From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Thu, 17 Jun 2010 23:15:50 +0000 (+0200)
Subject: Allow listing of private keys only. Certtool has now the --pkcs11-list-privkeya option.
X-Git-Tag: gnutls_2_11_3~173
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=664098d0bf95dd1990fe2a9a16052634be64c3e8;p=thirdparty%2Fgnutls.git

Allow listing of private keys only. Certtool has now the --pkcs11-list-privkeya option.
---

diff --git a/lib/includes/gnutls/pkcs11.h b/lib/includes/gnutls/pkcs11.h
index da30b486ac..80e4b42a11 100644
--- a/lib/includes/gnutls/pkcs11.h
+++ b/lib/includes/gnutls/pkcs11.h
@@ -80,6 +80,7 @@ typedef enum {
 	GNUTLS_PKCS11_OBJ_ATTR_CRT_TRUSTED, /* certificates marked as trusted */
 	GNUTLS_PKCS11_OBJ_ATTR_CRT_WITH_PRIVKEY, /* certificates with corresponding private key */
 	GNUTLS_PKCS11_OBJ_ATTR_PUBKEY, /* public keys */
+	GNUTLS_PKCS11_OBJ_ATTR_PRIVKEY, /* private keys */
 	GNUTLS_PKCS11_OBJ_ATTR_ALL, /* everything! */
 } gnutls_pkcs11_obj_attr_t;
 
diff --git a/lib/pkcs11.c b/lib/pkcs11.c
index 0941c395ad..51d7f2f2bc 100644
--- a/lib/pkcs11.c
+++ b/lib/pkcs11.c
@@ -1833,7 +1833,8 @@ static int find_objs(pakchois_session_t *pks, struct token_info *info, void* inp
             gnutls_assert();
             return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
         }
-    } else if (find_data->flags==GNUTLS_PKCS11_OBJ_ATTR_ALL) {
+    } else if (find_data->flags==GNUTLS_PKCS11_OBJ_ATTR_ALL ||
+        find_data->flags == GNUTLS_PKCS11_OBJ_ATTR_PRIVKEY) {
         ret = pkcs11_login(pks, info, NULL);
         if (ret < 0) {
             gnutls_assert();
@@ -1884,6 +1885,13 @@ static int find_objs(pakchois_session_t *pks, struct token_info *info, void* inp
     } else if (find_data->flags == GNUTLS_PKCS11_OBJ_ATTR_PUBKEY) {
         class = CKO_PUBLIC_KEY;
 
+        a[tot_values].type = CKA_CLASS;
+        a[tot_values].value = &class;
+        a[tot_values].value_len = sizeof class;
+        tot_values++;
+    } else if (find_data->flags == GNUTLS_PKCS11_OBJ_ATTR_PRIVKEY) {
+        class = CKO_PRIVATE_KEY;
+
         a[tot_values].type = CKA_CLASS;
         a[tot_values].value = &class;
         a[tot_values].value_len = sizeof class;
diff --git a/src/certtool-common.h b/src/certtool-common.h
index f937f95de3..95ff5dc67b 100644
--- a/src/certtool-common.h
+++ b/src/certtool-common.h
@@ -48,6 +48,7 @@ void pkcs11_delete(FILE* outfile, const char *pkcs11_url, int batch);
 #define PKCS11_TYPE_TRUSTED 2
 #define PKCS11_TYPE_PK 3
 #define PKCS11_TYPE_ALL 4
+#define PKCS11_TYPE_PRIVKEY 5
 
 extern unsigned char buffer[];
 extern const int buffer_size;
diff --git a/src/certtool-gaa.c b/src/certtool-gaa.c
index c8c761c69e..535ac4c9fe 100644
--- a/src/certtool-gaa.c
+++ b/src/certtool-gaa.c
@@ -181,6 +181,7 @@ void gaa_help(void)
 	__gaa_helpsingle(0, "pkcs11-provider", "Library ", "Specify the pkcs11 provider library");
 	__gaa_helpsingle(0, "pkcs11-export-url", "URL ", "Export data specified a pkcs11 URL");
 	__gaa_helpsingle(0, "pkcs11-list-certs", "", "List certificates that have a private key specified by a PKCS#11 URL");
+	__gaa_helpsingle(0, "pkcs11-list-privkeys", "", "List private keys specified by a PKCS#11 URL");
 	__gaa_helpsingle(0, "pkcs11-list-trusted", "", "List certificates marked as trusted, specified by a PKCS#11 URL");
 	__gaa_helpsingle(0, "pkcs11-list-all-certs", "", "List all certificates specified by a PKCS#11 URL");
 	__gaa_helpsingle(0, "pkcs11-list-all", "", "List all objects specified by a PKCS#11 URL");
@@ -206,11 +207,11 @@ typedef struct _gaainfo gaainfo;
 
