chapters/

doc/Makefile.am

@@ -3,5 +3,5 @@ EXTRA_DIST = $(man_MANS) Doxyfile
 
 DISTCLEANFILES = microhttpd.cps tutorial.cps
 info_TEXINFOS = microhttpd.texi tutorial.texi
-microhttpd_TEXINFOS = lgpl.texi basicauthentication.inc bibliography.inc exploringrequests.inc fdl-1.2.texi hellobrowser.inc introduction.inc processingpost.inc responseheaders.inc 
+microhttpd_TEXINFOS = lgpl.texi chapters/basicauthentication.inc chapters/bibliography.inc chapters/exploringrequests.inc fdl-1.2.texi chapters/hellobrowser.inc chapters/introduction.inc chapters/processingpost.inc chapters/responseheaders.inc 
 

src/daemon/https/tls/gnutls_global.c

@@ -94,14 +94,6 @@ MHD_gtls_global_set_log_level (int level)
   _gnutls_log_level = level;
 }
 
-extern gnutls_alloc_function gnutls_secure_malloc;
-extern gnutls_alloc_function gnutls_malloc;
-extern gnutls_free_function gnutls_free;
-extern int (*_gnutls_is_secure_memory) (const void *);
-extern gnutls_realloc_function gnutls_realloc;
-extern char *(*gnutls_strdup) (const char *);
-extern void *(*gnutls_calloc) (size_t, size_t);
-
 int _gnutls_is_secure_mem_null (const void *);
 
 /**

src/daemon/https/tls/gnutls_x509.c

@@ -249,8 +249,8 @@ _gnutls_check_key_cert_match (mhd_gtls_cert_credentials_t res)
 }
 
 /* Reads a DER encoded certificate list from memory and stores it to
- * a gnutls_cert structure. This is only called if PKCS7 read fails.
- * returns the number of certificates parsed (1)
+ * a gnutls_cert structure.
+ * Returns the number of certificates parsed.
  */
 static int
 parse_crt_mem (gnutls_cert ** cert_list, unsigned *ncerts,
@@ -284,8 +284,8 @@ parse_crt_mem (gnutls_cert ** cert_list, unsigned *ncerts,
 }
 
 /* Reads a DER encoded certificate list from memory and stores it to
- * a gnutls_cert structure. This is only called if PKCS7 read fails.
- * returns the number of certificates parsed (1)
+ * a gnutls_cert structure. 
+ * Returns the number of certificates parsed.
  */
 static int
 parse_der_cert_mem (gnutls_cert ** cert_list, unsigned *ncerts,
@@ -319,134 +319,6 @@ parse_der_cert_mem (gnutls_cert ** cert_list, unsigned *ncerts,
   return ret;
 }
 
