From: Nikos Mavrogiannopoulos <nmav@gnutls.org>
Date: Mon, 28 Jun 2010 17:01:20 +0000 (+0200)
Subject: Combined object flags. No implicit login any more. Login has to be specified with... 
X-Git-Tag: gnutls_2_11_3~139
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a9801fddb8d28acf0685f111add562c6c4b3a689;p=thirdparty%2Fgnutls.git

Combined object flags. No implicit login any more. Login has to be specified with a flag
on every call that could use it.
---

diff --git a/lib/includes/gnutls/pkcs11.h b/lib/includes/gnutls/pkcs11.h
index e7ae57a5b7..e754804246 100644
--- a/lib/includes/gnutls/pkcs11.h
+++ b/lib/includes/gnutls/pkcs11.h
@@ -49,6 +49,7 @@ int gnutls_pkcs11_add_provider (const char * name, const char * params);
 int gnutls_pkcs11_obj_init ( gnutls_pkcs11_obj_t *certificate);
 
 #define GNUTLS_PKCS11_OBJ_FLAG_LOGIN 1 /* force login in the token for the operation */
+#define GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED 1 /* object marked as trusted */
 
 int gnutls_pkcs11_obj_import_url (gnutls_pkcs11_obj_t, const char * url,
 	unsigned int flags/* GNUTLS_PKCS11_OBJ_FLAG_* */);
@@ -59,14 +60,13 @@ int gnutls_pkcs11_obj_export(gnutls_pkcs11_obj_t obj,
 		     void *output_data, size_t * output_data_size);
 
 
-#define GNUTLS_PKCS11_COPY_FLAG_MARK_TRUSTED 1 /* object marked as trusted */
-
 int gnutls_pkcs11_copy_x509_crt(const char* token_url, gnutls_x509_crt_t crt, 
-	const char* label, unsigned int flags /* GNUTLS_PKCS11_COPY_FLAG_* */);
+	const char* label, unsigned int flags /* GNUTLS_PKCS11_OBJ_FLAG_* */);
 int gnutls_pkcs11_copy_x509_privkey(const char* token_url, 
 	gnutls_x509_privkey_t crt, const char* label, unsigned int key_usage /*GNUTLS_KEY_* */,
-	unsigned int flags /* GNUTLS_PKCS11_COPY_FLAG_* */);
-int gnutls_pkcs11_delete_url(const char* object_url);
+	unsigned int flags /* GNUTLS_PKCS11_OBJ_FLAG_* */);
+int gnutls_pkcs11_delete_url(const char* object_url, 
+	unsigned int flags/* GNUTLS_PKCS11_OBJ_FLAG_* */);
 
 typedef enum {
 	GNUTLS_PKCS11_OBJ_ID_HEX=1,
diff --git a/lib/pkcs11.c b/lib/pkcs11.c
index f4ae85d026..0d1d8d43bb 100644
--- a/lib/pkcs11.c
+++ b/lib/pkcs11.c
@@ -1517,7 +1517,7 @@ static int find_obj_url(pakchois_session_t * pks, struct token_info *info,
 	return ret;
 }
 
-inline static unsigned int pkcs11_obj_flags_to_int(unsigned int flags)
+unsigned int pkcs11_obj_flags_to_int(unsigned int flags)
 {
         switch(flags) {
                 case GNUTLS_PKCS11_OBJ_FLAG_LOGIN:
diff --git a/lib/pkcs11_int.h b/lib/pkcs11_int.h
index f177183b8f..783478d053 100644
--- a/lib/pkcs11_int.h
+++ b/lib/pkcs11_int.h
@@ -89,4 +89,6 @@ int pkcs11_find_object(pakchois_session_t ** _pks,
 		       struct pkcs11_url_info *info, token_creds_st *,
 		       unsigned int flags);
 
