lib/gnutls_cert.c

   1 /*
   2  * Copyright (C) 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009,
   3  * 2010,2011 Free Software Foundation, Inc.
   4  *
   5  * Author: Nikos Mavrogiannopoulos
   6  *
   7  * This file is part of GnuTLS.
   8  *
   9  * The GnuTLS is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU Lesser General Public License
  11  * as published by the Free Software Foundation; either version 3 of
  12  * the License, or (at your option) any later version.
  13  *
  14  * This library is distributed in the hope that it will be useful, but
  15  * WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * Lesser General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU Lesser General Public License
  20  * along with this program.  If not, see <http://www.gnu.org/licenses/>
  21  *
  22  */
  23
  24 /* Some of the stuff needed for Certificate authentication is contained
  25  * in this file.
  26  */
  27
  28 #include <gnutls_int.h>
  29 #include <gnutls_errors.h>
  30 #include <auth/cert.h>
  31 #include <gnutls_datum.h>
  32 #include <gnutls_mpi.h>
  33 #include <gnutls_global.h>
  34 #include <algorithms.h>
  35 #include <gnutls_dh.h>
  36 #include <gnutls_str.h>
  37 #include <gnutls_state.h>
  38 #include <gnutls_auth.h>
  39 #include <gnutls_x509.h>
  40 #include <gnutls_str_array.h>
  41 #include "x509/x509_int.h"
  42 #ifdef ENABLE_OPENPGP
  43 #include "openpgp/gnutls_openpgp.h"
  44 #endif
  45
  46 /**
  47  * gnutls_certificate_free_keys:
  48  * @sc: is a #gnutls_certificate_credentials_t structure.
  49  *
  50  * This function will delete all the keys and the certificates associated
  51  * with the given credentials. This function must not be called when a
  52  * TLS negotiation that uses the credentials is in progress.
  53  *
  54  **/
  55 void
  56 gnutls_certificate_free_keys (gnutls_certificate_credentials_t sc)
  57 {
  58   unsigned i, j;
  59
  60   for (i = 0; i < sc->ncerts; i++)
  61     {
  62       for (j = 0; j < sc->certs[i].cert_list_length; j++)
  63         {
  64           gnutls_pcert_deinit (&sc->certs[i].cert_list[j]);
  65         }
  66       gnutls_free (sc->certs[i].cert_list);
  67       _gnutls_str_array_clear (&sc->certs[i].names);
  68     }
  69
  70   gnutls_free (sc->certs);
  71   sc->certs = NULL;
  72
  73   for (i = 0; i < sc->ncerts; i++)
  74     {
  75       gnutls_privkey_deinit (sc->pkey[i]);
  76     }
  77
  78   gnutls_free (sc->pkey);
  79   sc->pkey = NULL;
  80
  81   sc->ncerts = 0;
  82 }
  83
  84 /**
  85  * gnutls_certificate_free_cas:
  86  * @sc: is a #gnutls_certificate_credentials_t structure.
  87  *
  88  * This function will delete all the CAs associated with the given
  89  * credentials. Servers that do not use
  90  * gnutls_certificate_verify_peers2() may call this to save some
  91  * memory.
  92  **/
  93 void
  94 gnutls_certificate_free_cas (gnutls_certificate_credentials_t sc)
  95 {
  96   /* FIXME: do nothing for now */
  97   return;
  98 }
  99
 100 /**
 101  * gnutls_certificate_get_issuer:
 102  * @sc: is a #gnutls_certificate_credentials_t structure.
 103  * @cert: is the certificate to find issuer for
 104  * @issuer: Will hold the issuer if any. Should be treated as constant.
 105  * @flags: Use zero.
 106  *
 107  * This function will return the issuer of a given certificate.
 108  *
 109  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a
 110  *   negative error value.
 111  *
 112  * Since: 3.0.0
 113  **/
 114 int
 115 gnutls_certificate_get_issuer (gnutls_certificate_credentials_t sc,
 116   gnutls_x509_crt_t cert, gnutls_x509_crt_t* issuer, unsigned int flags)
 117 {
 118   return gnutls_x509_trust_list_get_issuer(sc->tlist, cert, issuer, flags);
 119 }
 120
 121 /**
 122  * gnutls_certificate_free_ca_names:
 123  * @sc: is a #gnutls_certificate_credentials_t structure.
