libgnutls-config.in libgnutls.m4 gnutls.h.in.in gnutls_errors_int.h \
gnutls-api.tex gnutls_datum.h auth_cert.h gnutls_mpi.h \
gnutls_pk.h gnutls_record.h gnutls_cert.h \
- gnutls_privkey.h gnutls_constate.h gnutls_global.h \
+ gnutls_constate.h gnutls_global.h \
gnutls_sig.h gnutls_mem.h gnutls_ui.h \
io_debug.h ext_max_record.h gnutls_session_pack.h \
gnutls_alert.h gnutls_str.h gnutls_state.h gnutls_x509.h \
auth_anon.c gnutls_extensions.c gnutls_auth.c gnutls_random.c \
gnutls_v2_compat.c gnutls_datum.c auth_rsa.c gnutls_session_pack.c \
gnutls_mpi.c gnutls_pk.c gnutls_cert.c \
- gnutls_global.c gnutls_privkey.c gnutls_constate.c gnutls_anon_cred.c \
+ gnutls_global.c gnutls_constate.c gnutls_anon_cred.c \
pkix_asn1_tab.c gnutls_asn1_tab.c gnutls_mem.c \
auth_cert.c gnutls_ui.c gnutls_sig.c auth_dhe.c \
gnutls_dh_primes.c ext_max_record.c gnutls_alert.c gnutls_int_compat.c \
int ret, i;
opaque *pdata;
gnutls_cert *apr_cert_list;
- gnutls_private_key *apr_pkey;
+ gnutls_x509_privkey apr_pkey;
int apr_cert_list_length;
/* find the appropriate certificate */
int ret;
opaque *pdata;
gnutls_cert *apr_cert_list;
- gnutls_private_key *apr_pkey;
+ gnutls_x509_privkey apr_pkey;
int apr_cert_list_length;
/* find the appropriate certificate */
int ret, fpr_size, packet_size;
opaque *pdata;
gnutls_cert *apr_cert_list;
- gnutls_private_key *apr_pkey;
+ gnutls_x509_privkey apr_pkey;
int apr_cert_list_length;
/* find the appropriate certificate */
{
int ret;
gnutls_cert *apr_cert_list;
- gnutls_private_key *apr_pkey;
+ gnutls_x509_privkey apr_pkey;
int apr_cert_list_length, size;
gnutls_datum signature;
int _gnutls_find_apr_cert(gnutls_session session,
gnutls_cert ** apr_cert_list,
int *apr_cert_list_length,
- gnutls_private_key ** apr_pkey)
+ gnutls_x509_privkey * apr_pkey)
{
const gnutls_certificate_credentials cred;
int ind;
*apr_cert_list = cred->cert_list[ind];
*apr_cert_list_length =
cred->cert_list_length[ind];
- *apr_pkey = &cred->pkey[ind];
+ *apr_pkey = cred->pkey[ind];
}
}
} else { /* CLIENT SIDE */
*apr_cert_list = cred->cert_list[ind];
*apr_cert_list_length =
cred->cert_list_length[ind];
- *apr_pkey = &cred->pkey[ind];
+ *apr_pkey = cred->pkey[ind];
}
}
* This is the same with the number of pkeys.
*/
- gnutls_private_key * pkey;
+ gnutls_x509_privkey * pkey;
/* private keys. It contains ncerts private
* keys. pkey[i] corresponds to certificate in
* cert_list[i][0].
int _gnutls_proc_cert_cert_req(gnutls_session, opaque *, size_t);
int _gnutls_proc_cert_client_cert_vrfy(gnutls_session, opaque *, size_t);
int _gnutls_proc_cert_server_certificate(gnutls_session, opaque *, size_t);
-int _gnutls_find_apr_cert( gnutls_session session, gnutls_cert** apr_cert_list, int *apr_cert_list_length, gnutls_private_key** apr_pkey);
+int _gnutls_find_apr_cert( gnutls_session session, gnutls_cert** apr_cert_list, int *apr_cert_list_length, gnutls_x509_privkey* apr_pkey);
const gnutls_cert * _gnutls_server_find_cert( struct gnutls_session_int*, gnutls_pk_algorithm);
#define _gnutls_proc_cert_client_certificate _gnutls_proc_cert_server_certificate
