/*

 * Copyright (C) 2011 Collabora Ltd.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU Lesser General Public License as

 * published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public

 * License along with this program; if not, see <http://www.gnu.org/licenses/>.

 *

 * Author: Stef Walter <stefw@collabora.co.uk>

 */

#include "config.h"

#include "gcr-certificate-request.h"

#include "gcr-key-mechanisms.h"

#include "gcr-subject-public-key.h"

#include "gcr/gcr-enum-types-base.h"

#include "gcr/gcr-oids.h"

#include <egg/egg-armor.h>

#include <egg/egg-asn1x.h>

#include <egg/egg-asn1-defs.h>

#include <egg/egg-dn.h>

#include <glib/gi18n-lib.h>

/**

 * SECTION:gcr-certificate-request

 * @title: GcrCertificateRequest

 * @short_description: Represents a certificate request

 *

 * This is an object that allows creation of certificate requests. A

 * certificate request is sent to a certificate authority to request an

 * X.509 certificate.

 *

 * Use gcr_certificate_request_prepare() to create a blank certificate

 * request for a given private key. Set the common name on the certificate

 * request with gcr_certificate_request_set_cn(), and then sign the request

 * with gcr_certificate_request_complete_async().

 */

/**

 * GcrCertificateRequest:

 *

 * Represents a certificate request.

 */

/**

 * GcrCertificateRequestFormat:

 * @GCR_CERTIFICATE_REQUEST_PKCS10: certificate request is in PKCS\#10 format

 *

 * The format of a certificate request. Currently only PKCS\#10 is supported.

 */

#define GCR_CERTIFICATE_REQUEST_CLASS(klass)       (G_TYPE_CHECK_CLASS_CAST ((klass), GCR_TYPE_CERTIFICATE_REQUEST, GcrCertificateRequestClass))

#define GCR_IS_CERTIFICATE_REQUEST_CLASS(klass)    (G_TYPE_CHECK_CLASS_TYPE ((klass), GCR_TYPE_CERTIFICATE_REQUEST))

#define GCR_CERTIFICATE_REQUEST_GET_CLASS(obj)     (G_TYPE_INSTANCE_GET_CLASS ((obj), GCR_TYPE_CERTIFICATE_REQUEST, GcrCertificateRequestClass))

typedef struct _GcrCertificateRequestClass GcrCertificateRequestClass;

struct _GcrCertificateRequest {

	GObject parent;

	GckObject *private_key;

	GNode *asn;

	gulong *mechanisms;

	gulong n_mechanisms;

};

struct _GcrCertificateRequestClass {

	GObjectClass parent_class;

};

enum {

	PROP_0,

	PROP_FORMAT,

	PROP_PRIVATE_KEY

};

/* Forward declarations */

G_DEFINE_TYPE (GcrCertificateRequest, gcr_certificate_request, G_TYPE_OBJECT);

/* When updating here, update prepare_to_be_signed() */

static const gulong RSA_MECHANISMS[] = {

	CKM_SHA1_RSA_PKCS,

	CKM_RSA_PKCS,

};

/* When updating here, update prepare_to_be_signed() */

static const gulong DSA_MECHANISMS[] = {

	CKM_DSA_SHA1,

	CKM_DSA,

};

static const gulong ALL_MECHANISMS[] = {

	CKM_SHA1_RSA_PKCS,

	CKM_DSA_SHA1,

	CKM_RSA_PKCS,

	CKM_DSA,

};

G_STATIC_ASSERT (sizeof (ALL_MECHANISMS) == sizeof (RSA_MECHANISMS) + sizeof (DSA_MECHANISMS));

static void

gcr_certificate_request_init (GcrCertificateRequest *self)

{

}

static void

gcr_certificate_request_constructed (GObject *obj)

{

	GcrCertificateRequest *self = GCR_CERTIFICATE_REQUEST (obj);

	GNode *version;

	G_OBJECT_CLASS (gcr_certificate_request_parent_class)->constructed (obj);

	self->asn = egg_asn1x_create (pkix_asn1_tab, "pkcs-10-CertificationRequest");

	g_return_if_fail (self->asn != NULL);

	/* Setup the version */

	version = egg_asn1x_node (self->asn, "certificationRequestInfo", "version", NULL);

	egg_asn1x_set_integer_as_ulong (version, 0);