 124  *
 125  * This function will delete all the CA name in the given
 126  * credentials. Clients may call this to save some memory since in
 127  * client side the CA names are not used. Servers might want to use
 128  * this function if a large list of trusted CAs is present and
 129  * sending the names of it would just consume bandwidth without providing
 130  * information to client.
 131  *
 132  * CA names are used by servers to advertize the CAs they support to
 133  * clients.
 134  **/
 135 void
 136 gnutls_certificate_free_ca_names (gnutls_certificate_credentials_t sc)
 137 {
 138   _gnutls_free_datum (&sc->x509_rdn_sequence);
 139 }
 140
 141 /*-
 142  * _gnutls_certificate_get_rsa_params - Returns the RSA parameters pointer
 143  * @rsa_params: holds the RSA parameters or NULL.
 144  * @func: function to retrieve the parameters or NULL.
 145  * @session: The session.
 146  *
 147  * This function will return the rsa parameters pointer.
 148  -*/
 149 gnutls_rsa_params_t
 150 _gnutls_certificate_get_rsa_params (gnutls_rsa_params_t rsa_params,
 151                                     gnutls_params_function * func,
 152                                     gnutls_session_t session)
 153 {
 154   gnutls_params_st params;
 155   int ret;
 156
 157   if (session->internals.params.rsa_params)
 158     {
 159       return session->internals.params.rsa_params;
 160     }
 161
 162   if (rsa_params)
 163     {
 164       session->internals.params.rsa_params = rsa_params;
 165     }
 166   else if (func)
 167     {
 168       ret = func (session, GNUTLS_PARAMS_RSA_EXPORT, &params);
 169       if (ret == 0 && params.type == GNUTLS_PARAMS_RSA_EXPORT)
 170         {
 171           session->internals.params.rsa_params = params.params.rsa_export;
 172           session->internals.params.free_rsa_params = params.deinit;
 173         }
 174     }
 175
 176   return session->internals.params.rsa_params;
 177 }
 178
 179
 180 /**
 181  * gnutls_certificate_free_credentials:
 182  * @sc: is a #gnutls_certificate_credentials_t structure.
 183  *
 184  * This structure is complex enough to manipulate directly thus this
 185  * helper function is provided in order to free (deallocate) it.
 186  *
 187  * This function does not free any temporary parameters associated
 188  * with this structure (ie RSA and DH parameters are not freed by this
 189  * function).
 190  **/
 191 void
 192 gnutls_certificate_free_credentials (gnutls_certificate_credentials_t sc)
 193 {
 194   gnutls_x509_trust_list_deinit(sc->tlist, 1);
 195   gnutls_certificate_free_keys (sc);
 196   gnutls_certificate_free_ca_names (sc);
 197
 198 #ifdef ENABLE_OPENPGP
 199   gnutls_openpgp_keyring_deinit (sc->keyring);
 200 #endif
 201
 202   gnutls_free (sc);
 203 }
 204
 205
 206 /**
 207  * gnutls_certificate_allocate_credentials:
 208  * @res: is a pointer to a #gnutls_certificate_credentials_t structure.
 209  *
 210  * This structure is complex enough to manipulate directly thus this
 211  * helper function is provided in order to allocate it.
 212  *
 213  * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
 214  **/
 215 int
 216 gnutls_certificate_allocate_credentials (gnutls_certificate_credentials_t *
 217                                          res)
 218 {
 219 int ret;
 220
 221   *res = gnutls_calloc (1, sizeof (certificate_credentials_st));
 222
 223   if (*res == NULL)
 224     return GNUTLS_E_MEMORY_ERROR;
 225
 226   ret = gnutls_x509_trust_list_init( &(*res)->tlist, 0);
 227   if (ret < 0)
 228     {
 229       gnutls_assert();
 230       gnutls_free(*res);
 231       return GNUTLS_E_MEMORY_ERROR;
 232     }
 233   (*res)->verify_bits = DEFAULT_VERIFY_BITS;
 234   (*res)->verify_depth = DEFAULT_VERIFY_DEPTH;
 235
 236   return 0;
 237 }
 238
 239
 240 /* returns the KX algorithms that are supported by a
 241  * certificate. (Eg a certificate with RSA params, supports
 242  * GNUTLS_KX_RSA algorithm).
 243  * This function also uses the KeyUsage field of the certificate
 244  * extensions in order to disable unneded algorithms.
