lib/gnutls_cert.c

   1 /*
   2  * Copyright (C) 2001-2012 Free Software Foundation, Inc.
   3  *
   4  * Author: Nikos Mavrogiannopoulos
   5  *
   6  * This file is part of GnuTLS.
   7  *
   8  * The GnuTLS is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * as published by the Free Software Foundation; either version 3 of
  11  * the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public License
  19  * along with this program.  If not, see <http://www.gnu.org/licenses/>
  20  *
  21  */
  22
  23 /* Some of the stuff needed for Certificate authentication is contained
  24  * in this file.
  25  */
  26
  27 #include <gnutls_int.h>
  28 #include <gnutls_errors.h>
  29 #include <auth/cert.h>
  30 #include <gnutls_datum.h>
  31 #include <gnutls_mpi.h>
  32 #include <gnutls_global.h>
  33 #include <algorithms.h>
  34 #include <gnutls_dh.h>
  35 #include <gnutls_str.h>
  36 #include <gnutls_state.h>
  37 #include <gnutls_auth.h>
  38 #include <gnutls_x509.h>
  39 #include <gnutls_str_array.h>
  40 #include "x509/x509_int.h"
  41 #ifdef ENABLE_OPENPGP
  42 #include "openpgp/gnutls_openpgp.h"
  43 #endif
  44
  45 /**
  46  * gnutls_certificate_free_keys:
  47  * @sc: is a #gnutls_certificate_credentials_t structure.
  48  *
  49  * This function will delete all the keys and the certificates associated
  50  * with the given credentials. This function must not be called when a
  51  * TLS negotiation that uses the credentials is in progress.
  52  *
  53  **/
  54 void
  55 gnutls_certificate_free_keys (gnutls_certificate_credentials_t sc)
  56 {
  57   unsigned i, j;
  58
  59   for (i = 0; i < sc->ncerts; i++)
  60     {
  61       for (j = 0; j < sc->certs[i].cert_list_length; j++)
  62         {
  63           gnutls_pcert_deinit (&sc->certs[i].cert_list[j]);
  64         }
  65       gnutls_free (sc->certs[i].cert_list);
  66       _gnutls_str_array_clear (&sc->certs[i].names);
  67     }
  68
  69   gnutls_free (sc->certs);
  70   sc->certs = NULL;
  71
  72   for (i = 0; i < sc->ncerts; i++)
  73     {
  74       gnutls_privkey_deinit (sc->pkey[i]);
  75     }
  76
  77   gnutls_free (sc->pkey);
  78   sc->pkey = NULL;
  79
  80   sc->ncerts = 0;
  81 }
  82
  83 /**
  84  * gnutls_certificate_free_cas:
  85  * @sc: is a #gnutls_certificate_credentials_t structure.
  86  *
  87  * This function will delete all the CAs associated with the given
  88  * credentials. Servers that do not use
  89  * gnutls_certificate_verify_peers2() may call this to save some
  90  * memory.
  91  **/
  92 void
  93 gnutls_certificate_free_cas (gnutls_certificate_credentials_t sc)
  94 {
  95   /* FIXME: do nothing for now */
  96   return;
  97 }
  98
  99 /**
 100  * gnutls_certificate_get_issuer:
 101  * @sc: is a #gnutls_certificate_credentials_t structure.
 102  * @cert: is the certificate to find issuer for
 103  * @issuer: Will hold the issuer if any. Should be treated as constant.
 104  * @flags: Use zero.
 105  *
 106  * This function will return the issuer of a given certificate.
 107  *
 108  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 109  *   negative error value.
 110  *
 111  * Since: 3.0
 112  **/
 113 int
 114 gnutls_certificate_get_issuer (gnutls_certificate_credentials_t sc,
 115   gnutls_x509_crt_t cert, gnutls_x509_crt_t* issuer, unsigned int flags)
 116 {
 117   return gnutls_x509_trust_list_get_issuer(sc->tlist, cert, issuer, flags);
 118 }
 119
 120 /**
 121  * gnutls_certificate_free_ca_names:
 122  * @sc: is a #gnutls_certificate_credentials_t structure.