int ret = 0, data_size;
int bits;
gnutls_cert *apr_cert_list;
- gnutls_private_key *apr_pkey;
+ gnutls_x509_privkey apr_pkey;
int apr_cert_list_length;
gnutls_datum signature, ddata;
CERTIFICATE_AUTH_INFO info;
/* non export cipher suites. */
- *params_size = cred->pkey[index].params_size;
- *params = cred->pkey[index].params;
+ *params_size = cred->pkey[index]->params_size;
+ *params = cred->pkey[index]->params;
return 0;
}
uint8 *data_e, *data_m;
int ret = 0, data_size;
gnutls_cert *apr_cert_list;
- gnutls_private_key *apr_pkey;
+ gnutls_x509_privkey apr_pkey;
int apr_cert_list_length;
gnutls_datum signature, ddata;
CERTIFICATE_AUTH_INFO info;
#include <gnutls_datum.h>
#include <gnutls_mpi.h>
#include <gnutls_global.h>
-#include <gnutls_privkey.h>
#include <gnutls_algorithms.h>
#include <gnutls_dh.h>
#include <gnutls_str.h>
_gnutls_free_datum( &sc->keyring);
for (i = 0; i < sc->ncerts; i++) {
- _gnutls_free_private_key(sc->pkey[i]);
+ gnutls_x509_privkey_deinit(sc->pkey[i]);
}
gnutls_free( sc->pkey);
#include <gnutls_ui.h>
#include "x509/x509.h"
-#define MAX_PARAMS_SIZE 6 /* ok for RSA and DSA */
+#define MAX_PUBLIC_PARAMS_SIZE 4 /* ok for RSA and DSA */
/* parameters should not be larger than this limit */
-#define MAX_PARAMETER_SIZE 1200
-#define DSA_PRIVATE_PARAMS 5
#define DSA_PUBLIC_PARAMS 4
-#define RSA_PRIVATE_PARAMS 6
#define RSA_PUBLIC_PARAMS 2
-#if MAX_PARAMS_SIZE - RSA_PRIVATE_PARAMS < 0
-# error INCREASE MAX_PARAMS
-#endif
-
-#if MAX_PARAMS_SIZE - DSA_PRIVATE_PARAMS < 0
-# error INCREASE MAX_PARAMS
-#endif
-
/* For key Usage, test as:
* if (st.keyUsage & KEY_DIGITAL_SIGNATURE) ...
*/
#define KEY_DECIPHER_ONLY 1
typedef struct gnutls_cert {
- MPI params[MAX_PARAMS_SIZE]; /* the size of params depends on the public
+ MPI params[MAX_PUBLIC_PARAMS_SIZE]; /* the size of params depends on the public
* key algorithm
* RSA: [0] is modulus
* [1] is public exponent
} gnutls_cert;
-typedef struct {
- MPI params[MAX_PARAMS_SIZE];/* the size of params depends on the public
- * key algorithm
- */
- /*
- * RSA: [0] is modulus
- * [1] is public exponent
- * [2] is private exponent
- * [3] is prime1 (p)
- * [4] is prime2 (q)
- * [5] is coefficient (u == inverse of p mod q)
- * DSA: [0] is p
- * [1] is q
- * [2] is g
- * [3] is y (public key)
- * [4] is x (private key)
- */
- int params_size; /* holds the number of params */
-
- gnutls_pk_algorithm pk_algorithm;
-
-} gnutls_private_key;
-
struct gnutls_session_int; /* because gnutls_session is not defined when this file is included */
typedef enum ConvFlags {
#define HANDSHAKE_DEBUG // Prints some information on handshake
#define X509_DEBUG
#define RECORD_DEBUG
-#define COMPRESSION_DEBUG
+#define COMPRESSION_DEBUG*/
#define DEBUG
-*/
+
/* It might be a good idea to replace int with void*
* here.
+++ /dev/null
-/*
- * Copyright (C) 2001 Nikos Mavroyanopoulos
- *
- * This file is part of GNUTLS.
- *
- * The GNUTLS library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
- *
- */
-
-/* This file contains functions needed to read DSA or RSA private keys
- * from files, or memory.