+unsigned int pkcs11_obj_flags_to_int(unsigned int flags);
+
 #endif
diff --git a/lib/pkcs11_write.c b/lib/pkcs11_write.c
index 09d32a7fb2..7ed62b4f05 100644
--- a/lib/pkcs11_write.c
+++ b/lib/pkcs11_write.c
@@ -33,7 +33,7 @@
  * @token_url: A PKCS #11 URL specifying a token
  * @crt: A certificate
  * @label: A name to be used for the stored data
- * @flags: One of GNUTLS_PKCS11_COPY_FLAG_*
+ * @flags: One of GNUTLS_PKCS11_OBJ_FLAG_*
  *
  * This function will copy a certificate into a PKCS #11 token specified by
  * a URL. The certificate can be marked as trusted or not.
@@ -67,7 +67,7 @@ int gnutls_pkcs11_copy_x509_crt(const char *token_url,
 
 	ret =
 	    pkcs11_open_session(&pks, &info, NULL,
-				SESSION_WRITE | SESSION_LOGIN);
+				SESSION_WRITE | pkcs11_obj_flags_to_int(flags));
 	if (ret < 0) {
 		gnutls_assert();
 		return ret;
@@ -128,7 +128,7 @@ int gnutls_pkcs11_copy_x509_crt(const char *token_url,
 		a_val++;
 	}
 
-	if (flags & GNUTLS_PKCS11_COPY_FLAG_MARK_TRUSTED) {
+	if (flags & GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED) {
 		a[a_val].type = CKA_TRUSTED;
 		a[a_val].value = &tval;
 		a[a_val].value_len = sizeof(tval);
@@ -162,7 +162,7 @@ int gnutls_pkcs11_copy_x509_crt(const char *token_url,
  * @key: A private key
  * @label: A name to be used for the stored data
  * @key_usage: One of GNUTLS_KEY_*
- * @flags: One of GNUTLS_PKCS11_COPY_* flags
+ * @flags: One of GNUTLS_PKCS11_OBJ_* flags
  *
  * This function will copy a private key into a PKCS #11 token specified by
  * a URL. 
@@ -208,7 +208,7 @@ int gnutls_pkcs11_copy_x509_privkey(const char *token_url,
 
 	ret =
 	    pkcs11_open_session(&pks, &info, NULL,
-				SESSION_WRITE | SESSION_LOGIN);
+				SESSION_WRITE | pkcs11_obj_flags_to_int(flags));
 	if (ret < 0) {
 		gnutls_assert();
 		return ret;
@@ -418,12 +418,6 @@ static int delete_obj_url(pakchois_session_t * pks,
 		}
 	}
 
-	ret = pkcs11_login(pks, info, NULL);
-	if (ret < 0) {
-		gnutls_assert();
-		return ret;
-	}
-
 	a_vals = 0;
 
 	/* Find objects with given class and type */
@@ -494,13 +488,14 @@ static int delete_obj_url(pakchois_session_t * pks,
 /**
  * gnutls_pkcs11_delete_url:
  * @object_url: The URL of the object to delete.
+ * @flags: One of GNUTLS_PKCS11_OBJ_* flags
  * 
  * This function will delete objects matching the given URL.
  *
  * Returns: On success, the number of objects deleted is returned, otherwise a
  *   negative error value.
  **/
-int gnutls_pkcs11_delete_url(const char *object_url)
+int gnutls_pkcs11_delete_url(const char *object_url, unsigned int flags)
 {
 	int ret;
 	struct delete_data_st find_data;
@@ -515,7 +510,7 @@ int gnutls_pkcs11_delete_url(const char *object_url)
 
 	ret =
 	    _pkcs11_traverse_tokens(delete_obj_url, &find_data,
-				    SESSION_WRITE);
+				    SESSION_WRITE|pkcs11_obj_flags_to_int(flags));
 	if (ret < 0) {
 		gnutls_assert();
 		return ret;
diff --git a/src/certtool-common.h b/src/certtool-common.h
index 010eac0142..093ceef869 100644
--- a/src/certtool-common.h
+++ b/src/certtool-common.h
@@ -41,8 +41,8 @@ void certtool_version (void);
 void pkcs11_list( FILE*outfile, const char* url, int type, unsigned int login);
 void pkcs11_export(FILE* outfile, const char *pkcs11_url, unsigned int login);
 void pkcs11_token_list(FILE* outfile);
-void pkcs11_write(FILE* outfile, const char *pkcs11_url, const char* label, int trusted);
-void pkcs11_delete(FILE* outfile, const char *pkcs11_url, int batch);
+void pkcs11_write(FILE* outfile, const char *pkcs11_url, const char* label, int trusted, unsigned int login);
+void pkcs11_delete(FILE* outfile, const char *pkcs11_url, int batch, unsigned int login);
 
