lib/gnutls_ui.c

   1 /*
   2  * Copyright (C) 2001-2012 Free Software Foundation, Inc.
   3  *
   4  * Author: Nikos Mavrogiannopoulos
   5  *
   6  * This file is part of GnuTLS.
   7  *
   8  * The GnuTLS is free software; you can redistribute it and/or
   9  * modify it under the terms of the GNU Lesser General Public License
  10  * as published by the Free Software Foundation; either version 3 of
  11  * the License, or (at your option) any later version.
  12  *
  13  * This library is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * Lesser General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU Lesser General Public License
  19  * along with this program.  If not, see <http://www.gnu.org/licenses/>
  20  *
  21  */
  22
  23 /* This file contains certificate authentication functions to be exported in the
  24  * API which did not fit elsewhere.
  25  */
  26
  27 #include <gnutls_int.h>
  28 #include <auth/srp.h>
  29 #include <auth/anon.h>
  30 #include <auth/cert.h>
  31 #include <auth/psk.h>
  32 #include <gnutls_errors.h>
  33 #include <gnutls_auth.h>
  34 #include <gnutls_state.h>
  35 #include <gnutls_datum.h>
  36 #include <extras/randomart.h>
  37 #include <read-file.h>
  38
  39 /**
  40  * gnutls_random_art:
  41  * @type: The type of the random art
  42  * @key_type: The type of the key (RSA, DSA etc.)
  43  * @key_size: The size of the key in bits
  44  * @fpr: The fingerprint of the key
  45  * @fpr_size: The size of the fingerprint
  46  * @art: The returned random art
  47  *
  48  * This function will convert a given fingerprint to an "artistic"
  49  * image. The returned image is allocated using gnutls_malloc()
  50  *
  51  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
  52  *   an error code is returned.
  53  *
  54  **/
  55 int gnutls_random_art (gnutls_random_art_t type,
  56                        const char* key_type, unsigned int key_size,
  57                        void * fpr, size_t fpr_size,
  58                        gnutls_datum_t* art)
  59 {
  60   if (type != GNUTLS_RANDOM_ART_OPENSSH)
  61     return gnutls_assert_val(GNUTLS_E_INVALID_REQUEST);
  62
  63   art->data = (void*)_gnutls_key_fingerprint_randomart(fpr, fpr_size, key_type, key_size, NULL);
  64   if (art->data == NULL)
  65     return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR);
  66
  67   art->size = strlen((char*)art->data);
  68
  69   return 0;
  70 }
  71
  72 /* ANON & DHE */
  73
  74 /**
  75  * gnutls_dh_set_prime_bits:
  76  * @session: is a #gnutls_session_t structure.
  77  * @bits: is the number of bits
  78  *
  79  * This function sets the number of bits, for use in a Diffie-Hellman
  80  * key exchange.  This is used both in DH ephemeral and DH anonymous
  81  * cipher suites.  This will set the minimum size of the prime that
  82  * will be used for the handshake.
  83  *
  84  * In the client side it sets the minimum accepted number of bits.  If
  85  * a server sends a prime with less bits than that
  86  * %GNUTLS_E_DH_PRIME_UNACCEPTABLE will be returned by the handshake.
  87  *
  88  * Note that values lower than 512 bits may allow decryption of the
  89  * exchanged data.
  90  *
  91  * This function has no effect in server side.
  92  *
  93  **/
  94 void
  95 gnutls_dh_set_prime_bits (gnutls_session_t session, unsigned int bits)
  96 {
  97   if (bits <= 512) _gnutls_audit_log(session, "Note that the security level of the Diffie-Hellman key exchange has been lowered to %u bits and this may allow decryption of the session data\n", bits);
  98   session->internals.dh_prime_bits = bits;
  99 }
 100
 101
 102 /**
 103  * gnutls_dh_get_group:
 104  * @session: is a gnutls session
 105  * @raw_gen: will hold the generator.
 106  * @raw_prime: will hold the prime.