 struct _gaainfo
 {
-#line 159 "certtool.gaa"
+#line 160 "certtool.gaa"
 	int debug;
-#line 154 "certtool.gaa"
+#line 155 "certtool.gaa"
 	int pkcs11_trusted;
-#line 151 "certtool.gaa"
+#line 152 "certtool.gaa"
 	char* pkcs11_label;
 #line 144 "certtool.gaa"
 	int pkcs11_type;
@@ -322,7 +323,7 @@ static int gaa_error = 0;
 #define GAA_MULTIPLE_OPTION     3
 
 #define GAA_REST                0
-#define GAA_NB_OPTION           63
+#define GAA_NB_OPTION           64
 #define GAAOPTID_version	1
 #define GAAOPTID_help	2
 #define GAAOPTID_debug	3
@@ -334,58 +335,59 @@ static int gaa_error = 0;
 #define GAAOPTID_pkcs11_list_all	9
 #define GAAOPTID_pkcs11_list_all_certs	10
 #define GAAOPTID_pkcs11_list_trusted	11
-#define GAAOPTID_pkcs11_list_certs	12
-#define GAAOPTID_pkcs11_export_url	13
-#define GAAOPTID_pkcs11_provider	14
-#define GAAOPTID_pkcs_cipher	15
-#define GAAOPTID_template	16
-#define GAAOPTID_infile	17
-#define GAAOPTID_outfile	18
-#define GAAOPTID_disable_quick_random	19
-#define GAAOPTID_sec_param	20
-#define GAAOPTID_bits	21
-#define GAAOPTID_outraw	22
-#define GAAOPTID_outder	23
-#define GAAOPTID_inraw	24
-#define GAAOPTID_inder	25
-#define GAAOPTID_export_ciphers	26
-#define GAAOPTID_hash	27
-#define GAAOPTID_dsa	28
-#define GAAOPTID_pkcs8	29
-#define GAAOPTID_to_p8	30
-#define GAAOPTID_to_p12	31
-#define GAAOPTID_v1	32
-#define GAAOPTID_fix_key	33
-#define GAAOPTID_pubkey_info	34
-#define GAAOPTID_pgp_key_info	35
-#define GAAOPTID_key_info	36
-#define GAAOPTID_smime_to_p7	37
-#define GAAOPTID_p7_info	38
-#define GAAOPTID_p12_info	39
-#define GAAOPTID_no_crq_extensions	40
-#define GAAOPTID_crq_info	41
-#define GAAOPTID_crl_info	42
-#define GAAOPTID_pgp_ring_info	43
-#define GAAOPTID_pgp_certificate_info	44
-#define GAAOPTID_certificate_info	45
-#define GAAOPTID_password	46
-#define GAAOPTID_load_ca_certificate	47
-#define GAAOPTID_load_ca_privkey	48
-#define GAAOPTID_load_certificate	49
-#define GAAOPTID_load_request	50
-#define GAAOPTID_load_pubkey	51
-#define GAAOPTID_load_privkey	52
-#define GAAOPTID_get_dh_params	53
-#define GAAOPTID_generate_dh_params	54
-#define GAAOPTID_verify_crl	55
-#define GAAOPTID_verify_chain	56
-#define GAAOPTID_generate_request	57
-#define GAAOPTID_generate_privkey	58
-#define GAAOPTID_update_certificate	59
-#define GAAOPTID_generate_crl	60
-#define GAAOPTID_generate_proxy	61
-#define GAAOPTID_generate_certificate	62
-#define GAAOPTID_generate_self_signed	63
+#define GAAOPTID_pkcs11_list_privkeys	12
+#define GAAOPTID_pkcs11_list_certs	13
+#define GAAOPTID_pkcs11_export_url	14
+#define GAAOPTID_pkcs11_provider	15
+#define GAAOPTID_pkcs_cipher	16
+#define GAAOPTID_template	17
+#define GAAOPTID_infile	18
+#define GAAOPTID_outfile	19
+#define GAAOPTID_disable_quick_random	20
+#define GAAOPTID_sec_param	21
+#define GAAOPTID_bits	22
+#define GAAOPTID_outraw	23
+#define GAAOPTID_outder	24
+#define GAAOPTID_inraw	25
+#define GAAOPTID_inder	26
+#define GAAOPTID_export_ciphers	27
+#define GAAOPTID_hash	28
+#define GAAOPTID_dsa	29
+#define GAAOPTID_pkcs8	30
+#define GAAOPTID_to_p8	31
+#define GAAOPTID_to_p12	32
+#define GAAOPTID_v1	33
+#define GAAOPTID_fix_key	34
+#define GAAOPTID_pubkey_info	35
+#define GAAOPTID_pgp_key_info	36
+#define GAAOPTID_key_info	37
+#define GAAOPTID_smime_to_p7	38
+#define GAAOPTID_p7_info	39
+#define GAAOPTID_p12_info	40
+#define GAAOPTID_no_crq_extensions	41
+#define GAAOPTID_crq_info	42
+#define GAAOPTID_crl_info	43
+#define GAAOPTID_pgp_ring_info	44
+#define GAAOPTID_pgp_certificate_info	45
+#define GAAOPTID_certificate_info	46
+#define GAAOPTID_password	47
+#define GAAOPTID_load_ca_certificate	48
+#define GAAOPTID_load_ca_privkey	49
+#define GAAOPTID_load_certificate	50
+#define GAAOPTID_load_request	51
+#define GAAOPTID_load_pubkey	52
+#define GAAOPTID_load_privkey	53
+#define GAAOPTID_get_dh_params	54
+#define GAAOPTID_generate_dh_params	55
+#define GAAOPTID_verify_crl	56
+#define GAAOPTID_verify_chain	57
+#define GAAOPTID_generate_request	58
+#define GAAOPTID_generate_privkey	59
+#define GAAOPTID_update_certificate	60
+#define GAAOPTID_generate_crl	61
+#define GAAOPTID_generate_proxy	62
+#define GAAOPTID_generate_certificate	63
+#define GAAOPTID_generate_self_signed	64
 
