lib/gnutls_ui.c

   1 /*
   2  * Copyright (C) 2001-2012 Free Software Foundation, Inc.
   3  *
   4  * Author: Nikos Mavrogiannopoulos
   5  *
   6  * This file is part of GnuTLS.
   7  *
   8  * The GnuTLS is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * as published by the Free Software Foundation; either version 3 of
  11  * the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public License
  19  * along with this program.  If not, see <http://www.gnu.org/licenses/>
  20  *
  21  */
  22
  23 /* This file contains certificate authentication functions to be exported in the
  24  * API which did not fit elsewhere.
  25  */
  26
  27 #include <gnutls_int.h>
  28 #include <auth/srp.h>
  29 #include <auth/anon.h>
  30 #include <auth/cert.h>
  31 #include <auth/psk.h>
  32 #include <gnutls_errors.h>
  33 #include <gnutls_auth.h>
  34 #include <gnutls_state.h>
  35 #include <gnutls_datum.h>
  36 #include <extras/randomart.h>
  37 #include <read-file.h>
  38
  39 /**
  40  * gnutls_random_art:
  41  * @type: The type of the random art
  42  * @key_type: The type of the key (RSA, DSA etc.)
  43  * @key_size: The size of the key in bits
  44  * @fpr: The fingerprint of the key
  45  * @fpr_size: The size of the fingerprint
  46  * @art: The returned random art
  47  *
  48  * This function will convert a given fingerprint to an "artistic"
  49  * image. The returned image is allocated using gnutls_malloc()
  50  *
  51  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
  52  *   an error code is returned.
  53  *
  54  **/
  55 int gnutls_random_art (gnutls_random_art_t type,
  56                        const char* key_type, unsigned int key_size,
  57                        void * fpr, size_t fpr_size,
  58                        gnutls_datum_t* art)
  59 {
  60   if (type != GNUTLS_RANDOM_ART_OPENSSH)
  61     return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
  62
  63   art->data = (void*)_gnutls_key_fingerprint_randomart(fpr, fpr_size, key_type, key_size, NULL);
  64   if (art->data == NULL)
  65     return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
  66
  67   art->size = strlen((char*)art->data);
  68
  69   return 0;
  70 }
  71
  72 /* ANON & DHE */
  73
  74 /**
  75  * gnutls_dh_set_prime_bits:
  76  * @session: is a #gnutls_session_t structure.
  77  * @bits: is the number of bits
  78  *
  79  * This function sets the number of bits, for use in a Diffie-Hellman
  80  * key exchange.  This is used both in DH ephemeral and DH anonymous
  81  * cipher suites.  This will set the minimum size of the prime that
  82  * will be used for the handshake.
  83  *
  84  * In the client side it sets the minimum accepted number of bits.  If
  85  * a server sends a prime with less bits than that
  86  * %GNUTLS_E_DH_PRIME_UNACCEPTABLE will be returned by the handshake.
  87  *
  88  * Note that values lower than 512 bits may allow decryption of the
  89  * exchanged data.
  90  *
  91  * This function has no effect in server side.
  92  *
  93  **/
  94 void
  95 gnutls_dh_set_prime_bits (gnutls_session_t session, unsigned int bits)
  96 {
  97   if (bits <= 512) _gnutls_audit_log(session, "Note that the security level of the Diffie-Hellman key exchange has been lowered to %u bits and this may allow decryption of the session data\n", bits);
  98   session->internals.dh_prime_bits = bits;
  99 }
 100
 101
 102 /**
 103  * gnutls_dh_get_group:
 104  * @session: is a gnutls session
 105  * @raw_gen: will hold the generator.
 106  * @raw_prime: will hold the prime.
 107  *
 108  * This function will return the group parameters used in the last
 109  * Diffie-Hellman key exchange with the peer.  These are the prime and
 110  * the generator used.  This function should be used for both
 111  * anonymous and ephemeral Diffie-Hellman.  The output parameters must
 112  * be freed with gnutls_free().
 113  *
 114  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
 115  *   an error code is returned.