 107  *
 108  * This function will return the group parameters used in the last
 109  * Diffie-Hellman key exchange with the peer.  These are the prime and
 110  * the generator used.  This function should be used for both
 111  * anonymous and ephemeral Diffie-Hellman.  The output parameters must
 112  * be freed with gnutls_free().
 113  *
 114  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
 115  *   an error code is returned.
 116  **/
 117 int
 118 gnutls_dh_get_group (gnutls_session_t session,
 119                      gnutls_datum_t * raw_gen, gnutls_datum_t * raw_prime)
 120 {
 121   dh_info_st *dh;
 122   int ret;
 123   anon_auth_info_t anon_info;
 124   cert_auth_info_t cert_info;
 125   psk_auth_info_t psk_info;
 126
 127   switch (gnutls_auth_get_type (session))
 128     {
 129     case GNUTLS_CRD_ANON:
 130       anon_info = _gnutls_get_auth_info (session);
 131       if (anon_info == NULL)
 132         return GNUTLS_E_INTERNAL_ERROR;
 133       dh = &anon_info->dh;
 134       break;
 135     case GNUTLS_CRD_PSK:
 136       psk_info = _gnutls_get_auth_info (session);
 137       if (psk_info == NULL)
 138         return GNUTLS_E_INTERNAL_ERROR;
 139       dh = &psk_info->dh;
 140       break;
 141     case GNUTLS_CRD_CERTIFICATE:
 142       cert_info = _gnutls_get_auth_info (session);
 143       if (cert_info == NULL)
 144         return GNUTLS_E_INTERNAL_ERROR;
 145       dh = &cert_info->dh;
 146       break;
 147     default:
 148       gnutls_assert ();
 149       return GNUTLS_E_INVALID_REQUEST;
 150     }
 151
 152   ret = _gnutls_set_datum (raw_prime, dh->prime.data, dh->prime.size);
 153   if (ret < 0)
 154     {
 155       gnutls_assert ();
 156       return ret;
 157     }
 158
 159   ret = _gnutls_set_datum (raw_gen, dh->generator.data, dh->generator.size);
 160   if (ret < 0)
 161     {
 162       gnutls_assert ();
 163       _gnutls_free_datum (raw_prime);
 164       return ret;
 165     }
 166
 167   return 0;
 168 }
 169
 170 /**
 171  * gnutls_dh_get_pubkey:
 172  * @session: is a gnutls session
 173  * @raw_key: will hold the public key.
 174  *
 175  * This function will return the peer's public key used in the last
 176  * Diffie-Hellman key exchange.  This function should be used for both
 177  * anonymous and ephemeral Diffie-Hellman.  The output parameters must
 178  * be freed with gnutls_free().
 179  *
 180  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
 181  *   an error code is returned.
 182  **/
 183 int
 184 gnutls_dh_get_pubkey (gnutls_session_t session, gnutls_datum_t * raw_key)
 185 {
 186   dh_info_st *dh;
 187   anon_auth_info_t anon_info;
 188   cert_auth_info_t cert_info;
 189   cert_auth_info_t psk_info;
 190
 191   switch (gnutls_auth_get_type (session))
 192     {
 193     case GNUTLS_CRD_ANON:
 194       {
 195         anon_info = _gnutls_get_auth_info (session);
 196         if (anon_info == NULL)
 197           return GNUTLS_E_INTERNAL_ERROR;
 198         dh = &anon_info->dh;
 199         break;
 200       }
 201     case GNUTLS_CRD_PSK:
 202       {
 203         psk_info = _gnutls_get_auth_info (session);
 204         if (psk_info == NULL)
 205           return GNUTLS_E_INTERNAL_ERROR;
 206         dh = &psk_info->dh;
 207         break;
 208       }
 209     case GNUTLS_CRD_CERTIFICATE:
 210       {
 211
 212         cert_info = _gnutls_get_auth_info (session);
 213         if (cert_info == NULL)
 214           return GNUTLS_E_INTERNAL_ERROR;
 215         dh = &cert_info->dh;
 216         break;
 217       }
 218     default:
 219       gnutls_assert ();
 220       return GNUTLS_E_INVALID_REQUEST;
 221     }
 222
 223   return _gnutls_set_datum (raw_key, dh->public_key.data,
 224                             dh->public_key.size);
 225 }
 226
 227 /**
 228  * gnutls_rsa_export_get_pubkey:
 229  * @session: is a gnutls session
 230  * @exponent: will hold the exponent.
