PKCS #11 PIN handling fixes.

Added gnutls_x509_crt_set_pin_function() and set the PIN
handling function in gnutls_privkey_import_pkcs11_url().

diff --git a/NEWS b/NEWS
index 4c1b3576e487b5bfa78760a71104e3d2d6a3d345..0387d0f99919f19901ebc344ec9937d21803ae01 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -67,6 +67,7 @@ gnutls_pubkey_verify_hash2: Added
 gnutls_pubkey_set_pin_function: Added
 gnutls_x509_privkey_import2: Added
 gnutls_x509_privkey_import_openssl: Added
+gnutls_x509_crt_set_pin_function: Added
 gnutls_load_file: Added
 gnutls_pkcs12_simple_parse: Added
 gnutls_certificate_set_x509_system_trust: Added

diff --git a/lib/gnutls_privkey.c b/lib/gnutls_privkey.c
index 92809b637e24901bbb8a9641234b47300ca6a2bc..816e941a7d7fdec0b1fecb113501424462364edf 100644 (file)
--- a/lib/gnutls_privkey.c
+++ b/lib/gnutls_privkey.c
@@ -375,6 +375,9 @@ gnutls_privkey_import_pkcs11_url (gnutls_privkey_t key, const char *url)
       gnutls_assert ();
       return ret;
     }
+  
+  if (key->pin.cb)
+    gnutls_pkcs11_privkey_set_pin_function(pkey, key->pin.cb, key->pin.data);
 
   ret = gnutls_pkcs11_privkey_import_url (pkey, url, 0);
   if (ret < 0)

diff --git a/lib/includes/gnutls/x509.h b/lib/includes/gnutls/x509.h
index 5923aca72a825144548865ddbbea695c97620408..0ec4f218ca979a0e7c3879c3f2e24ecb57a369cb 100644 (file)
--- a/lib/includes/gnutls/x509.h
+++ b/lib/includes/gnutls/x509.h
@@ -181,6 +181,9 @@ extern "C"
   int gnutls_x509_crt_get_issuer_unique_id (gnutls_x509_crt_t crt, char *buf,
                                             size_t * buf_size);
 
+  void gnutls_x509_crt_set_pin_function (gnutls_x509_crt_t crt,
+                                       gnutls_pin_callback_t fn, void *userdata);
+
   /**
    * gnutls_info_access_what_t:
    * @GNUTLS_IA_ACCESSMETHOD_OID: Get accessMethod OID.

diff --git a/lib/libgnutls.map b/lib/libgnutls.map
index 2bfc2f60e02dfdd7c5ed0cf052a9d0d66c623d8c..19f63c3ce820bf951f4dc26785fddb493cc0d4ba 100644 (file)
--- a/lib/libgnutls.map
+++ b/lib/libgnutls.map
@@ -824,6 +824,7 @@ GNUTLS_3_1_0 {
        gnutls_pkcs11_obj_set_pin_function;
        gnutls_pkcs11_privkey_set_pin_function;
        gnutls_certificate_set_pin_function;
+       gnutls_x509_crt_set_pin_function;
 } GNUTLS_3_0_0;
 
 GNUTLS_PRIVATE {

diff --git a/lib/pkcs11.c b/lib/pkcs11.c
index a5a9c92b2a21a00a619f13fee510b14969870b67..32f6a8ae1b643fe34e5dc0f17bfdaa60a02e9d89 100644 (file)
--- a/lib/pkcs11.c
+++ b/lib/pkcs11.c
@@ -2705,6 +2705,9 @@ gnutls_x509_crt_import_pkcs11_url (gnutls_x509_crt_t crt,
       gnutls_assert ();
       return ret;
     }
+  
+  if (crt->pin.cb)
+    gnutls_pkcs11_obj_set_pin_function (pcrt, crt->pin.cb, crt->pin.data);
 
   ret = gnutls_pkcs11_obj_import_url (pcrt, url, flags);
   if (ret < 0)
@@ -2728,7 +2731,6 @@ cleanup:
   return ret;
 }
 
-
 /**
  * gnutls_x509_crt_import_pkcs11:
  * @crt: A certificate of type #gnutls_x509_crt_t

diff --git a/lib/x509/x509.c b/lib/x509/x509.c
index ab8bac0bce1f5084eb45a732ea6e12da7f4e1934..1158b4bd68f97831ed3b5072f12158423730b35b 100644 (file)
--- a/lib/x509/x509.c
+++ b/lib/x509/x509.c
@@ -3692,3 +3692,26 @@ gnutls_x509_crt_get_authority_info_access (gnutls_x509_crt_t crt,
 
   return ret;
 }
+
+/**
+ * gnutls_x509_crt_set_pin_function:
+ * @crt: The certificate structure
+ * @fn: the callback
+ * @userdata: data associated with the callback
+ *
+ * This function will set a callback function to be used when
+ * it is required to access a protected object. This function overrides 
+ * the global function set using gnutls_pkcs11_set_pin_function().
+ *
+ * Note that this callback is currently used only during the import
+ * of a PKCS #11 certificate with gnutls_x509_crt_import_pkcs11_url().
+ *
+ * Since: 3.1.0
+ *
+ **/
+void gnutls_x509_crt_set_pin_function (gnutls_x509_crt_t crt,
+                                       gnutls_pin_callback_t fn, void *userdata)
+{
+  crt->pin.cb = fn;
+  crt->pin.data = userdata;
+}

diff --git a/lib/x509/x509_int.h b/lib/x509/x509_int.h
index 3cc18e4bb0a2ef7f63c7bbda7ca106728e02296f..c83edb0fb1e7a1972ea51260959ef2dcd4c05213 100644 (file)
--- a/lib/x509/x509_int.h
+++ b/lib/x509/x509_int.h
@@ -58,6 +58,8 @@ typedef struct gnutls_x509_crt_int
 {
   ASN1_TYPE cert;
   int use_extensions;
+  
+  struct pin_info_st pin;
 } gnutls_x509_crt_int;
 
 typedef struct gnutls_x509_crq_int