← Back to branch summary

~nutznboltz-deactivatedaccount/ubuntu/precise/gnutls26/fix-lp926350

« back to all changes in this revision

Viewing changes to lib/x509/crq.c

  • Committer: Package Import Robot
  • Author(s): Andreas Metzler
  • Date: 2011-10-01 15:28:13 UTC
  • mfrom: (12.1.20 sid)
  • Revision ID: package-import@ubuntu.com-20111001152813-yygm1c4cxonfxhzy
Tags: 2.12.11-1
http://bugs.debian.org/640639
* New upstream version.
  + Allow CA importing of 0 certificates to succeed. Closes: #640639
* Add libp11-kit-dev to libgnutls-dev dependencies. (see #643811)
* [20_guiledocstring.diff] guile: Fix docstring extraction with CPP 4.5+.

Show diffs side-by-side

added added

removed removed

Lines of Context:
lib/x509/crq.c
1
1
/*
2
 
 * Copyright (C) 2003, 2004, 2005, 2008, 2009, 2010 Free Software
 
2
 * Copyright (C) 2003, 2004, 2005, 2008, 2009, 2010, 2011 Free Software
3
3
 * Foundation, Inc.
4
4
 *
5
5
 * Author: Nikos Mavrogiannopoulos
60
60
    return GNUTLS_E_MEMORY_ERROR;
61
61
 
62
62
  result = asn1_create_element (_gnutls_get_pkix (),
63
 
                                "PKIX1.pkcs-10-CertificationRequest",
64
 
                                &((*crq)->crq));
 
63
                                "PKIX1.pkcs-10-CertificationRequest",
 
64
                                &((*crq)->crq));
65
65
  if (result != ASN1_SUCCESS)
66
66
    {
67
67
      gnutls_assert ();
112
112
 **/
113
113
int
114
114
gnutls_x509_crq_import (gnutls_x509_crq_t crq,
115
 
                        const gnutls_datum_t * data,
116
 
                        gnutls_x509_crt_fmt_t format)
 
115
                        const gnutls_datum_t * data,
 
116
                        gnutls_x509_crt_fmt_t format)
117
117
{
118
118
  int result = 0, need_free = 0;
119
119
  gnutls_datum_t _data;
136
136
      /* Try the first header */
137
137
      result = _gnutls_fbase64_decode (PEM_CRQ, data->data, data->size, &out);
138
138
 
139
 
      if (result <= 0)          /* Go for the second header */
140
 
        result =
141
 
          _gnutls_fbase64_decode (PEM_CRQ2, data->data, data->size, &out);
 
139
      if (result <= 0)          /* Go for the second header */
 
140
        result =
 
141
          _gnutls_fbase64_decode (PEM_CRQ2, data->data, data->size, &out);
142
142
 
143
143
      if (result <= 0)
144
 
        {
145
 
          if (result == 0)
146
 
            result = GNUTLS_E_INTERNAL_ERROR;
147
 
          gnutls_assert ();
148
 
          return result;
149
 
        }
 
144
        {
 
145
          if (result == 0)
 
146
            result = GNUTLS_E_INTERNAL_ERROR;
 
147
          gnutls_assert ();
 
148
          return result;
 
149
        }
150
150
 
151
151
      _data.data = out;
152
152
      _data.size = result;
198
198
    }
199
199
 
200
200
  return _gnutls_x509_parse_dn (crq->crq,
201
 
                                "certificationRequestInfo.subject.rdnSequence",
202
 
                                buf, sizeof_buf);
 
201
                                "certificationRequestInfo.subject.rdnSequence",
 
202
                                buf, sizeof_buf);
203
203
}
204
204
 
205
205
/**
229
229
 **/
230
230
int
231
231
gnutls_x509_crq_get_dn_by_oid (gnutls_x509_crq_t crq, const char *oid,
232
 
                               int indx, unsigned int raw_flag,
233
 
                               void *buf, size_t * sizeof_buf)
 
232
                               int indx, unsigned int raw_flag,
 
233
                               void *buf, size_t * sizeof_buf)
234
234
{
235
235
  if (crq == NULL)
236
236
    {
260
260
 **/
261
261
int
262
262
gnutls_x509_crq_get_dn_oid (gnutls_x509_crq_t crq,
263
 
                            int indx, void *oid, size_t * sizeof_oid)
 
263
                            int indx, void *oid, size_t * sizeof_oid)
264
264
{
265
265
  if (crq == NULL)
266
266
    {
269
269
    }
270
270
 
271
271
  return _gnutls_x509_get_dn_oid (crq->crq,
272
 
                                  "certificationRequestInfo.subject.rdnSequence",
273
 
                                  indx, oid, sizeof_oid);
 
272
                                  "certificationRequestInfo.subject.rdnSequence",
 
273
                                  indx, oid, sizeof_oid);
274
274
}
275
275
 
276
276
/* Parses an Attribute list in the asn1_struct, and searches for the
285
285
 */
286
286
static int
287
287
parse_attribute (ASN1_TYPE asn1_struct,
288
 
                 const char *attr_name, const char *given_oid, int indx,
289
 
                 int raw, char *buf, size_t * sizeof_buf)
 
288
                 const char *attr_name, const char *given_oid, int indx,
 
289
                 int raw, char *buf, size_t * sizeof_buf)
290
290
{
291
291
  int k1, result;
292
292
  char tmpbuffer1[ASN1_MAX_NAME_SIZE];
303
303
      /* create a string like "attribute.?1"
304
304
       */
305
305
      if (attr_name[0] != 0)
306
 
        snprintf (tmpbuffer1, sizeof (tmpbuffer1), "%s.?%u", attr_name, k1);
 
306
        snprintf (tmpbuffer1, sizeof (tmpbuffer1), "%s.?%u", attr_name, k1);
307
307
      else
308
 
        snprintf (tmpbuffer1, sizeof (tmpbuffer1), "?%u", k1);
 
308
        snprintf (tmpbuffer1, sizeof (tmpbuffer1), "?%u", k1);
309
309
 
310
310
      len = sizeof (value) - 1;
311
311
      result = asn1_read_value (asn1_struct, tmpbuffer1, value, &len);
312
312
 
313
313
      if (result == ASN1_ELEMENT_NOT_FOUND)
314
 
        {
315
 
          gnutls_assert ();
316
 
          break;
317
 
        }
 
314
        {
 
315
          gnutls_assert ();
 
316
          break;
 
317
        }
318
318
 
319
319
      if (result != ASN1_VALUE_NOT_FOUND)
320
 
        {
321
 
          gnutls_assert ();
322
 
          result = _gnutls_asn2err (result);
323
 
          goto cleanup;
324
 
        }
 
320
        {
 
321
          gnutls_assert ();
 
322
          result = _gnutls_asn2err (result);
 
323
          goto cleanup;
 
324
        }
325
325
 
326
326
      /* Move to the attibute type and values
327
327
       */
334
334
      result = asn1_read_value (asn1_struct, tmpbuffer3, oid, &len);
335
335
 
336
336
      if (result == ASN1_ELEMENT_NOT_FOUND)
337
 
        break;
 