 123  *
 124  * This function will delete all the CA name in the given
 125  * credentials. Clients may call this to save some memory since in
 126  * client side the CA names are not used. Servers might want to use
 127  * this function if a large list of trusted CAs is present and
 128  * sending the names of it would just consume bandwidth without providing
 129  * information to client.
 130  *
 131  * CA names are used by servers to advertise the CAs they support to
 132  * clients.
 133  **/
 134 void
 135 gnutls_certificate_free_ca_names (gnutls_certificate_credentials_t sc)
 136 {
 137   _gnutls_free_datum (&sc->x509_rdn_sequence);
 138 }
 139
 140 /*-
 141  * _gnutls_certificate_get_rsa_params - Returns the RSA parameters pointer
 142  * @rsa_params: holds the RSA parameters or NULL.
 143  * @func: function to retrieve the parameters or NULL.
 144  * @session: The session.
 145  *
 146  * This function will return the rsa parameters pointer.
 147  -*/
 148 gnutls_rsa_params_t
 149 _gnutls_certificate_get_rsa_params (gnutls_rsa_params_t rsa_params,
 150                                     gnutls_params_function * func,
 151                                     gnutls_session_t session)
 152 {
 153   gnutls_params_st params;
 154   int ret;
 155
 156   if (session->internals.params.rsa_params)
 157     {
 158       return session->internals.params.rsa_params;
 159     }
 160
 161   if (rsa_params)
 162     {
 163       session->internals.params.rsa_params = rsa_params;
 164     }
 165   else if (func)
 166     {
 167       ret = func (session, GNUTLS_PARAMS_RSA_EXPORT, &params);
 168       if (ret == 0 && params.type == GNUTLS_PARAMS_RSA_EXPORT)
 169         {
 170           session->internals.params.rsa_params = params.params.rsa_export;
 171           session->internals.params.free_rsa_params = params.deinit;
 172         }
 173     }
 174
 175   return session->internals.params.rsa_params;
 176 }
 177
 178
 179 /**
 180  * gnutls_certificate_free_credentials:
 181  * @sc: is a #gnutls_certificate_credentials_t structure.
 182  *
 183  * This structure is complex enough to manipulate directly thus this
 184  * helper function is provided in order to free (deallocate) it.
 185  *
 186  * This function does not free any temporary parameters associated
 187  * with this structure (ie RSA and DH parameters are not freed by this
 188  * function).
 189  **/
 190 void
 191 gnutls_certificate_free_credentials (gnutls_certificate_credentials_t sc)
 192 {
 193   gnutls_x509_trust_list_deinit(sc->tlist, 1);
 194   gnutls_certificate_free_keys (sc);
 195   gnutls_certificate_free_ca_names (sc);
 196   gnutls_free(sc->ocsp_response_file);
 197
 198 #ifdef ENABLE_OPENPGP
 199   gnutls_openpgp_keyring_deinit (sc->keyring);
 200 #endif
 201
 202   gnutls_free (sc);
 203 }
 204
 205
 206 /**
 207  * gnutls_certificate_allocate_credentials:
 208  * @res: is a pointer to a #gnutls_certificate_credentials_t structure.
 209  *
 210  * This structure is complex enough to manipulate directly thus this
 211  * helper function is provided in order to allocate it.