}

static void

gcr_certificate_request_finalize (GObject *obj)

{

	GcrCertificateRequest *self = GCR_CERTIFICATE_REQUEST (obj);

	egg_asn1x_destroy (self->asn);

	g_free (self->mechanisms);

	G_OBJECT_CLASS (gcr_certificate_request_parent_class)->finalize (obj);

}

static void

gcr_certificate_request_set_property (GObject *obj,

                                      guint prop_id,

                                      const GValue *value,

                                      GParamSpec *pspec)

{

	GcrCertificateRequest *self = GCR_CERTIFICATE_REQUEST (obj);

	GcrCertificateRequestFormat format;

	switch (prop_id) {

	case PROP_PRIVATE_KEY:

		g_return_if_fail (self->private_key == NULL);

		self->private_key = g_value_dup_object (value);

		g_return_if_fail (GCK_IS_OBJECT (self->private_key));

		break;

	case PROP_FORMAT:

		format = g_value_get_enum (value);

		g_return_if_fail (format == GCR_CERTIFICATE_REQUEST_PKCS10);

		break;

	default:

		G_OBJECT_WARN_INVALID_PROPERTY_ID (obj, prop_id, pspec);

		break;

	}

}

static void

gcr_certificate_request_get_property (GObject *obj,

                                      guint prop_id,

                                      GValue *value,

                                      GParamSpec *pspec)

{

	GcrCertificateRequest *self = GCR_CERTIFICATE_REQUEST (obj);

	switch (prop_id) {

	case PROP_PRIVATE_KEY:

		g_value_set_object (value, gcr_certificate_request_get_private_key (self));

		break;

	case PROP_FORMAT:

		g_value_set_enum (value, gcr_certificate_request_get_format (self));

		break;

	default:

		G_OBJECT_WARN_INVALID_PROPERTY_ID (obj, prop_id, pspec);

		break;

	}

}

static void

gcr_certificate_request_class_init (GcrCertificateRequestClass *klass)

{

	GObjectClass *gobject_class = G_OBJECT_CLASS (klass);

	gobject_class->constructed = gcr_certificate_request_constructed;

	gobject_class->finalize = gcr_certificate_request_finalize;

	gobject_class->set_property = gcr_certificate_request_set_property;

	gobject_class->get_property = gcr_certificate_request_get_property;

	/**

	 * GcrCertificateRequest:private-key:

	 *

	 * The private key that this certificate request is for.

	 */

	g_object_class_install_property (gobject_class, PROP_PRIVATE_KEY,

	            g_param_spec_object ("private-key", "Private key", "Private key for request",

	                                 GCK_TYPE_OBJECT, G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY));

	/**

	 * GcrCertificateRequest:format:

	 *

	 * The format of the certificate request.

	 */

	g_object_class_install_property (gobject_class, PROP_FORMAT,

	              g_param_spec_enum ("format", "Format", "Format of certificate request",

	                                 GCR_TYPE_CERTIFICATE_REQUEST_FORMAT, GCR_CERTIFICATE_REQUEST_PKCS10,

	                                 G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY));

}

/**

 * gcr_certificate_request_prepare:

 * @format: the format for the certificate request

 * @private_key: the private key the the certificate is being requested for

 *

 * Create a new certificate request, in the given format for the private key.

 *

 * Returns: (transfer full): a new #GcrCertificate request

 */

GcrCertificateRequest *

gcr_certificate_request_prepare (GcrCertificateRequestFormat format,

                                 GckObject *private_key)

{

	g_return_val_if_fail (format == GCR_CERTIFICATE_REQUEST_PKCS10, NULL);

	g_return_val_if_fail (GCK_IS_OBJECT (private_key), NULL);

	return g_object_new (GCR_TYPE_CERTIFICATE_REQUEST,

	                     "format", format,

	                     "private-key", private_key,

	                     NULL);

}

/**

 * gcr_certificate_request_get_private_key:

 * @self: the certificate request

 *

 * Get the private key this certificate request is for.

 *

 * Returns: (transfer none): the private key,

 */

GckObject *

gcr_certificate_request_get_private_key (GcrCertificateRequest *self)

{

	g_return_val_if_fail (GCR_IS_CERTIFICATE_REQUEST (self), NULL);

	return self->private_key;

}

/**

 * gcr_certificate_request_get_format:

 * @self: the certificate request

 *

 * Get the format of this certificate request.