- */
-
-#include <gnutls_int.h>
-#include <gnutls_errors.h>
-#include <x509_b64.h>
-#include <auth_cert.h>
-#include <gnutls_cert.h>
-#include <libtasn1.h>
-#include <gnutls_datum.h>
-#include <gnutls_mpi.h>
-#include <gnutls_global.h>
-#include <gnutls_privkey.h>
-
-/* Converts an RSA PKCS#1 key to
- * an internal structure (gnutls_private_key)
- */
-int _gnutls_PKCS1key2gnutlsKey(gnutls_private_key * pkey,
- gnutls_datum raw_key)
-{
- int result;
- opaque str[MAX_PARAMETER_SIZE];
- ASN1_TYPE pkey_asn;
-
- pkey->pk_algorithm = GNUTLS_PK_RSA;
-
- if ((result =
- asn1_create_element(_gnutls_get_gnutls_asn(),
- "GNUTLS.RSAPrivateKey", &pkey_asn
- )) != ASN1_SUCCESS) {
- gnutls_assert();
- return _gnutls_asn2err(result);
- }
-
- if ((sizeof(pkey->params) / sizeof(GNUTLS_MPI)) < RSA_PRIVATE_PARAMS) {
- gnutls_assert();
- /* internal error. Increase the GNUTLS_MPIs in params */
- return GNUTLS_E_INTERNAL_ERROR;
- }
-
- result = asn1_der_decoding(&pkey_asn, raw_key.data, raw_key.size, NULL);
- if (result != ASN1_SUCCESS) {
- gnutls_assert();
- return _gnutls_asn2err(result);
- }
-
- if ((result = _gnutls_x509_read_int(pkey_asn, "modulus",
- str, sizeof(str) - 1,
- &pkey->params[0])) < 0) {
- gnutls_assert();
- asn1_delete_structure(&pkey_asn);
- return result;
- }
-
- if ((result =
- _gnutls_x509_read_int(pkey_asn, "publicExponent", str,
- sizeof(str) - 1,
- &pkey->params[1])) < 0) {
- gnutls_assert();
- asn1_delete_structure(&pkey_asn);
- _gnutls_mpi_release(&pkey->params[0]);
- return result;
- }
-
- if ((result =
- _gnutls_x509_read_int(pkey_asn, "privateExponent", str,
- sizeof(str) - 1,
- &pkey->params[2])) < 0) {
- gnutls_assert();
- _gnutls_mpi_release(&pkey->params[0]);
- _gnutls_mpi_release(&pkey->params[1]);
- asn1_delete_structure(&pkey_asn);
- return result;
- }
-
- if ((result = _gnutls_x509_read_int(pkey_asn, "prime1",
- str, sizeof(str) - 1,
- &pkey->params[3])) < 0) {
- gnutls_assert();
- _gnutls_mpi_release(&pkey->params[0]);
- _gnutls_mpi_release(&pkey->params[1]);
- _gnutls_mpi_release(&pkey->params[2]);
- asn1_delete_structure(&pkey_asn);
- return result;
- }
-
- if ((result = _gnutls_x509_read_int(pkey_asn, "prime2",
- str, sizeof(str) - 1,
- &pkey->params[4])) < 0) {
- gnutls_assert();
- _gnutls_mpi_release(&pkey->params[0]);
- _gnutls_mpi_release(&pkey->params[1]);
- _gnutls_mpi_release(&pkey->params[2]);
- _gnutls_mpi_release(&pkey->params[3]);
- asn1_delete_structure(&pkey_asn);
- return result;
- }
-
-#if 1
- /* Calculate the coefficient. This is because the gcrypt
- * library is uses the p,q in the reverse order.
- */
- pkey->params[5] =
- _gnutls_mpi_snew(_gnutls_mpi_get_nbits(pkey->params[0]));
-
- if (pkey->params[5] == NULL) {
- gnutls_assert();
- return GNUTLS_E_MEMORY_ERROR;
- }
-
- _gnutls_mpi_invm(pkey->params[5], pkey->params[3], pkey->params[4]);
- /* p, q */
-#else
- if ( (result=_gnutls_x509_read_int( pkey_asn, "coefficient",
- str, sizeof(str)-1, &pkey->params[5])) < 0) {
- gnutls_assert();
- _gnutls_mpi_release( &pkey->params[0]);
- _gnutls_mpi_release( &pkey->params[1]);
- _gnutls_mpi_release( &pkey->params[2]);
- _gnutls_mpi_release( &pkey->params[3]);
- _gnutls_mpi_release( &pkey->params[4]);
- asn1_delete_structure(&pkey_asn);
- return result;
- }
-#endif
-
- pkey->params_size = RSA_PRIVATE_PARAMS;
-
- asn1_delete_structure(&pkey_asn);
-
- return 0;
-
-
-}
-
-int _gnutls_DSAkey2gnutlsKey(gnutls_private_key * pkey,
- gnutls_datum raw_key)
-{
- int result;
- opaque str[MAX_PARAMETER_SIZE];
- ASN1_TYPE dsa_asn;
-
- pkey->pk_algorithm = GNUTLS_PK_DSA;
-
- if ((result =
- asn1_create_element(_gnutls_get_gnutls_asn(),
- "GNUTLS.DSAPrivateKey", &dsa_asn
- )) != ASN1_SUCCESS) {
- gnutls_assert();
- return _gnutls_asn2err(result);