 212  *
 213  * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
 214  **/
 215 int
 216 gnutls_certificate_allocate_credentials (gnutls_certificate_credentials_t *
 217                                          res)
 218 {
 219 int ret;
 220
 221   *res = gnutls_calloc (1, sizeof (certificate_credentials_st));
 222
 223   if (*res == NULL)
 224     return GNUTLS_E_MEMORY_ERROR;
 225
 226   ret = gnutls_x509_trust_list_init( &(*res)->tlist, 0);
 227   if (ret < 0)
 228     {
 229       gnutls_assert();
 230       gnutls_free(*res);
 231       return GNUTLS_E_MEMORY_ERROR;
 232     }
 233   (*res)->verify_bits = DEFAULT_MAX_VERIFY_BITS;
 234   (*res)->verify_depth = DEFAULT_MAX_VERIFY_DEPTH;
 235   (*res)->verify_flags = GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN;
 236
 237   return 0;
 238 }
 239
 240
 241 /* returns the KX algorithms that are supported by a
 242  * certificate. (Eg a certificate with RSA params, supports
 243  * GNUTLS_KX_RSA algorithm).
 244  * This function also uses the KeyUsage field of the certificate
 245  * extensions in order to disable unneded algorithms.
 246  */
 247 int
 248 _gnutls_selected_cert_supported_kx (gnutls_session_t session,
 249                                     gnutls_kx_algorithm_t * alg,
 250                                     int *alg_size)
 251 {
 252   gnutls_kx_algorithm_t kx;
 253   gnutls_pk_algorithm_t pk, cert_pk;
 254   gnutls_pcert_st *cert;
 255   int i;
 256
 257   if (session->internals.selected_cert_list_length == 0)
 258     {
 259       *alg_size = 0;
 260       return 0;
 261     }
 262
 263   cert = &session->internals.selected_cert_list[0];
 264   cert_pk = gnutls_pubkey_get_pk_algorithm(cert->pubkey, NULL);
 265   i = 0;
 266
 267   for (kx = 0; kx < MAX_ALGOS; kx++)
 268     {
 269       pk = _gnutls_map_pk_get_pk (kx);
 270       if (pk == cert_pk)
 271         {
 272           /* then check key usage */
 273           if (_gnutls_check_key_usage (cert, kx) == 0)
 274             {
 275               alg[i] = kx;
 276               i++;
 277
 278               if (i > *alg_size)
 279                 return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
 280             }
 281         }
 282     }
 283
 284   if (i == 0)
 285     {
 286       gnutls_assert ();
 287       return GNUTLS_E_INVALID_REQUEST;
 288     }
 289
 290   *alg_size = i;
 291
 292   return 0;
 293 }
 294
 295
 296 /**
 297  * gnutls_certificate_server_set_request:
 298  * @session: is a #gnutls_session_t structure.
 299  * @req: is one of GNUTLS_CERT_REQUEST, GNUTLS_CERT_REQUIRE
 300  *
 301  * This function specifies if we (in case of a server) are going to
 302  * send a certificate request message to the client. If @req is
 303  * GNUTLS_CERT_REQUIRE then the server will return an error if the
 304  * peer does not provide a certificate. If you do not call this
 305  * function then the client will not be asked to send a certificate.
 306  **/
 307 void
 308 gnutls_certificate_server_set_request (gnutls_session_t session,
 309                                        gnutls_certificate_request_t req)
 310 {
 311   session->internals.send_cert_req = req;
 312 }
 313
 314 /**
 315  * gnutls_certificate_client_set_retrieve_function:
 316  * @cred: is a #gnutls_certificate_credentials_t structure.
 317  * @func: is the callback function
 318  *
 319  * This function sets a callback to be called in order to retrieve the
 320  * certificate to be used in the handshake.
 321  * You are advised to use gnutls_certificate_set_retrieve_function2() because it
 322  * is much more efficient in the processing it requires from gnutls.
 323  *
 324  * The callback's function prototype is:
 325  * int (*callback)(gnutls_session_t, const gnutls_datum_t* req_ca_dn, int nreqs,
 326  * const gnutls_pk_algorithm_t* pk_algos, int pk_algos_length, gnutls_retr_st* st);
 327  *
 328  * @req_ca_cert is only used in X.509 certificates.
 329  * Contains a list with the CA names that the server considers trusted.
 330  * Normally we should send a certificate that is signed
 331  * by one of these CAs. These names are DER encoded. To get a more
 332  * meaningful value use the function gnutls_x509_rdn_get().