 245  */
 246 int
 247 _gnutls_selected_cert_supported_kx (gnutls_session_t session,
 248                                     gnutls_kx_algorithm_t * alg,
 249                                     int *alg_size)
 250 {
 251   gnutls_kx_algorithm_t kx;
 252   gnutls_pk_algorithm_t pk, cert_pk;
 253   gnutls_pcert_st *cert;
 254   int i;
 255
 256   if (session->internals.selected_cert_list_length == 0)
 257     {
 258       *alg_size = 0;
 259       return 0;
 260     }
 261
 262   cert = &session->internals.selected_cert_list[0];
 263   cert_pk = gnutls_pubkey_get_pk_algorithm(cert->pubkey, NULL);
 264   i = 0;
 265
 266   for (kx = 0; kx < MAX_ALGOS; kx++)
 267     {
 268       pk = _gnutls_map_pk_get_pk (kx);
 269       if (pk == cert_pk)
 270         {
 271           /* then check key usage */
 272           if (_gnutls_check_key_usage (cert, kx) == 0)
 273             {
 274               alg[i] = kx;
 275               i++;
 276
 277               if (i > *alg_size)
 278                 return gnutls_assert_val(GNUTLS_E_INTERNAL_ERROR);
 279             }
 280         }
 281     }
 282
 283   if (i == 0)
 284     {
 285       gnutls_assert ();
 286       return GNUTLS_E_INVALID_REQUEST;
 287     }
 288
 289   *alg_size = i;
 290
 291   return 0;
 292 }
 293
 294
 295 /**
 296  * gnutls_certificate_server_set_request:
 297  * @session: is a #gnutls_session_t structure.
 298  * @req: is one of GNUTLS_CERT_REQUEST, GNUTLS_CERT_REQUIRE
 299  *
 300  * This function specifies if we (in case of a server) are going to
 301  * send a certificate request message to the client. If @req is
 302  * GNUTLS_CERT_REQUIRE then the server will return an error if the
 303  * peer does not provide a certificate. If you do not call this
 304  * function then the client will not be asked to send a certificate.
 305  **/
 306 void
 307 gnutls_certificate_server_set_request (gnutls_session_t session,
 308                                        gnutls_certificate_request_t req)
 309 {
 310   session->internals.send_cert_req = req;
 311 }
 312
 313 /**
 314  * gnutls_certificate_client_set_retrieve_function:
 315  * @cred: is a #gnutls_certificate_credentials_t structure.
 316  * @func: is the callback function
 317  *
 318  * This function sets a callback to be called in order to retrieve the
 319  * certificate to be used in the handshake.
 320  * You are advised to use gnutls_certificate_set_retrieve_function2() because it
 321  * is much more efficient in the processing it requires from gnutls.
 322  *
 323  * The callback's function prototype is:
 324  * int (*callback)(gnutls_session_t, const gnutls_datum_t* req_ca_dn, int nreqs,
 325  * const gnutls_pk_algorithm_t* pk_algos, int pk_algos_length, gnutls_retr_st* st);
 326  *
 327  * @req_ca_cert is only used in X.509 certificates.
 328  * Contains a list with the CA names that the server considers trusted.
 329  * Normally we should send a certificate that is signed
 330  * by one of these CAs. These names are DER encoded. To get a more
 331  * meaningful value use the function gnutls_x509_rdn_get().
 332  *
 333  * @pk_algos contains a list with server's acceptable signature algorithms.
 334  * The certificate returned should support the server's given algorithms.
 335  *
 336  * @st should contain the certificates and private keys.
 337  *
 338  * If the callback function is provided then gnutls will call it, in the
 339  * handshake, after the certificate request message has been received.
 340  *
 341  * The callback function should set the certificate list to be sent,
 342  * and return 0 on success. If no certificate was selected then the
 343  * number of certificates should be set to zero. The value (-1)
 344  * indicates error and the handshake will be terminated.
 345  **/
 346 void gnutls_certificate_client_set_retrieve_function
 347   (gnutls_certificate_credentials_t cred,
 348    gnutls_certificate_client_retrieve_function * func)
 349 {
 350   cred->client_get_cert_callback = func;
 351 }
 352
 353 /**
 354  * gnutls_certificate_server_set_retrieve_function:
 355  * @cred: is a #gnutls_certificate_credentials_t structure.
 356  * @func: is the callback function
 357  *
 358  * This function sets a callback to be called in order to retrieve the
 359  * certificate to be used in the handshake.