 *

 * Returns: the format

 */

GcrCertificateRequestFormat

gcr_certificate_request_get_format (GcrCertificateRequest *self)

{

	g_return_val_if_fail (GCR_IS_CERTIFICATE_REQUEST (self), 0);

	return GCR_CERTIFICATE_REQUEST_PKCS10;

}

/**

 * gcr_certificate_request_set_cn:

 * @self: the certificate request

 * @cn: common name to set on the request

 *

 * Set the common name encoded in the certificate request.

 */

void

gcr_certificate_request_set_cn (GcrCertificateRequest *self,

                                const gchar *cn)

{

	GNode *subject;

	GNode *dn;

	g_return_if_fail (GCR_IS_CERTIFICATE_REQUEST (self));

	g_return_if_fail (cn != NULL);

	subject = egg_asn1x_node (self->asn, "certificationRequestInfo", "subject", NULL);

	dn = egg_asn1x_node (subject, "rdnSequence", NULL);

	/* TODO: we shouldn't really be clearing this, but replacing CN */

	egg_asn1x_set_choice (subject, dn);

	egg_asn1x_clear (dn);

	egg_dn_add_string_part (dn, GCR_OID_NAME_CN, cn);

}

static GBytes *

hash_sha1_pkcs1 (GBytes *data)

{

	const guchar SHA1_ASN[15] = /* Object ID is 1.3.14.3.2.26 */

		{ 0x30, 0x21, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03,

		  0x02, 0x1a, 0x05, 0x00, 0x04, 0x14 };

	GChecksum *checksum;

	guchar *hash;

	gsize n_hash;

	gsize n_digest;

	n_digest = g_checksum_type_get_length (G_CHECKSUM_SHA1);

	n_hash = n_digest + sizeof (SHA1_ASN);

	hash = g_malloc (n_hash);

	memcpy (hash, SHA1_ASN, sizeof (SHA1_ASN));

	checksum = g_checksum_new (G_CHECKSUM_SHA1);

	g_checksum_update (checksum, g_bytes_get_data (data, NULL), g_bytes_get_size (data));

	g_checksum_get_digest (checksum, hash + sizeof (SHA1_ASN), &n_digest);

	g_checksum_free (checksum);

	return g_bytes_new_take (hash, n_hash);

}

static GBytes *

hash_sha1 (GBytes *data)

{

	GChecksum *checksum;

	guchar *hash;

	gsize n_hash;

	n_hash = g_checksum_type_get_length (G_CHECKSUM_SHA1);

	hash = g_malloc (n_hash);

	checksum = g_checksum_new (G_CHECKSUM_SHA1);

	g_checksum_update (checksum, g_bytes_get_data (data, NULL), g_bytes_get_size (data));

	g_checksum_get_digest (checksum, hash, &n_hash);

	g_checksum_free (checksum);

	return g_bytes_new_take (hash, n_hash);

}

static GBytes *

prepare_to_be_signed (GcrCertificateRequest *self,

                      GckMechanism *mechanism)

{

	GNode *node;

	GBytes *data;

	GBytes *hash;

	g_assert (mechanism != NULL);

	node = egg_asn1x_node (self->asn, "certificationRequestInfo", NULL);

	data = egg_asn1x_encode (node, NULL);

	mechanism->parameter = NULL;

	mechanism->n_parameter = 0;

	switch (mechanism->type) {

	case CKM_SHA1_RSA_PKCS:

	case CKM_DSA_SHA1:

		return data;

	case CKM_RSA_PKCS:

		hash = hash_sha1_pkcs1 (data);

		g_bytes_unref (data);

		return hash;

	case CKM_DSA:

		hash = hash_sha1 (data);

		g_bytes_unref (data);

		return hash;

	default:

		g_assert_not_reached ();

		return NULL;

	}

}

static gboolean

prepare_subject_public_key_and_mechanisms (GcrCertificateRequest *self,

                                           GNode *subject_public_key,

                                           GQuark *algorithm,

                                           const gulong **mechanisms,

                                           gsize *n_mechanisms,

                                           GError **error)