 333  *
 334  * @pk_algos contains a list with server's acceptable signature algorithms.
 335  * The certificate returned should support the server's given algorithms.
 336  *
 337  * @st should contain the certificates and private keys.
 338  *
 339  * If the callback function is provided then gnutls will call it, in the
 340  * handshake, if a certificate is requested by the server (and after the
 341  * certificate request message has been received).
 342  *
 343  * The callback function should set the certificate list to be sent,
 344  * and return 0 on success. If no certificate was selected then the
 345  * number of certificates should be set to zero. The value (-1)
 346  * indicates error and the handshake will be terminated.
 347  **/
 348 void gnutls_certificate_client_set_retrieve_function
 349   (gnutls_certificate_credentials_t cred,
 350    gnutls_certificate_client_retrieve_function * func)
 351 {
 352   cred->client_get_cert_callback = func;
 353 }
 354
 355 /**
 356  * gnutls_certificate_server_set_retrieve_function:
 357  * @cred: is a #gnutls_certificate_credentials_t structure.
 358  * @func: is the callback function
 359  *
 360  * This function sets a callback to be called in order to retrieve the
 361  * certificate to be used in the handshake.
 362  * You are advised to use gnutls_certificate_set_retrieve_function2() because it
 363  * is much more efficient in the processing it requires from gnutls.
 364  *
 365  * The callback's function prototype is:
 366  * int (*callback)(gnutls_session_t, gnutls_retr_st* st);
 367  *
 368  * @st should contain the certificates and private keys.
 369  *
 370  * If the callback function is provided then gnutls will call it, in the
 371  * handshake, after the certificate request message has been received.
 372  *
 373  * The callback function should set the certificate list to be sent, and
 374  * return 0 on success.  The value (-1) indicates error and the handshake
 375  * will be terminated.
 376  **/
 377 void gnutls_certificate_server_set_retrieve_function
 378   (gnutls_certificate_credentials_t cred,
 379    gnutls_certificate_server_retrieve_function * func)
 380 {
 381   cred->server_get_cert_callback = func;
 382 }
 383
 384 /**
 385  * gnutls_certificate_set_retrieve_function:
 386  * @cred: is a #gnutls_certificate_credentials_t structure.
 387  * @func: is the callback function
 388  *
 389  * This function sets a callback to be called in order to retrieve the
 390  * certificate to be used in the handshake. You are advised
 391  * to use gnutls_certificate_set_retrieve_function2() because it
 392  * is much more efficient in the processing it requires from gnutls.
 393  *
 394  * The callback's function prototype is:
 395  * int (*callback)(gnutls_session_t, const gnutls_datum_t* req_ca_dn, int nreqs,
 396  * const gnutls_pk_algorithm_t* pk_algos, int pk_algos_length, gnutls_retr2_st* st);
 397  *
 398  * @req_ca_cert is only used in X.509 certificates.
 399  * Contains a list with the CA names that the server considers trusted.
 400  * Normally we should send a certificate that is signed
 401  * by one of these CAs. These names are DER encoded. To get a more
 402  * meaningful value use the function gnutls_x509_rdn_get().
 403  *
 404  * @pk_algos contains a list with server's acceptable signature algorithms.
 405  * The certificate returned should support the server's given algorithms.
 406  *
 407  * @st should contain the certificates and private keys.
 408  *
 409  * If the callback function is provided then gnutls will call it, in the
 410  * handshake, after the certificate request message has been received.
 411  *
 412  * In server side pk_algos and req_ca_dn are NULL.
 413  *
 414  * The callback function should set the certificate list to be sent,
 415  * and return 0 on success. If no certificate was selected then the
 416  * number of certificates should be set to zero. The value (-1)
 417  * indicates error and the handshake will be terminated.