 360  * You are advised to use gnutls_certificate_set_retrieve_function2() because it
 361  * is much more efficient in the processing it requires from gnutls.
 362  *
 363  * The callback's function prototype is:
 364  * int (*callback)(gnutls_session_t, gnutls_retr_st* st);
 365  *
 366  * @st should contain the certificates and private keys.
 367  *
 368  * If the callback function is provided then gnutls will call it, in the
 369  * handshake, after the certificate request message has been received.
 370  *
 371  * The callback function should set the certificate list to be sent, and
 372  * return 0 on success.  The value (-1) indicates error and the handshake
 373  * will be terminated.
 374  **/
 375 void gnutls_certificate_server_set_retrieve_function
 376   (gnutls_certificate_credentials_t cred,
 377    gnutls_certificate_server_retrieve_function * func)
 378 {
 379   cred->server_get_cert_callback = func;
 380 }
 381
 382 /**
 383  * gnutls_certificate_set_retrieve_function:
 384  * @cred: is a #gnutls_certificate_credentials_t structure.
 385  * @func: is the callback function
 386  *
 387  * This function sets a callback to be called in order to retrieve the
 388  * certificate to be used in the handshake. You are advised
 389  * to use gnutls_certificate_set_retrieve_function2() because it
 390  * is much more efficient in the processing it requires from gnutls.
 391  *
 392  * The callback's function prototype is:
 393  * int (*callback)(gnutls_session_t, const gnutls_datum_t* req_ca_dn, int nreqs,
 394  * const gnutls_pk_algorithm_t* pk_algos, int pk_algos_length, gnutls_retr2_st* st);
 395  *
 396  * @req_ca_cert is only used in X.509 certificates.
 397  * Contains a list with the CA names that the server considers trusted.
 398  * Normally we should send a certificate that is signed
 399  * by one of these CAs. These names are DER encoded. To get a more
 400  * meaningful value use the function gnutls_x509_rdn_get().
 401  *
 402  * @pk_algos contains a list with server's acceptable signature algorithms.
 403  * The certificate returned should support the server's given algorithms.
 404  *
 405  * @st should contain the certificates and private keys.
 406  *
 407  * If the callback function is provided then gnutls will call it, in the
 408  * handshake, after the certificate request message has been received.
 409  *
 410  * In server side pk_algos and req_ca_dn are NULL.
 411  *
 412  * The callback function should set the certificate list to be sent,
 413  * and return 0 on success. If no certificate was selected then the
 414  * number of certificates should be set to zero. The value (-1)
 415  * indicates error and the handshake will be terminated.
 416  *
 417  * Since: 3.0.0
 418  **/
 419 void gnutls_certificate_set_retrieve_function
 420   (gnutls_certificate_credentials_t cred,
 421    gnutls_certificate_retrieve_function * func)
 422 {
 423   cred->get_cert_callback = func;
 424 }
 425
 426 /**
 427  * gnutls_certificate_set_retrieve_function2:
 428  * @cred: is a #gnutls_certificate_credentials_t structure.
 429  * @func: is the callback function
 430  *
 431  * This function sets a callback to be called in order to retrieve the
 432  * certificate to be used in the handshake.
 433  *
 434  * The callback's function prototype is:
 435  * int (*callback)(gnutls_session_t, const gnutls_datum_t* req_ca_dn, int nreqs,
 436  * const gnutls_pk_algorithm_t* pk_algos, int pk_algos_length, gnutls_pcert_st* st);
 437  *
 438  * @req_ca_cert is only used in X.509 certificates.
 439  * Contains a list with the CA names that the server considers trusted.
 440  * Normally we should send a certificate that is signed
 441  * by one of these CAs. These names are DER encoded. To get a more
 442  * meaningful value use the function gnutls_x509_rdn_get().
 443  *
 444  * @pk_algos contains a list with server's acceptable signature algorithms.
 445  * The certificate returned should support the server's given algorithms.
 446  *
 447  * @st should contain the certificates and private keys.
 448  *
 449  * If the callback function is provided then gnutls will call it, in the
 450  * handshake, after the certificate request message has been received.
 451  *
 452  * In server side pk_algos and req_ca_dn are NULL.
 453  *
 454  * The callback function should set the certificate list to be sent,
 455  * and return 0 on success. If no certificate was selected then the
 456  * number of certificates should be set to zero. The value (-1)
 457  * indicates error and the handshake will be terminated.
