lib/gnutls_pcert.c

   1 /*
   2  * Copyright (C) 2011-2012 Free Software Foundation, Inc.
   3  *
   4  * Author: Nikos Mavrogiannopoulos
   5  *
   6  * This file is part of GnuTLS.
   7  *
   8  * The GnuTLS is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * as published by the Free Software Foundation; either version 3 of
  11  * the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public License
  19  * along with this program.  If not, see <http://www.gnu.org/licenses/>
  20  *
  21  */
  22
  23 #include <gnutls_int.h>
  24 #include <gnutls_errors.h>
  25 #include <auth/cert.h>
  26 #include <gnutls_x509.h>
  27 #include "x509/x509_int.h"
  28 #ifdef ENABLE_OPENPGP
  29 #include "openpgp/gnutls_openpgp.h"
  30 #endif
  31
  32 /**
  33  * gnutls_pcert_import_x509:
  34  * @pcert: The pcert structure
  35  * @crt: The raw certificate to be imported
  36  * @flags: zero for now
  37  *
  38  * This convenience function will import the given certificate to a
  39  * #gnutls_pcert_st structure. The structure must be deinitialized
  40  * afterwards using gnutls_pcert_deinit();
  41  *
  42  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
  43  *   negative error value.
  44  *
  45  * Since: 3.0
  46  **/
  47 int gnutls_pcert_import_x509 (gnutls_pcert_st* pcert,
  48         gnutls_x509_crt_t crt, unsigned int flags)
  49 {
  50 int ret;
  51 size_t sz;
  52
  53   memset(pcert, 0, sizeof(*pcert));
  54
  55   pcert->type = GNUTLS_CRT_X509;
  56   pcert->cert.data = NULL;
  57
  58   sz = 0;
  59   ret = gnutls_x509_crt_export(crt, GNUTLS_X509_FMT_DER, NULL, &sz);
  60   if (ret < 0 && ret != GNUTLS_E_SHORT_MEMORY_BUFFER)
  61     {
  62       ret = gnutls_assert_val(ret);
  63       goto cleanup;
  64     }
  65
  66   pcert->cert.data = gnutls_malloc(sz);
  67   if (pcert->cert.data == NULL)
  68     {
  69       ret = gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
  70       goto cleanup;
  71     }
  72
  73   ret = gnutls_x509_crt_export(crt, GNUTLS_X509_FMT_DER, pcert->cert.data, &sz);
  74   if (ret < 0)
  75     {
  76       ret = gnutls_assert_val(ret);
  77       goto cleanup;
  78     }
  79   pcert->cert.size = sz;
  80
  81   ret = gnutls_pubkey_init(&pcert->pubkey);
  82   if (ret < 0)
  83     {
  84       ret = gnutls_assert_val(ret);
  85       goto cleanup;
  86     }
  87
  88   ret = gnutls_pubkey_import_x509(pcert->pubkey, crt, 0);
  89   if (ret < 0)
  90     {
  91       gnutls_pubkey_deinit(pcert->pubkey);
  92       pcert->pubkey = NULL;
  93       ret = gnutls_assert_val(ret);
  94       goto cleanup;
  95     }
  96
  97   return 0;
  98
  99 cleanup:
 100   _gnutls_free_datum(&pcert->cert);
 101
 102   return ret;
 103 }
 104
 105 /**
 106  * gnutls_pcert_list_import_x509_raw:
 107  * @pcerts: The structures to store the parsed certificate. Must not be initialized.
 108  * @pcert_max: Initially must hold the maximum number of certs. It will be updated with the number of certs available.
 109  * @data: The certificates.
 110  * @format: One of DER or PEM.
 111  * @flags: must be (0) or an OR'd sequence of gnutls_certificate_import_flags.
 112  *
 113  * This function will convert the given PEM encoded certificate list
 114  * to the native gnutls_x509_crt_t format. The output will be stored
 115  * in @certs.  They will be automatically initialized.
 116  *
 117  * If the Certificate is PEM encoded it should have a header of "X509
 118  * CERTIFICATE", or "CERTIFICATE".
 119  *
 120  * Returns: the number of certificates read or a negative error value.
