From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Wed, 17 Apr 2013 16:19:37 +0000 (+0200)
Subject: use the pass argument on PKCS #11 keys.
X-Git-Tag: gnutls_3_2_0~46
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=87eb3085c32d588459569364eb50b8dca0ac899e;p=thirdparty%2Fgnutls.git

use the pass argument on PKCS #11 keys.
---

diff --git a/lib/auth/cert.h b/lib/auth/cert.h
index 48168291b9..03fd3e97b6 100644
--- a/lib/auth/cert.h
+++ b/lib/auth/cert.h
@@ -86,6 +86,8 @@ typedef struct gnutls_certificate_credentials_st
   gnutls_certificate_verify_function *verify_callback;
 
   struct pin_info_st pin;
+  /* temporarily hold the PIN if set_key_file2() is used with a PIN */
+  char pin_tmp[GNUTLS_PKCS11_MAX_PIN_LEN];
   
   /* OCSP */
   gnutls_status_request_ocsp_func ocsp_func;
diff --git a/lib/gnutls_cert.c b/lib/gnutls_cert.c
index dbfec96b3e..dffd6c16a4 100644
--- a/lib/gnutls_cert.c
+++ b/lib/gnutls_cert.c
@@ -157,7 +157,7 @@ gnutls_certificate_free_credentials (gnutls_certificate_credentials_t sc)
   gnutls_certificate_free_keys (sc);
   gnutls_certificate_free_ca_names (sc);
   gnutls_free(sc->ocsp_response_file);
-
+  memset(sc->pin_tmp, 0, sizeof(sc->pin_tmp));
 #ifdef ENABLE_OPENPGP
   gnutls_openpgp_keyring_deinit (sc->keyring);
 #endif
diff --git a/lib/gnutls_x509.c b/lib/gnutls_x509.c
index acdd5b9236..d67ad5bf23 100644
--- a/lib/gnutls_x509.c
+++ b/lib/gnutls_x509.c
@@ -626,6 +626,20 @@ read_cert_mem (gnutls_certificate_credentials_t res, const void *cert,
   return ret;
 }
 
+static int tmp_pin_cb(void* userdata, int attempt, const char *token_url, const char *token_label,
+	unsigned int flags, char *pin, size_t pin_max)
+{
+const char* tmp_pin = userdata;
+
+  if (attempt == 0) 
+    {
+      snprintf(pin, pin_max, "%s", tmp_pin);
+      return 0;
+    }
+  
+  return -1;
+}
+
 /* Reads a PEM encoded PKCS-1 RSA/DSA private key from memory.  Type
  * indicates the certificate format.  KEY can be NULL, to indicate
  * that GnuTLS doesn't know the private key.
@@ -653,6 +667,11 @@ read_key_mem (gnutls_certificate_credentials_t res,
       
       if (res->pin.cb)
         gnutls_privkey_set_pin_function(privkey, res->pin.cb, res->pin.data);
+      else if (pass != NULL)
+        {
+          snprintf(res->pin_tmp, sizeof(res->pin_tmp), "%s", pass);
+          gnutls_privkey_set_pin_function(privkey, tmp_pin_cb, res->pin_tmp);
+        }
 
       ret = gnutls_privkey_import_x509_raw (privkey, &tmp, type, pass, flags);
       if (ret < 0)