 116  **/
 117 int
 118 gnutls_dh_get_group (gnutls_session_t session,
 119                      gnutls_datum_t * raw_gen, gnutls_datum_t * raw_prime)
 120 {
 121   dh_info_st *dh;
 122   int ret;
 123   anon_auth_info_t anon_info;
 124   cert_auth_info_t cert_info;
 125   psk_auth_info_t psk_info;
 126
 127   switch (gnutls_auth_get_type (session))
 128     {
 129     case GNUTLS_CRD_ANON:
 130       anon_info = _gnutls_get_auth_info (session);
 131       if (anon_info == NULL)
 132         return GNUTLS_E_INTERNAL_ERROR;
 133       dh = &anon_info->dh;
 134       break;
 135     case GNUTLS_CRD_PSK:
 136       psk_info = _gnutls_get_auth_info (session);
 137       if (psk_info == NULL)
 138         return GNUTLS_E_INTERNAL_ERROR;
 139       dh = &psk_info->dh;
 140       break;
 141     case GNUTLS_CRD_CERTIFICATE:
 142       cert_info = _gnutls_get_auth_info (session);
 143       if (cert_info == NULL)
 144         return GNUTLS_E_INTERNAL_ERROR;
 145       dh = &cert_info->dh;
 146       break;
 147     default:
 148       gnutls_assert ();
 149       return GNUTLS_E_INVALID_REQUEST;
 150     }
 151
 152   ret = _gnutls_set_datum (raw_prime, dh->prime.data, dh->prime.size);
 153   if (ret < 0)
 154     {
 155       gnutls_assert ();
 156       return ret;
 157     }
 158
 159   ret = _gnutls_set_datum (raw_gen, dh->generator.data, dh->generator.size);
 160   if (ret < 0)
 161     {
 162       gnutls_assert ();
 163       _gnutls_free_datum (raw_prime);
 164       return ret;
 165     }
 166
 167   return 0;
 168 }
 169
 170 /**
 171  * gnutls_dh_get_pubkey:
 172  * @session: is a gnutls session
 173  * @raw_key: will hold the public key.
 174  *
 175  * This function will return the peer's public key used in the last
 176  * Diffie-Hellman key exchange.  This function should be used for both
 177  * anonymous and ephemeral Diffie-Hellman.  The output parameters must
 178  * be freed with gnutls_free().
 179  *
 180  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
 181  *   an error code is returned.
 182  **/
 183 int
 184 gnutls_dh_get_pubkey (gnutls_session_t session, gnutls_datum_t * raw_key)
 185 {
 186   dh_info_st *dh;
 187   anon_auth_info_t anon_info;
 188   cert_auth_info_t cert_info;
 189   cert_auth_info_t psk_info;
 190
 191   switch (gnutls_auth_get_type (session))
 192     {
 193     case GNUTLS_CRD_ANON:
 194       {
 195         anon_info = _gnutls_get_auth_info (session);
 196         if (anon_info == NULL)
 197           return GNUTLS_E_INTERNAL_ERROR;
 198         dh = &anon_info->dh;
 199         break;
 200       }
 201     case GNUTLS_CRD_PSK:
 202       {
 203         psk_info = _gnutls_get_auth_info (session);
 204         if (psk_info == NULL)
 205           return GNUTLS_E_INTERNAL_ERROR;
 206         dh = &psk_info->dh;
 207         break;
 208       }
 209     case GNUTLS_CRD_CERTIFICATE:
 210       {
 211
 212         cert_info = _gnutls_get_auth_info (session);
 213         if (cert_info == NULL)
 214           return GNUTLS_E_INTERNAL_ERROR;
 215         dh = &cert_info->dh;
 216         break;
 217       }
 218     default:
 219       gnutls_assert ();
 220       return GNUTLS_E_INVALID_REQUEST;
 221     }
 222
 223   return _gnutls_set_datum (raw_key, dh->public_key.data,
 224                             dh->public_key.size);
 225 }
 226
 227 /**
 228  * gnutls_rsa_export_get_pubkey:
 229  * @session: is a gnutls session
 230  * @exponent: will hold the exponent.
 231  * @modulus: will hold the modulus.
 232  *
 233  * This function will return the peer's public key exponent and
 234  * modulus used in the last RSA-EXPORT authentication.  The output
 235  * parameters must be freed with gnutls_free().