 121  *
 122  * Since: 3.0
 123  **/
 124 int
 125 gnutls_pcert_list_import_x509_raw (gnutls_pcert_st * pcerts,
 126                              unsigned int *pcert_max,
 127                              const gnutls_datum_t * data,
 128                              gnutls_x509_crt_fmt_t format, unsigned int flags)
 129 {
 130 int ret;
 131 unsigned int i = 0, j;
 132 gnutls_x509_crt_t *crt;
 133
 134   crt = gnutls_malloc((*pcert_max) * sizeof(gnutls_x509_crt_t));
 135
 136   if (crt == NULL)
 137     return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
 138
 139   ret = gnutls_x509_crt_list_import( crt, pcert_max, data, format, flags);
 140   if (ret < 0)
 141     {
 142       ret = gnutls_assert_val(ret);
 143       goto cleanup;
 144     }
 145
 146   for (i=0;i<*pcert_max;i++)
 147     {
 148       ret = gnutls_pcert_import_x509(&pcerts[i], crt[i], flags);
 149       if (ret < 0)
 150         {
 151           ret = gnutls_assert_val(ret);
 152           goto cleanup_pcert;
 153         }
 154     }
 155
 156   ret = 0;
 157   goto cleanup;
 158
 159 cleanup_pcert:
 160   for (j=0;j<i;j++)
 161     gnutls_pcert_deinit(&pcerts[j]);
 162
 163 cleanup:
 164   for (i=0;i<*pcert_max;i++)
 165     gnutls_x509_crt_deinit(crt[i]);
 166
 167   gnutls_free(crt);
 168   return ret;
 169
 170 }
 171
 172 /**
 173  * gnutls_pcert_import_x509_raw:
 174  * @pcert: The pcert structure
 175  * @cert: The raw certificate to be imported
 176  * @format: The format of the certificate
 177  * @flags: zero for now
 178  *
 179  * This convenience function will import the given certificate to a
 180  * #gnutls_pcert_st structure. The structure must be deinitialized
 181  * afterwards using gnutls_pcert_deinit();
 182  *
 183  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 184  *   negative error value.
 185  *
 186  * Since: 3.0
 187  **/
 188 int gnutls_pcert_import_x509_raw (gnutls_pcert_st *pcert,
 189         const gnutls_datum_t* cert,
 190         gnutls_x509_crt_fmt_t format, unsigned int flags)
 191 {
 192 int ret;
 193 gnutls_x509_crt_t crt;
 194
 195   memset(pcert, 0, sizeof(*pcert));
 196
 197   ret = gnutls_x509_crt_init(&crt);
 198   if (ret < 0)
 199     return gnutls_assert_val(ret);
 200
 201   ret = gnutls_x509_crt_import(crt, cert, format);
 202   if (ret < 0)
 203     {
 204       ret = gnutls_assert_val(ret);
 205       goto cleanup;
 206     }
 207
 208   ret = gnutls_pcert_import_x509(pcert, crt, flags);
 209   if (ret < 0)
 210     {
 211       ret = gnutls_assert_val(ret);
 212       goto cleanup;
 213     }
 214
 215   ret = 0;
 216
 217 cleanup:
 218   gnutls_x509_crt_deinit(crt);
 219
 220   return ret;
 221 }
 222
 223 #ifdef ENABLE_OPENPGP
 224
 225 /**
 226  * gnutls_pcert_import_openpgp:
 227  * @pcert: The pcert structure
 228  * @crt: The raw certificate to be imported
 229  * @flags: zero for now
 230  *
 231  * This convenience function will import the given certificate to a
 232  * #gnutls_pcert_st structure. The structure must be deinitialized
 233  * afterwards using gnutls_pcert_deinit();
 234  *
 235  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 236  *   negative error value.
 237  *
 238  * Since: 3.0
 239  **/
 240 int gnutls_pcert_import_openpgp (gnutls_pcert_st* pcert,
 241         gnutls_openpgp_crt_t crt, unsigned int flags)
 242 {
 243 int ret;
 244 size_t sz;
 245
 246   memset(pcert, 0, sizeof(*pcert));
 247
 248   pcert->type = GNUTLS_CRT_OPENPGP;
 249   pcert->cert.data = NULL;
 250
 251   sz = 0;
 252   ret = gnutls_openpgp_crt_export(crt, GNUTLS_OPENPGP_FMT_RAW, NULL, &sz);
 253   if (ret < 0 && ret != GNUTLS_E_SHORT_MEMORY_BUFFER)
 254     {
 255       ret = gnutls_assert_val(ret);
 256       goto cleanup;
 257     }
 258
 259   pcert->cert.data = gnutls_malloc(sz);
 260   if (pcert->cert.data == NULL)
 261     {
 262       ret = gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
 263       goto cleanup;
 264     }
 265
 266   ret = gnutls_openpgp_crt_export(crt, GNUTLS_X509_FMT_DER, pcert->cert.data, &sz);
 267   if (ret < 0)
 268     {
 269       ret = gnutls_assert_val(ret);
 270       goto cleanup;
 271     }
 272   pcert->cert.size = sz;
 273
 274   ret = gnutls_pubkey_init(&pcert->pubkey);
 275   if (ret < 0)
 276     {
 277       ret = gnutls_assert_val(ret);
 278       goto cleanup;
 279     }
 280
 281   ret = gnutls_pubkey_import_openpgp(pcert->pubkey, crt, 0);
 282   if (ret < 0)
 283     {
 284       gnutls_pubkey_deinit(pcert->pubkey);
 285       pcert->pubkey = NULL;
 286       ret = gnutls_assert_val(ret);
 287       goto cleanup;
 288     }
 289
 290   return 0;
 291
 292 cleanup:
 293   _gnutls_free_datum(&pcert->cert);
 294
 295   return ret;
 296 }
 297
 298 /**
 299  * gnutls_pcert_import_openpgp_raw:
 300  * @pcert: The pcert structure
 301  * @cert: The raw certificate to be imported
 302  * @format: The format of the certificate
 303  * @keyid: The key ID to use (NULL for the master key)
 304  * @flags: zero for now
 305  *
 306  * This convenience function will import the given certificate to a
 307  * #gnutls_pcert_st structure. The structure must be deinitialized
 308  * afterwards using gnutls_pcert_deinit();
 309  *
 310  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 311  *   negative error value.