-#define CERT_PEM 1
-
-
-/* Reads a PKCS7 base64 encoded certificate list from memory and stores it to
- * a gnutls_cert structure.
- * returns the number of certificate parsed
- */
-static int
-parse_pkcs7_cert_mem (gnutls_cert ** cert_list, unsigned *ncerts, const
-                      void *input_cert, int input_cert_size, int flags)
-{
-#ifdef ENABLE_PKI
-  int i, j, count;
-  gnutls_datum_t tmp, tmp2;
-  int ret;
-  opaque *pcert = NULL;
-  size_t pcert_size;
-  gnutls_pkcs7_t pkcs7;
-
-  ret = gnutls_pkcs7_init (&pkcs7);
-  if (ret < 0)
-    {
-      gnutls_assert ();
-      return ret;
-    }
-  tmp.data = (opaque * ) input_cert;
-  tmp.size = input_cert_size;
-  if (flags & CERT_PEM)
-    ret = gnutls_pkcs7_import (pkcs7, &tmp, GNUTLS_X509_FMT_PEM);
-  else
-    ret = gnutls_pkcs7_import (pkcs7, &tmp, GNUTLS_X509_FMT_DER);
-  if (ret < 0)
-    {
-      /* if we failed to read the structure,
-       * then just try to decode a plain DER
-       * certificate.
-       */
-      gnutls_assert ();
-      gnutls_pkcs7_deinit (pkcs7);
-#endif
-      return parse_der_cert_mem (cert_list, ncerts,
-                                 input_cert, input_cert_size);
-#ifdef ENABLE_PKI
-    }
-
-  i = *ncerts + 1;
-
-  /* tmp now contains the decoded certificate list */
-  tmp.data = (opaque *) input_cert;
-  tmp.size = input_cert_size;
-
-  ret = gnutls_pkcs7_get_crt_count (pkcs7);
-
-  if (ret < 0)
-    {
-      gnutls_assert ();
-      gnutls_pkcs7_deinit (pkcs7);
-      return ret;
-    }
-  count = ret;
-
-  j = count - 1;
-  do
-    {
-      pcert_size = 0;
-      ret = gnutls_pkcs7_get_crt_raw (pkcs7, j, NULL, &pcert_size);
-      if (ret != GNUTLS_E_MEMORY_ERROR)
-        {
-          count--;
-          continue;
-        }
-
-      pcert = gnutls_malloc (pcert_size);
-      if (ret == GNUTLS_E_MEMORY_ERROR)
-        {
-          gnutls_assert ();
-          count--;
-          continue;
-        }
-
-      /* read the certificate
-       */
-      ret = gnutls_pkcs7_get_crt_raw (pkcs7, j, pcert, &pcert_size);
-
-      j--;
-
-      if (ret >= 0)
-        {
-          *cert_list =
-            (gnutls_cert *) mhd_gtls_realloc_fast (*cert_list,
-                                                   i * sizeof (gnutls_cert));
-
-          if (*cert_list == NULL)
-            {
-              gnutls_assert ();
-              gnutls_free (pcert);
-              return GNUTLS_E_MEMORY_ERROR;
-            }
-
-          tmp2.data = pcert;
-          tmp2.size = pcert_size;
-
-          ret =
-            mhd_gtls_x509_raw_cert_to_gcert (&cert_list[0][i - 1], &tmp2, 0);
-
-          if (ret < 0)
-            {
-              gnutls_assert ();
-              gnutls_pkcs7_deinit (pkcs7);
-              gnutls_free (pcert);
-              return ret;
-            }
-
-          i++;
-        }
-
-      gnutls_free (pcert);
-
-    }
-  while (ret >= 0 && j >= 0);
-
-  *ncerts = i - 1;
-
-  gnutls_pkcs7_deinit (pkcs7);
-  return count;
-#endif
-}
-
 /* Reads a base64 encoded certificate list from memory and stores it to
  * a gnutls_cert structure. Returns the number of certificate parsed.
  */
@@ -460,18 +332,6 @@ parse_pem_cert_mem (gnutls_cert ** cert_list, unsigned *ncerts,
   gnutls_datum_t tmp;
   int ret, count;
 
-#ifdef ENABLE_PKI
-  if ((ptr = memmem (input_cert, input_cert_size,
-                     PEM_PKCS7_SEP, sizeof (PEM_PKCS7_SEP) - 1)) != NULL)
-    {
-      size = strlen (ptr);
-
-      ret = parse_pkcs7_cert_mem (cert_list, ncerts, ptr, size, CERT_PEM);
-
-      return ret;
-    }
-#endif
-
   /* move to the certificate
    */
   ptr = memmem (input_cert, input_cert_size,
@@ -493,7 +353,7 @@ parse_pem_cert_mem (gnutls_cert ** cert_list, unsigned *ncerts,
   do
     {
 
-      siz2 = _gnutls_fbase64_decode (NULL, ptr, size, &ptr2);
+      siz2 = _gnutls_fbase64_decode (NULL, (const unsigned char*) ptr, size, &ptr2);
 
       if (siz2 < 0)
         {
@@ -590,9 +450,9 @@ read_cert_mem (mhd_gtls_cert_credentials_t res, const void *cert,
   res->cert_list_length[res->ncerts] = 0;
 
   if (type == GNUTLS_X509_FMT_DER)
-    ret = parse_pkcs7_cert_mem (&res->cert_list[res->ncerts],
+    ret = parse_der_cert_mem (&res->cert_list[res->ncerts],
                                 &res->cert_list_length[res->ncerts],
-                                cert, cert_size, 0);
+			      cert, cert_size);
   else
     ret =
       parse_pem_cert_mem (&res->cert_list[res->ncerts],
@@ -672,11 +532,13 @@ _gnutls_x509_raw_privkey_to_gkey (gnutls_privkey * privkey,
 
   ret = gnutls_x509_privkey_import (tmpkey, raw_key, type);
 
+#ifdef ENABLE_PKI
   /* If normal key decoding doesn't work try decoding a plain PKCS #8 key */
   if (ret < 0)
     ret =
       gnutls_x509_privkey_import_pkcs8 (tmpkey, raw_key, type, NULL,
                                         GNUTLS_PKCS_PLAIN);
+#endif
 
   if (ret < 0)
     {
@@ -1088,7 +950,7 @@ parse_pem_ca_mem (gnutls_x509_crt_t ** cert_list, unsigned *ncerts,
             ptr3 = memmem (ptr, size,
                            PEM_CERT_SEP2, sizeof (PEM_CERT_SEP2) - 1);
 