 418  *
 419  * Since: 3.0
 420  **/
 421 void gnutls_certificate_set_retrieve_function
 422   (gnutls_certificate_credentials_t cred,
 423    gnutls_certificate_retrieve_function * func)
 424 {
 425   cred->get_cert_callback = func;
 426 }
 427
 428 /**
 429  * gnutls_certificate_set_retrieve_function2:
 430  * @cred: is a #gnutls_certificate_credentials_t structure.
 431  * @func: is the callback function
 432  *
 433  * This function sets a callback to be called in order to retrieve the
 434  * certificate to be used in the handshake.
 435  *
 436  * The callback's function prototype is:
 437  * int (*callback)(gnutls_session_t, const gnutls_datum_t* req_ca_dn, int nreqs,
 438  * const gnutls_pk_algorithm_t* pk_algos, int pk_algos_length, gnutls_pcert_st** pcert,
 439  * unsigned int *pcert_length, gnutls_privkey_t * pkey);
 440  *
 441  * @req_ca_cert is only used in X.509 certificates.
 442  * Contains a list with the CA names that the server considers trusted.
 443  * Normally we should send a certificate that is signed
 444  * by one of these CAs. These names are DER encoded. To get a more
 445  * meaningful value use the function gnutls_x509_rdn_get().
 446  *
 447  * @pk_algos contains a list with server's acceptable signature algorithms.
 448  * The certificate returned should support the server's given algorithms.
 449  *
 450  * @pcert should contain a single certificate and public or a list of them.
 451  *
 452  * @pcert_length is the size of the previous list.
 453  *
 454  * @pkey is the private key.
 455  *
 456  * If the callback function is provided then gnutls will call it, in the
 457  * handshake, after the certificate request message has been received.
 458  *
 459  * In server side pk_algos and req_ca_dn are NULL.
 460  *
 461  * The callback function should set the certificate list to be sent,
 462  * and return 0 on success. If no certificate was selected then the
 463  * number of certificates should be set to zero. The value (-1)
 464  * indicates error and the handshake will be terminated.
 465  *
 466  * Since: 3.0
 467  **/
 468 void gnutls_certificate_set_retrieve_function2
 469   (gnutls_certificate_credentials_t cred,
 470    gnutls_certificate_retrieve_function2 * func)
 471 {
 472   cred->get_cert_callback2 = func;
 473 }
 474
 475 /**
 476  * gnutls_certificate_set_verify_function:
 477  * @cred: is a #gnutls_certificate_credentials_t structure.
 478  * @func: is the callback function
 479  *
 480  * This function sets a callback to be called when peer's certificate
 481  * has been received in order to verify it on receipt rather than
 482  * doing after the handshake is completed.
 483  *
 484  * The callback's function prototype is:
 485  * int (*callback)(gnutls_session_t);
 486  *
 487  * If the callback function is provided then gnutls will call it, in the
 488  * handshake, just after the certificate message has been received.
 489  * To verify or obtain the certificate the gnutls_certificate_verify_peers2(),
 490  * gnutls_certificate_type_get(), gnutls_certificate_get_peers() functions
 491  * can be used.
 492  *
 493  * The callback function should return 0 for the handshake to continue
 494  * or non-zero to terminate.
 495  *
 496  * Since: 2.10.0
 497  **/
 498 void
 499   gnutls_certificate_set_verify_function
 500   (gnutls_certificate_credentials_t cred,
 501    gnutls_certificate_verify_function * func)
 502 {
 503   cred->verify_callback = func;
 504 }
 505
 506 /*-
 507  * _gnutls_x509_extract_certificate_activation_time - return the peer's certificate activation time
 508  * @cert: should contain an X.509 DER encoded certificate
 509  *
 510  * This function will return the certificate's activation time in UNIX time
 511  * (ie seconds since 00:00:00 UTC January 1, 1970).
 512  *
 513  * Returns a (time_t) -1 in case of an error.