 458  *
 459  * Since: 3.0.0
 460  **/
 461 void gnutls_certificate_set_retrieve_function2
 462   (gnutls_certificate_credentials_t cred,
 463    gnutls_certificate_retrieve_function2 * func)
 464 {
 465   cred->get_cert_callback2 = func;
 466 }
 467
 468 /**
 469  * gnutls_certificate_set_verify_function:
 470  * @cred: is a #gnutls_certificate_credentials_t structure.
 471  * @func: is the callback function
 472  *
 473  * This function sets a callback to be called when peer's certificate
 474  * has been received in order to verify it on receipt rather than
 475  * doing after the handshake is completed.
 476  *
 477  * The callback's function prototype is:
 478  * int (*callback)(gnutls_session_t);
 479  *
 480  * If the callback function is provided then gnutls will call it, in the
 481  * handshake, just after the certificate message has been received.
 482  * To verify or obtain the certificate the gnutls_certificate_verify_peers2(),
 483  * gnutls_certificate_type_get(), gnutls_certificate_get_peers() functions
 484  * can be used.
 485  *
 486  * The callback function should return 0 for the handshake to continue
 487  * or non-zero to terminate.
 488  *
 489  * Since: 2.10.0
 490  **/
 491 void
 492   gnutls_certificate_set_verify_function
 493   (gnutls_certificate_credentials_t cred,
 494    gnutls_certificate_verify_function * func)
 495 {
 496   cred->verify_callback = func;
 497 }
 498
 499 /*-
 500  * _gnutls_x509_extract_certificate_activation_time - return the peer's certificate activation time
 501  * @cert: should contain an X.509 DER encoded certificate
 502  *
 503  * This function will return the certificate's activation time in UNIX time
 504  * (ie seconds since 00:00:00 UTC January 1, 1970).
 505  *
 506  * Returns a (time_t) -1 in case of an error.
 507  *
 508  -*/
 509 static time_t
 510 _gnutls_x509_get_raw_crt_activation_time (const gnutls_datum_t * cert)
 511 {
 512   gnutls_x509_crt_t xcert;
 513   time_t result;
 514
 515   result = gnutls_x509_crt_init (&xcert);
 516   if (result < 0)
 517     return (time_t) - 1;
 518
 519   result = gnutls_x509_crt_import (xcert, cert, GNUTLS_X509_FMT_DER);
 520   if (result < 0)
 521     {
 522       gnutls_x509_crt_deinit (xcert);
 523       return (time_t) - 1;
 524     }
 525
 526   result = gnutls_x509_crt_get_activation_time (xcert);
 527
 528   gnutls_x509_crt_deinit (xcert);
 529
 530   return result;
 531 }
 532
 533 /*-
 534  * gnutls_x509_extract_certificate_expiration_time:
 535  * @cert: should contain an X.509 DER encoded certificate
 536  *
 537  * This function will return the certificate's expiration time in UNIX
 538  * time (ie seconds since 00:00:00 UTC January 1, 1970).  Returns a
 539  *
 540  * (time_t) -1 in case of an error.
 541  *
 542  -*/
 543 static time_t
 544 _gnutls_x509_get_raw_crt_expiration_time (const gnutls_datum_t * cert)
 545 {
 546   gnutls_x509_crt_t xcert;
 547   time_t result;
 548
 549   result = gnutls_x509_crt_init (&xcert);
 550   if (result < 0)
 551     return (time_t) - 1;
 552
 553   result = gnutls_x509_crt_import (xcert, cert, GNUTLS_X509_FMT_DER);
 554   if (result < 0)
 555     {
 556       gnutls_x509_crt_deinit (xcert);
 557       return (time_t) - 1;
 558     }
 559
 560   result = gnutls_x509_crt_get_expiration_time (xcert);
 561
 562   gnutls_x509_crt_deinit (xcert);
 563
 564   return result;
 565 }
 566
 567 #ifdef ENABLE_OPENPGP
 568 /*-
 569  * _gnutls_openpgp_crt_verify_peers - return the peer's certificate status
 570  * @session: is a gnutls session
 571  *
 572  * This function will try to verify the peer's certificate and return its status (TRUSTED, INVALID etc.).
 573  * Returns a negative error code in case of an error, or GNUTLS_E_NO_CERTIFICATE_FOUND if no certificate was sent.