-          ptr = ptr3;
+          ptr = (const opaque *) ptr3;
           size = input_cert_size - (ptr - input_cert);
         }
       else
@@ -1106,8 +968,8 @@ parse_pem_ca_mem (gnutls_x509_crt_t ** cert_list, unsigned *ncerts,
 }
 
 /* Reads a DER encoded certificate list from memory and stores it to
- * a gnutls_cert structure. This is only called if PKCS7 read fails.
- * returns the number of certificates parsed (1)
+ * a gnutls_cert structure.
+ * returns the number of certificates parsed.
  */
 static int
 parse_der_ca_mem (gnutls_x509_crt_t ** cert_list, unsigned *ncerts,
@@ -1218,7 +1080,7 @@ MHD_gnutls_certificate_set_x509_trust_file (mhd_gtls_cert_credentials_t
 {
   int ret, ret2;
   size_t size;
-  char *data = read_binary_file (cafile, &size);
+  unsigned char *data = (unsigned char*) read_binary_file (cafile, &size);
 
   if (data == NULL)
     {
@@ -1292,8 +1154,8 @@ parse_pem_crl_mem (gnutls_x509_crl_t ** crl_list, unsigned *ncrls,
           gnutls_assert ();
           return ret;
         }
-
-      tmp.data = (char *) ptr;
+      
+      tmp.data = (unsigned char *) ptr;
       tmp.size = size;
 
       ret =
@@ -1329,8 +1191,8 @@ parse_pem_crl_mem (gnutls_x509_crl_t ** crl_list, unsigned *ncrls,
 }
 
 /* Reads a DER encoded certificate list from memory and stores it to
- * a gnutls_cert structure. This is only called if PKCS7 read fails.
- * returns the number of certificates parsed (1)
+ * a gnutls_cert structure.
+ * returns the number of certificates parsed.
  */
 static int
 parse_der_crl_mem (gnutls_x509_crl_t ** crl_list, unsigned *ncrls,
@@ -1461,7 +1323,7 @@ MHD_gnutls_certificate_set_x509_crl_file (mhd_gtls_cert_credentials_t
 {
   int ret;
   size_t size;
-  char *data = read_binary_file (crlfile, &size);
+  unsigned char *data = (unsigned char*) read_binary_file (crlfile, &size);
 
   if (data == NULL)
     {
@@ -1489,281 +1351,6 @@ MHD_gnutls_certificate_set_x509_crl_file (mhd_gtls_cert_credentials_t
 