 231  * @modulus: will hold the modulus.
 232  *
 233  * This function will return the peer's public key exponent and
 234  * modulus used in the last RSA-EXPORT authentication.  The output
 235  * parameters must be freed with gnutls_free().
 236  *
 237  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
 238  *   an error code is returned.
 239  **/
 240 int
 241 gnutls_rsa_export_get_pubkey (gnutls_session_t session,
 242                               gnutls_datum_t * exponent,
 243                               gnutls_datum_t * modulus)
 244 {
 245   cert_auth_info_t info;
 246   int ret;
 247
 248   if (gnutls_auth_get_type (session) == GNUTLS_CRD_CERTIFICATE)
 249     {
 250       info = _gnutls_get_auth_info (session);
 251       if (info == NULL)
 252         return GNUTLS_E_INTERNAL_ERROR;
 253
 254       ret = _gnutls_set_datum (modulus, info->rsa_export.modulus.data,
 255                                info->rsa_export.modulus.size);
 256       if (ret < 0)
 257         {
 258           gnutls_assert ();
 259           return ret;
 260         }
 261
 262       ret = _gnutls_set_datum (exponent, info->rsa_export.exponent.data,
 263                                info->rsa_export.exponent.size);
 264       if (ret < 0)
 265         {
 266           gnutls_assert ();
 267           _gnutls_free_datum (modulus);
 268           return ret;
 269         }
 270
 271       return 0;
 272     }
 273
 274   return GNUTLS_E_INVALID_REQUEST;
 275 }
 276
 277
 278 /**
 279  * gnutls_dh_get_secret_bits:
 280  * @session: is a gnutls session
 281  *
 282  * This function will return the bits used in the last Diffie-Hellman
 283  * key exchange with the peer.  Should be used for both anonymous and
 284  * ephemeral Diffie-Hellman.
 285  *
 286  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
 287  *   an error code is returned.
 288  **/
 289 int
 290 gnutls_dh_get_secret_bits (gnutls_session_t session)
 291 {
 292   switch (gnutls_auth_get_type (session))
 293     {
 294     case GNUTLS_CRD_ANON:
 295       {
 296         anon_auth_info_t info;
 297
 298         info = _gnutls_get_auth_info (session);
 299         if (info == NULL)
 300           return GNUTLS_E_INTERNAL_ERROR;
 301         return info->dh.secret_bits;
 302       }
 303     case GNUTLS_CRD_PSK:
 304       {
 305         psk_auth_info_t info;
 306
 307         info = _gnutls_get_auth_info (session);
 308         if (info == NULL)
 309           return GNUTLS_E_INTERNAL_ERROR;
 310         return info->dh.secret_bits;
 311       }
 312     case GNUTLS_CRD_CERTIFICATE:
 313       {
 314         cert_auth_info_t info;
 315
 316         info = _gnutls_get_auth_info (session);
 317         if (info == NULL)
 318           return GNUTLS_E_INTERNAL_ERROR;
 319
 320         return info->dh.secret_bits;
 321       }
 322     default:
 323       gnutls_assert ();
 324       return GNUTLS_E_INVALID_REQUEST;
 325     }
 326 }
 327
 328 static int
 329 mpi_buf2bits (gnutls_datum_t * mpi_buf)
 330 {
 331   bigint_t mpi;
 332   int rc;
 333
 334   rc = _gnutls_mpi_scan_nz (&mpi, mpi_buf->data, mpi_buf->size);
 335   if (rc)
 336     {
 337       gnutls_assert ();
 338       return rc;
 339     }
 340
 341   rc = _gnutls_mpi_get_nbits (mpi);
 342   _gnutls_mpi_release (&mpi);
 343
 344   return rc;
 345 }
 346
 347 /**
 348  * gnutls_dh_get_prime_bits:
 349  * @session: is a gnutls session
 350  *
 351  * This function will return the bits of the prime used in the last
 352  * Diffie-Hellman key exchange with the peer.  Should be used for both
 353  * anonymous and ephemeral Diffie-Hellman.  Note that some ciphers,
 354  * like RSA and DSA without DHE, do not use a Diffie-Hellman key
 355  * exchange, and then this function will return 0.