 514  *
 515  -*/
 516 static time_t
 517 _gnutls_x509_get_raw_crt_activation_time (const gnutls_datum_t * cert)
 518 {
 519   gnutls_x509_crt_t xcert;
 520   time_t result;
 521
 522   result = gnutls_x509_crt_init (&xcert);
 523   if (result < 0)
 524     return (time_t) - 1;
 525
 526   result = gnutls_x509_crt_import (xcert, cert, GNUTLS_X509_FMT_DER);
 527   if (result < 0)
 528     {
 529       gnutls_x509_crt_deinit (xcert);
 530       return (time_t) - 1;
 531     }
 532
 533   result = gnutls_x509_crt_get_activation_time (xcert);
 534
 535   gnutls_x509_crt_deinit (xcert);
 536
 537   return result;
 538 }
 539
 540 /*-
 541  * gnutls_x509_extract_certificate_expiration_time:
 542  * @cert: should contain an X.509 DER encoded certificate
 543  *
 544  * This function will return the certificate's expiration time in UNIX
 545  * time (ie seconds since 00:00:00 UTC January 1, 1970).  Returns a
 546  *
 547  * (time_t) -1 in case of an error.
 548  *
 549  -*/
 550 static time_t
 551 _gnutls_x509_get_raw_crt_expiration_time (const gnutls_datum_t * cert)
 552 {
 553   gnutls_x509_crt_t xcert;
 554   time_t result;
 555
 556   result = gnutls_x509_crt_init (&xcert);
 557   if (result < 0)
 558     return (time_t) - 1;
 559
 560   result = gnutls_x509_crt_import (xcert, cert, GNUTLS_X509_FMT_DER);
 561   if (result < 0)
 562     {
 563       gnutls_x509_crt_deinit (xcert);
 564       return (time_t) - 1;
 565     }
 566
 567   result = gnutls_x509_crt_get_expiration_time (xcert);
 568
 569   gnutls_x509_crt_deinit (xcert);
 570
 571   return result;
 572 }
 573
 574 #ifdef ENABLE_OPENPGP
 575 /*-
 576  * _gnutls_openpgp_crt_verify_peers - return the peer's certificate status
 577  * @session: is a gnutls session
 578  *
 579  * This function will try to verify the peer's certificate and return its status (TRUSTED, INVALID etc.).
 580  * Returns a negative error code in case of an error, or GNUTLS_E_NO_CERTIFICATE_FOUND if no certificate was sent.
 581  -*/
 582 static int
 583 _gnutls_openpgp_crt_verify_peers (gnutls_session_t session,
 584                                   unsigned int *status)
 585 {
 586   cert_auth_info_t info;
 587   gnutls_certificate_credentials_t cred;
 588   int peer_certificate_list_size, ret;
 589
 590   CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, GNUTLS_E_INVALID_REQUEST);
 591
 592   info = _gnutls_get_auth_info (session);
 593   if (info == NULL)
 594     return GNUTLS_E_INVALID_REQUEST;
 595
 596   cred = (gnutls_certificate_credentials_t)
 597     _gnutls_get_cred (session->key, GNUTLS_CRD_CERTIFICATE, NULL);
 598   if (cred == NULL)
 599     {
 600       gnutls_assert ();
 601       return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
 602     }
 603
 604   if (info->raw_certificate_list == NULL || info->ncerts == 0)
 605     {
 606       gnutls_assert ();
 607       return GNUTLS_E_NO_CERTIFICATE_FOUND;
 608     }
 609
 610   /* generate a list of gnutls_certs based on the auth info
 611    * raw certs.
 612    */
 613   peer_certificate_list_size = info->ncerts;
 614
 615   if (peer_certificate_list_size != 1)
 616     {
 617       gnutls_assert ();
 618       return GNUTLS_E_INTERNAL_ERROR;
 619     }
 620
 621   /* Verify certificate
 622    */
 623   ret =
 624     _gnutls_openpgp_verify_key (cred, &info->raw_certificate_list[0],
 625                                 peer_certificate_list_size, status);
 626
 627   if (ret < 0)
 628     {
 629       gnutls_assert ();
 630       return ret;
 631     }
 632
 633   return 0;
 634 }
 635 #endif
 636
 637 /**
 638  * gnutls_certificate_verify_peers2:
 639  * @session: is a gnutls session
 640  * @status: is the output of the verification
 641  *
 642  * This function will try to verify the peer's certificate and return
 643  * its status (trusted, invalid etc.).  The value of @status should
 644  * be one or more of the gnutls_certificate_status_t enumerated
 645  * elements bitwise or'd. To avoid denial of service attacks some
 646  * default upper limits regarding the certificate key size and chain
 647  * size are set. To override them use gnutls_certificate_set_verify_limits().
