt.gaa crypt-gaa.h README.crypt prime-gaa.h \
+EXTRA_DIST = common.h prime.gaa crypt.gaa crypt-gaa.h README.crypt prime-gaa.h \
README
SUBDIRS = srp x509
#include <sys/time.h>
#include <signal.h>
#include <netdb.h>
+#include <common.h>
#ifndef SHUT_WR
# define SHUT_WR 1
#define CLIKEYFILE "x509/clikey.pem"
#define CLICERTFILE "x509/clicert.pem"
-#define PRINTX(x,y) if (y[0]!=0) printf(" - %s %s\n", x, y)
-#define PRINT_DN(X) PRINTX( "CN:", X.common_name); \
- PRINTX( "OU:", X.organizational_unit_name); \
- PRINTX( "O:", X.organization); \
- PRINTX( "L:", X.locality_name); \
- PRINTX( "S:", X.state_or_province_name); \
- PRINTX( "C:", X.country); \
- PRINTX( "E:", X.email); \
- PRINTX( "SAN:", gnutls_x509pki_client_get_subject_dns_name(state))
-
static int print_info( GNUTLS_STATE state) {
const char *tmp;
CredType cred;
gnutls_DN dn;
CertificateStatus status;
-
+char dnsname[512];
+int dnsname_size;
tmp = gnutls_kx_get_name(gnutls_get_current_kx( state));
printf("- Key Exchange: %s\n", tmp);
--- /dev/null
+#define PORT 5556
+#define SERVER "127.0.0.1"
+
+#define PRINTX(x,y) if (y[0]!=0) printf(" - %s %s\n", x, y)
+#define PRINT_DN(X) PRINTX( "CN:", X.common_name); \
+ PRINTX( "OU:", X.organizational_unit_name); \
+ PRINTX( "O:", X.organization); \
+ PRINTX( "L:", X.locality_name); \
+ PRINTX( "S:", X.state_or_province_name); \
+ PRINTX( "C:", X.country); \
+ PRINTX( "E:", X.email); \
+ dnsname_size = sizeof(dnsname); \
+ gnutls_x509pki_client_get_subject_dns_name(state, dnsname, &dnsname_size); \
+ PRINTX( "SAN:", dnsname)
+++ /dev/null
-#define PORT 5556
-#define SERVER "127.0.0.1"
#include <string.h>
#include <unistd.h>
#include "../lib/gnutls.h"
-#include <port.h>
+#include <common.h>
#include <signal.h>
#define KEYFILE "x509/key.pem"
return state;
}
-#define PRINTX(x,y) if (y[0]!=0) printf(" - %s %s\n", x, y)
-#define PRINT_DN(X) PRINTX( "CN:", X.common_name); \
- PRINTX( "OU:", X.organizational_unit_name); \
- PRINTX( "O:", X.organization); \
- PRINTX( "L:", X.locality_name); \
- PRINTX( "S:", X.state_or_province_name); \
- PRINTX( "C:", X.country); \
- PRINTX( "E:", X.email); \
- PRINTX( "SAN:", gnutls_x509pki_client_get_subject_dns_name(state))
void print_info(GNUTLS_STATE state)
{
gnutls_DN dn;
CredType cred;
CertificateStatus status;
+ char dnsname[512];
+ int dnsname_size;
/* print session_id specific data */
gnutls_get_current_session_id( state, sesid, &sesid_size);
projects / thirdparty / gnutls.git / commitdiff