 356  *
 357  * Returns: The Diffie-Hellman bit strength is returned, or 0 if no
 358  *   Diffie-Hellman key exchange was done, or a negative error code on
 359  *   failure.
 360  **/
 361 int
 362 gnutls_dh_get_prime_bits (gnutls_session_t session)
 363 {
 364   dh_info_st *dh;
 365
 366   switch (gnutls_auth_get_type (session))
 367     {
 368     case GNUTLS_CRD_ANON:
 369       {
 370         anon_auth_info_t info;
 371
 372         info = _gnutls_get_auth_info (session);
 373         if (info == NULL)
 374           return GNUTLS_E_INTERNAL_ERROR;
 375         dh = &info->dh;
 376         break;
 377       }
 378     case GNUTLS_CRD_PSK:
 379       {
 380         psk_auth_info_t info;
 381
 382         info = _gnutls_get_auth_info (session);
 383         if (info == NULL)
 384           return GNUTLS_E_INTERNAL_ERROR;
 385         dh = &info->dh;
 386         break;
 387       }
 388     case GNUTLS_CRD_CERTIFICATE:
 389       {
 390         cert_auth_info_t info;
 391
 392         info = _gnutls_get_auth_info (session);
 393         if (info == NULL)
 394           return GNUTLS_E_INTERNAL_ERROR;
 395
 396         dh = &info->dh;
 397         break;
 398       }
 399     default:
 400       gnutls_assert ();
 401       return GNUTLS_E_INVALID_REQUEST;
 402     }
 403
 404   return mpi_buf2bits (&dh->prime);
 405 }
 406
 407 /**
 408  * gnutls_rsa_export_get_modulus_bits:
 409  * @session: is a gnutls session
 410  *
 411  * Get the export RSA parameter's modulus size.
 412  *
 413  * Returns: The bits used in the last RSA-EXPORT key exchange with the
 414  *   peer, or a negative error code in case of error.
 415  **/
 416 int
 417 gnutls_rsa_export_get_modulus_bits (gnutls_session_t session)
 418 {
 419   cert_auth_info_t info;
 420
 421   info = _gnutls_get_auth_info (session);
 422   if (info == NULL)
 423     return GNUTLS_E_INTERNAL_ERROR;
 424
 425   return mpi_buf2bits (&info->rsa_export.modulus);
 426 }
 427
 428 /**
 429  * gnutls_dh_get_peers_public_bits:
 430  * @session: is a gnutls session
 431  *
 432  * Get the Diffie-Hellman public key bit size.  Can be used for both
 433  * anonymous and ephemeral Diffie-Hellman.
 434  *
 435  * Returns: The public key bit size used in the last Diffie-Hellman
 436  *   key exchange with the peer, or a negative error code in case of error.