{

	GBytes *encoded;

	GNode *node;

	GQuark oid;

	g_assert (algorithm != NULL);

	g_assert (mechanisms != NULL);

	g_assert (n_mechanisms != NULL);

	encoded = egg_asn1x_encode (subject_public_key, NULL);

	g_return_val_if_fail (encoded != NULL, FALSE);

	node = egg_asn1x_node (subject_public_key, "algorithm", "algorithm", NULL);

	oid = egg_asn1x_get_oid_as_quark (node);

	if (oid == GCR_OID_PKIX1_RSA) {

		*mechanisms = RSA_MECHANISMS;

		*n_mechanisms = G_N_ELEMENTS (RSA_MECHANISMS);

		*algorithm = GCR_OID_PKIX1_SHA1_WITH_RSA;

	} else if (oid == GCR_OID_PKIX1_DSA) {

		*mechanisms = DSA_MECHANISMS;

		*n_mechanisms = G_N_ELEMENTS (DSA_MECHANISMS);

		*algorithm = GCR_OID_PKIX1_SHA1_WITH_DSA;

	} else {

		g_bytes_unref (encoded);

		g_set_error (error, GCR_DATA_ERROR, GCR_ERROR_UNRECOGNIZED,

		             _("Unsupported key type for certificate request"));

		return FALSE;

	}

	node = egg_asn1x_node (self->asn, "certificationRequestInfo", "subjectPKInfo", NULL);

	if (!egg_asn1x_decode (node, encoded))

		g_return_val_if_reached (FALSE);

	g_bytes_unref (encoded);

	return TRUE;

}

static void

encode_take_signature_into_request (GcrCertificateRequest *self,

                                    GQuark algorithm,

                                    GNode *subject_public_key,

                                    guchar *result,

                                    gsize n_result)

{

	GNode *params;

	GNode *node;

	node = egg_asn1x_node (self->asn, "signature", NULL);

	egg_asn1x_take_bits_as_raw (node, g_bytes_new_take (result, n_result), n_result * 8);

	node = egg_asn1x_node (self->asn, "signatureAlgorithm", "algorithm", NULL);

	egg_asn1x_set_oid_as_quark (node, algorithm);

	node = egg_asn1x_node (self->asn, "signatureAlgorithm", "parameters", NULL);

	params = egg_asn1x_node (subject_public_key, "algorithm", "parameters", NULL);

	egg_asn1x_set_any_from (node, params);

}

/**

 * gcr_certificate_request_complete:

 * @self: a certificate request

 * @cancellable: a cancellation object

 * @error: location to place an error on failure

 *

 * Complete and sign a certificate request, so that it can be encoded

 * and sent to a certificate authority.

 *

 * This call may block as it signs the request using the private key.

 *

 * Returns: whether certificate request was successfully completed or not

 */

gboolean

gcr_certificate_request_complete (GcrCertificateRequest *self,

                                  GCancellable *cancellable,

                                  GError **error)

{

	GNode *subject_public_key;

	const gulong *mechanisms;

	gsize n_mechanisms;

	GckMechanism mechanism = { 0, };

	GQuark algorithm = 0;

	GBytes *tbs;

	GckSession *session;

	guchar *signature;

	gsize n_signature;

	gboolean ret;

	g_return_val_if_fail (GCR_IS_CERTIFICATE_REQUEST (self), FALSE);

	g_return_val_if_fail (cancellable == NULL || G_CANCELLABLE (cancellable), FALSE);

	g_return_val_if_fail (error == NULL || *error == NULL, FALSE);

	subject_public_key = _gcr_subject_public_key_load (self->private_key,

	                                                   cancellable, error);

	if (subject_public_key == NULL)

		return FALSE;

	ret = prepare_subject_public_key_and_mechanisms (self, subject_public_key,

	                                                 &algorithm, &mechanisms,

	                                                 &n_mechanisms, error);

	if (!ret) {

		egg_asn1x_destroy (subject_public_key);

		return FALSE;

	}

	/* Figure out which mechanism to use */

	mechanism.type = _gcr_key_mechanisms_check (self->private_key, mechanisms,

	                                            n_mechanisms, CKA_SIGN,

	                                            cancellable, NULL);

	if (mechanism.type == GCK_INVALID) {

		egg_asn1x_destroy (subject_public_key);

		g_set_error (error, GCK_ERROR, CKR_KEY_TYPE_INCONSISTENT,

		             _("The key cannot be used to sign the request"));

		return FALSE;