 #line 168 "gaa.skel"
 
@@ -632,7 +634,7 @@ struct GAAOPTION_outfile
 	int size1;
 };
 
-struct GAAOPTION_sec_param
+struct GAAOPTION_sec_param 
 {
 	char* arg1;
 	int size1;
@@ -750,6 +752,7 @@ static int gaa_get_option_num(char *str, int status)
 			GAA_CHECK1STR("", GAAOPTID_pkcs11_list_all);
 			GAA_CHECK1STR("", GAAOPTID_pkcs11_list_all_certs);
 			GAA_CHECK1STR("", GAAOPTID_pkcs11_list_trusted);
+			GAA_CHECK1STR("", GAAOPTID_pkcs11_list_privkeys);
 			GAA_CHECK1STR("", GAAOPTID_pkcs11_list_certs);
 			GAA_CHECK1STR("", GAAOPTID_disable_quick_random);
 			GAA_CHECK1STR("", GAAOPTID_outraw);
@@ -801,6 +804,7 @@ static int gaa_get_option_num(char *str, int status)
 			GAA_CHECKSTR("pkcs11-list-all", GAAOPTID_pkcs11_list_all);
 			GAA_CHECKSTR("pkcs11-list-all-certs", GAAOPTID_pkcs11_list_all_certs);
 			GAA_CHECKSTR("pkcs11-list-trusted", GAAOPTID_pkcs11_list_trusted);
+			GAA_CHECKSTR("pkcs11-list-privkeys", GAAOPTID_pkcs11_list_privkeys);
 			GAA_CHECKSTR("pkcs11-list-certs", GAAOPTID_pkcs11_list_certs);
 			GAA_CHECKSTR("pkcs11-export-url", GAAOPTID_pkcs11_export_url);
 			GAA_CHECKSTR("pkcs11-provider", GAAOPTID_pkcs11_provider);
@@ -907,14 +911,14 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
     {
 	case GAAOPTID_version:
 	OK = 0;
-#line 164 "certtool.gaa"
+#line 165 "certtool.gaa"
 { certtool_version(); exit(0); ;};
 