337
        break;
338
338
      else if (result != ASN1_SUCCESS)
339
 
        {
340
 
          gnutls_assert ();
341
 
          result = _gnutls_asn2err (result);
342
 
          goto cleanup;
343
 
        }
 
339
        {
 
340
          gnutls_assert ();
 
341
          result = _gnutls_asn2err (result);
 
342
          goto cleanup;
 
343
        }
344
344
 
345
345
      if (strcmp (oid, given_oid) == 0)
346
 
        {                       /* Found the OID */
347
 
 
348
 
          /* Read the Value
349
 
           */
350
 
          snprintf (tmpbuffer3, sizeof (tmpbuffer3), "%s.values.?%u",
351
 
                    tmpbuffer1, indx + 1);
352
 
 
353
 
          len = sizeof (value) - 1;
354
 
          result = asn1_read_value (asn1_struct, tmpbuffer3, value, &len);
355
 
 
356
 
          if (result != ASN1_SUCCESS)
357
 
            {
358
 
              gnutls_assert ();
359
 
              result = _gnutls_asn2err (result);
360
 
              goto cleanup;
361
 
            }
362
 
 
363
 
          if (raw == 0)
364
 
            {
365
 
              printable = _gnutls_x509_oid_data_printable (oid);
366
 
              if (printable == 1)
367
 
                {
368
 
                  if ((result =
369
 
                       _gnutls_x509_oid_data2string
370
 
                       (oid, value, len, buf, sizeof_buf)) < 0)
371
 
                    {
372
 
                      gnutls_assert ();
373
 
                      goto cleanup;
374
 
                    }
375
 
                  return 0;
376
 
                }
377
 
              else
378
 
                {
379
 
                  gnutls_assert ();
380
 
                  return GNUTLS_E_X509_UNSUPPORTED_ATTRIBUTE;
381
 
                }
382
 
            }
383
 
          else
384
 
            {                   /* raw!=0 */
385
 
              if (*sizeof_buf >= (size_t) len && buf != NULL)
386
 
                {
387
 
                  *sizeof_buf = len;
388
 
                  memcpy (buf, value, len);
389
 
 
390
 
                  return 0;
391
 
                }
392
 
              else
393
 
                {
394
 
                  *sizeof_buf = len;
395
 
                  return GNUTLS_E_SHORT_MEMORY_BUFFER;
396
 
                }
397
 
            }
398
 
        }
 
346
        {                       /* Found the OID */
 
347
 
 
348
          /* Read the Value
 
349
           */
 
350
          snprintf (tmpbuffer3, sizeof (tmpbuffer3), "%s.values.?%u",
 
351
                    tmpbuffer1, indx + 1);
 
352
 
 
353
          len = sizeof (value) - 1;
 
354
          result = asn1_read_value (asn1_struct, tmpbuffer3, value, &len);
 
355
 
 
356
          if (result != ASN1_SUCCESS)
 
357
            {
 
358
              gnutls_assert ();
 
359
              result = _gnutls_asn2err (result);
 
360
              goto cleanup;
 
361
            }
 
362
 
 
363
          if (raw == 0)
 
364
            {
 
365
              printable = _gnutls_x509_oid_data_printable (oid);
 
366
              if (printable == 1)
 
367
                {
 
368
                  if ((result =
 
369
                       _gnutls_x509_oid_data2string
 
370
                       (oid, value, len, buf, sizeof_buf)) < 0)
 
371
                    {
 
372
                      gnutls_assert ();
 
373
                      goto cleanup;
 
374
                    }
 
375
                  return 0;
 
376
                }
 
377
              else
 
378
                {
 
379
                  gnutls_assert ();
 
380
                  return GNUTLS_E_X509_UNSUPPORTED_ATTRIBUTE;
 
381
                }
 
382
            }
 
383
          else
 
384
            {                   /* raw!=0 */
 
385
              if (*sizeof_buf >= (size_t) len && buf != NULL)
 
386
                {
 
387
                  *sizeof_buf = len;
 
388
                  memcpy (buf, value, len);
 
389
 
 
390
                  return 0;
 
391
                }
 
392
              else
 
393
                {
 
394
                  *sizeof_buf = len;
 
395
                  return GNUTLS_E_SHORT_MEMORY_BUFFER;
 
396
                }
 
397
            }
 
398
        }
399
399
 
400
400
    }
401
401
  while (1);
423
423
 **/
424
424
int
425
425
gnutls_x509_crq_get_challenge_password (gnutls_x509_crq_t crq,
426
 
                                        char *pass, size_t * sizeof_pass)
 
426
                                        char *pass, size_t * sizeof_pass)
427
427
{
428
428
  if (crq == NULL)
429
429
    {
432
432
    }
433
433
 
434
434
  return parse_attribute (crq->crq, "certificationRequestInfo.attributes",
435
 
                          "1.2.840.113549.1.9.7", 0, 0, pass, sizeof_pass);
 
435
                          "1.2.840.113549.1.9.7", 0, 0, pass, sizeof_pass);
436
436
}
437
437
 
438
438
/* This function will attempt to set the requested attribute in
442
442
 */
443
443
static int
444
444
add_attribute (ASN1_TYPE asn, const char *root, const char *attribute_id,
445
 
               const gnutls_datum_t * ext_data)
 
445
               const gnutls_datum_t * ext_data)
446
446
{
447
447
  int result;
448
448
  char name[ASN1_MAX_NAME_SIZE];
493
493
 */
494
494
static int
495
495
overwrite_attribute (ASN1_TYPE asn, const char *root, unsigned int indx,
496
 
                     const gnutls_datum_t * ext_data)
 
496
                     const gnutls_datum_t * ext_data)
497
497
{
498
498
  char name[ASN1_MAX_NAME_SIZE], name2[ASN1_MAX_NAME_SIZE];
499
499
  int result;
516
516
 
517
517
static int
518
518
set_attribute (ASN1_TYPE asn, const char *root,
519
 
               const char *ext_id, const gnutls_datum_t * ext_data)
 
519
               const char *ext_id, const gnutls_datum_t * ext_data)
520
520
{
521
521
  int result;
522
522
  int k, len;
539
539
       */
540
540
 
541
541
      if (result == ASN1_ELEMENT_NOT_FOUND)
542
 
        {
543
 
          break;
544
 
        }
 
542
        {
 
543
          break;
 
544
        }
545
545
 
546
546
      do
547
 
        {
548
 
 
549
 
          _gnutls_str_cpy (name2, sizeof (name2), name);
550
 
          _gnutls_str_cat (name2, sizeof (name2), ".type");
551
 
 
552
 
          len = sizeof (extnID) - 1;
553
 
          result = asn1_read_value (asn, name2, extnID, &len);
554
 
 
555
 
          if (result == ASN1_ELEMENT_NOT_FOUND)
556
 
            {
557
 
              gnutls_assert ();
558
 
              break;
559
 
            }
560
 
          else if (result != ASN1_SUCCESS)
561
 
            {
562
 
              gnutls_assert ();
563
 
              return _gnutls_asn2err (result);
564
 
            }
565
 
 
566
 
          /* Handle Extension
567
 
           */
568
 
          if (strcmp (extnID, ext_id) == 0)
569
 
            {
570
 
              /* attribute was found
571
 
               */
572
 
              return overwrite_attribute (asn, root, k, ext_data);
573
 
            }
574
 
 
575
 
 
576
 
        }
 
547
        {
 
548
 
 
549
          _gnutls_str_cpy (name2, sizeof (name2), name);
 
