2 * Copyright (C) 2001, 2002, 2003, 2004, 2005, 2007, 2010 Free Software
5 * Author: Nikos Mavrogiannopoulos
7 * This file is part of GnuTLS.
9 * The GnuTLS is free software; you can redistribute it and/or
10 * modify it under the terms of the GNU Lesser General Public License
11 * as published by the Free Software Foundation; either version 2.1 of
12 * the License, or (at your option) any later version.
14 * This library is distributed in the hope that it will be useful, but
15 * WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 * Lesser General Public License for more details.
19 * You should have received a copy of the GNU Lesser General Public
20 * License along with this library; if not, write to the Free Software
21 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
26 #include <gnutls_int.h>
30 #include "gnutls_errors.h"
31 #include "auth_srp_passwd.h"
32 #include "gnutls_auth.h"
33 #include "gnutls_auth.h"
34 #include "gnutls_srp.h"
36 #include "gnutls_num.h"
38 #include <gnutls_str.h>
39 #include <auth_cert.h>
40 #include <gnutls_datum.h>
41 #include <gnutls_sig.h>
43 #include <gnutls_x509.h>
45 static int gen_srp_cert_server_kx (gnutls_session_t
, opaque
**);
46 static int proc_srp_cert_server_kx (gnutls_session_t
, opaque
*, size_t);
48 const mod_auth_st srp_rsa_auth_struct
= {
50 _gnutls_gen_cert_server_certificate
,
52 gen_srp_cert_server_kx
,
53 _gnutls_gen_srp_client_kx
,
57 _gnutls_proc_cert_server_certificate
,
58 NULL
, /* certificate */
59 proc_srp_cert_server_kx
,
60 _gnutls_proc_srp_client_kx
,
65 const mod_auth_st srp_dss_auth_struct
= {
67 _gnutls_gen_cert_server_certificate
,
69 gen_srp_cert_server_kx
,
70 _gnutls_gen_srp_client_kx
,
74 _gnutls_proc_cert_server_certificate
,
75 NULL
, /* certificate */
76 proc_srp_cert_server_kx
,
77 _gnutls_proc_srp_client_kx
,
83 gen_srp_cert_server_kx (gnutls_session_t session
, opaque
** data
)
85 ssize_t ret
, data_size
;
86 gnutls_datum_t signature
, ddata
;
87 gnutls_certificate_credentials_t cred
;
88 gnutls_cert
*apr_cert_list
;
89 gnutls_privkey_t apr_pkey
;
90 int apr_cert_list_length
;
91 gnutls_sign_algorithm_t sign_algo
;
93 ret
= _gnutls_gen_srp_server_kx (session
, data
);
100 ddata
.size
= data_size
;
102 cred
= (gnutls_certificate_credentials_t
)
103 _gnutls_get_cred (session
->key
, GNUTLS_CRD_CERTIFICATE
, NULL
);
107 return GNUTLS_E_INSUFFICIENT_CREDENTIALS
;
110 /* find the appropriate certificate */
112 _gnutls_get_selected_cert (session
, &apr_cert_list
,
113 &apr_cert_list_length
, &apr_pkey
)) < 0)
120 _gnutls_handshake_sign_data (session
, &apr_cert_list
[0],
121 apr_pkey
, &ddata
, &signature
,
129 *data
= gnutls_realloc_fast (*data
, data_size
+ signature
.size
+ 2);
132 _gnutls_free_datum (&signature
);
134 return GNUTLS_E_MEMORY_ERROR
;
137 _gnutls_write_datum16 (&(*data
)[data_size
], signature
);
138 data_size
+= signature
.size
+ 2;
140 _gnutls_free_datum (&signature
);
147 proc_srp_cert_server_kx (gnutls_session_t session
, opaque
* data
,
152 gnutls_datum_t vparams
, signature
;
154 cert_auth_info_t info
;
155 gnutls_cert peer_cert
;
158 ret
= _gnutls_proc_srp_server_kx (session
, data
, _data_size
);
162 data_size
= _data_size
- ret
;
164 info
= _gnutls_get_auth_info (session
);
165 if (info
== NULL
|| info
->ncerts
== 0)
168 /* we need this in order to get peer's certificate */
169 return GNUTLS_E_INTERNAL_ERROR
;
172 /* VERIFY SIGNATURE */
174 vparams
.size
= ret
; /* all the data minus the signature */
177 p
= &data
[vparams
.size
];
179 DECR_LEN (data_size
, 2);
180 sigsize
= _gnutls_read_uint16 (p
);
182 DECR_LEN (data_size
, sigsize
);
183 signature
.data
= &p
[2];
184 signature
.size
= sigsize
;
187 _gnutls_get_auth_info_gcert (&peer_cert
,
188 session
->security_parameters
.cert_type
,
198 _gnutls_handshake_verify_data (session
, &peer_cert
, &vparams
, &signature
,
199 GNUTLS_SIGN_UNKNOWN
);
201 _gnutls_gcert_deinit (&peer_cert
);
212 #endif /* ENABLE_SRP */