 312  *
 313  * Since: 3.0
 314  **/
 315 int gnutls_pcert_import_openpgp_raw (gnutls_pcert_st *pcert,
 316         const gnutls_datum_t* cert,
 317         gnutls_openpgp_crt_fmt_t format,
 318         gnutls_openpgp_keyid_t keyid,
 319         unsigned int flags)
 320 {
 321 int ret;
 322 gnutls_openpgp_crt_t crt;
 323
 324   memset(pcert, 0, sizeof(*pcert));
 325
 326   pcert->cert.data = NULL;
 327
 328   ret = gnutls_openpgp_crt_init(&crt);
 329   if (ret < 0)
 330     return gnutls_assert_val(ret);
 331
 332   ret = gnutls_openpgp_crt_import(crt, cert, format);
 333   if (ret < 0)
 334     {
 335       ret = gnutls_assert_val(ret);
 336       goto cleanup;
 337     }
 338
 339   if (keyid != NULL)
 340     {
 341       ret = gnutls_openpgp_crt_set_preferred_key_id(crt, keyid);
 342       if (ret < 0)
 343         {
 344           ret = gnutls_assert_val(ret);
 345           goto cleanup;
 346         }
 347     }
 348
 349   ret = gnutls_pcert_import_openpgp(pcert, crt, flags);
 350   if (ret < 0)
 351     {
 352       ret = gnutls_assert_val(ret);
 353       goto cleanup;
 354     }
 355   ret = 0;
 356
 357 cleanup:
 358   gnutls_openpgp_crt_deinit(crt);
 359
 360   return ret;
 361 }
 362
 363 #endif
 364
 365 /**
 366  * gnutls_pcert_deinit:
 367  * @pcert: The structure to be deinitialized
 368  *
 369  * This function will deinitialize a pcert structure.
 370  *
 371  * Since: 3.0
 372  **/
 373 void
 374 gnutls_pcert_deinit (gnutls_pcert_st *pcert)
 375 {
 376   gnutls_pubkey_deinit(pcert->pubkey);
 377   pcert->pubkey = NULL;
 378   _gnutls_free_datum(&pcert->cert);
 379 }
 380
 381 /* Converts the first certificate for the cert_auth_info structure
 382  * to a pcert.
 383  */
 384 int
 385 _gnutls_get_auth_info_pcert (gnutls_pcert_st* pcert,
 386                              gnutls_certificate_type_t type,
 387                              cert_auth_info_t info)
 388 {
 389   switch (type)
 390     {
 391     case GNUTLS_CRT_X509:
 392       return gnutls_pcert_import_x509_raw(pcert, &info->raw_certificate_list[0],
 393         GNUTLS_X509_FMT_DER, GNUTLS_PCERT_NO_CERT);
 394 #ifdef ENABLE_OPENPGP
 395     case GNUTLS_CRT_OPENPGP:
 396       return gnutls_pcert_import_openpgp_raw(pcert,
 397                                                &info->raw_certificate_list[0],
 398                                                GNUTLS_OPENPGP_FMT_RAW,
 399                                                info->use_subkey ? info->
 400                                                subkey_id : NULL, GNUTLS_PCERT_NO_CERT);
 401 #endif
 402     default:
 403       gnutls_assert ();
 404       return GNUTLS_E_INTERNAL_ERROR;
 405     }
 406 }