 #define PKCS11_TYPE_CRT_ALL 1
 #define PKCS11_TYPE_TRUSTED 2
diff --git a/src/certtool.c b/src/certtool.c
index 02a44173ce..dcca2fa28f 100644
--- a/src/certtool.c
+++ b/src/certtool.c
@@ -1136,10 +1136,10 @@ gaa_parser (int argc, char **argv)
       pkcs11_export(outfile, info.pkcs11_url, info.pkcs11_login);
       break;
     case ACTION_PKCS11_WRITE_URL:
-      pkcs11_write(outfile, info.pkcs11_url, info.pkcs11_label, info.pkcs11_trusted);
+      pkcs11_write(outfile, info.pkcs11_url, info.pkcs11_label, info.pkcs11_trusted, info.pkcs11_login);
       break;
     case ACTION_PKCS11_DELETE_URL:
-      pkcs11_delete(outfile, info.pkcs11_url, batch);
+      pkcs11_delete(outfile, info.pkcs11_url, batch, info.pkcs11_login);
       break;
 #ifdef ENABLE_OPENPGP
     case ACTION_PGP_INFO:
diff --git a/src/pkcs11.c b/src/pkcs11.c
index f4275b940a..ae28a84e2f 100644
--- a/src/pkcs11.c
+++ b/src/pkcs11.c
@@ -44,18 +44,23 @@ static void pkcs11_common(void)
 
 }
 
-void pkcs11_delete(FILE* outfile, const char* url, int batch)
+void pkcs11_delete(FILE* outfile, const char* url, int batch, unsigned int login)
 {
 int ret;
+unsigned int obj_flags = 0;
+
+	if (login)
+		obj_flags = GNUTLS_PKCS11_OBJ_FLAG_LOGIN;
+
 	if (!batch) {
-		pkcs11_list(outfile, url, PKCS11_TYPE_ALL, 1/*login*/);
+		pkcs11_list(outfile, url, PKCS11_TYPE_ALL, login);
 		ret = read_yesno("Are you sure you want to delete those objects? (Y/N): ");
 		if (ret == 0) {
 			exit(1);
 		}
 	}
 	
-	ret = gnutls_pkcs11_delete_url(url);
+	ret = gnutls_pkcs11_delete_url(url, obj_flags);
 	if (ret < 0) {
 		fprintf(stderr, "Error in %s:%d: %s\n", __func__, __LINE__, gnutls_strerror(ret));
 		exit(1);
@@ -375,7 +380,7 @@ size_t size;
 	return;
 }
 
-void pkcs11_write(FILE* outfile, const char* url, const char* label, int trusted)
+void pkcs11_write(FILE* outfile, const char* url, const char* label, int trusted, unsigned int login)
 {
 gnutls_x509_crt_t xcrt;
 gnutls_x509_privkey_t xkey;
@@ -383,6 +388,9 @@ int ret;
 unsigned int flags = 0;
 unsigned int key_usage;
 
+	if (login)
+		flags = GNUTLS_PKCS11_OBJ_FLAG_LOGIN;
+
 	pkcs11_common();
 
 	if (url == NULL)
@@ -391,7 +399,7 @@ unsigned int key_usage;
 	xcrt = load_cert(0);
 	if (xcrt != NULL) {
 		if (trusted)
-			flags |= GNUTLS_PKCS11_COPY_FLAG_MARK_TRUSTED;
+			flags |= GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED;
 		ret = gnutls_pkcs11_copy_x509_crt(url, xcrt, label, flags);
 		if (ret < 0) {
 			fprintf(stderr, "Error in %s:%d: %s\n", __func__, __LINE__, gnutls_strerror(ret));