 574  -*/
 575 static int
 576 _gnutls_openpgp_crt_verify_peers (gnutls_session_t session,
 577                                   unsigned int *status)
 578 {
 579   cert_auth_info_t info;
 580   gnutls_certificate_credentials_t cred;
 581   int peer_certificate_list_size, ret;
 582
 583   CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, GNUTLS_E_INVALID_REQUEST);
 584
 585   info = _gnutls_get_auth_info (session);
 586   if (info == NULL)
 587     return GNUTLS_E_INVALID_REQUEST;
 588
 589   cred = (gnutls_certificate_credentials_t)
 590     _gnutls_get_cred (session->key, GNUTLS_CRD_CERTIFICATE, NULL);
 591   if (cred == NULL)
 592     {
 593       gnutls_assert ();
 594       return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
 595     }
 596
 597   if (info->raw_certificate_list == NULL || info->ncerts == 0)
 598     {
 599       gnutls_assert ();
 600       return GNUTLS_E_NO_CERTIFICATE_FOUND;
 601     }
 602
 603   /* generate a list of gnutls_certs based on the auth info
 604    * raw certs.
 605    */
 606   peer_certificate_list_size = info->ncerts;
 607
 608   if (peer_certificate_list_size != 1)
 609     {
 610       gnutls_assert ();
 611       return GNUTLS_E_INTERNAL_ERROR;
 612     }
 613
 614   /* Verify certificate
 615    */
 616   ret =
 617     _gnutls_openpgp_verify_key (cred, &info->raw_certificate_list[0],
 618                                 peer_certificate_list_size, status);
 619
 620   if (ret < 0)
 621     {
 622       gnutls_assert ();
 623       return ret;
 624     }
 625
 626   return 0;
 627 }
 628 #endif
 629
 630 /**
 631  * gnutls_certificate_verify_peers2:
 632  * @session: is a gnutls session
 633  * @status: is the output of the verification
 634  *
 635  * This function will try to verify the peer's certificate and return
 636  * its status (trusted, invalid etc.).  The value of @status should
 637  * be one or more of the gnutls_certificate_status_t enumerated
 638  * elements bitwise or'd. To avoid denial of service attacks some
 639  * default upper limits regarding the certificate key size and chain
 640  * size are set. To override them use
 641  * gnutls_certificate_set_verify_limits().
 642  *
 643  * Note that you must also check the peer's name in order to check if
 644  * the verified certificate belongs to the actual peer.
 645  *
 646  * This function uses gnutls_x509_crt_list_verify() with the CAs in
 647  * the credentials as trusted CAs.
 648  *
 649  * Returns: a negative error code on error and %GNUTLS_E_SUCCESS (0) on success.
 650  **/
 651 int
 652 gnutls_certificate_verify_peers2 (gnutls_session_t session,
 653                                   unsigned int *status)
 654 {
 655   cert_auth_info_t info;
 656
 657   CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, GNUTLS_E_INVALID_REQUEST);
 658
 659   info = _gnutls_get_auth_info (session);
 660   if (info == NULL)
 661     {
 662       return GNUTLS_E_NO_CERTIFICATE_FOUND;
 663     }
 664
 665   if (info->raw_certificate_list == NULL || info->ncerts == 0)
 666     return GNUTLS_E_NO_CERTIFICATE_FOUND;
 667
 668   switch (gnutls_certificate_type_get (session))
 669     {
 670     case GNUTLS_CRT_X509:
 671       return _gnutls_x509_cert_verify_peers (session, status);
 672 #ifdef ENABLE_OPENPGP
 673     case GNUTLS_CRT_OPENPGP:
 674       return _gnutls_openpgp_crt_verify_peers (session, status);
 675 #endif
 676     default:
 677       return GNUTLS_E_INVALID_REQUEST;
 678     }
 679 }
 680
 681 /**
 682  * gnutls_certificate_expiration_time_peers:
 683  * @session: is a gnutls session
 684  *
 685  * This function will return the peer's certificate expiration time.
 686  *
 687  * Returns: (time_t)-1 on error.
 688  *
 689  * Deprecated: gnutls_certificate_verify_peers2() now verifies expiration times.