- }
-
- if ((sizeof(pkey->params) / sizeof(GNUTLS_MPI)) < DSA_PRIVATE_PARAMS) {
- gnutls_assert();
- /* internal error. Increase the GNUTLS_MPIs in params */
- return GNUTLS_E_INTERNAL_ERROR;
- }
-
- result = asn1_der_decoding(&dsa_asn, raw_key.data, raw_key.size, NULL);
- if (result != ASN1_SUCCESS) {
- gnutls_assert();
- return _gnutls_asn2err(result);
- }
-
- if ((result = _gnutls_x509_read_int(dsa_asn, "p",
- str, sizeof(str) - 1,
- &pkey->params[0])) < 0) {
- gnutls_assert();
- asn1_delete_structure(&dsa_asn);
- return result;
- }
-
- if ((result = _gnutls_x509_read_int(dsa_asn, "q",
- str, sizeof(str) - 1,
- &pkey->params[1])) < 0) {
- gnutls_assert();
- asn1_delete_structure(&dsa_asn);
- _gnutls_mpi_release(&pkey->params[0]);
- return result;
- }
-
- if ((result = _gnutls_x509_read_int(dsa_asn, "g",
- str, sizeof(str) - 1,
- &pkey->params[2])) < 0) {
- gnutls_assert();
- asn1_delete_structure(&dsa_asn);
- _gnutls_mpi_release(&pkey->params[0]);
- _gnutls_mpi_release(&pkey->params[1]);
- return result;
- }
-
- if ((result = _gnutls_x509_read_int(dsa_asn, "Y",
- str, sizeof(str) - 1,
- &pkey->params[3])) < 0) {
- gnutls_assert();
- asn1_delete_structure(&dsa_asn);
- _gnutls_mpi_release(&pkey->params[0]);
- _gnutls_mpi_release(&pkey->params[1]);
- _gnutls_mpi_release(&pkey->params[2]);
- return result;
- }
-
- if ((result = _gnutls_x509_read_int(dsa_asn, "priv",
- str, sizeof(str) - 1,
- &pkey->params[4])) < 0) {
- gnutls_assert();
- asn1_delete_structure(&dsa_asn);
- _gnutls_mpi_release(&pkey->params[0]);
- _gnutls_mpi_release(&pkey->params[1]);
- _gnutls_mpi_release(&pkey->params[2]);
- _gnutls_mpi_release(&pkey->params[3]);
- return result;
- }
- pkey->params_size = DSA_PRIVATE_PARAMS;
-
- asn1_delete_structure(&dsa_asn);
-
- return 0;
-
-
-}
-
-void _gnutls_free_private_key(gnutls_private_key pkey)
-{
- int i;
-
- for (i = 0; i < pkey.params_size; i++) {
- _gnutls_mpi_release(&pkey.params[i]);
- }
-
- return;
-}
-
+++ /dev/null
-int _gnutls_PKCS1key2gnutlsKey(gnutls_private_key * pkey, gnutls_datum raw_key);
-int _gnutls_DSAkey2gnutlsKey(gnutls_private_key * pkey, gnutls_datum raw_key);
-void _gnutls_free_private_key( gnutls_private_key pkey);
-int _gnutls_der_check_if_rsa_key(const gnutls_datum * key_struct);
-int _gnutls_der_check_if_dsa_key(const gnutls_datum * key_struct);
#include <libtasn1.h>
#include <gnutls_datum.h>
#include <gnutls_mpi.h>
-#include <gnutls_privkey.h>
#include <gnutls_global.h>
#include <gnutls_pk.h>
#include <debug.h>
#include <gnutls_sig.h>
-int _gnutls_generate_sig( gnutls_cert* cert, gnutls_private_key *pkey, const gnutls_datum* hash_concat, gnutls_datum *signature);
+int _gnutls_generate_sig( gnutls_cert* cert, gnutls_x509_privkey pkey, const gnutls_datum* hash_concat, gnutls_datum *signature);
/* Generates a signature of all the previous sent packets in the
* handshake procedure.
*/
-int _gnutls_generate_sig_from_hdata( gnutls_session session, gnutls_cert* cert, gnutls_private_key *pkey, gnutls_datum *signature) {
+int _gnutls_generate_sig_from_hdata( gnutls_session session, gnutls_cert* cert, gnutls_x509_privkey pkey, gnutls_datum *signature) {
gnutls_datum dconcat;
int ret;
opaque concat[36];
/* Generates a signature of all the random data and the parameters.
* Used in DHE_* ciphersuites.
*/
-int _gnutls_generate_sig_params( gnutls_session session, gnutls_cert* cert, gnutls_private_key *pkey, gnutls_datum* params, gnutls_datum *signature)
+int _gnutls_generate_sig_params( gnutls_session session, gnutls_cert* cert, gnutls_x509_privkey pkey, gnutls_datum* params, gnutls_datum *signature)
{
gnutls_datum dconcat;
int ret;
* Cert is the certificate of the corresponding private key. It is only checked if
* it supports signing.
