lib/auth_cert.h

   1 /*
   2  * Copyright (C) 2002, 2003, 2004, 2005, 2007, 2008, 2010 Free Software
   3  * Foundation, Inc.
   4  *
   5  * Author: Nikos Mavrogiannopoulos
   6  *
   7  * This file is part of GNUTLS.
   8  *
   9  * The GNUTLS library is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU Lesser General Public License
  11  * as published by the Free Software Foundation; either version 2.1 of
  12  * the License, or (at your option) any later version.
  13  *
  14  * This library is distributed in the hope that it will be useful, but
  15  * WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * Lesser General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU Lesser General Public
  20  * License along with this library; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
  22  * USA
  23  *
  24  */
  25
  26 #ifndef AUTH_CERT_H
  27 # define AUTH_CERT_H
  28 # include "gnutls_cert.h"
  29 # include "gnutls_auth.h"
  30 # include "auth_dh_common.h"
  31 # include "x509/x509_int.h"
  32 # include "openpgp/openpgp_int.h"
  33
  34 /* This structure may be complex, but it's the only way to
  35  * support a server that has multiple certificates
  36  */
  37 typedef struct gnutls_certificate_credentials_st
  38 {
  39   gnutls_dh_params_t dh_params;
  40   gnutls_rsa_params_t rsa_params;
  41   /* this callback is used to retrieve the DH or RSA
  42    * parameters.
  43    */
  44   gnutls_params_function *params_func;
  45
  46   gnutls_cert **cert_list;
  47   /* contains a list of a list of certificates.
  48    * eg (X509): [0] certificate1, certificate11, certificate111
  49    * (if more than one, one certificate certifies the one before)
  50    *       [1] certificate2, certificate22, ...
  51    */
  52   unsigned *cert_list_length;
  53   /* contains the number of the certificates in a
  54    * row (should be 1 for OpenPGP keys).
  55    */
  56   unsigned ncerts;              /* contains the number of columns in cert_list.
  57                                  * This is the same with the number of pkeys.
  58                                  */
  59
  60   gnutls_privkey *pkey;
  61   /* private keys. It contains ncerts private
  62    * keys. pkey[i] corresponds to certificate in
  63    * cert_list[i][0].
  64    */
  65
  66 #ifdef ENABLE_OPENPGP
  67   /* OpenPGP specific stuff */
  68   gnutls_openpgp_keyring_t keyring;
  69 #endif
  70
  71   /* X509 specific stuff */
  72
  73   gnutls_x509_crt_t *x509_ca_list;
  74   unsigned x509_ncas;           /* number of CAs in the ca_list
  75                                  */
  76
  77   gnutls_x509_crl_t *x509_crl_list;
  78   unsigned x509_ncrls;          /* number of CRLs in the crl_list
  79                                  */
  80
  81   unsigned int verify_flags;    /* flags to be used at
  82                                  * certificate verification.
  83                                  */
  84   unsigned int verify_depth;
  85   unsigned int verify_bits;
  86
  87   /* holds a sequence of the
  88    * RDNs of the CAs above.
  89    * This is better than
  90    * generating on every handshake.
  91    */
  92   gnutls_datum_t x509_rdn_sequence;
  93
  94   gnutls_certificate_client_retrieve_function *client_get_cert_callback;
  95   gnutls_certificate_server_retrieve_function *server_get_cert_callback;
  96 } certificate_credentials_st;
  97
  98 typedef struct rsa_info_st
  99 {
 100   gnutls_datum_t modulus;
 101   gnutls_datum_t exponent;
 102 } rsa_info_st;
 103
 104 /* This is the information we keep for the peer
 105  * certificate.
 106  */
 107 typedef struct cert_auth_info_st
 108 {
 109   /* These (dh/rsa) are just copies from the credentials_t structure.
 110    * They must be freed.
 111    */
 112   dh_info_st dh;
 113   rsa_info_st rsa_export;
 114
 115   gnutls_datum_t *raw_certificate_list; /* holds the raw certificate of the
 116                                          * peer.
 117                                          */
 118   unsigned int ncerts;          /* holds the size of the list above */
 119
 120   gnutls_certificate_type_t cert_type;
 121   gnutls_sign_algorithm_t sign_algo;
 122 #ifdef ENABLE_OPENPGP
 123   int use_subkey;
 124   gnutls_openpgp_keyid_t subkey_id;
 125 #endif
 126 } *cert_auth_info_t;
 127
 128 typedef struct cert_auth_info_st cert_auth_info_st;
 129
 130 void _gnutls_free_rsa_info (rsa_info_st * rsa);
 131
 132 /* AUTH X509 functions */
 133 int _gnutls_gen_cert_server_certificate (gnutls_session_t, opaque **);
 134 int _gnutls_gen_cert_client_certificate (gnutls_session_t, opaque **);
 135 int _gnutls_gen_cert_client_cert_vrfy (gnutls_session_t, opaque **);
 136 int _gnutls_gen_cert_server_cert_req (gnutls_session_t, opaque **);
 137 int _gnutls_proc_cert_cert_req (gnutls_session_t, opaque *, size_t);
 138 int _gnutls_proc_cert_client_cert_vrfy (gnutls_session_t, opaque *, size_t);
 139 int _gnutls_proc_cert_server_certificate (gnutls_session_t, opaque *, size_t);
 140 int _gnutls_get_selected_cert (gnutls_session_t session,
 141                                gnutls_cert ** apr_cert_list,
 142                                int *apr_cert_list_length,
 143                                gnutls_privkey ** apr_pkey);
 144
 145 int _gnutls_server_select_cert (struct gnutls_session_int *,
 146                                 gnutls_pk_algorithm_t);
 147 void _gnutls_selected_certs_deinit (gnutls_session_t session);
 148 void _gnutls_selected_certs_set (gnutls_session_t session,
 149                                  gnutls_cert * certs, int ncerts,
 150                                  gnutls_privkey * key, int need_free);
 151
 152 #define _gnutls_proc_cert_client_certificate _gnutls_proc_cert_server_certificate
 153
 154 gnutls_rsa_params_t _gnutls_certificate_get_rsa_params (gnutls_rsa_params_t
 155                                                         rsa_params,
 156                                                         gnutls_params_function
 157                                                         * func,
 158                                                         gnutls_session_t);
 159
 160 int _gnutls_get_auth_info_gcert (gnutls_cert * gcert,
 161                                gnutls_certificate_type_t type,
 162                                cert_auth_info_t info,
 163                                int flags /* OR of ConvFlags */ );
 164
 165 #endif