 		return GAA_OK;
 		break;
 	case GAAOPTID_help:
 	OK = 0;
-#line 162 "certtool.gaa"
+#line 163 "certtool.gaa"
 { gaa_help(); exit(0); ;};
 
 		return GAA_OK;
@@ -924,7 +928,7 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 		GAA_TESTMOREARGS;
 		GAA_FILL(GAATMP_debug.arg1, gaa_getint, GAATMP_debug.size1);
 		gaa_index++;
-#line 160 "certtool.gaa"
+#line 161 "certtool.gaa"
 { gaaval->debug = GAATMP_debug.arg1 ;};
 
 		return GAA_OK;
@@ -934,14 +938,14 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 		GAA_TESTMOREARGS;
 		GAA_FILL(GAATMP_pkcs11_delete_url.arg1, gaa_getstr, GAATMP_pkcs11_delete_url.size1);
 		gaa_index++;
-#line 157 "certtool.gaa"
+#line 158 "certtool.gaa"
 { gaaval->action = ACTION_PKCS11_DELETE_URL; gaaval->pkcs11_url = GAATMP_pkcs11_delete_url.arg1; ;};
 
 		return GAA_OK;
 		break;
 	case GAAOPTID_pkcs11_write_trusted:
 	OK = 0;
-#line 155 "certtool.gaa"
+#line 156 "certtool.gaa"
 { gaaval->pkcs11_trusted = 1; ;};
 
 		return GAA_OK;
@@ -951,7 +955,7 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 		GAA_TESTMOREARGS;
 		GAA_FILL(GAATMP_pkcs11_write_label.arg1, gaa_getstr, GAATMP_pkcs11_write_label.size1);
 		gaa_index++;
-#line 153 "certtool.gaa"
+#line 154 "certtool.gaa"
 { gaaval->pkcs11_label = GAATMP_pkcs11_write_label.arg1; ;};
 
 		return GAA_OK;
@@ -961,37 +965,44 @@ static int gaa_try(int gaa_num, int gaa_index, gaainfo *gaaval, char *opt_list)
 		GAA_TESTMOREARGS;
 		GAA_FILL(GAATMP_pkcs11_write.arg1, gaa_getstr, GAATMP_pkcs11_write.size1);
 		gaa_index++;
-#line 152 "certtool.gaa"
+#line 153 "certtool.gaa"
 { gaaval->action = ACTION_PKCS11_WRITE_URL; gaaval->pkcs11_url = GAATMP_pkcs11_write.arg1; ;};
 
 		return GAA_OK;
 		break;
 	case GAAOPTID_pkcs11_list_tokens:
 	OK = 0;
-#line 149 "certtool.gaa"
+#line 150 "certtool.gaa"
 { gaaval->action = ACTION_PKCS11_TOKENS; ;};
 
 		return GAA_OK;
 		break;
 	case GAAOPTID_pkcs11_list_all:
 	OK = 0;
-#line 148 "certtool.gaa"
+#line 149 "certtool.gaa"
 { gaaval->action = ACTION_PKCS11_LIST; gaaval->pkcs11_type=PKCS11_TYPE_ALL; ;};
 
 		return GAA_OK;
 		break;
 	case GAAOPTID_pkcs11_list_all_certs:
 	OK = 0;
-#line 147 "certtool.gaa"
+#line 148 "certtool.gaa"
 { gaaval->action = ACTION_PKCS11_LIST; gaaval->pkcs11_type=PKCS11_TYPE_CRT_ALL; ;};
 
 		return GAA_OK;
 		break;
 	case GAAOPTID_pkcs11_list_trusted:
 	OK = 0;
-#line 146 "certtool.gaa"
+#line 147 "certtool.gaa"
 { gaaval->action = ACTION_PKCS11_LIST; gaaval->pkcs11_type=PKCS11_TYPE_TRUSTED; ;};
 