*/
-int _gnutls_generate_sig( gnutls_cert* cert, gnutls_private_key *pkey, const gnutls_datum* hash_concat, gnutls_datum *signature)
+int _gnutls_generate_sig( gnutls_cert* cert, gnutls_x509_privkey pkey, const gnutls_datum* hash_concat, gnutls_datum *signature)
{
int ret;
gnutls_datum tmpdata;
# include <auth_cert.h>
gnutls_certificate_status gnutls_x509_verify_signature(gnutls_cert* cert, gnutls_cert* issuer);
-int _gnutls_pkcs1_rsa_generate_sig( gnutls_cert* cert, gnutls_private_key *pkey, const gnutls_datum* hash_concat, gnutls_datum *signature);
-int _gnutls_generate_sig_from_hdata( gnutls_session session, gnutls_cert* cert, gnutls_private_key *pkey, gnutls_datum *signature);
-int _gnutls_generate_sig_params( gnutls_session session, gnutls_cert* cert, gnutls_private_key *pkey, gnutls_datum* params, gnutls_datum *signature);
+int _gnutls_generate_sig_from_hdata( gnutls_session session, gnutls_cert* cert, gnutls_x509_privkey pkey, gnutls_datum *signature);
+int _gnutls_generate_sig_params( gnutls_session session, gnutls_cert* cert, gnutls_x509_privkey pkey, gnutls_datum* params, gnutls_datum *signature);
int _gnutls_verify_sig_hdata( gnutls_session session, gnutls_cert *cert, gnutls_datum* signature);
int _gnutls_verify_sig_params( gnutls_session session, gnutls_cert *cert, const gnutls_datum* params, gnutls_datum* signature);
#include <gnutls_str.h>
#include <debug.h>
#include <x509_b64.h>
-#include <gnutls_privkey.h>
#include <gnutls_x509.h>
#include "x509/common.h"
#include "x509/x509.h"
{
int pk = res->cert_list[res->ncerts-1][0].subject_pk_algorithm;
- if (res->pkey[res->ncerts-1].pk_algorithm != (unsigned int)pk) {
+ if (gnutls_x509_privkey_get_pk_algorithm(res->pkey[res->ncerts-1]) != pk)
+ {
gnutls_assert();
return GNUTLS_E_CERTIFICATE_KEY_MISMATCH;
}
-/* This will check if the given DER key is a PKCS-1 RSA key.
- * Returns 0 if the key is an RSA one.
- */
-int _gnutls_der_check_if_rsa_key(const gnutls_datum * key_struct)
-{
- ASN1_TYPE c2;
- int result;
-
- if (key_struct->size == 0 || key_struct->data == NULL) {
- gnutls_assert();
- return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
- }
-
- if ((result=asn1_create_element
- (_gnutls_get_gnutls_asn(), "GNUTLS.RSAPrivateKey", &c2
- )) != ASN1_SUCCESS)
- {
- gnutls_assert();
- return _gnutls_asn2err(result);
- }
-
- result = asn1_der_decoding(&c2, key_struct->data, key_struct->size, NULL);
- asn1_delete_structure(&c2);
-
- if (result != ASN1_SUCCESS) {
- /* couldn't decode DER */
-
- gnutls_assert();
- return _gnutls_asn2err(result);
- }
-
- return 0;
-}
-
-/* This will check if the given DER key is an openssl formated DSA key.
- * Returns 0 if the key is a DSA one.
- */
-int _gnutls_der_check_if_dsa_key(const gnutls_datum * key_struct)
-{
- ASN1_TYPE c2;
- int result;
-
- if (key_struct->size == 0 || key_struct->data == NULL) {
- gnutls_assert();
- return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;
- }
-
- if ((result=asn1_create_element
- (_gnutls_get_gnutls_asn(), "GNUTLS.DSAPrivateKey", &c2
- )) != ASN1_SUCCESS)
- {
- gnutls_assert();
- return _gnutls_asn2err(result);
- }
-
- result = asn1_der_decoding(&c2, key_struct->data, key_struct->size, NULL);
- asn1_delete_structure(&c2);
-
- if (result != ASN1_SUCCESS) {
- /* couldn't decode DER */
-
- gnutls_assert();
- return _gnutls_asn2err(result);
- }
-
- return 0;
-}
-
-
-
-
/* Reads a PEM encoded PKCS-1 RSA private key from memory
* 2002-01-26: Added ability to read DSA keys.
* type indicates the certificate format.
gnutls_x509_crt_fmt type)
{
int ret;
- opaque *b64 = NULL;
gnutls_datum tmp;
- gnutls_pk_algorithm pk;
/* allocate space for the pkey list
*/
- res->pkey = gnutls_realloc_fast( res->pkey, (res->ncerts+1)*sizeof(gnutls_private_key));
+ res->pkey = gnutls_realloc_fast( res->pkey, (res->ncerts+1)*sizeof(gnutls_x509_privkey));
if (res->pkey==NULL) {
gnutls_assert();
return GNUTLS_E_MEMORY_ERROR;
}
- /* read PKCS-1 private key */
-
- if (type==GNUTLS_X509_FMT_DER) { /* DER */
- int cv;
-
- tmp.data = (opaque*)key;
- tmp.size = key_size;
-
- /* The only way to distinguish the keys
- * is to count the sequence of integers.
- */
- pk = GNUTLS_PK_UNKNOWN;
- cv = _gnutls_der_check_if_rsa_key( &tmp);
- if (cv==0)
- pk = GNUTLS_PK_RSA;
- else {
- cv = _gnutls_der_check_if_dsa_key( &tmp);
- if (cv == 0) pk = GNUTLS_PK_DSA;
- }
-
- } else { /* PEM */
-
- /* If we find the "DSA PRIVATE" string in the
- * pem encoded certificate then it's a DSA key.