 648  *
 649  * This function will utilize the OCSP Certificate Status extension if
 650  * negotiated --to enable see gnutls_ocsp_status_request_enable_client().
 651  *
 652  * Note that you must also check the peer's name in order to check if
 653  * the verified certificate belongs to the actual peer, see gnutls_x509_crt_check_hostname().
 654  *
 655  * Returns: a negative error code on error and %GNUTLS_E_SUCCESS (0) on success.
 656  **/
 657 int
 658 gnutls_certificate_verify_peers2 (gnutls_session_t session,
 659                                   unsigned int *status)
 660 {
 661   cert_auth_info_t info;
 662
 663   CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, GNUTLS_E_INVALID_REQUEST);
 664
 665   info = _gnutls_get_auth_info (session);
 666   if (info == NULL)
 667     {
 668       return GNUTLS_E_NO_CERTIFICATE_FOUND;
 669     }
 670
 671   if (info->raw_certificate_list == NULL || info->ncerts == 0)
 672     return GNUTLS_E_NO_CERTIFICATE_FOUND;
 673
 674   switch (gnutls_certificate_type_get (session))
 675     {
 676     case GNUTLS_CRT_X509:
 677       return _gnutls_x509_cert_verify_peers (session, status);
 678 #ifdef ENABLE_OPENPGP
 679     case GNUTLS_CRT_OPENPGP:
 680       return _gnutls_openpgp_crt_verify_peers (session, status);
 681 #endif
 682     default:
 683       return GNUTLS_E_INVALID_REQUEST;
 684     }
 685 }
 686
 687 /**
 688  * gnutls_certificate_expiration_time_peers:
 689  * @session: is a gnutls session
 690  *
 691  * This function will return the peer's certificate expiration time.
 692  *
 693  * Returns: (time_t)-1 on error.
 694  *
 695  * Deprecated: gnutls_certificate_verify_peers2() now verifies expiration times.
 696  **/
 697 time_t
 698 gnutls_certificate_expiration_time_peers (gnutls_session_t session)
 699 {
 700   cert_auth_info_t info;
 701
 702   CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, GNUTLS_E_INVALID_REQUEST);
 703
 704   info = _gnutls_get_auth_info (session);
 705   if (info == NULL)
 706     {
 707       return (time_t) - 1;
 708     }
 709
 710   if (info->raw_certificate_list == NULL || info->ncerts == 0)
 711     {
 712       gnutls_assert ();
 713       return (time_t) - 1;
 714     }
 715
 716   switch (gnutls_certificate_type_get (session))
 717     {
 718     case GNUTLS_CRT_X509:
 719       return
 720         _gnutls_x509_get_raw_crt_expiration_time (&info->raw_certificate_list
 721                                                   [0]);
 722 #ifdef ENABLE_OPENPGP
 723     case GNUTLS_CRT_OPENPGP:
 724       return
 725         _gnutls_openpgp_get_raw_key_expiration_time
 726         (&info->raw_certificate_list[0]);
 727 #endif
 728     default:
 729       return (time_t) - 1;
 730     }
 731 }
 732
 733 /**
 734  * gnutls_certificate_activation_time_peers:
 735  * @session: is a gnutls session
 736  *
 737  * This function will return the peer's certificate activation time.
 738  * This is the creation time for openpgp keys.
 739  *
 740  * Returns: (time_t)-1 on error.