 236  *
 237  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
 238  *   an error code is returned.
 239  **/
 240 int
 241 gnutls_rsa_export_get_pubkey (gnutls_session_t session,
 242                               gnutls_datum_t * exponent,
 243                               gnutls_datum_t * modulus)
 244 {
 245   cert_auth_info_t info;
 246   int ret;
 247
 248   if (gnutls_auth_get_type (session) == GNUTLS_CRD_CERTIFICATE)
 249     {
 250       info = _gnutls_get_auth_info (session);
 251       if (info == NULL)
 252         return GNUTLS_E_INTERNAL_ERROR;
 253
 254       ret = _gnutls_set_datum (modulus, info->rsa_export.modulus.data,
 255                                info->rsa_export.modulus.size);
 256       if (ret < 0)
 257         {
 258           gnutls_assert ();
 259           return ret;
 260         }
 261
 262       ret = _gnutls_set_datum (exponent, info->rsa_export.exponent.data,
 263                                info->rsa_export.exponent.size);
 264       if (ret < 0)
 265         {
 266           gnutls_assert ();
 267           _gnutls_free_datum (modulus);
 268           return ret;
 269         }
 270
 271       return 0;
 272     }
 273
 274   return GNUTLS_E_INVALID_REQUEST;
 275 }
 276
 277
 278 /**
 279  * gnutls_dh_get_secret_bits:
 280  * @session: is a gnutls session
 281  *
 282  * This function will return the bits used in the last Diffie-Hellman
 283  * key exchange with the peer.  Should be used for both anonymous and
 284  * ephemeral Diffie-Hellman.
 285  *
 286  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
 287  *   an error code is returned.
 288  **/
 289 int
 290 gnutls_dh_get_secret_bits (gnutls_session_t session)
 291 {
 292   switch (gnutls_auth_get_type (session))
 293     {
 294     case GNUTLS_CRD_ANON:
 295       {
 296         anon_auth_info_t info;
 297
 298         info = _gnutls_get_auth_info (session);
 299         if (info == NULL)
 300           return GNUTLS_E_INTERNAL_ERROR;
 301         return info->dh.secret_bits;
 302       }
 303     case GNUTLS_CRD_PSK:
 304       {
 305         psk_auth_info_t info;
 306
 307         info = _gnutls_get_auth_info (session);
 308         if (info == NULL)
 309           return GNUTLS_E_INTERNAL_ERROR;
 310         return info->dh.secret_bits;
 311       }
 312     case GNUTLS_CRD_CERTIFICATE:
 313       {
 314         cert_auth_info_t info;
 315
 316         info = _gnutls_get_auth_info (session);
 317         if (info == NULL)
 318           return GNUTLS_E_INTERNAL_ERROR;
 319
 320         return info->dh.secret_bits;
 321       }
 322     default:
 323       gnutls_assert ();
 324       return GNUTLS_E_INVALID_REQUEST;
 325     }
 326 }
 327
 328 static int
 329 mpi_buf2bits (gnutls_datum_t * mpi_buf)
 330 {
 331   bigint_t mpi;
 332   int rc;
 333
 334   rc = _gnutls_mpi_scan_nz (&mpi, mpi_buf->data, mpi_buf->size);
 335   if (rc)
 336     {
 337       gnutls_assert ();
 338       return rc;
 339     }
 340
 341   rc = _gnutls_mpi_get_nbits (mpi);
 342   _gnutls_mpi_release (&mpi);
 343
 344   return rc;
 345 }
 346
 347 /**
 348  * gnutls_dh_get_prime_bits:
 349  * @session: is a gnutls session
 350  *
 351  * This function will return the bits of the prime used in the last
 352  * Diffie-Hellman key exchange with the peer.  Should be used for both
 353  * anonymous and ephemeral Diffie-Hellman.  Note that some ciphers,
 354  * like RSA and DSA without DHE, do not use a Diffie-Hellman key
 355  * exchange, and then this function will return 0.
 356  *
 357  * Returns: The Diffie-Hellman bit strength is returned, or 0 if no
 358  *   Diffie-Hellman key exchange was done, or a negative error code on
 359  *   failure.