 690  **/
 691 time_t
 692 gnutls_certificate_expiration_time_peers (gnutls_session_t session)
 693 {
 694   cert_auth_info_t info;
 695
 696   CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, GNUTLS_E_INVALID_REQUEST);
 697
 698   info = _gnutls_get_auth_info (session);
 699   if (info == NULL)
 700     {
 701       return (time_t) - 1;
 702     }
 703
 704   if (info->raw_certificate_list == NULL || info->ncerts == 0)
 705     {
 706       gnutls_assert ();
 707       return (time_t) - 1;
 708     }
 709
 710   switch (gnutls_certificate_type_get (session))
 711     {
 712     case GNUTLS_CRT_X509:
 713       return
 714         _gnutls_x509_get_raw_crt_expiration_time (&info->raw_certificate_list
 715                                                   [0]);
 716 #ifdef ENABLE_OPENPGP
 717     case GNUTLS_CRT_OPENPGP:
 718       return
 719         _gnutls_openpgp_get_raw_key_expiration_time
 720         (&info->raw_certificate_list[0]);
 721 #endif
 722     default:
 723       return (time_t) - 1;
 724     }
 725 }
 726
 727 /**
 728  * gnutls_certificate_activation_time_peers:
 729  * @session: is a gnutls session
 730  *
 731  * This function will return the peer's certificate activation time.
 732  * This is the creation time for openpgp keys.
 733  *
 734  * Returns: (time_t)-1 on error.
 735  *
 736  * Deprecated: gnutls_certificate_verify_peers2() now verifies activation times.
 737  **/
 738 time_t
 739 gnutls_certificate_activation_time_peers (gnutls_session_t session)
 740 {
 741   cert_auth_info_t info;
 742
 743   CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, GNUTLS_E_INVALID_REQUEST);
 744
 745   info = _gnutls_get_auth_info (session);
 746   if (info == NULL)
 747     {
 748       return (time_t) - 1;
 749     }
 750
 751   if (info->raw_certificate_list == NULL || info->ncerts == 0)
 752     {
 753       gnutls_assert ();
 754       return (time_t) - 1;
 755     }
 756
 757   switch (gnutls_certificate_type_get (session))
 758     {
 759     case GNUTLS_CRT_X509:
 760       return
 761         _gnutls_x509_get_raw_crt_activation_time (&info->raw_certificate_list
 762                                                   [0]);
 763 #ifdef ENABLE_OPENPGP
 764     case GNUTLS_CRT_OPENPGP:
 765       return
 766         _gnutls_openpgp_get_raw_key_creation_time (&info->raw_certificate_list
 767                                                    [0]);
 768 #endif
 769     default:
 770       return (time_t) - 1;
 771     }
 772 }
 773
 774 /**
 775  * gnutls_sign_callback_set:
 776  * @session: is a gnutls session
 777  * @sign_func: function pointer to application's sign callback.
 778  * @userdata: void pointer that will be passed to sign callback.
 779  *
 780  * Set the callback function.  The function must have this prototype:
 781  *
 782  * typedef int (*gnutls_sign_func) (gnutls_session_t session,
 783  *                                  void *userdata,
 784  *                                  gnutls_certificate_type_t cert_type,
 785  *                                  const gnutls_datum_t * cert,
 786  *                                  const gnutls_datum_t * hash,
 787  *                                  gnutls_datum_t * signature);
 788  *
 789  * The @userdata parameter is passed to the @sign_func verbatim, and
 790  * can be used to store application-specific data needed in the
 791  * callback function.  See also gnutls_sign_callback_get().
 792  *
 793  * Deprecated: Use the PKCS 11 or #gnutls_privkey_t interfacess instead.
 794  */
 795 void
 796 gnutls_sign_callback_set (gnutls_session_t session,
 797                           gnutls_sign_func sign_func, void *userdata)
 798 {
 799   session->internals.sign_func = sign_func;
 800   session->internals.sign_func_userdata = userdata;
 801 }
 802
 803 /**
 804  * gnutls_sign_callback_get:
 805  * @session: is a gnutls session
 806  * @userdata: if non-%NULL, will be set to abstract callback pointer.
 807  *
 808  * Retrieve the callback function, and its userdata pointer.
 809  *
 810  * Returns: The function pointer set by gnutls_sign_callback_set(), or
 811  *   if not set, %NULL.
 812  *
 813  * Deprecated: Use the PKCS 11 interfaces instead.
 814  */
 815 gnutls_sign_func
 816 gnutls_sign_callback_get (gnutls_session_t session, void **userdata)
 817 {
 818   if (userdata)
 819     *userdata = session->internals.sign_func_userdata;
 820   return session->internals.sign_func;
 821 }
 822
 823