- */
- if (strstr( key, "DSA PRIVATE")!=NULL) {
- pk = GNUTLS_PK_DSA;
- key = strstr( key, PEM_KEY_DSA_SEP);
- if (key == NULL) {
- gnutls_assert();
- return GNUTLS_E_BASE64_DECODING_ERROR;
- } key_size = strlen( key);
- } else {
- pk = GNUTLS_PK_RSA;
- key = strstr( key, PEM_KEY_RSA_SEP);
- if (key == NULL) {
- gnutls_assert();
- return GNUTLS_E_BASE64_DECODING_ERROR;
- }
- key_size = strlen( key);
- }
-
+ ret = gnutls_x509_privkey_init( &res->pkey[res->ncerts]);
+ if (ret < 0) {
+ gnutls_assert();
+ return ret;
+ }
- ret = _gnutls_fbase64_decode( NULL, key, key_size, &b64);
+ tmp.data = (opaque*)key;
+ tmp.size = key_size;
- if (ret < 0) {
- gnutls_assert();
- return GNUTLS_E_BASE64_DECODING_ERROR;
- }
-
- tmp.data = b64;
- tmp.size = ret;
- }
+ ret = gnutls_x509_privkey_import( res->pkey[res->ncerts], &tmp, type);
+ if (ret < 0) {
+ gnutls_assert();
+ gnutls_x509_privkey_deinit( res->pkey[res->ncerts]);
+ res->pkey[res->ncerts] = NULL;
- switch (pk) { /* decode the key */
- case GNUTLS_PK_RSA:
- if ((ret =
- _gnutls_PKCS1key2gnutlsKey(&res->pkey[res->ncerts],
- tmp)) < 0) {
- gnutls_assert();
- gnutls_free(b64);
- return ret;
- }
- break;
- case GNUTLS_PK_DSA:
- if ((ret =
- _gnutls_DSAkey2gnutlsKey(&res->pkey[res->ncerts],
- tmp)) < 0) {
- gnutls_assert();
- gnutls_free(b64);
- return ret;
- }
- break;
- default:
- gnutls_assert();
- gnutls_free(b64);
- return GNUTLS_E_INTERNAL_ERROR;
+ return ret;
}
- /* this doesn't hurt in the DER case, since
- * b64 is NULL
- */
- gnutls_free(b64);
-
return 0;
}
sc->cert_list = NULL;
for (i = 0; i < sc->ncerts; i++) {
- _gnutls_free_private_key(sc->pkey[i]);
+ gnutls_x509_privkey_deinit(sc->pkey[i]);
}
gnutls_free( sc->pkey);
int _gnutls_x509_read_rsa_params(opaque * der, int dersize, GNUTLS_MPI * params);
int _gnutls_x509_read_dsa_pubkey(opaque * der, int dersize, GNUTLS_MPI * params);
+
*key = gnutls_calloc( 1, sizeof(gnutls_x509_privkey_int));
if (*key) {
+ (*key)->pk_algorithm = GNUTLS_PK_UNKNOWN;
return 0; /* success */
}
+
return GNUTLS_E_MEMORY_ERROR;
}
**/
void gnutls_x509_privkey_deinit(gnutls_x509_privkey key)
{
- _gnutls_free_datum(&key->raw);
+int i;
+
+ for (i = 0; i < key->params_size; i++) {
+ _gnutls_mpi_release( &key->params[i]);
+ }
gnutls_free(key);
}
+/* Converts an RSA PKCS#1 key to
+ * an internal structure (gnutls_private_key)
+ */
+static ASN1_TYPE decode_pkcs1_rsa_key( const gnutls_datum *raw_key,
+ gnutls_x509_privkey pkey)
+{
+ int result;
+ opaque str[MAX_PARAMETER_SIZE];
+ ASN1_TYPE pkey_asn;
+
+ if ((result =
+ asn1_create_element(_gnutls_get_gnutls_asn(),
+ "GNUTLS.RSAPrivateKey", &pkey_asn
+ )) != ASN1_SUCCESS) {
+ gnutls_assert();
+ return NULL;
+ }
+
+ if ((sizeof(pkey->params) / sizeof(GNUTLS_MPI)) < RSA_PRIVATE_PARAMS) {
+ gnutls_assert();
+ /* internal error. Increase the GNUTLS_MPIs in params */
+ return NULL;
+ }
+
+ result = asn1_der_decoding(&pkey_asn, raw_key->data, raw_key->size, NULL);
+ if (result != ASN1_SUCCESS) {
+ gnutls_assert();
+ goto error;
+ }
+
+ if ((result = _gnutls_x509_read_int(pkey_asn, "modulus",
+ str, sizeof(str) - 1,
+ &pkey->params[0])) < 0) {
+ gnutls_assert();
+ goto error;
+ }
+
+ if ((result =
+ _gnutls_x509_read_int(pkey_asn, "publicExponent", str,
+ sizeof(str) - 1,
+ &pkey->params[1])) < 0) {
+ gnutls_assert();
+ goto error;
+ }
+
+ if ((result =
+ _gnutls_x509_read_int(pkey_asn, "privateExponent", str,
+ sizeof(str) - 1,
+ &pkey->params[2])) < 0) {
+ gnutls_assert();
+ goto error;
+ }
+
+ if ((result = _gnutls_x509_read_int(pkey_asn, "prime1",
+ str, sizeof(str) - 1,
+ &pkey->params[3])) < 0) {
+ gnutls_assert();
+ goto error;
+ }
+
+ if ((result = _gnutls_x509_read_int(pkey_asn, "prime2",
+ str, sizeof(str) - 1,
+ &pkey->params[4])) < 0) {
+ gnutls_assert();
+ goto error;
+ }
+
+#if 1
+ /* Calculate the coefficient. This is because the gcrypt
+ * library is uses the p,q in the reverse order.
