From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Sat, 31 Aug 2002 08:51:09 +0000 (+0000)
Subject: Improved the certificate and key read functions. They can now read a PEM encoded... 
X-Git-Tag: gnutls_0_5_5~16
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4af5483c00659bdec4db197bc5bcdadf6e2bb997;p=thirdparty%2Fgnutls.git

Improved the certificate and key read functions. They can now read a PEM encoded key and certificate from the same file.
---

diff --git a/NEWS b/NEWS
index 027684980e..e14f8873d0 100644
--- a/NEWS
+++ b/NEWS
@@ -4,6 +4,7 @@ Version 0.5.5
   for other hash algorithms except for the srpsha. 
 - Renamed all the constructed types in order to have more consistent
   names. 
+- Improved the certificate and key read functions.
 
 Version 0.5.4 (27/08/2002)
 - Fixes in TLS 1.0 PRF and SSL3 random functions.
diff --git a/lib/gnutls_x509.c b/lib/gnutls_x509.c
index 8e2da47d67..7484957899 100644
--- a/lib/gnutls_x509.c
+++ b/lib/gnutls_x509.c
@@ -1207,11 +1207,11 @@ static int parse_pem_cert_mem( gnutls_cert** cert_list, int* ncerts,
 	gnutls_datum tmp;
 	int ret, count;
 
-	ptr = input_cert;
-	siz = input_cert_size;
+	if ( (ptr = strstr( input_cert, PEM_PKCS7_SEP)) != NULL) 
+	{
+		siz = strlen( ptr);
 
-	if (strstr( input_cert, "-----BEGIN PKCS7")!=NULL) {
-		siz2 = _gnutls_fbase64_decode(ptr, siz, &b64);
+		siz2 = _gnutls_fbase64_decode( ptr, siz, &b64);
 
 		ret = parse_pkcs7_cert_mem( cert_list, ncerts, b64,
 			siz2);
@@ -1221,6 +1221,15 @@ static int parse_pem_cert_mem( gnutls_cert** cert_list, int* ncerts,
 		return ret;
 	}
 
+	/* move to the certificate
+	 */
+	ptr = strstr( input_cert, PEM_CERT_SEP);
+	if (ptr == NULL) {
+		gnutls_assert();
+		return GNUTLS_E_PARSING_ERROR;
+	}
+	siz = strlen( ptr);
+
 	i = *ncerts + 1;
 	count = 0;
 
@@ -1274,7 +1283,7 @@ static int parse_pem_cert_mem( gnutls_cert** cert_list, int* ncerts,
 
 
 
-/* Reads a base64 encoded certificate from memory
+/* Reads a DER or PEM certificate from memory
  */
 static int read_cert_mem(GNUTLS_CERTIFICATE_CREDENTIALS res, const char *cert, int cert_size, 
 	gnutls_x509_certificate_fmt type)
@@ -1412,10 +1421,23 @@ static int read_key_mem(GNUTLS_CERTIFICATE_CREDENTIALS res, const char *key, int
 		/* If we find the "DSA PRIVATE" string in the
 		 * pem encoded certificate then it's a DSA key.
 		 */
-		if (strstr( key, "DSA PRIVATE")!=NULL) 
+		if (strstr( key, "DSA PRIVATE")!=NULL) {
 			pk = GNUTLS_PK_DSA;
-		else
+			key = strstr( key, PEM_KEY_DSA_SEP);
+			if (key == NULL) {
+				gnutls_assert();
+				return GNUTLS_E_PARSING_ERROR;
+			}			key_size = strlen( key);
+		} else {
 			pk = GNUTLS_PK_RSA;
+			key = strstr( key, PEM_KEY_RSA_SEP);
+			if (key == NULL) {
+				gnutls_assert();
+				return GNUTLS_E_PARSING_ERROR;
+			}
+			key_size = strlen( key);
+		}
+			
 
 		ret = _gnutls_fbase64_decode(key, key_size, &b64);
 
@@ -1692,6 +1714,9 @@ int gnutls_certificate_set_x509_trust_file(GNUTLS_CERTIFICATE_CREDENTIALS res,
   * DSA private keys are encoded the OpenSSL way, which is an ASN.1
   * DER sequence of 6 INTEGERs - version, p, q, g, pub, priv.
   *
+  * If the certificate and the private key are given in PEM encoding
+  * then the strings that hold their values must be null terminated.
+  *
   **/
 int gnutls_certificate_set_x509_key_mem(GNUTLS_CERTIFICATE_CREDENTIALS res, const gnutls_datum* CERT,
 			   const gnutls_datum* KEY, gnutls_x509_certificate_fmt type)
diff --git a/lib/gnutls_x509.h b/lib/gnutls_x509.h
index 8fe3398e76..a692b3cfdd 100644
--- a/lib/gnutls_x509.h
+++ b/lib/gnutls_x509.h
@@ -13,7 +13,11 @@ int _gnutls_x509_cert2gnutls_cert(gnutls_cert * gCert, gnutls_datum derCert, Con
 #define MAX_INT_DIGITS 4
 void _gnutls_int2str(unsigned int k, char *data);
 
-#define PEM_CERT_SEP "-----BEGIN"
+#define PEM_CERT_SEP "-----BEGIN CERTIFICATE"
+#define PEM_PKCS7_SEP "-----BEGIN PKCS7"
+
+#define PEM_KEY_RSA_SEP "-----BEGIN RSA"
+#define PEM_KEY_DSA_SEP "-----BEGIN DSA"
 
 int _gnutls_check_x509_key_usage( const gnutls_cert * cert, gnutls_kx_algorithm alg);
 time_t gnutls_x509_extract_certificate_activation_time( const gnutls_datum*);