550
          _gnutls_str_cat (name2, sizeof (name2), ".type");
 
551
 
 
552
          len = sizeof (extnID) - 1;
 
553
          result = asn1_read_value (asn, name2, extnID, &len);
 
554
 
 
555
          if (result == ASN1_ELEMENT_NOT_FOUND)
 
556
            {
 
557
              gnutls_assert ();
 
558
              break;
 
559
            }
 
560
          else if (result != ASN1_SUCCESS)
 
561
            {
 
562
              gnutls_assert ();
 
563
              return _gnutls_asn2err (result);
 
564
            }
 
565
 
 
566
          /* Handle Extension
 
567
           */
 
568
          if (strcmp (extnID, ext_id) == 0)
 
569
            {
 
570
              /* attribute was found
 
571
               */
 
572
              return overwrite_attribute (asn, root, k, ext_data);
 
573
            }
 
574
 
 
575
 
 
576
        }
577
577
      while (0);
578
578
    }
579
579
  while (1);
608
608
 **/
609
609
int
610
610
gnutls_x509_crq_set_attribute_by_oid (gnutls_x509_crq_t crq,
611
 
                                      const char *oid, void *buf,
612
 
                                      size_t sizeof_buf)
 
611
                                      const char *oid, void *buf,
 
612
                                      size_t sizeof_buf)
613
613
{
614
614
  gnutls_datum_t data;
615
615
 
623
623
    }
624
624
 
625
625
  return set_attribute (crq->crq, "certificationRequestInfo.attributes",
626
 
                        oid, &data);
 
626
                        oid, &data);
627
627
}
628
628
 
629
629
/**
644
644
 **/
645
645
int
646
646
gnutls_x509_crq_get_attribute_by_oid (gnutls_x509_crq_t crq,
647
 
                                      const char *oid, int indx, void *buf,
648
 
                                      size_t * sizeof_buf)
 
647
                                      const char *oid, int indx, void *buf,
 
648
                                      size_t * sizeof_buf)
649
649
{
650
650
  if (crq == NULL)
651
651
    {
654
654
    }
655
655
 
656
656
  return parse_attribute (crq->crq, "certificationRequestInfo.attributes",
657
 
                          oid, indx, 1, buf, sizeof_buf);
 
657
                          oid, indx, 1, buf, sizeof_buf);
658
658
}
659
659
 
660
660
/**
680
680
 **/
681
681
int
682
682
gnutls_x509_crq_set_dn_by_oid (gnutls_x509_crq_t crq, const char *oid,
683
 
                               unsigned int raw_flag, const void *data,
684
 
                               unsigned int sizeof_data)
 
683
                               unsigned int raw_flag, const void *data,
 
684
                               unsigned int sizeof_data)
685
685
{
686
686
  if (sizeof_data == 0 || data == NULL || crq == NULL)
687
687
    {
689
689
    }
690
690
 
691
691
  return _gnutls_x509_set_dn_oid (crq->crq,
692
 
                                  "certificationRequestInfo.subject", oid,
693
 
                                  raw_flag, data, sizeof_data);
 
692
                                  "certificationRequestInfo.subject", oid,
 
693
                                  raw_flag, data, sizeof_data);
694
694
}
695
695
 
696
696
/**
755
755
  len = sizeof (version);
756
756
  if ((result =
757
757
       asn1_read_value (crq->crq, "certificationRequestInfo.version",
758
 
                        version, &len)) != ASN1_SUCCESS)
 
758
                        version, &len)) != ASN1_SUCCESS)
759
759
    {
760
760
 
761
761
      if (result == ASN1_ELEMENT_NOT_FOUND)
762
 
        return 1;               /* the DEFAULT version */
 
762
        return 1;               /* the DEFAULT version */
763
763
      gnutls_assert ();
764
764
      return _gnutls_asn2err (result);
765
765
    }
820
820
 **/
821
821
int
822
822
gnutls_x509_crq_get_key_rsa_raw (gnutls_x509_crq_t crq,
823
 
                                 gnutls_datum_t * m, gnutls_datum_t * e)
 
823
                                 gnutls_datum_t * m, gnutls_datum_t * e)
824
824
{
825
825
  int ret;
826
826
  bigint_t params[MAX_PUBLIC_PARAMS_SIZE];
888
888
 **/
889
889
int
890
890
gnutls_x509_crq_set_key_rsa_raw (gnutls_x509_crq_t crq,
891
 
                                 const gnutls_datum_t * m,
892
 
                                 const gnutls_datum_t * e)
 
891
                                 const gnutls_datum_t * m,
 
892
                                 const gnutls_datum_t * e)
893
893
{
894
894
  int result, ret;
895
895
  size_t siz = 0;
952
952
 **/
953
953
int
954
954
gnutls_x509_crq_set_challenge_password (gnutls_x509_crq_t crq,
955
 
                                        const char *pass)
 
955
                                        const char *pass)
956
956
{
957
957
  int result;
958
958
 
965
965
  /* Add the attribute.
966
966
   */
967
967
  result = asn1_write_value (crq->crq, "certificationRequestInfo.attributes",
968
 
                             "NEW", 1);
 
968
                             "NEW", 1);
969
969
  if (result != ASN1_SUCCESS)
970
970
    {
971
971
      gnutls_assert ();
1004
1004
 *   information in the certificate request (e.g., the version using
1005
1005
 *   gnutls_x509_crq_set_version()).
1006
1006
 *
 
1007
 * Deprecated: Use gnutls_x509_crq_privkey_sign() instead.
1007
1008
 **/
1008
1009
int
1009
1010
gnutls_x509_crq_sign2 (gnutls_x509_crq_t crq, gnutls_x509_privkey_t key,
1010
 
                       gnutls_digest_algorithm_t dig, unsigned int flags)
 
1011
                       gnutls_digest_algorithm_t dig, unsigned int flags)
1011
1012
{
1012
1013
  int result;
1013
 
  gnutls_datum_t signature;
 
1014
  gnutls_privkey_t privkey;
1014
1015
 
1015
1016
  if (crq == NULL)
1016
1017
    {
1018
1019
      return GNUTLS_E_INVALID_REQUEST;
1019
1020
    }
1020
1021
 