 437  **/
 438 int
 439 gnutls_dh_get_peers_public_bits (gnutls_session_t session)
 440 {
 441   dh_info_st *dh;
 442
 443   switch (gnutls_auth_get_type (session))
 444     {
 445     case GNUTLS_CRD_ANON:
 446       {
 447         anon_auth_info_t info;
 448
 449         info = _gnutls_get_auth_info (session);
 450         if (info == NULL)
 451           return GNUTLS_E_INTERNAL_ERROR;
 452
 453         dh = &info->dh;
 454         break;
 455       }
 456     case GNUTLS_CRD_PSK:
 457       {
 458         psk_auth_info_t info;
 459
 460         info = _gnutls_get_auth_info (session);
 461         if (info == NULL)
 462           return GNUTLS_E_INTERNAL_ERROR;
 463
 464         dh = &info->dh;
 465         break;
 466       }
 467     case GNUTLS_CRD_CERTIFICATE:
 468       {
 469         cert_auth_info_t info;
 470
 471         info = _gnutls_get_auth_info (session);
 472         if (info == NULL)
 473           return GNUTLS_E_INTERNAL_ERROR;
 474
 475         dh = &info->dh;
 476         break;
 477       }
 478     default:
 479       gnutls_assert ();
 480       return GNUTLS_E_INVALID_REQUEST;
 481     }
 482
 483   return mpi_buf2bits (&dh->public_key);
 484 }
 485
 486 /* CERTIFICATE STUFF */
 487
 488 /**
 489  * gnutls_certificate_get_ours:
 490  * @session: is a gnutls session
 491  *
 492  * Gets the certificate as sent to the peer in the last handshake.
 493  * The certificate is in raw (DER) format.  No certificate
 494  * list is being returned. Only the first certificate.
 495  *
 496  * Returns: a pointer to a #gnutls_datum_t containing our
 497  *   certificate, or %NULL in case of an error or if no certificate
 498  *   was used.
 499  **/
 500 const gnutls_datum_t *
 501 gnutls_certificate_get_ours (gnutls_session_t session)
 502 {
 503   gnutls_certificate_credentials_t cred;
 504
 505   CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, NULL);
 506
 507   cred = (gnutls_certificate_credentials_t)
 508     _gnutls_get_cred (session, GNUTLS_CRD_CERTIFICATE, NULL);
 509   if (cred == NULL || cred->certs == NULL)
 510     {
 511       gnutls_assert ();
 512       return NULL;
 513     }
 514
 515   if (session->internals.selected_cert_list == NULL)
 516     return NULL;
 517
 518   return &session->internals.selected_cert_list[0].cert;
 519 }
 520
 521 /**
 522  * gnutls_certificate_get_peers:
 523  * @session: is a gnutls session
 524  * @list_size: is the length of the certificate list
 525  *
 526  * Get the peer's raw certificate (chain) as sent by the peer.  These
 527  * certificates are in raw format (DER encoded for X.509).  In case of
 528  * a X.509 then a certificate list may be present.  The first
 529  * certificate in the list is the peer's certificate, following the
 530  * issuer's certificate, then the issuer's issuer etc.
 531  *
 532  * In case of OpenPGP keys a single key will be returned in raw
 533  * format.
 534  *
 535  * Returns: a pointer to a #gnutls_datum_t containing our
 536  *   certificates, or %NULL in case of an error or if no certificate
 537  *   was used.
 538  **/
 539 const gnutls_datum_t *
 540 gnutls_certificate_get_peers (gnutls_session_t
 541                               session, unsigned int *list_size)
 542 {
 543   cert_auth_info_t info;
 544
 545   CHECK_AUTH (GNUTLS_CRD_CERTIFICATE, NULL);
 546
 547   info = _gnutls_get_auth_info (session);
 548   if (info == NULL)
 549     return NULL;
 550
 551   *list_size = info->ncerts;
 552   return info->raw_certificate_list;
 553 }
 554
 555
 556 /**
 557  * gnutls_certificate_client_get_request_status:
 558  * @session: is a gnutls session
 559  *
 560  * Get whether client certificate is requested or not.
 561  *
 562  * Returns: 0 if the peer (server) did not request client
 563  *   authentication or 1 otherwise, or a negative error code in case of
 564  *   error.
 565  **/
 566 int
 567 gnutls_certificate_client_get_request_status (gnutls_session_t session)
 568 {
 569   return session->key.crt_requested;
 570 }
 571
 572 /**
 573  * gnutls_fingerprint:
 574  * @algo: is a digest algorithm
 575  * @data: is the data
 576  * @result: is the place where the result will be copied (may be null).
 577  * @result_size: should hold the size of the result. The actual size
 578  * of the returned result will also be copied there.