 360  **/
 361 int
 362 gnutls_dh_get_prime_bits (gnutls_session_t session)
 363 {
 364   dh_info_st *dh;
 365
 366   switch (gnutls_auth_get_type (session))
 367     {
 368     case GNUTLS_CRD_ANON:
 369       {
 370         anon_auth_info_t info;
 371
 372         info = _gnutls_get_auth_info (session);
 373         if (info == NULL)
 374           return GNUTLS_E_INTERNAL_ERROR;
 375         dh = &info->dh;
 376         break;
 377       }
 378     case GNUTLS_CRD_PSK:
 379       {
 380         psk_auth_info_t info;
 381
 382         info = _gnutls_get_auth_info (session);
 383         if (info == NULL)
 384           return GNUTLS_E_INTERNAL_ERROR;
 385         dh = &info->dh;
 386         break;
 387       }
 388     case GNUTLS_CRD_CERTIFICATE:
 389       {
 390         cert_auth_info_t info;
 391
 392         info = _gnutls_get_auth_info (session);
 393         if (info == NULL)
 394           return GNUTLS_E_INTERNAL_ERROR;
 395
 396         dh = &info->dh;
 397         break;
 398       }
 399     default:
 400       gnutls_assert ();
 401       return GNUTLS_E_INVALID_REQUEST;
 402     }
 403
 404   return mpi_buf2bits (&dh->prime);
 405 }
 406
 407 /**
 408  * gnutls_rsa_export_get_modulus_bits:
 409  * @session: is a gnutls session
 410  *
 411  * Get the export RSA parameter's modulus size.
 412  *
 413  * Returns: The bits used in the last RSA-EXPORT key exchange with the
 414  *   peer, or a negative error code in case of error.
 415  **/
 416 int
 417 gnutls_rsa_export_get_modulus_bits (gnutls_session_t session)
 418 {
 419   cert_auth_info_t info;
 420
 421   info = _gnutls_get_auth_info (session);
 422   if (info == NULL)
 423     return GNUTLS_E_INTERNAL_ERROR;
 424
 425   return mpi_buf2bits (&info->rsa_export.modulus);
 426 }
 427
 428 /**
 429  * gnutls_dh_get_peers_public_bits:
 430  * @session: is a gnutls session
 431  *
 432  * Get the Diffie-Hellman public key bit size.  Can be used for both
 433  * anonymous and ephemeral Diffie-Hellman.
 434  *
 435  * Returns: The public key bit size used in the last Diffie-Hellman
 436  *   key exchange with the peer, or a negative error code in case of error.
 437  **/
 438 int
 439 gnutls_dh_get_peers_public_bits (gnutls_session_t session)
 440 {
 441   dh_info_st *dh;
 442
 443   switch (gnutls_auth_get_type (session))
 444     {
 445     case GNUTLS_CRD_ANON:
 446       {
 447         anon_auth_info_t info;
 448
 449         info = _gnutls_get_auth_info (session);
 450         if (info == NULL)
 451           return GNUTLS_E_INTERNAL_ERROR;
 452
 453         dh = &info->dh;
 454         break;
 455       }
 456     case GNUTLS_CRD_PSK:
 457       {
 458         psk_auth_info_t info;
 459
 460         info = _gnutls_get_auth_info (session);
 461         if (info == NULL)
 462           return GNUTLS_E_INTERNAL_ERROR;
 463
 464         dh = &info->dh;
 465         break;
 466       }
 467     case GNUTLS_CRD_CERTIFICATE:
 468       {
 469         cert_auth_info_t info;
 470
 471         info = _gnutls_get_auth_info (session);
 472         if (info == NULL)
 473           return GNUTLS_E_INTERNAL_ERROR;
 474
 475         dh = &info->dh;
 476         break;
 477       }
 478     default:
 479       gnutls_assert ();
 480       return GNUTLS_E_INVALID_REQUEST;
 481     }
 482
 483   return mpi_buf2bits (&dh->public_key);
 484 }
 485
 486 /* CERTIFICATE STUFF */
 487
 488 /**
 489  * gnutls_certificate_get_ours:
 490  * @session: is a gnutls session
 491  *
 492  * Gets the certificate as sent to the peer in the last handshake.
 493  * The certificate is in raw (DER) format.  No certificate
 494  * list is being returned. Only the first certificate.