1021
 
  /* Make sure version field is set. */
1022
 
  if (gnutls_x509_crq_get_version (crq) == GNUTLS_E_ASN1_VALUE_NOT_FOUND)
1023
 
    {
1024
 
      result = gnutls_x509_crq_set_version (crq, 1);
1025
 
      if (result < 0)
1026
 
        {
1027
 
          gnutls_assert ();
1028
 
          return result;
1029
 
        }
1030
 
    }
1031
 
 
1032
 
  /* Step 1. Self sign the request.
1033
 
   */
1034
 
  result =
1035
 
    _gnutls_x509_sign_tbs (crq->crq, "certificationRequestInfo",
1036
 
                           dig, key, &signature);
1037
 
 
1038
 
  if (result < 0)
1039
 
    {
1040
 
      gnutls_assert ();
1041
 
      return result;
1042
 
    }
1043
 
 
1044
 
  /* Step 2. write the signature (bits)
1045
 
   */
1046
 
  result =
1047
 
    asn1_write_value (crq->crq, "signature", signature.data,
1048
 
                      signature.size * 8);
1049
 
 
1050
 
  _gnutls_free_datum (&signature);
1051
 
 
1052
 
  if (result != ASN1_SUCCESS)
1053
 
    {
1054
 
      gnutls_assert ();
1055
 
      return _gnutls_asn2err (result);
1056
 
    }
1057
 
 
1058
 
  /* Step 3. Write the signatureAlgorithm field.
1059
 
   */
1060
 
  result = _gnutls_x509_write_sig_params (crq->crq, "signatureAlgorithm",
1061
 
                                          key->pk_algorithm, dig, key->params,
1062
 
                                          key->params_size);
1063
 
  if (result < 0)
1064
 
    {
1065
 
      gnutls_assert ();
1066
 
      return result;
1067
 
    }
1068
 
 
1069
 
  return 0;
 
1022
  result = gnutls_privkey_init (&privkey);
 
1023
  if (result < 0)
 
1024
    {
 
1025
      gnutls_assert ();
 
1026
      return result;
 
1027
    }
 
1028
 
 
1029
  result = gnutls_privkey_import_x509 (privkey, key, 0);
 
1030
  if (result < 0)
 
1031
    {
 
1032
      gnutls_assert ();
 
1033
      goto fail;
 
1034
    }
 
1035
 
 
1036
  result = gnutls_x509_crq_privkey_sign (crq, privkey, dig, flags);
 
1037
  if (result < 0)
 
1038
    {
 
1039
      gnutls_assert ();
 
1040
      goto fail;
 
1041
    }
 
1042
 
 
1043
  result = 0;
 
1044
 
 
1045
fail:
 
1046
  gnutls_privkey_deinit (privkey);
 
1047
 
 
1048
  return result;
1070
1049
}
1071
1050
 
1072
1051
/**
1079
1058
 *
1080
1059
 * Returns: On success, %GNUTLS_E_SUCCESS is returned, otherwise a
1081
1060
 *   negative error value.
1082
 
 **/
 
1061
 *
 
1062
 * Deprecated: Use gnutls_x509_crq_privkey_sign() instead.
 
1063
 */
1083
1064
int
1084
1065
gnutls_x509_crq_sign (gnutls_x509_crq_t crq, gnutls_x509_privkey_t key)
1085
1066
{
1109
1090
 **/
1110
1091
int
1111
1092
gnutls_x509_crq_export (gnutls_x509_crq_t crq,
1112
 
                        gnutls_x509_crt_fmt_t format, void *output_data,
1113
 
                        size_t * output_data_size)
 
1093
                        gnutls_x509_crt_fmt_t format, void *output_data,
 
1094
                        size_t * output_data_size)
1114
1095
{
1115
1096
  if (crq == NULL)
1116
1097
    {
1119
1100
    }
1120
1101
 
1121
1102
  return _gnutls_x509_export_int (crq->crq, format, PEM_CRQ,
1122
 
                                  output_data, output_data_size);
 
1103
                                  output_data, output_data_size);
1123
1104
}
1124
1105
 
1125
1106
/**
1184
1165
 **/
1185
1166
int
1186
1167
gnutls_x509_crq_get_attribute_info (gnutls_x509_crq_t crq, int indx,
1187
 
                                    void *oid, size_t * sizeof_oid)
 
1168
                                    void *oid, size_t * sizeof_oid)
1188
1169
{
1189
1170
  int result;
1190
1171
  char name[ASN1_MAX_NAME_SIZE];
1197
1178
    }
1198
1179
 
1199
1180
  snprintf (name, sizeof (name),
1200
 
            "certificationRequestInfo.attributes.?%u.type", indx + 1);
 
1181
            "certificationRequestInfo.attributes.?%u.type", indx + 1);
1201
1182
 
1202
1183
  len = *sizeof_oid;
1203
1184
  result = asn1_read_value (crq->crq, name, oid, &len);
1240
1221
 **/
1241
1222
int
1242
1223
gnutls_x509_crq_get_attribute_data (gnutls_x509_crq_t crq, int indx,
1243
 
                                    void *data, size_t * sizeof_data)
 
1224
                                    void *data, size_t * sizeof_data)
1244
1225
{
1245
1226
  int result, len;
1246
1227
  char name[ASN1_MAX_NAME_SIZE];
1252
1233
    }
1253
1234
 
1254
1235
  snprintf (name, sizeof (name),
1255
 
            "certificationRequestInfo.attributes.?%u.values.?1", indx + 1);
 
1236
            "certificationRequestInfo.attributes.?%u.values.?1", indx + 1);
1256
1237
 
1257
1238
  len = *sizeof_data;
1258
1239
  result = asn1_read_value (crq->crq, name, data, &len);
1296
1277
 **/
1297
1278
int
1298
1279
gnutls_x509_crq_get_extension_info (gnutls_x509_crq_t crq, int indx,
1299
 
                                    void *oid, size_t * sizeof_oid,
1300
 
                                    int *critical)
 
1280
                                    void *oid, size_t * sizeof_oid,
 
1281
                                    int *critical)
1301
1282
{
1302
1283
  int result;
1303
1284
  char str_critical[10];
1315
1296
 
1316
1297
  /* read extensionRequest */
1317
1298
  result = gnutls_x509_crq_get_attribute_by_oid (crq, "1.2.840.113549.1.9.14",
1318
 
                                                 0, NULL, &extensions_size);
 
1299
                                                 0, NULL, &extensions_size);
1319
1300
  if (result == GNUTLS_E_SHORT_MEMORY_BUFFER)
1320
1301
    {
1321
1302
      extensions = gnutls_malloc (extensions_size);
1322
1303
      if (extensions == NULL)
1323
 
        {
1324
 
          gnutls_assert ();
1325
 
          return GNUTLS_E_MEMORY_ERROR;
1326
 
        }
 
1304
        {
 
1305
          gnutls_assert ();
 
1306
          return GNUTLS_E_MEMORY_ERROR;
 
1307
        }
1327
1308
 
1328
1309
      result = gnutls_x509_crq_get_attribute_by_oid (crq,
1329
 
                                                     "1.2.840.113549.1.9.14",
1330
 
                                                     0, extensions,
1331
 
                                                     &extensions_size);
 
1310
                                                     "1.2.840.113549.1.9.14",
 
1311
                                                     0, extensions,
 
1312
                                                     &extensions_size);
1332
1313
    }
1333
1314
  if (result < 0)
1334
1315
    {
1389
1370
  if (critical)
1390
1371
    {
1391
1372
      if (str_critical[0] == 'T')
1392
 
        *critical = 1;
 