 #include <pkcs12.h>
 
-static int
-parse_pkcs12 (mhd_gtls_cert_credentials_t res,
-              gnutls_pkcs12_t p12,
-              const char *password,
-              gnutls_x509_privkey_t * key,
-              gnutls_x509_crt_t * cert, gnutls_x509_crl_t * crl)
-{
-  gnutls_pkcs12_bag_t bag = NULL;
-  int index = 0;
-  int ret;
-
-  for (;;)
-    {
-      int elements_in_bag;
-      int i;
-
-      ret = gnutls_pkcs12_bag_init (&bag);
-      if (ret < 0)
-        {
-          bag = NULL;
-          gnutls_assert ();
-          goto done;
-        }
-
-      ret = gnutls_pkcs12_get_bag (p12, index, bag);
-      if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
-        break;
-      if (ret < 0)
-        {
-          gnutls_assert ();
-          goto done;
-        }
-
-      ret = gnutls_pkcs12_bag_get_type (bag, 0);
-      if (ret < 0)
-        {
-          gnutls_assert ();
-          goto done;
-        }
-
-      if (ret == GNUTLS_BAG_ENCRYPTED)
-        {
-          ret = gnutls_pkcs12_bag_decrypt (bag, password);
-          if (ret < 0)
-            {
-              gnutls_assert ();
-              goto done;
-            }
-        }
-
-      elements_in_bag = gnutls_pkcs12_bag_get_count (bag);
-      if (elements_in_bag < 0)
-        {
-          gnutls_assert ();
-          goto done;
-        }
-
-      for (i = 0; i < elements_in_bag; i++)
-        {
-          int type;
-          gnutls_datum_t data;
-
-          type = gnutls_pkcs12_bag_get_type (bag, i);
-          if (type < 0)
-            {
-              gnutls_assert ();
-              goto done;
-            }
-
-          ret = gnutls_pkcs12_bag_get_data (bag, i, &data);
-          if (ret < 0)
-            {
-              gnutls_assert ();
-              goto done;
-            }
-
-          switch (type)
-            {
-            case GNUTLS_BAG_PKCS8_ENCRYPTED_KEY:
-            case GNUTLS_BAG_PKCS8_KEY:
-              ret = gnutls_x509_privkey_init (key);
-              if (ret < 0)
-                {
-                  gnutls_assert ();
-                  goto done;
-                }
-
-              ret = gnutls_x509_privkey_import_pkcs8
-                (*key, &data, GNUTLS_X509_FMT_DER, password,
-                 type == GNUTLS_BAG_PKCS8_KEY ? GNUTLS_PKCS_PLAIN : 0);
-              if (ret < 0)
-                {
-                  gnutls_assert ();
-                  goto done;
-                }
-              break;
-
-            case GNUTLS_BAG_CERTIFICATE:
-              ret = gnutls_x509_crt_init (cert);
-              if (ret < 0)
-                {
-                  gnutls_assert ();
-                  goto done;
-                }
-
-              ret =
-                gnutls_x509_crt_import (*cert, &data, GNUTLS_X509_FMT_DER);
-              if (ret < 0)
-                {
-                  gnutls_assert ();
-                  goto done;
-                }
-              break;
-
-            case GNUTLS_BAG_CRL:
-              ret = gnutls_x509_crl_init (crl);
-              if (ret < 0)
-                {
-                  gnutls_assert ();
-                  goto done;
-                }
-
-              ret = gnutls_x509_crl_import (*crl, &data, GNUTLS_X509_FMT_DER);
-              if (ret < 0)
-                {
-                  gnutls_assert ();
-                  goto done;
-                }
-              break;
-
-            case GNUTLS_BAG_ENCRYPTED:
-              /* XXX Bother to recurse one level down?  Unlikely to
-                 use the same password anyway. */
-            case GNUTLS_BAG_EMPTY:
-            default:
-              break;
-            }
-        }
-
-      index++;
-      gnutls_pkcs12_bag_deinit (bag);
-    }
-
-  ret = 0;
-
-done:
-  if (bag)
-    gnutls_pkcs12_bag_deinit (bag);
-
-  return ret;
-}
-
-/**
- * gnutls_certificate_set_x509_simple_pkcs12_file:
- * @res: is an #mhd_gtls_cert_credentials_t structure.
- * @pkcs12file: filename of file containing PKCS#12 blob.
- * @type: is PEM or DER of the @pkcs12file.
- * @password: optional password used to decrypt PKCS#12 file, bags and keys.
- *
- * This function sets a certificate/private key pair and/or a CRL in
- * the mhd_gtls_cert_credentials_t structure.  This function may
- * be called more than once (in case multiple keys/certificates exist
- * for the server).
- *
- * MAC:ed PKCS#12 files are supported.  Encrypted PKCS#12 bags are
- * supported.  Encrypted PKCS#8 private keys are supported.  However,
- * only password based security, and the same password for all
- * operations, are supported.
- *
- * The private keys may be RSA PKCS#1 or DSA private keys encoded in
- * the OpenSSL way.
- *
- * PKCS#12 file may contain many keys and/or certificates, and there
- * is no way to identify which key/certificate pair you want.  You
- * should make sure the PKCS#12 file only contain one key/certificate
- * pair and/or one CRL.
- *
- * It is believed that the limitations of this function is acceptable
- * for most usage, and that any more flexibility would introduce
- * complexity that would make it harder to use this functionality at
- * all.
- *
- * Returns: %GNUTLS_E_SUCCESS on success, or an error code.
- **/
-//int
-//  gnutls_certificate_set_x509_simple_pkcs12_file
-//  (mhd_gtls_cert_credentials_t res, const char *pkcs12file,
-//   gnutls_x509_crt_fmt_t type, const char *password)
-//{
-//  gnutls_pkcs12_t p12;
-//  gnutls_datum_t p12blob;
-//  gnutls_x509_privkey_t key = NULL;
-//  gnutls_x509_crt_t cert = NULL;
-//  gnutls_x509_crl_t crl = NULL;
-//  int ret;
-//  size_t size;
-//
-//  ret = gnutls_pkcs12_init (&p12);
-//  if (ret < 0)
-//    {
-//      gnutls_assert ();
-//      return ret;
-//    }
-//
-//  p12blob.data = read_binary_file (pkcs12file, &size);
-//  p12blob.size = (unsigned int) size;
-//  if (p12blob.data == NULL)
-//    {
-//      gnutls_assert ();
-//      gnutls_pkcs12_deinit (p12);
-//      return GNUTLS_E_FILE_ERROR;
-//    }
-//
-//  ret = gnutls_pkcs12_import (p12, &p12blob, type, 0);
-//  free (p12blob.data);
-//  if (ret < 0)
-//    {
-//      gnutls_assert ();
-//      gnutls_pkcs12_deinit (p12);
-//      return ret;
-//    }
-//
-//  if (password)
-//    {
-//      ret = gnutls_pkcs12_verify_mac (p12, password);
-//      if (ret < 0)
-//        {
-//          gnutls_assert ();
-//          gnutls_pkcs12_deinit (p12);
-//          return ret;
-//        }
-//    }
-//
-//  ret = parse_pkcs12 (res, p12, password, &key, &cert, &crl);
-//  gnutls_pkcs12_deinit (p12);
-//  if (ret < 0)
-//    {
-//      gnutls_assert ();
-//      return ret;
-//    }
-//
-//  if (key && cert)
-//    {
-//      ret = gnutls_certificate_set_x509_key (res, &cert, 1, key);
-//      if (ret < 0)
-//        {
-//          gnutls_assert ();
-//          goto done;
-//        }
-//    }
-//
-//  if (crl)
-//    {
-//      ret = gnutls_certificate_set_x509_crl (res, &crl, 1);
-//      if (ret < 0)
-//        {
-//          gnutls_assert ();
-//          goto done;
-//        }
-//    }
-//
-//  ret = 0;
-//
-//done:
-//  if (cert)
-//    gnutls_x509_crt_deinit (cert);
-//  if (key)
-//    gnutls_x509_privkey_deinit (key);
-//  if (crl)
-//    gnutls_x509_crl_deinit (crl);
-//
-//  return ret;
-//}
-
-
 /**
   * MHD_gnutls_certificate_free_crls - Used to free all the CRLs from a mhd_gtls_cert_credentials_t structure
   * @sc: is an #mhd_gtls_cert_credentials_t structure.