 495  *
 496  * Returns: a pointer to a #gnutls_datum_t containing our
 497  *   certificate, or %NULL in case of an error or if no certificate
 498  *   was used.
 499  **/
 500 const gnutls_datum_t *
 501 gnutls_certificate_get_ours (gnutls_session_t session)
 502 {
 503   gnutls_certificate_credentials_t cred;
 504
 505   CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, NULL);
 506
 507   cred = (gnutls_certificate_credentials_t)
 508     _gnutls_get_cred (session, GNUTLS_CRD_CERTIFICATE, NULL);
 509   if (cred == NULL || cred->certs == NULL)
 510     {
 511       gnutls_assert ();
 512       return NULL;
 513     }
 514
 515   if (session->internals.selected_cert_list == NULL)
 516     return NULL;
 517
 518   return &session->internals.selected_cert_list[0].cert;
 519 }
 520
 521 /**
 522  * gnutls_certificate_get_peers:
 523  * @session: is a gnutls session
 524  * @list_size: is the length of the certificate list
 525  *
 526  * Get the peer's raw certificate (chain) as sent by the peer.  These
 527  * certificates are in raw format (DER encoded for X.509).  In case of
 528  * a X.509 then a certificate list may be present.  The first
 529  * certificate in the list is the peer's certificate, following the
 530  * issuer's certificate, then the issuer's issuer etc.
 531  *
 532  * In case of OpenPGP keys a single key will be returned in raw
 533  * format.
 534  *
 535  * Returns: a pointer to a #gnutls_datum_t containing our
 536  *   certificates, or %NULL in case of an error or if no certificate
 537  *   was used.
 538  **/
 539 const gnutls_datum_t *
 540 gnutls_certificate_get_peers (gnutls_session_t
 541                               session, unsigned int *list_size)
 542 {
 543   cert_auth_info_t info;
 544
 545   CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, NULL);
 546
 547   info = _gnutls_get_auth_info (session);
 548   if (info == NULL)
 549     return NULL;
 550
 551   *list_size = info->ncerts;
 552   return info->raw_certificate_list;
 553 }
 554
 555 /**
 556  * gnutls_certificate_get_peers_subkey_id:
 557  * @session: is a gnutls session
 558  * @id: will contain the ID
 559  *
 560  * Get the peer's subkey ID when OpenPGP certificates are
 561  * used. The returned @id should be treated as constant.
 562  *
 563  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
 564  *   an error code is returned.
 565  **/
 566 int gnutls_certificate_get_peers_subkey_id(gnutls_session_t session,
 567                                            gnutls_datum_t *id)
 568 {
 569   cert_auth_info_t info;
 570
 571   CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, GNUTLS_E_INVALID_REQUEST);
 572
 573   info = _gnutls_get_auth_info (session);
 574   if (info == NULL)
 575     return GNUTLS_E_INVALID_REQUEST;
 576
 577   id->data = info->subkey_id;
 578   id->size = GNUTLS_OPENPGP_KEYID_SIZE;
 579
 580   return 0;
 581 }
 582
 583 /**
 584  * gnutls_certificate_client_get_request_status:
 585  * @session: is a gnutls session
 586  *
 587  * Get whether client certificate is requested or not.
 588  *
 589  * Returns: 0 if the peer (server) did not request client
 590  *   authentication or 1 otherwise, or a negative error code in case of
 591  *   error.
 592  **/
 593 int
 594 gnutls_certificate_client_get_request_status (gnutls_session_t session)
 595 {
 596   return session->key.crt_requested;
 597 }
 598
 599 /**
 600  * gnutls_fingerprint:
 601  * @algo: is a digest algorithm
 602  * @data: is the data
 603  * @result: is the place where the result will be copied (may be null).
 604  * @result_size: should hold the size of the result. The actual size
 605  * of the returned result will also be copied there.
 606  *
 607  * This function will calculate a fingerprint (actually a hash), of
 608  * the given data.  The result is not printable data.  You should
 609  * convert it to hex, or to something else printable.
 610  *
 611  * This is the usual way to calculate a fingerprint of an X.509 DER
 612  * encoded certificate.  Note however that the fingerprint of an
 613  * OpenPGP is not just a hash and cannot be calculated with this
 614  * function.
