/** * gnutls_x509_crt_set_crq_extensions: * @crt: a certificate of type #gnutls_x509_crt_t * @crq: holds a certificate request * * This function will set extensions from the given request to the * certificate. * * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a * negative error value. * * Since: 2.8.0 **/ int gnutls_x509_crt_set_crq_extensions(gnutls_x509_crt_t crt, gnutls_x509_crq_t crq) { size_t i; if (crt == NULL || crq == NULL) { gnutls_assert(); return GNUTLS_E_INVALID_REQUEST; } for (i = 0;; i++) { int result; char oid[MAX_OID_SIZE]; size_t oid_size; uint8_t *extensions; size_t extensions_size; unsigned int critical; gnutls_datum_t ext; oid_size = sizeof(oid); result = gnutls_x509_crq_get_extension_info(crq, i, oid, &oid_size, &critical); if (result < 0) { if (result == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) break; gnutls_assert(); return result; } extensions_size = 0; result = gnutls_x509_crq_get_extension_data(crq, i, NULL, &extensions_size); if (result < 0) { gnutls_assert(); return result; } extensions = gnutls_malloc(extensions_size); if (extensions == NULL) { gnutls_assert(); return GNUTLS_E_MEMORY_ERROR; } result = gnutls_x509_crq_get_extension_data(crq, i, extensions, &extensions_size); if (result < 0) { gnutls_assert(); gnutls_free(extensions); return result; } ext.data = extensions; ext.size = extensions_size; result = _gnutls_x509_crt_set_extension(crt, oid, &ext, critical); gnutls_free(extensions); if (result < 0) { gnutls_assert(); return result; } } if (i > 0) crt->use_extensions = 1; return 0; }
void doit (void) { gnutls_x509_privkey_t pkey; gnutls_x509_crt_t crt; gnutls_x509_crq_t crq; gnutls_datum_t out; size_t s = 0; char smallbuf[10]; int ret; ret = gnutls_global_init (); if (ret < 0) fail ("gnutls_global_init\n"); gnutls_global_set_log_function (tls_log_func); if (debug) gnutls_global_set_log_level (4711); ret = gnutls_x509_crq_init (&crq); if (ret != 0) fail ("gnutls_x509_crq_init\n"); ret = gnutls_x509_privkey_init (&pkey); if (ret != 0) fail ("gnutls_x509_privkey_init\n"); ret = gnutls_x509_crt_init (&crt); if (ret != 0) fail ("gnutls_x509_crt_init\n"); ret = gnutls_x509_privkey_import (pkey, &key, GNUTLS_X509_FMT_PEM); if (ret != 0) fail ("gnutls_x509_privkey_import\n"); ret = gnutls_x509_crq_set_version (crq, 0); if (ret != 0) fail ("gnutls_x509_crq_set_version\n"); ret = gnutls_x509_crq_set_key (crq, pkey); if (ret != 0) fail ("gnutls_x509_crq_set_key\n"); s = 0; ret = gnutls_x509_crq_get_extension_info (crq, 0, NULL, &s, NULL); if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) fail ("gnutls_x509_crq_get_extension_info\n"); ret = gnutls_x509_crq_set_basic_constraints (crq, 0, 0); if (ret != 0) fail ("gnutls_x509_crq_set_basic_constraints %d\n", ret); ret = gnutls_x509_crq_set_key_usage (crq, 0); if (ret != 0) fail ("gnutls_x509_crq_set_key_usage %d\n", ret); ret = gnutls_x509_crq_get_challenge_password (crq, NULL, &s); if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) fail ("gnutls_x509_crq_get_challenge_password %d\n", ret); ret = gnutls_x509_crq_set_challenge_password (crq, "foo"); if (ret != 0) fail ("gnutls_x509_crq_set_challenge_password %d\n", ret); s = 0; ret = gnutls_x509_crq_get_challenge_password (crq, NULL, &s); if (ret != 0 || s != 3) fail ("gnutls_x509_crq_get_challenge_password2 %d/%d\n", ret, (int) s); s = 10; ret = gnutls_x509_crq_get_challenge_password (crq, smallbuf, &s); if (ret != 0 || s != 3 || strcmp (smallbuf, "foo") != 0) fail ("gnutls_x509_crq_get_challenge_password3 %d/%d/%s\n", ret, (int) s, smallbuf); s = 0; ret = gnutls_x509_crq_get_extension_info (crq, 0, NULL, &s, NULL); if (ret != 0) fail ("gnutls_x509_crq_get_extension_info2\n"); s = 0; ret = gnutls_x509_crq_get_extension_data (crq, 