 579  *
 580  * This function will calculate a fingerprint (actually a hash), of
 581  * the given data.  The result is not printable data.  You should
 582  * convert it to hex, or to something else printable.
 583  *
 584  * This is the usual way to calculate a fingerprint of an X.509 DER
 585  * encoded certificate.  Note however that the fingerprint of an
 586  * OpenPGP is not just a hash and cannot be calculated with this
 587  * function.
 588  *
 589  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
 590  *   an error code is returned.
 591  **/
 592 int
 593 gnutls_fingerprint (gnutls_digest_algorithm_t algo,
 594                     const gnutls_datum_t * data, void *result,
 595                     size_t * result_size)
 596 {
 597   int ret;
 598   int hash_len = _gnutls_hash_get_algo_len (algo);
 599
 600   if (hash_len < 0 || (unsigned) hash_len > *result_size || result == NULL)
 601     {
 602       *result_size = hash_len;
 603       return GNUTLS_E_SHORT_MEMORY_BUFFER;
 604     }
 605   *result_size = hash_len;
 606
 607   if (result)
 608     {
 609       ret = _gnutls_hash_fast( algo, data->data, data->size, result);
 610       if (ret < 0)
 611         return gnutls_assert_val(ret);
 612     }
 613
 614   return 0;
 615 }
 616
 617
 618 /**
 619  * gnutls_certificate_set_dh_params:
 620  * @res: is a gnutls_certificate_credentials_t structure
 621  * @dh_params: is a structure that holds Diffie-Hellman parameters.
 622  *
 623  * This function will set the Diffie-Hellman parameters for a
 624  * certificate server to use. These parameters will be used in
 625  * Ephemeral Diffie-Hellman cipher suites.  Note that only a pointer
 626  * to the parameters are stored in the certificate handle, so if you
 627  * deallocate the parameters before the certificate is deallocated,
 628  * you must change the parameters stored in the certificate first.
 629  *
 630  **/
 631 void
 632 gnutls_certificate_set_dh_params (gnutls_certificate_credentials_t res,
 633                                   gnutls_dh_params_t dh_params)
 634 {
 635   res->dh_params = dh_params;
 636 }
 637
 638 /**
 639  * gnutls_certificate_set_params_function:
 640  * @res: is a gnutls_certificate_credentials_t structure
 641  * @func: is the function to be called
 642  *
 643  * This function will set a callback in order for the server to get
 644  * the Diffie-Hellman or RSA parameters for certificate
 645  * authentication.  The callback should return %GNUTLS_E_SUCCESS (0) on success.
 646  **/
 647 void
 648 gnutls_certificate_set_params_function (gnutls_certificate_credentials_t res,
 649                                         gnutls_params_function * func)
 650 {
 651   res->params_func = func;
 652 }
 653
 654
 655 /**
 656  * gnutls_certificate_set_verify_flags:
 657  * @res: is a gnutls_certificate_credentials_t structure
 658  * @flags: are the flags
 659  *
 660  * This function will set the flags to be used at verification of the
 661  * certificates.  Flags must be OR of the
 662  * #gnutls_certificate_verify_flags enumerations. The default
 663  * for TLS sessions is GNUTLS_VERIFY_ALLOW_UNSORTED_CHAIN.
 664  *
 665  **/
 666 void
 667 gnutls_certificate_set_verify_flags (gnutls_certificate_credentials_t
 668                                      res, unsigned int flags)
 669 {
 670   res->verify_flags = flags;
 671 }
 672
 673 /**
 674  * gnutls_certificate_set_verify_limits:
 675  * @res: is a gnutls_certificate_credentials structure
 676  * @max_bits: is the number of bits of an acceptable certificate (default 8200)
 677  * @max_depth: is maximum depth of the verification of a certificate chain (default 5)
 678  *
 679  * This function will set some upper limits for the default
 680  * verification function, gnutls_certificate_verify_peers2(), to avoid
 681  * denial of service attacks.  You can set them to zero to disable
 682  * limits.