 741  *
 742  * Deprecated: gnutls_certificate_verify_peers2() now verifies activation times.
 743  **/
 744 time_t
 745 gnutls_certificate_activation_time_peers (gnutls_session_t session)
 746 {
 747   cert_auth_info_t info;
 748
 749   CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, GNUTLS_E_INVALID_REQUEST);
 750
 751   info = _gnutls_get_auth_info (session);
 752   if (info == NULL)
 753     {
 754       return (time_t) - 1;
 755     }
 756
 757   if (info->raw_certificate_list == NULL || info->ncerts == 0)
 758     {
 759       gnutls_assert ();
 760       return (time_t) - 1;
 761     }
 762
 763   switch (gnutls_certificate_type_get (session))
 764     {
 765     case GNUTLS_CRT_X509:
 766       return
 767         _gnutls_x509_get_raw_crt_activation_time (&info->raw_certificate_list
 768                                                   [0]);
 769 #ifdef ENABLE_OPENPGP
 770     case GNUTLS_CRT_OPENPGP:
 771       return
 772         _gnutls_openpgp_get_raw_key_creation_time (&info->raw_certificate_list
 773                                                    [0]);
 774 #endif
 775     default:
 776       return (time_t) - 1;
 777     }
 778 }
 779
 780 /**
 781  * gnutls_sign_callback_set:
 782  * @session: is a gnutls session
 783  * @sign_func: function pointer to application's sign callback.
 784  * @userdata: void pointer that will be passed to sign callback.
 785  *
 786  * Set the callback function.  The function must have this prototype:
 787  *
 788  * typedef int (*gnutls_sign_func) (gnutls_session_t session,
 789  *                                  void *userdata,
 790  *                                  gnutls_certificate_type_t cert_type,
 791  *                                  const gnutls_datum_t * cert,
 792  *                                  const gnutls_datum_t * hash,
 793  *                                  gnutls_datum_t * signature);
 794  *
 795  * The @userdata parameter is passed to the @sign_func verbatim, and
 796  * can be used to store application-specific data needed in the
 797  * callback function.  See also gnutls_sign_callback_get().
 798  *
 799  * Deprecated: Use the PKCS 11 or #gnutls_privkey_t interfacess like gnutls_privkey_import_ext() instead.
 800  **/
 801 void
 802 gnutls_sign_callback_set (gnutls_session_t session,
 803                           gnutls_sign_func sign_func, void *userdata)
 804 {
 805   session->internals.sign_func = sign_func;
 806   session->internals.sign_func_userdata = userdata;
 807 }
 808
 809 /**
 810  * gnutls_sign_callback_get:
 811  * @session: is a gnutls session
 812  * @userdata: if non-%NULL, will be set to abstract callback pointer.
 813  *
 814  * Retrieve the callback function, and its userdata pointer.
 815  *
 816  * Returns: The function pointer set by gnutls_sign_callback_set(), or
 817  *   if not set, %NULL.
 818  *
 819  * Deprecated: Use the PKCS 11 interfaces instead.
 820  **/
 821 gnutls_sign_func
 822 gnutls_sign_callback_get (gnutls_session_t session, void **userdata)
 823 {
 824   if (userdata)
 825     *userdata = session->internals.sign_func_userdata;
 826   return session->internals.sign_func;
 827 }
 828
 829 /* returns error if the certificate has different algorithm than
 830  * the given key parameters.
 831  */
 832 int
 833 _gnutls_check_key_cert_match (gnutls_certificate_credentials_t res)
 834 {
 835   int pk = gnutls_pubkey_get_pk_algorithm(res->certs[res->ncerts-1].cert_list[0].pubkey, NULL);
 836   int pk2 = gnutls_privkey_get_pk_algorithm (res->pkey[res->ncerts - 1], NULL);
 837
 838   if (pk2 != pk)
 839     {
 840       gnutls_assert ();
 841       return GNUTLS_E_CERTIFICATE_KEY_MISMATCH;
 842     }
 843
 844   return 0;
 845 }