0, NULL, &s); if (ret != 0) fail ("gnutls_x509_crq_get_extension_data\n"); ret = gnutls_x509_crq_set_subject_alt_name (crq, GNUTLS_SAN_DNSNAME, "foo", 3, 1); if (ret != 0) fail ("gnutls_x509_crq_set_subject_alt_name\n"); ret = gnutls_x509_crq_set_subject_alt_name (crq, GNUTLS_SAN_DNSNAME, "bar", 3, 1); if (ret != 0) fail ("gnutls_x509_crq_set_subject_alt_name\n"); ret = gnutls_x509_crq_set_subject_alt_name (crq, GNUTLS_SAN_DNSNAME, "apa", 3, 0); if (ret != 0) fail ("gnutls_x509_crq_set_subject_alt_name\n"); ret = gnutls_x509_crq_set_subject_alt_name (crq, GNUTLS_SAN_DNSNAME, "foo", 3, 1); if (ret != 0) fail ("gnutls_x509_crq_set_subject_alt_name\n"); s = 0; ret = gnutls_x509_crq_get_key_purpose_oid (crq, 0, NULL, &s, NULL); if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) fail ("gnutls_x509_crq_get_key_purpose_oid %d\n", ret); s = 0; ret = gnutls_x509_crq_set_key_purpose_oid (crq, GNUTLS_KP_TLS_WWW_SERVER, 0); if (ret != 0) fail ("gnutls_x509_crq_set_key_purpose_oid %d\n", ret); s = 0; ret = gnutls_x509_crq_get_key_purpose_oid (crq, 0, NULL, &s, NULL); if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER) fail ("gnutls_x509_crq_get_key_purpose_oid %d\n", ret); s = 0; ret = gnutls_x509_crq_set_key_purpose_oid (crq, GNUTLS_KP_TLS_WWW_CLIENT, 1); if (ret != 0) fail ("gnutls_x509_crq_set_key_purpose_oid2 %d\n", ret); ret = gnutls_x509_crq_print (crq, GNUTLS_CRT_PRINT_FULL, &out); if (ret != 0) fail ("gnutls_x509_crq_print\n"); if (debug) printf ("crq: %.*s\n", out.size, out.data); gnutls_free (out.data); ret = gnutls_x509_crt_set_version (crt, 3); if (ret != 0) fail ("gnutls_x509_crt_set_version\n"); ret = gnutls_x509_crt_set_crq_extensions (crt, crq); if (ret != 0) fail ("gnutls_x509_crt_set_crq_extensions\n"); ret = gnutls_x509_crt_print (crt, GNUTLS_CRT_PRINT_FULL, &out); if (ret != 0) fail ("gnutls_x509_crt_print\n"); if (debug) printf ("crt: %.*s\n", out.size, out.data); gnutls_free (out.data); gnutls_x509_crq_deinit (crq); gnutls_x509_crt_deinit (crt); gnutls_x509_privkey_deinit (pkey); gnutls_global_deinit (); }
static gnutls_x509_crq_t generate_crq(void) { gnutls_x509_crq_t crq; gnutls_x509_privkey_t pkey; const char *err; int ret; size_t s = 0; char smallbuf[10]; gnutls_datum_t out; unsigned crit; ret = gnutls_x509_privkey_init(&pkey); if (ret != 0) fail("gnutls_x509_privkey_init\n"); ret = gnutls_x509_privkey_import(pkey, &key, GNUTLS_X509_FMT_PEM); if (ret != 0) fail("gnutls_x509_privkey_import\n"); ret = gnutls_x509_crq_init(&crq); if (ret != 0) fail("gnutls_x509_crq_init\n"); ret = gnutls_x509_crq_set_version(crq, 0); if (ret != 0) fail("gnutls_x509_crq_set_version\n"); ret = gnutls_x509_crq_set_key(crq, pkey); if (ret != 0) fail("gnutls_x509_crq_set_key\n"); s = 0; ret = gnutls_x509_crq_get_extension_info(crq, 0, NULL, &s, NULL); if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) fail("gnutls_x509_crq_get_extension_info\n"); ret = gnutls_x509_crq_set_basic_constraints(crq, 0, 0); if (ret != 0) fail("gnutls_x509_crq_set_basic_constraints %d\n", ret); ret = gnutls_x509_crq_set_key_usage(crq, 0); if (ret != 0) fail("gnutls_x509_crq_set_key_usage %d\n", ret); ret = gnutls_x509_crq_get_challenge_password(crq, NULL, &s); if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) fail("%d: gnutls_x509_crq_get_challenge_password %d: %s\n", __LINE__, ret, gnutls_strerror(ret)); ret = gnutls_x509_crq_set_dn(crq, "o = none to\\, mention,cn = nikos", &err); if (ret < 0) { fail("gnutls_x509_crq_set_dn: %s, %s\n", gnutls_strerror(ret), err); } ret = gnutls_x509_crq_set_challenge_password(crq, "foo"); if (ret != 0) fail("gnutls_x509_crq_set_challenge_password %d\n", ret); s = 0; ret = gnutls_x509_crq_get_challenge_password(crq, NULL, &s); if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER || s != 4) fail("%d: gnutls_x509_crq_get_challenge_password %d: %s (passlen: %d)\n", __LINE__, ret, gnutls_strerror(ret), (int) s); s = 10; ret = gnutls_x509_crq_get_challenge_password(crq, smallbuf, &s); if (ret != 0 || s != 3 || strcmp(smallbuf, "foo") != 0) fail("%d: gnutls_x509_crq_get_challenge_password3 %d/%d/%s\n", __LINE__, ret, (int) s, smallbuf); s = 0; ret = gnutls_x509_crq_get_extension_info(crq, 0, NULL, &s, NULL); if (ret != 0) fail("gnutls_x509_crq_get_extension_info2\n"); s = 0; ret = gnutls_x509_crq_get_extension_data(crq, 0, NULL, &s); if (ret != 0) fail("gnutls_x509_crq_get_extension_data\n"); ret = gnutls_x509_crq_set_subject_alt_name(crq, GNUTLS_SAN_DNSNAME, "foo", 3, 1); if (ret != 0) fail("gnutls_x509_crq_set_subject_alt_name\n"); ret = gnutls_x509_crq_set_subject_alt_name(crq, GNUTLS_SAN_DNSNAME, "bar", 3, 1); if (ret != 0) fail("gnutls_x509_crq_set_subject_alt_name\n"); ret = gnutls_x509_crq_set_subject_alt_name(crq, GNUTLS_SAN_DNSNAME, "apa", 3, 0); if (ret != 0) fail("gnutls_x509_crq_set_subject_alt_name\n"); ret = gnutls_x509_crq_set_subject_alt_name(crq, GNUTLS_SAN_DNSNAME, "foo", 3, 1); if (ret != 0) fail("gnutls_x509_crq_set_subject_alt_name\n"); ret = gnutls_x509_crq_set_subject_alt_name(crq, GNUTLS_SAN_DNSNAME, "νίκο.com", strlen("νίκο.com"), GNUTLS_FSAN_APPEND); if (ret != 0) fail("gnutls_x509_crq_set_subject_alt_name\n"); s = 0; ret = gnutls_x509_crq_get_key_purpose_oid(crq, 0, NULL, &s, NULL); if (ret != GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) fail("gnutls_x509_crq_get_key_purpose_oid %d\n", ret); s = 0; ret = gnutls_x509_crq_set_key_purpose_oid(crq, GNUTLS_KP_TLS_WWW_SERVER, 0); if (ret != 0) fail("gnutls_x509_crq_set_key_purpose_oid %d\n", ret); s = 0; ret = gnutls_x509_crq_get_key_purpose_oid(crq, 0, NULL, &s, NULL); if (ret != GNUTLS_E_SHORT_MEMORY_BUFFER) fail("gnutls_x509_crq_get_key_purpose_oid %d\n", ret); s = 0; ret = gnutls_x509_crq_set_key_purpose_oid(crq, GNUTLS_KP_TLS_WWW_CLIENT, 1); if (ret != 0) fail("gnutls_x509_crq_set_key_purpose_oid2 %d\n", ret); #define EXT_ID1 "1.2.3.4.5" #define EXT_ID2 "1.5.3.555555991.5" #define EXT_DATA1 "\xCA\xFE\xFF" #define EXT_DATA2 "\xCA\xFE\xFF\xFA\xFE" /* test writing arbitrary extensions */ ret = gnutls_x509_crq_set_extension_by_oid(crq, EXT_ID1, EXT_DATA1, sizeof(EXT_DATA1)-1, 0); if (ret != 0) fail("gnutls_x509_crq_set_extension_by_oid %s\n", gnutls_strerror(ret)); ret = gnutls_x509_crq_set_extension_by_oid(crq, EXT_ID2, EXT_DATA2, sizeof(EXT_DATA2)-1, 1); if (ret != 0) fail("gnutls_x509_crq_set_extension_by_oid %s\n", gnutls_strerror(ret)); ret = gnutls_x509_crq_print(crq, GNUTLS_CRT_PRINT_FULL, &out); if (ret != 0) fail("gnutls_x509_crq_print\n"); if (debug) printf("crq: %.*s\n", out.size, out.data); gnutls_free(out.data); ret = gnutls_x509_crq_sign2(crq, pkey, GNUTLS_DIG_SHA256, 0); if (ret < 0) fail("gnutls_x509_crq_sign2: %s\n", gnutls_strerror(ret)); gnutls_x509_privkey_deinit(pkey); /* test reading the arb. extensions */ crit = -1; ret = gnutls_x509_crq_get_extension_by_oid2(crq, EXT_ID1, 0, &out, &crit); if (ret < 0) fail("gnutls_x509_crq_get_extension_by_oid2: %s\n", gnutls_strerror(ret)); if (out.size != sizeof(EXT_DATA1)-1 || memcmp(out.data, EXT_DATA1, out.size) != 0) { fail("ext1 doesn't match\n"); } if (crit != 0) { fail("ext1 crit flag doesn't match\n"); } gnutls_free(out.data); crit = -1; ret = gnutls_x509_crq_get_extension_by_oid2(crq, EXT_ID2, 0, &out, &crit); if (ret < 0) fail("gnutls_x509_crq_get_extension_by_oid2: %s\n", gnutls_strerror(ret)); if (out.size != sizeof(EXT_DATA2)-1 || memcmp(out.data, EXT_DATA2, out.size) != 0) { fail("ext2 doesn't match\n"); } if (crit != 1) { fail("ext2 crit flag doesn't match\n"); } gnutls_free(out.data); return crq; }