src/daemon/https/tls/gnutls_x509.h

@@ -29,7 +29,6 @@ int _gnutls_x509_cert_verify_peers (mhd_gtls_session_t session,
 
 #define PEM_CERT_SEP2 "-----BEGIN X509 CERTIFICATE"
 #define PEM_CERT_SEP "-----BEGIN CERTIFICATE"
-#define PEM_PKCS7_SEP "-----BEGIN PKCS7"
 
 #define PEM_CRL_SEP "-----BEGIN X509 CRL"
 

src/daemon/https/x509/dn.c

@@ -759,13 +759,12 @@ _gnutls_x509_encode_and_write_attribute (const char *given_oid,
 }
 
 /* This will write the AttributeTypeAndValue field. The data must be already DER encoded.
- * 'multi' must be zero if writing an AttributeTypeAndValue, and 1 if Attribute.
  * In all cases only one value is written.
  */
-int
+static int
 _gnutls_x509_write_attribute (const char *given_oid,
                               ASN1_TYPE asn1_struct, const char *where,
-                              const void *_data, int sizeof_data, int multi)
+                              const void *_data, int sizeof_data)
 {
   char tmp[128];
   int result;
@@ -776,21 +775,6 @@ _gnutls_x509_write_attribute (const char *given_oid,
   mhd_gtls_str_cpy (tmp, sizeof (tmp), where);
   mhd_gtls_str_cat (tmp, sizeof (tmp), ".value");
 
-  if (multi != 0)
-    {                           /* if not writing an AttributeTypeAndValue, but an Attribute */
-      mhd_gtls_str_cat (tmp, sizeof (tmp), "s");        /* values */
-
-      result = asn1_write_value (asn1_struct, tmp, "NEW", 1);
-      if (result != ASN1_SUCCESS)
-        {
-          gnutls_assert ();
-          return mhd_gtls_asn2err (result);
-        }
-
-      mhd_gtls_str_cat (tmp, sizeof (tmp), ".?LAST");
-
-    }
-
   result = asn1_write_value (asn1_struct, tmp, _data, sizeof_data);
   if (result < 0)
     {
@@ -938,7 +922,7 @@ _gnutls_x509_set_dn_oid (ASN1_TYPE asn1_struct,
     {
       result =
         _gnutls_x509_write_attribute (given_oid, asn1_struct,
-                                      tmp, name, sizeof_name, 0);
+                                      tmp, name, sizeof_name);
     }
 
   if (result < 0)