1373
        *critical = 1;
1393
1374
      else
1394
 
        *critical = 0;
 
1375
        *critical = 0;
1395
1376
    }
1396
1377
 
1397
1378
  result = 0;
1426
1407
 **/
1427
1408
int
1428
1409
gnutls_x509_crq_get_extension_data (gnutls_x509_crq_t crq, int indx,
1429
 
                                    void *data, size_t * sizeof_data)
 
1410
                                    void *data, size_t * sizeof_data)
1430
1411
{
1431
1412
  int result, len;
1432
1413
  char name[ASN1_MAX_NAME_SIZE];
1442
1423
 
1443
1424
  /* read extensionRequest */
1444
1425
  result = gnutls_x509_crq_get_attribute_by_oid (crq, "1.2.840.113549.1.9.14",
1445
 
                                                 0, NULL, &extensions_size);
 
1426
                                                 0, NULL, &extensions_size);
1446
1427
  if (result != GNUTLS_E_SHORT_MEMORY_BUFFER)
1447
1428
    {
1448
1429
      gnutls_assert ();
1449
1430
      if (result == 0)
1450
 
        return GNUTLS_E_INTERNAL_ERROR;
 
1431
        return GNUTLS_E_INTERNAL_ERROR;
1451
1432
      return result;
1452
1433
    }
1453
1434
 
1459
1440
    }
1460
1441
 
1461
1442
  result = gnutls_x509_crq_get_attribute_by_oid (crq, "1.2.840.113549.1.9.14",
1462
 
                                                 0, extensions,
1463
 
                                                 &extensions_size);
 
1443
                                                 0, extensions,
 
1444
                                                 &extensions_size);
1464
1445
  if (result < 0)
1465
1446
    {
1466
1447
      gnutls_assert ();
1526
1507
 **/
1527
1508
int
1528
1509
gnutls_x509_crq_get_key_usage (gnutls_x509_crq_t crq,
1529
 
                               unsigned int *key_usage,
1530
 
                               unsigned int *critical)
 
1510
                               unsigned int *key_usage,
 
1511
                               unsigned int *critical)
1531
1512
{
1532
1513
  int result;
1533
1514
  uint16_t _usage;
1541
1522
    }
1542
1523
 
1543
1524
  result = gnutls_x509_crq_get_extension_by_oid (crq, "2.5.29.15", 0,
1544
 
                                                 buf, &buf_size, critical);
 
1525
                                                 buf, &buf_size, critical);
1545
1526
  if (result < 0)
1546
1527
    {
1547
1528
      gnutls_assert ();
1585
1566
 **/
1586
1567
int
1587
1568
gnutls_x509_crq_get_basic_constraints (gnutls_x509_crq_t crq,
1588
 
                                       unsigned int *critical,
1589
 
                                       int *ca, int *pathlen)
 
1569
                                       unsigned int *critical,
 
1570
                                       int *ca, int *pathlen)
1590
1571
{
1591
1572
  int result;
1592
1573
  int tmp_ca;
1600
1581
    }
1601
1582
 
1602
1583
  result = gnutls_x509_crq_get_extension_by_oid (crq, "2.5.29.19", 0,
1603
 
                                                 buf, &buf_size, critical);
 
1584
                                                 buf, &buf_size, critical);
1604
1585
  if (result < 0)
1605
1586
    {
1606
1587
      gnutls_assert ();
1609
1590
 
1610
1591
  result =
1611
1592
    _gnutls_x509_ext_extract_basicConstraints (&tmp_ca,
1612
 
                                               pathlen, buf, buf_size);
 
1593
                                               pathlen, buf, buf_size);
1613
1594
  if (ca)
1614
1595
    *ca = tmp_ca;
1615
1596
 
1624
1605
 
1625
1606
static int
1626
1607
get_subject_alt_name (gnutls_x509_crq_t crq,
1627
 
                      unsigned int seq, void *ret,
1628
 
                      size_t * ret_size, unsigned int *ret_type,
1629
 
                      unsigned int *critical, int othername_oid)
 
1608
                      unsigned int seq, void *ret,
 
1609
                      size_t * ret_size, unsigned int *ret_type,
 
1610
                      unsigned int *critical, int othername_oid)
1630
1611
{
1631
1612
  int result;
1632
1613
  ASN1_TYPE c2 = ASN1_TYPE_EMPTY;
1648
1629
  /* Extract extension.
1649
1630
   */
1650
1631
  result = gnutls_x509_crq_get_extension_by_oid (crq, "2.5.29.17", 0,
1651
 
                                                 NULL, &dns_size, critical);
 
1632
                                                 NULL, &dns_size, critical);
1652
1633
  if (result < 0)
1653
1634
    {
1654
1635
      gnutls_assert ();
1664
1645
    }
1665
1646
 
1666
1647
  result = gnutls_x509_crq_get_extension_by_oid (crq, "2.5.29.17", 0,
1667
 
                                                 dnsname.data, &dns_size,
1668
 
                                                 critical);
 
1648
                                                 dnsname.data, &dns_size,
 
1649
                                                 critical);
1669
1650
  if (result < 0)
1670
1651
    {
1671
1652
      gnutls_assert ();
1692
1673
    }
1693
1674
 
1694
1675
  result = _gnutls_parse_general_name (c2, "", seq, ret, ret_size,
1695
 
                                       ret_type, othername_oid);
 
1676
                                       ret_type, othername_oid);
1696
1677
  asn1_delete_structure (&c2);
1697
1678
  if (result < 0)
1698
1679
    {
1734
1715
 **/
1735
1716
int
1736
1717
gnutls_x509_crq_get_subject_alt_name (gnutls_x509_crq_t crq,
1737
 
                                      unsigned int seq, void *ret,
1738
 
                                      size_t * ret_size,
1739
 
                                      unsigned int *ret_type,
1740
 
                                      unsigned int *critical)
 
1718
                                      unsigned int seq, void *ret,
 
1719
                                      size_t * ret_size,
 
1720
                                      unsigned int *ret_type,
 
1721
                                      unsigned int *critical)
1741
1722
{
1742
1723
  return get_subject_alt_name (crq, seq, ret, ret_size, ret_type, critical,
1743
 
                               0);
 
1724
                               0);
1744
1725
}
1745
1726
 
1746
1727
/**
1773
1754
 **/
1774
1755
int
1775
1756
gnutls_x509_crq_get_subject_alt_othername_oid (gnutls_x509_crq_t crq,
1776
 
                                               unsigned int seq,
1777
 
                                               void *ret, size_t * ret_size)
 
1757
                                               unsigned int seq,
 
1758
                                               void *ret, size_t * ret_size)
1778
1759
{
1779
1760
  return get_subject_alt_name (crq, seq, ret, ret_size, NULL, NULL, 1);
1780
1761
}
1802
1783
 **/
1803
1784
int
1804
1785
gnutls_x509_crq_get_extension_by_oid (gnutls_x509_crq_t crq,
1805
 
                                      const char *oid, int indx,
1806
 
                                      void *buf, size_t * sizeof_buf,
1807
 
                                      unsigned int *critical)
 