 615  *
 616  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
 617  *   an error code is returned.
 618  **/
 619 int
 620 gnutls_fingerprint (gnutls_digest_algorithm_t algo,
 621                     const gnutls_datum_t * data, void *result,
 622                     size_t * result_size)
 623 {
 624   int ret;
 625   int hash_len = _gnutls_hash_get_algo_len (algo);
 626
 627   if (hash_len < 0 || (unsigned) hash_len > *result_size || result == NULL)
 628     {
 629       *result_size = hash_len;
 630       return GNUTLS_E_SHORT_MEMORY_BUFFER;
 631     }
 632   *result_size = hash_len;
 633
 634   if (result)
 635     {
 636       ret = _gnutls_hash_fast( algo, data->data, data->size, result);
 637       if (ret < 0)
 638         return gnutls_assert_val(ret);
 639     }
 640
 641   return 0;
 642 }
 643
 644
 645 /**
 646  * gnutls_certificate_set_dh_params:
 647  * @res: is a gnutls_certificate_credentials_t structure
 648  * @dh_params: is a structure that holds Diffie-Hellman parameters.
 649  *
 650  * This function will set the Diffie-Hellman parameters for a
 651  * certificate server to use. These parameters will be used in
 652  * Ephemeral Diffie-Hellman cipher suites.  Note that only a pointer
 653  * to the parameters are stored in the certificate handle, so if you
 654  * deallocate the parameters before the certificate is deallocated,
 655  * you must change the parameters stored in the certificate first.
 656  *
 657  **/
 658 void
 659 gnutls_certificate_set_dh_params (gnutls_certificate_credentials_t res,
 660                                   gnutls_dh_params_t dh_params)
 661 {
 662   res->dh_params = dh_params;
 663 }
 664
 665 /**
 666  * gnutls_certificate_set_params_function:
 667  * @res: is a gnutls_certificate_credentials_t structure
 668  * @func: is the function to be called
 669  *
 670  * This function will set a callback in order for the server to get
 671  * the Diffie-Hellman or RSA parameters for certificate
 672  * authentication.  The callback should return %GNUTLS_E_SUCCESS (0) on success.
 673  **/
 674 void
 675 gnutls_certificate_set_params_function (gnutls_certificate_credentials_t res,
 676                                         gnutls_params_function * func)
 677 {
 678   res->params_func = func;
 679 }
 680
 681
 682 /**
 683  * gnutls_certificate_set_verify_flags:
 684  * @res: is a gnutls_certificate_credentials_t structure
 685  * @flags: are the flags
 686  *
 687  * This function will set the flags to be used for verification
 688  * of certificates and override any defaults.  The provided flags must be an OR of the
 689  * #gnutls_certificate_verify_flags enumerations.
 690  *
 691  **/
 692 void
 693 gnutls_certificate_set_verify_flags (gnutls_certificate_credentials_t
 694                                      res, unsigned int flags)
 695 {
 696   res->verify_flags = flags;
 697 }
 698
 699 /**
 700  * gnutls_certificate_set_verify_limits:
 701  * @res: is a gnutls_certificate_credentials structure
 702  * @max_bits: is the number of bits of an acceptable certificate (default 8200)
 703  * @max_depth: is maximum depth of the verification of a certificate chain (default 5)
 704  *
 705  * This function will set some upper limits for the default
 706  * verification function, gnutls_certificate_verify_peers2(), to avoid
 707  * denial of service attacks.  You can set them to zero to disable
 708  * limits.
 709  **/
 710 void
 711 gnutls_certificate_set_verify_limits (gnutls_certificate_credentials_t res,
 712                                       unsigned int max_bits,
 713                                       unsigned int max_depth)
 714 {
 715   res->verify_depth = max_depth;
 716   res->verify_bits = max_bits;
 717 }
 718
 719 /**
 720  * gnutls_certificate_set_rsa_export_params:
 721  * @res: is a gnutls_certificate_credentials_t structure
 722  * @rsa_params: is a structure that holds temporary RSA parameters.
 723  *
 724  * This function will set the temporary RSA parameters for a
 725  * certificate server to use.  These parameters will be used in
 726  * RSA-EXPORT cipher suites.