 683  **/
 684 void
 685 gnutls_certificate_set_verify_limits (gnutls_certificate_credentials_t res,
 686                                       unsigned int max_bits,
 687                                       unsigned int max_depth)
 688 {
 689   res->verify_depth = max_depth;
 690   res->verify_bits = max_bits;
 691 }
 692
 693 /**
 694  * gnutls_certificate_set_rsa_export_params:
 695  * @res: is a gnutls_certificate_credentials_t structure
 696  * @rsa_params: is a structure that holds temporary RSA parameters.
 697  *
 698  * This function will set the temporary RSA parameters for a
 699  * certificate server to use.  These parameters will be used in
 700  * RSA-EXPORT cipher suites.
 701  **/
 702 void
 703 gnutls_certificate_set_rsa_export_params (gnutls_certificate_credentials_t
 704                                           res, gnutls_rsa_params_t rsa_params)
 705 {
 706   res->rsa_params = rsa_params;
 707 }
 708
 709 /**
 710  * gnutls_psk_set_params_function:
 711  * @res: is a gnutls_psk_server_credentials_t structure
 712  * @func: is the function to be called
 713  *
 714  * This function will set a callback in order for the server to get
 715  * the Diffie-Hellman or RSA parameters for PSK authentication.  The
 716  * callback should return %GNUTLS_E_SUCCESS (0) on success.
 717  **/
 718 void
 719 gnutls_psk_set_params_function (gnutls_psk_server_credentials_t res,
 720                                 gnutls_params_function * func)
 721 {
 722   res->params_func = func;
 723 }
 724
 725 /**
 726  * gnutls_anon_set_params_function:
 727  * @res: is a gnutls_anon_server_credentials_t structure
 728  * @func: is the function to be called
 729  *
 730  * This function will set a callback in order for the server to get
 731  * the Diffie-Hellman or RSA parameters for anonymous authentication.
 732  * The callback should return %GNUTLS_E_SUCCESS (0) on success.
 733  **/
 734 void
 735 gnutls_anon_set_params_function (gnutls_anon_server_credentials_t res,
 736                                  gnutls_params_function * func)
 737 {
 738   res->params_func = func;
 739 }
 740
 741 /**
 742  * gnutls_load_file:
 743  * @filename: the name of the file to load
 744  * @data: Where the file will be stored
 745  *
 746  * This function will load a file into a datum. The data are
 747  * zero terminated but the terminating null is not included in length.
 748  * The returned data are allocated using gnutls_malloc().
 749  *
 750  * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise
 751  *   an error code is returned.
 752  *
 753  * Since 3.1.0
 754  **/
 755 int gnutls_load_file(const char* filename, gnutls_datum_t * data)
 756 {
 757 size_t len;
 758
 759   data->data = (void*)read_binary_file(filename, &len);
 760   if (data->data == NULL)
 761     return GNUTLS_E_FILE_ERROR;
 762
 763   if (malloc != gnutls_malloc)
 764     {
 765       void* tmp = gnutls_malloc(len);
 766
 767       memcpy(tmp, data->data, len);
 768       free(data->data);
 769       data->data = tmp;
 770     }
 771
 772   data->size = len;
 773
 774   return 0;
 775 }
 776
 777 /**
 778  * gnutls_url_is_supported:
 779  * @url: A PKCS 11 url
 780  *
 781  * Check whether url is supported.  Depending on the system libraries
 782  * GnuTLS may support pkcs11 or tpmkey URLs.
 783  *
 784  * Returns: return non-zero if the given URL is supported, and zero if
 785  * it is not known.
 786  *
 787  * Since: 3.1.0
 788  **/
 789 int
 790 gnutls_url_is_supported (const char* url)
 791 {
 792 #ifdef ENABLE_PKCS11
 793   if (strstr(url, "pkcs11:") != NULL)
 794     return 1;
 795 #endif
 796 #ifdef HAVE_TROUSERS
 797   if (strstr(url, "tpmkey:") != NULL)
 798     return 1;
 799 #endif
 800   return 0;
 801 }