1786
                                      const char *oid, int indx,
 
1787
                                      void *buf, size_t * sizeof_buf,
 
1788
                                      unsigned int *critical)
1808
1789
{
1809
1790
  int result;
1810
1791
  unsigned int i;
1815
1796
    {
1816
1797
      oid_size = sizeof (_oid);
1817
1798
      result =
1818
 
        gnutls_x509_crq_get_extension_info (crq, i, _oid, &oid_size,
1819
 
                                            critical);
 
1799
        gnutls_x509_crq_get_extension_info (crq, i, _oid, &oid_size,
 
1800
                                            critical);
1820
1801
      if (result < 0)
1821
 
        {
1822
 
          gnutls_assert ();
1823
 
          return result;
1824
 
        }
 
1802
        {
 
1803
          gnutls_assert ();
 
1804
          return result;
 
1805
        }
1825
1806
 
1826
1807
      if (strcmp (oid, _oid) == 0)
1827
 
        {                       /* found */
1828
 
          if (indx == 0)
1829
 
            return gnutls_x509_crq_get_extension_data (crq, i, buf,
1830
 
                                                       sizeof_buf);
1831
 
          else
1832
 
            indx--;
1833
 
        }
 
1808
        {                       /* found */
 
1809
          if (indx == 0)
 
1810
            return gnutls_x509_crq_get_extension_data (crq, i, buf,
 
1811
                                                       sizeof_buf);
 
1812
          else
 
1813
            indx--;
 
1814
        }
1834
1815
    }
1835
1816
 
1836
1817
 
1867
1848
 **/
1868
1849
int
1869
1850
gnutls_x509_crq_set_subject_alt_name (gnutls_x509_crq_t crq,
1870
 
                                      gnutls_x509_subject_alt_name_t nt,
1871
 
                                      const void *data,
1872
 
                                      unsigned int data_size,
1873
 
                                      unsigned int flags)
 
1851
                                      gnutls_x509_subject_alt_name_t nt,
 
1852
                                      const void *data,
 
1853
                                      unsigned int data_size,
 
1854
                                      unsigned int flags)
1874
1855
{
1875
1856
  int result = 0;
1876
1857
  gnutls_datum_t der_data = { NULL, 0 };
1889
1870
  if (flags == GNUTLS_FSAN_APPEND)
1890
1871
    {
1891
1872
      result = gnutls_x509_crq_get_extension_by_oid (crq, "2.5.29.17", 0,
1892
 
                                                     NULL, &prev_data_size,
1893
 
                                                     &critical);
 
1873
                                                     NULL, &prev_data_size,
 
1874
                                                     &critical);
1894
1875
      prev_der_data.size = prev_data_size;
1895
1876
 
1896
1877
      switch (result)
1897
 
        {
1898
 
        case GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE:
1899
 
          /* Replacing non-existing data means the same as set data. */
1900
 
          break;
1901
 
 
1902
 
        case GNUTLS_E_SUCCESS:
1903
 
          prev_der_data.data = gnutls_malloc (prev_der_data.size);
1904
 
          if (prev_der_data.data == NULL)
1905
 
            {
1906
 
              gnutls_assert ();
1907
 
              return GNUTLS_E_MEMORY_ERROR;
1908
 
            }
1909
 
 
1910
 
          result = gnutls_x509_crq_get_extension_by_oid (crq, "2.5.29.17", 0,
1911
 
                                                         prev_der_data.data,
1912
 
                                                         &prev_data_size,
1913
 
                                                         &critical);
1914
 
          if (result < 0)
1915
 
            {
1916
 
              gnutls_assert ();
1917
 
              gnutls_free (prev_der_data.data);
1918
 
              return result;
1919
 
            }
1920
 
          break;
1921
 
 
1922
 
        default:
1923
 
          gnutls_assert ();
1924
 
          return result;
1925
 
        }
 
1878
        {
 
1879
        case GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE:
 
1880
          /* Replacing non-existing data means the same as set data. */
 
1881
          break;
 
1882
 
 
1883
        case GNUTLS_E_SUCCESS:
 
1884
          prev_der_data.data = gnutls_malloc (prev_der_data.size);
 
1885
          if (prev_der_data.data == NULL)
 
1886
            {
 
1887
              gnutls_assert ();
 
1888
              return GNUTLS_E_MEMORY_ERROR;
 
1889
            }
 
1890
 
 
1891
          result = gnutls_x509_crq_get_extension_by_oid (crq, "2.5.29.17", 0,
 
1892
                                                         prev_der_data.data,
 
1893
                                                         &prev_data_size,
 
1894
                                                         &critical);
 
1895
          if (result < 0)
 
1896
            {
 
1897
              gnutls_assert ();
 
1898
              gnutls_free (prev_der_data.data);
 
1899
              return result;
 
1900
            }
 
1901
          break;
 
1902
 
 
1903
        default:
 
1904
          gnutls_assert ();
 
1905
          return result;
 
1906
        }
1926
1907
    }
1927
1908
 
1928
1909
  /* generate the extension.
1929
1910
   */
1930
1911
  result = _gnutls_x509_ext_gen_subject_alt_name (nt, data, data_size,
1931
 
                                                  &prev_der_data, &der_data);
 
1912
                                                  &prev_der_data, &der_data);
1932
1913
  gnutls_free (prev_der_data.data);
1933
1914
  if (result < 0)
1934
1915
    {
1937
1918
    }
1938
1919
 
1939
1920
  result = _gnutls_x509_crq_set_extension (crq, "2.5.29.17", &der_data,
1940
 
                                           critical);
 
1921
                                           critical);
1941
1922
 
1942
1923
  _gnutls_free_datum (&der_data);
1943
1924
 
1970
1951
 **/
1971
1952
int
1972
1953
gnutls_x509_crq_set_basic_constraints (gnutls_x509_crq_t crq,
1973
 
                                       unsigned int ca, int pathLenConstraint)
 
1954
                                       unsigned int ca, int pathLenConstraint)
1974
1955
{
1975
1956
  int result;
1976
1957
  gnutls_datum_t der_data;
1984
1965
  /* generate the extension.
1985
1966
   */
1986
1967
  result = _gnutls_x509_ext_gen_basicConstraints (ca, pathLenConstraint,
1987
 
                                                  &der_data);
 
1968
                                                  &der_data);
1988
1969
  if (result < 0)
1989
1970
    {
1990
1971
      gnutls_assert ();
2071
2052
 **/
2072
2053
int
2073
2054
gnutls_x509_crq_get_key_purpose_oid (gnutls_x509_crq_t crq,
2074
 
                                     int indx, void *oid, size_t * sizeof_oid,
2075
 
                                     unsigned int *critical)
 
2055
                                     int indx, void *oid, size_t * sizeof_oid,
 
2056
                                     unsigned int *critical)
2076
2057
{
2077
2058
  char tmpstr[ASN1_MAX_NAME_SIZE];
2078
2059
  int result, len;
2088
2069
  /* Extract extension.
2089
2070
   */
2090
2071
  result = gnutls_x509_crq_get_extension_by_oid (crq, "2.5.29.37", 0,
2091
 
                                                 NULL, &prev_size, critical);
 