 727  **/
 728 void
 729 gnutls_certificate_set_rsa_export_params (gnutls_certificate_credentials_t
 730                                           res, gnutls_rsa_params_t rsa_params)
 731 {
 732   res->rsa_params = rsa_params;
 733 }
 734
 735 /**
 736  * gnutls_psk_set_params_function:
 737  * @res: is a gnutls_psk_server_credentials_t structure
 738  * @func: is the function to be called
 739  *
 740  * This function will set a callback in order for the server to get
 741  * the Diffie-Hellman or RSA parameters for PSK authentication.  The
 742  * callback should return %GNUTLS_E_SUCCESS (0) on success.
 743  **/
 744 void
 745 gnutls_psk_set_params_function (gnutls_psk_server_credentials_t res,
 746                                 gnutls_params_function * func)
 747 {
 748   res->params_func = func;
 749 }
 750
 751 /**
 752  * gnutls_anon_set_params_function:
 753  * @res: is a gnutls_anon_server_credentials_t structure
 754  * @func: is the function to be called
 755  *
 756  * This function will set a callback in order for the server to get
 757  * the Diffie-Hellman or RSA parameters for anonymous authentication.
 758  * The callback should return %GNUTLS_E_SUCCESS (0) on success.
 759  **/
 760 void
 761 gnutls_anon_set_params_function (gnutls_anon_server_credentials_t res,
 762                                  gnutls_params_function * func)
 763 {
 764   res->params_func = func;
 765 }
 766
 767 /**
 768  * gnutls_load_file:
 769  * @filename: the name of the file to load
 770  * @data: Where the file will be stored
 771  *
 772  * This function will load a file into a datum. The data are
 773  * zero terminated but the terminating null is not included in length.
 774  * The returned data are allocated using gnutls_malloc().
 775  *
 776  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
 777  *   an error code is returned.
 778  *
 779  * Since 3.1.0
 780  **/
 781 int gnutls_load_file(const char* filename, gnutls_datum_t * data)
 782 {
 783 size_t len;
 784
 785   data->data = (void*)read_binary_file(filename, &len);
 786   if (data->data == NULL)
 787     return GNUTLS_E_FILE_ERROR;
 788
 789   if (malloc != gnutls_malloc)
 790     {
 791       void* tmp = gnutls_malloc(len);
 792
 793       memcpy(tmp, data->data, len);
 794       free(data->data);
 795       data->data = tmp;
 796     }
 797
 798   data->size = len;
 799
 800   return 0;
 801 }
 802
 803 /**
 804  * gnutls_url_is_supported:
 805  * @url: A PKCS 11 url
 806  *
 807  * Check whether url is supported.  Depending on the system libraries
 808  * GnuTLS may support pkcs11 or tpmkey URLs.
 809  *
 810  * Returns: return non-zero if the given URL is supported, and zero if
 811  * it is not known.
 812  *
 813  * Since: 3.1.0
 814  **/
 815 int
 816 gnutls_url_is_supported (const char* url)
 817 {
 818 #ifdef ENABLE_PKCS11
 819   if (strstr(url, "pkcs11:") != NULL)
 820     return 1;
 821 #endif
 822 #ifdef HAVE_TROUSERS
 823   if (strstr(url, "tpmkey:") != NULL)
 824     return 1;
 825 #endif
 826   return 0;
 827 }
 828
 829 /**
 830  * gnutls_ocsp_status_request_is_checked:
 831  * @session: is a gnutls session
 832  * @flags: should be zero
 833  *
 834  * Check whether an OCSP status response was included in the handshake
 835  * and whether it was checked and valid (not too old or superseded).
 836  * This is a helper function when needing to decide whether to perform an
 837  * OCSP validity check on the peer's certificate. Must be called after
 838  * gnutls_certificate_verify_peers3() is called.
 839  *
 840  * Returns: non zero it was valid, or a zero if it wasn't sent,
 841  * or sent and was invalid.
 842  **/
 843 int
 844 gnutls_ocsp_status_request_is_checked (gnutls_session_t session, unsigned int flags)
 845 {
 846   return session->internals.ocsp_check_ok;
 847 }