+ */
+ pkey->params[5] =
+ _gnutls_mpi_snew(_gnutls_mpi_get_nbits(pkey->params[0]));
+
+ if (pkey->params[5] == NULL) {
+ gnutls_assert();
+ goto error;
+ }
+
+ _gnutls_mpi_invm(pkey->params[5], pkey->params[3], pkey->params[4]);
+ /* p, q */
+#else
+ if ( (result=_gnutls_x509_read_int( pkey_asn, "coefficient",
+ str, sizeof(str)-1, &pkey->params[5])) < 0) {
+ gnutls_assert();
+ goto error;
+ }
+#endif
+ pkey->params_size = 6;
+
+ return pkey_asn;
+
+ error:
+ asn1_delete_structure(&pkey_asn);
+ _gnutls_mpi_release(&pkey->params[0]);
+ _gnutls_mpi_release(&pkey->params[1]);
+ _gnutls_mpi_release(&pkey->params[2]);
+ _gnutls_mpi_release(&pkey->params[3]);
+ _gnutls_mpi_release(&pkey->params[4]);
+ _gnutls_mpi_release(&pkey->params[5]);
+ return NULL;
+
+}
+
+static ASN1_TYPE decode_dsa_key( const gnutls_datum* raw_key,
+ gnutls_x509_privkey pkey)
+{
+ int result;
+ opaque str[MAX_PARAMETER_SIZE];
+ ASN1_TYPE dsa_asn;
+
+ if ((result =
+ asn1_create_element(_gnutls_get_gnutls_asn(),
+ "GNUTLS.DSAPrivateKey", &dsa_asn
+ )) != ASN1_SUCCESS) {
+ gnutls_assert();
+ return NULL;
+ }
+
+ if ((sizeof(pkey->params) / sizeof(GNUTLS_MPI)) < DSA_PRIVATE_PARAMS) {
+ gnutls_assert();
+ /* internal error. Increase the GNUTLS_MPIs in params */
+ return NULL;
+ }
+
+ result = asn1_der_decoding(&dsa_asn, raw_key->data, raw_key->size, NULL);
+ if (result != ASN1_SUCCESS) {
+ gnutls_assert();
+ goto error;
+ }
+
+ if ((result = _gnutls_x509_read_int(dsa_asn, "p",
+ str, sizeof(str) - 1,
+ &pkey->params[0])) < 0) {
+ gnutls_assert();
+ goto error;
+ }
+
+ if ((result = _gnutls_x509_read_int(dsa_asn, "q",
+ str, sizeof(str) - 1,
+ &pkey->params[1])) < 0) {
+ gnutls_assert();
+ goto error;
+ }
+
+ if ((result = _gnutls_x509_read_int(dsa_asn, "g",
+ str, sizeof(str) - 1,
+ &pkey->params[2])) < 0) {
+ gnutls_assert();
+ goto error;
+ }
+
+ if ((result = _gnutls_x509_read_int(dsa_asn, "Y",
+ str, sizeof(str) - 1,
+ &pkey->params[3])) < 0) {
+ gnutls_assert();
+ goto error;
+ }
+
+ if ((result = _gnutls_x509_read_int(dsa_asn, "priv",
+ str, sizeof(str) - 1,
+ &pkey->params[4])) < 0) {
+ gnutls_assert();
+ goto error;
+ }
+ pkey->params_size = 5;
+
+ return dsa_asn;
+
+ error:
+ asn1_delete_structure(&dsa_asn);
+ _gnutls_mpi_release(&pkey->params[0]);
+ _gnutls_mpi_release(&pkey->params[1]);
+ _gnutls_mpi_release(&pkey->params[2]);
+ _gnutls_mpi_release(&pkey->params[3]);
+ _gnutls_mpi_release(&pkey->params[4]);
+ return NULL;
+
+}
+
+
#define PEM_KEY_DSA "DSA PRIVATE"
#define PEM_KEY_RSA "RSA PRIVATE"
int result = 0, need_free = 0;
gnutls_datum _data = { data->data, data->size };
+ key->pk_algorithm = GNUTLS_PK_UNKNOWN;
+
/* If the Certificate is in PEM format then decode it
*/
if (format == GNUTLS_X509_FMT_PEM) {
/* Try the first header */
result = _gnutls_fbase64_decode(PEM_KEY_RSA, data->data, data->size,
&out);
+ key->pk_algorithm = GNUTLS_PK_RSA;
if (result <= 0) {
/* try for the second header */
result = _gnutls_fbase64_decode(PEM_KEY_DSA, data->data, data->size,