2072
                                                 NULL, &prev_size, critical);
2092
2073
  prev.size = prev_size;
2093
2074
 
2094
2075
  if (result < 0)
2105
2086
    }
2106
2087
 
2107
2088
  result = gnutls_x509_crq_get_extension_by_oid (crq, "2.5.29.37", 0,
2108
 
                                                 prev.data, &prev_size,
2109
 
                                                 critical);
 
2089
                                                 prev.data, &prev_size,
 
2090
                                                 critical);
2110
2091
  if (result < 0)
2111
2092
    {
2112
2093
      gnutls_assert ();
2151
2132
  if (result != ASN1_SUCCESS)
2152
2133
    {
2153
2134
      if (result != ASN1_MEM_ERROR)
2154
 
        gnutls_assert ();
 
2135
        gnutls_assert ();
2155
2136
      return _gnutls_asn2err (result);
2156
2137
    }
2157
2138
 
2177
2158
 **/
2178
2159
int
2179
2160
gnutls_x509_crq_set_key_purpose_oid (gnutls_x509_crq_t crq,
2180
 
                                     const void *oid, unsigned int critical)
 
2161
                                     const void *oid, unsigned int critical)
2181
2162
{
2182
2163
  int result;
2183
2164
  gnutls_datum_t prev = { NULL, 0 }, der_data;
2187
2168
  /* Read existing extension, if there is one.
2188
2169
   */
2189
2170
  result = gnutls_x509_crq_get_extension_by_oid (crq, "2.5.29.37", 0,
2190
 
                                                 NULL, &prev_size, &critical);
 
2171
                                                 NULL, &prev_size, &critical);
2191
2172
  prev.size = prev_size;
2192
2173
 
2193
2174
  switch (result)
2199
2180
    case GNUTLS_E_SUCCESS:
2200
2181
      prev.data = gnutls_malloc (prev.size);
2201
2182
      if (prev.data == NULL)
2202
 
        {
2203
 
          gnutls_assert ();
2204
 
          return GNUTLS_E_MEMORY_ERROR;
2205
 
        }
 
2183
        {
 
2184
          gnutls_assert ();
 
2185
          return GNUTLS_E_MEMORY_ERROR;
 
2186
        }
2206
2187
 
2207
2188
      result = gnutls_x509_crq_get_extension_by_oid (crq, "2.5.29.37", 0,
2208
 
                                                     prev.data, &prev_size,
2209
 
                                                     &critical);
 
2189
                                                     prev.data, &prev_size,
 
2190
                                                     &critical);
2210
2191
      if (result < 0)
2211
 
        {
2212
 
          gnutls_assert ();
2213
 
          gnutls_free (prev.data);
2214
 
          return result;
2215
 
        }
 
2192
        {
 
2193
          gnutls_assert ();
 
2194
          gnutls_free (prev.data);
 
2195
          return result;
 
2196
        }
2216
2197
      break;
2217
2198
 
2218
2199
    default:
2221
2202
    }
2222
2203
 
2223
2204
  result = asn1_create_element (_gnutls_get_pkix (),
2224
 
                                "PKIX1.ExtKeyUsageSyntax", &c2);
 
2205
                                "PKIX1.ExtKeyUsageSyntax", &c2);
2225
2206
  if (result != ASN1_SUCCESS)
2226
2207
    {
2227
2208
      gnutls_assert ();
2236
2217
      result = asn1_der_decoding (&c2, prev.data, prev.size, NULL);
2237
2218
      gnutls_free (prev.data);
2238
2219
      if (result != ASN1_SUCCESS)
2239
 
        {
2240
 
          gnutls_assert ();
2241
 
          asn1_delete_structure (&c2);
2242
 
          return _gnutls_asn2err (result);
2243
 
        }
 
2220
        {
 
2221
          gnutls_assert ();
 
2222
          asn1_delete_structure (&c2);
 
2223
          return _gnutls_asn2err (result);
 
2224
        }
2244
2225
    }
2245
2226
 
2246
2227
  /* generate the extension.
2275
2256
    }
2276
2257
 
2277
2258
  result = _gnutls_x509_crq_set_extension (crq, "2.5.29.37",
2278
 
                                           &der_data, critical);
 
2259
                                           &der_data, critical);
2279
2260
  _gnutls_free_datum (&der_data);
2280
2261
  if (result < 0)
2281
2262
    {
2288
2269
 
2289
2270
static int
2290
2271
rsadsa_crq_get_key_id (gnutls_x509_crq_t crq, int pk,
2291
 
                       unsigned char *output_data, size_t * output_data_size)
 
2272
                       unsigned char *output_data, size_t * output_data_size)
2292
2273
{
2293
2274
  bigint_t params[MAX_PUBLIC_PARAMS_SIZE];
2294
2275
  int params_size = MAX_PUBLIC_PARAMS_SIZE;
2307
2288
    {
2308
2289
      result = _gnutls_x509_write_rsa_params (params, params_size, &der);
2309
2290
      if (result < 0)
2310
 
        {
2311
 
          gnutls_assert ();
2312
 
          goto cleanup;
2313
 
        }
 
2291
        {
 
2292
          gnutls_assert ();
 
2293
          goto cleanup;
 
2294
        }
2314
2295
    }
2315
2296
  else if (pk == GNUTLS_PK_DSA)
2316
2297
    {
2317
2298
      result = _gnutls_x509_write_dsa_public_key (params, params_size, &der);
2318
2299
      if (result < 0)
2319
 
        {
2320
 
          gnutls_assert ();
2321
 
          goto cleanup;
2322
 
        }
 
2300
        {
 
2301
          gnutls_assert ();
 
2302
          goto cleanup;
 
2303
        }
2323
2304
    }
2324
2305
  else
2325
2306
    return GNUTLS_E_INTERNAL_ERROR;
2375
2356
 **/
2376
2357
int
2377
2358
gnutls_x509_crq_get_key_id (gnutls_x509_crq_t crq, unsigned int flags,
2378
 
                            unsigned char *output_data,
2379
 
                            size_t * output_data_size)
 
2359
                            unsigned char *output_data,
 
2360
                            size_t * output_data_size)
2380
2361
{
2381
2362
  int pk, result = 0;
2382
2363
  gnutls_datum_t pubkey;
2413
2394
  pubkey.size = 0;
2414
2395
  result =
2415
2396
    asn1_der_coding (crq->crq, "certificationRequestInfo.subjectPKInfo", NULL,
2416
 
                     &pubkey.size, NULL);
 
2397
                     &pubkey.size, NULL);
2417
2398
  if (result != ASN1_MEM_ERROR)
2418
2399
    {
2419
2400
      gnutls_assert ();
2429
2410
 
2430
2411
  result =
2431
2412
    asn1_der_coding (crq->crq, "certificationRequestInfo.subjectPKInfo",
2432
 
                     pubkey.data, &pubkey.size, NULL);
 
2413
                     pubkey.data, &pubkey.size, NULL);
2433
2414
  if (result != ASN1_SUCCESS)
2434
2415
    {
2435
2416
      gnutls_assert ();
2438
2419
    }
2439
2420
 
2440
2421
  result = gnutls_fingerprint (GNUTLS_DIG_SHA1, &pubkey,
2441
 
                               output_data, output_data_size);
 
2422
                               output_data, output_data_size);
2442
2423
 
2443
2424
  gnutls_free (pubkey.data);
2444
2425
 
2445
2426
  return result;
2446
2427
}
2447
2428
 
 
2429
/**
 
2430
 * gnutls_x509_crq_privkey_sign:
 
2431
 * @crq: should contain a #gnutls_x509_crq_t structure
 
2432
 * @key: holds a private key
 
2433
 * @dig: The message digest to use, i.e., %GNUTLS_DIG_SHA1
 
2434
 * @flags: must be 0
 
2435
 *
 
2436
 * This function will sign the certificate request with a private key.
 