+		return GAA_OK;
+		break;
+	case GAAOPTID_pkcs11_list_privkeys:
+	OK = 0;
+#line 146 "certtool.gaa"
+{ gaaval->action = ACTION_PKCS11_LIST; gaaval->pkcs11_type=PKCS11_TYPE_PRIVKEY; ;};
+
 		return GAA_OK;
 		break;
 	case GAAOPTID_pkcs11_list_certs:
@@ -1430,7 +1441,7 @@ int gaa(int argc, char **argv, gaainfo *gaaval)
     if(inited == 0)
     {
 
-#line 166 "certtool.gaa"
+#line 167 "certtool.gaa"
 { gaaval->bits = 0; gaaval->pkcs8 = 0; gaaval->privkey = NULL; gaaval->ca=NULL; gaaval->ca_privkey = NULL;
 	gaaval->debug=1; gaaval->request = NULL; gaaval->infile = NULL; gaaval->outfile = NULL; gaaval->cert = NULL; 
 	gaaval->incert_format = 0; gaaval->outcert_format = 0; gaaval->action=-1; gaaval->pass = NULL; gaaval->v1_cert = 0;
diff --git a/src/certtool-gaa.h b/src/certtool-gaa.h
index 647e512b9f..8e9f2ff8ff 100644
--- a/src/certtool-gaa.h
+++ b/src/certtool-gaa.h
@@ -8,11 +8,11 @@ typedef struct _gaainfo gaainfo;
 
 struct _gaainfo
 {
-#line 159 "certtool.gaa"
+#line 160 "certtool.gaa"
 	int debug;
-#line 154 "certtool.gaa"
+#line 155 "certtool.gaa"
 	int pkcs11_trusted;
-#line 151 "certtool.gaa"
+#line 152 "certtool.gaa"
 	char* pkcs11_label;
 #line 144 "certtool.gaa"
 	int pkcs11_type;
diff --git a/src/certtool.gaa b/src/certtool.gaa
index 9b778645ea..0f7be24d4a 100644
--- a/src/certtool.gaa
+++ b/src/certtool.gaa
@@ -143,6 +143,7 @@ option (pkcs11-export-url) STR "URL" { $action = ACTION_PKCS11_EXPORT_URL; $pkcs
 
 #int pkcs11_type;
 option (pkcs11-list-certs) { $action = ACTION_PKCS11_LIST; $pkcs11_type=PKCS11_TYPE_PK; } "List certificates that have a private key specified by a PKCS#11 URL"
+option (pkcs11-list-privkeys) { $action = ACTION_PKCS11_LIST; $pkcs11_type=PKCS11_TYPE_PRIVKEY; } "List private keys specified by a PKCS#11 URL"
 option (pkcs11-list-trusted) { $action = ACTION_PKCS11_LIST; $pkcs11_type=PKCS11_TYPE_TRUSTED; } "List certificates marked as trusted, specified by a PKCS#11 URL"
 option (pkcs11-list-all-certs) { $action = ACTION_PKCS11_LIST; $pkcs11_type=PKCS11_TYPE_CRT_ALL; } "List all certificates specified by a PKCS#11 URL"
 option (pkcs11-list-all) { $action = ACTION_PKCS11_LIST; $pkcs11_type=PKCS11_TYPE_ALL; } "List all objects specified by a PKCS#11 URL"
diff --git a/src/pkcs11.c b/src/pkcs11.c
index dc3e8a355a..d092136599 100644
--- a/src/pkcs11.c
+++ b/src/pkcs11.c
@@ -88,6 +88,8 @@ int i, flags;
 		flags = GNUTLS_PKCS11_OBJ_ATTR_CRT_WITH_PRIVKEY;
 	} else if (type == PKCS11_TYPE_CRT_ALL) {
 		flags = GNUTLS_PKCS11_OBJ_ATTR_CRT_ALL;
+	} else if (type == PKCS11_TYPE_PRIVKEY) {
+		flags = GNUTLS_PKCS11_OBJ_ATTR_PRIVKEY;
 	} else {
 		flags = GNUTLS_PKCS11_OBJ_ATTR_ALL;
 	}
@@ -158,7 +160,7 @@ int i, flags;
 		
 		
 
-		if (flags == GNUTLS_PKCS11_OBJ_ATTR_ALL)
+		if (flags == GNUTLS_PKCS11_OBJ_ATTR_ALL || flags == GNUTLS_PKCS11_OBJ_ATTR_PRIVKEY)
 			continue;
 
 		ret = gnutls_x509_crt_init(&xcrt);