&out);
+ key->pk_algorithm = GNUTLS_PK_DSA;
if (result <= 0) {
if (result==0) result = GNUTLS_E_INTERNAL_ERROR;
need_free = 1;
}
- result =
- _gnutls_set_datum(&key->raw, _data.data, _data.size);
- if (result < 0) {
- gnutls_assert();
- goto cleanup;
+ if (key->pk_algorithm == GNUTLS_PK_RSA) {
+ key->key = decode_pkcs1_rsa_key( &_data, key);
+ if (key->key == NULL) {
+ gnutls_assert();
+ result = GNUTLS_E_ASN1_DER_ERROR;
+ goto cleanup;
+ }
+ } else if (key->pk_algorithm == GNUTLS_PK_DSA) {
+ key->key = decode_dsa_key( &_data, key);
+ if (key->key == NULL) {
+ gnutls_assert();
+ result = GNUTLS_E_ASN1_DER_ERROR;
+ goto cleanup;
+ }
+ } else {
+ /* Try decoding with both, and accept the one that
+ * succeeds.
+ */
+ key->pk_algorithm = GNUTLS_PK_DSA;
+ key->key = decode_dsa_key( &_data, key);
+
+ if (key->key == NULL) {
+ key->pk_algorithm = GNUTLS_PK_RSA;
+ key->key = decode_pkcs1_rsa_key( &_data, key);
+ if (key->key == NULL) {
+ gnutls_assert();
+ result = GNUTLS_E_ASN1_DER_ERROR;
+ goto cleanup;
+ }
+ }
}
-
+
if (need_free) _gnutls_free_datum( &_data);
+ /* The key has now been decoded.
+ */
+
return 0;
cleanup:
- _gnutls_free_datum(&key->raw);
+ key->pk_algorithm = GNUTLS_PK_UNKNOWN;
if (need_free) _gnutls_free_datum( &_data);
return result;
}
**/
int gnutls_x509_privkey_get_pk_algorithm( gnutls_x509_privkey key)
{
-int cv, pk;
-
- pk = GNUTLS_PK_UNKNOWN;
-
- /* The only way to distinguish the keys
- * is to count the sequence of integers.
- */
- cv = _gnutls_der_check_if_rsa_key( &key->raw);
- if (cv==0)
- pk = GNUTLS_PK_RSA;
- else {
- cv = _gnutls_der_check_if_dsa_key( &key->raw);
- if (cv==0)
- pk = GNUTLS_PK_DSA;
- }
-
- return pk;
-
+ return key->pk_algorithm;
}
gnutls_pk_algorithm signature_algorithm;
} gnutls_x509_crt_int;
+/* Raw encoded parameter.
+ */
+#define MAX_PARAMETER_SIZE 1200
+
+#define MAX_PARAMS_SIZE 6 /* ok for RSA and DSA */
+
+/* parameters should not be larger than this limit */
+#define DSA_PRIVATE_PARAMS 5
+#define DSA_PUBLIC_PARAMS 4
+#define RSA_PRIVATE_PARAMS 6
+#define RSA_PUBLIC_PARAMS 2
+
+#if MAX_PARAMS_SIZE - RSA_PRIVATE_PARAMS < 0
+# error INCREASE MAX_PARAMS
+#endif
+
+#if MAX_PARAMS_SIZE - DSA_PRIVATE_PARAMS < 0
+# error INCREASE MAX_PARAMS
+#endif
+
typedef struct gnutls_x509_privkey_int {
- gnutls_datum raw; /* we only keep raw data for the moment */
+ MPI params[MAX_PARAMS_SIZE];/* the size of params depends on the public
+ * key algorithm
+ */
+ /*
+ * RSA: [0] is modulus
+ * [1] is public exponent
+ * [2] is private exponent
+ * [3] is prime1 (p)
+ * [4] is prime2 (q)
+ * [5] is coefficient (u == inverse of p mod q)
+ * DSA: [0] is p
+ * [1] is q
+ * [2] is g
+ * [3] is y (public key)
+ * [4] is x (private key)
+ */
+ int params_size; /* holds the number of params */
+
+ gnutls_pk_algorithm pk_algorithm;
+
+ ASN1_TYPE key;
} gnutls_x509_privkey_int;
typedef struct gnutls_x509_crt_int *gnutls_x509_crt;
projects / thirdparty / gnutls.git / commitdiff