2437
 * This must be the same key as the one used in
 
2438
 * gnutls_x509_crt_set_key() since a certificate request is self
 
2439
 * signed.
 
2440
 *
 
2441
 * This must be the last step in a certificate request generation
 
2442
 * since all the previously set parameters are now signed.
 
2443
 *
 
2444
 * Returns: %GNUTLS_E_SUCCESS on success, otherwise an error.
 
2445
 *   %GNUTLS_E_ASN1_VALUE_NOT_FOUND is returned if you didn't set all
 
2446
 *   information in the certificate request (e.g., the version using
 
2447
 *   gnutls_x509_crq_set_version()).
 
2448
 *
 
2449
 **/
 
2450
int
 
2451
gnutls_x509_crq_privkey_sign (gnutls_x509_crq_t crq, gnutls_privkey_t key,
 
2452
                              gnutls_digest_algorithm_t dig,
 
2453
                              unsigned int flags)
 
2454
{
 
2455
  int result;
 
2456
  gnutls_datum_t signature;
 
2457
  gnutls_datum_t tbs;
 
2458
 
 
2459
  if (crq == NULL)
 
2460
    {
 
2461
      gnutls_assert ();
 
2462
      return GNUTLS_E_INVALID_REQUEST;
 
2463
    }
 
2464
 
 
2465
  /* Make sure version field is set. */
 
2466
  if (gnutls_x509_crq_get_version (crq) == GNUTLS_E_ASN1_VALUE_NOT_FOUND)
 
2467
    {
 
2468
      result = gnutls_x509_crq_set_version (crq, 1);
 
2469
      if (result < 0)
 
2470
        {
 
2471
          gnutls_assert ();
 
2472
          return result;
 
2473
        }
 
2474
    }
 
2475
 
 
2476
  /* Step 1. Self sign the request.
 
2477
   */
 
2478
  result = _gnutls_x509_get_tbs (crq->crq, "certificationRequestInfo", &tbs);
 
2479
 
 
2480
  if (result < 0)
 
2481
    {
 
2482
      gnutls_assert ();
 
2483
      return result;
 
2484
    }
 
2485
 
 
2486
  result = gnutls_privkey_sign_data (key, dig, 0, &tbs, &signature);
 
2487
  gnutls_free (tbs.data);
 
2488
 
 
2489
  if (result < 0)
 
2490
    {
 
2491
      gnutls_assert ();
 
2492
      return result;
 
2493
    }
 
2494
 
 
2495
  /* Step 2. write the signature (bits)
 
2496
   */
 
2497
  result =
 
2498
    asn1_write_value (crq->crq, "signature", signature.data,
 
2499
                      signature.size * 8);
 
2500
 
 
2501
  _gnutls_free_datum (&signature);
 
2502
 
 
2503
  if (result != ASN1_SUCCESS)
 
2504
    {
 
2505
      gnutls_assert ();
 
2506
      return _gnutls_asn2err (result);
 
2507
    }
 
2508
 
 
2509
  /* Step 3. Write the signatureAlgorithm field.
 
2510
   */
 
2511
  result = _gnutls_x509_write_sig_params (crq->crq, "signatureAlgorithm",
 
2512
                                          gnutls_privkey_get_pk_algorithm
 
2513
                                          (key, NULL), dig);
 
2514
  if (result < 0)
 
2515
    {
 
2516
      gnutls_assert ();
 
2517
      return result;
 
2518
    }
 
2519
 
 
2520
  return 0;
 
2521
}
 
2522
 
 
2523
 
 
2524
/**
 
2525
 * gnutls_x509_crq_verify:
 
2526
 * @crq: is the crq to be verified
 
2527
 * @flags: Flags that may be used to change the verification algorithm. Use OR of the gnutls_certificate_verify_flags enumerations.
 
2528
 *
 
2529
 * This function will verify self signature in the certificate
 
2530
 * request and return its status.
 
2531
 *
 
2532
 * Returns: On success, %GNUTLS_E_SUCCESS is returned, %GNUTLS_E_PK_SIG_VERIFY_FAILED
 
2533
 * if verification failed, otherwise a negative error value.
 
2534
 **/
 
2535
int
 
2536
gnutls_x509_crq_verify (gnutls_x509_crq_t crq,
 
2537
                        unsigned int flags)
 
2538
{
 
2539
gnutls_datum data = { NULL, 0 };
 
2540
gnutls_datum signature = { NULL, 0 };
 
2541
bigint_t params[MAX_PUBLIC_PARAMS_SIZE];
 
2542
int ret, params_size = 0, i;
 
2543
 
 
2544
  ret =
 
2545
    _gnutls_x509_get_signed_data (crq->crq, "certificationRequestInfo", &data);
 
2546
  if (ret < 0)
 
2547
    {
 
2548
      gnutls_assert ();
 
2549
      return ret;
 
2550
    }
 
2551
 
 
2552
  ret = _gnutls_x509_get_signature (crq->crq, "signature", &signature);
 
2553
  if (ret < 0)
 
2554
    {
 
2555
      gnutls_assert ();
 
2556
      goto cleanup;
 
2557
    }
 
2558
 
 
2559
  params_size = MAX_PUBLIC_PARAMS_SIZE;
 
2560
  ret =
 
2561
    _gnutls_x509_crq_get_mpis(crq, params, &params_size);
 
2562
  if (ret < 0)
 
2563
    {
 
2564
      gnutls_assert ();
 
2565
      goto cleanup;
 
2566
    }
 
2567
 
 
2568
  ret = pubkey_verify_sig(&data, NULL, &signature,
 
2569
                          gnutls_x509_crq_get_pk_algorithm (crq, NULL),
 
2570
    params, params_size);
 
2571
  if (ret < 0)
 
2572
    {
 
2573
      gnutls_assert ();
 
2574
      goto cleanup;
 
2575
    }
 
2576
 
 
2577
  ret = 0;
 
2578
 
 
2579
cleanup:
 
2580
  _gnutls_free_datum (&data);
 
2581
  _gnutls_free_datum (&signature);
 
2582
 
 
2583
  for (i = 0; i < params_size; i++)
 
2584
      {
 
2585
            _gnutls_mpi_release (&params[i]);
 
2586
      }
 
2587
 
 
2588
  return ret;
 
2589
}
2448
2590
 
2449
2591
#endif /* ENABLE_PKI */
 
2592