	}

	tbs = prepare_to_be_signed (self, &mechanism);

	session = gck_object_get_session (self->private_key);

	signature = gck_session_sign_full (session, self->private_key, &mechanism,

	                                   g_bytes_get_data (tbs, NULL),

	                                   g_bytes_get_size (tbs),

	                                   &n_signature, cancellable, error);

	g_object_unref (session);

	g_bytes_unref (tbs);

	if (!signature) {

		egg_asn1x_destroy (subject_public_key);

		return FALSE;

	}

	encode_take_signature_into_request (self, algorithm, subject_public_key,

	                                    signature, n_signature);

	egg_asn1x_destroy (subject_public_key);

	return TRUE;

}

typedef struct {

	GcrCertificateRequest *request;

	GCancellable *cancellable;

	GQuark algorithm;

	GNode *subject_public_key;

	GckMechanism mechanism;

	GckSession *session;

	GBytes *tbs;

} CompleteClosure;

static void

complete_closure_free (gpointer data)

{

	CompleteClosure *closure = data;

	egg_asn1x_destroy (closure->subject_public_key);

	g_clear_object (&closure->request);

	g_clear_object (&closure->cancellable);

	g_clear_object (&closure->session);

	if (closure->tbs)

		g_bytes_unref (closure->tbs);

	g_free (closure);

}

static void

on_certificate_request_signed (GObject *source,

                               GAsyncResult *result,

                               gpointer user_data)

{

	GSimpleAsyncResult *res = G_SIMPLE_ASYNC_RESULT (user_data);

	CompleteClosure *closure = g_simple_async_result_get_op_res_gpointer (res);

	GError *error = NULL;

	guchar *signature;

	gsize n_signature;

	signature = gck_session_sign_finish (closure->session, result, &n_signature, &error);

	if (error == NULL) {

		encode_take_signature_into_request (closure->request,

		                                    closure->algorithm,

		                                    closure->subject_public_key,

		                                    signature, n_signature);

	} else {

		g_simple_async_result_take_error (res, error);

	}

	g_simple_async_result_complete (res);

	g_object_unref (res);

}

static void

on_mechanism_check (GObject *source,

                    GAsyncResult *result,

                    gpointer user_data)

{

	GSimpleAsyncResult *res = G_SIMPLE_ASYNC_RESULT (user_data);

	CompleteClosure *closure = g_simple_async_result_get_op_res_gpointer (res);

	closure->mechanism.type =  _gcr_key_mechanisms_check_finish (closure->request->private_key,

	                                                             result, NULL);

	if (closure->mechanism.type == GCK_INVALID) {

		g_simple_async_result_set_error (res, GCK_ERROR, CKR_KEY_TYPE_INCONSISTENT,

		                                 _("The key cannot be used to sign the request"));

		g_simple_async_result_complete (res);

	} else {

		closure->tbs = prepare_to_be_signed (closure->request, &closure->mechanism);

		gck_session_sign_async (closure->session,

		                        closure->request->private_key,

		                        &closure->mechanism,

		                        g_bytes_get_data (closure->tbs, NULL),

		                        g_bytes_get_size (closure->tbs),

		                        closure->cancellable,

		                        on_certificate_request_signed,

		                        g_object_ref (res));

	}

	g_object_unref (res);

}

static void

on_subject_public_key_loaded (GObject *source,

                              GAsyncResult *result,

                              gpointer user_data)

{

	GSimpleAsyncResult *res = G_SIMPLE_ASYNC_RESULT (user_data);

	CompleteClosure *closure = g_simple_async_result_get_op_res_gpointer (res);

	const gulong *mechanisms;

	gsize n_mechanisms;

	GError *error = NULL;

	closure->subject_public_key = _gcr_subject_public_key_load_finish (result, &error);

	if (error == NULL) {

		prepare_subject_public_key_and_mechanisms (closure->request,

		                                           closure->subject_public_key,

		                                           &closure->algorithm,

		                                           &mechanisms,

		                                           &n_mechanisms,

		                                           &error);

	}

	if (error != NULL) {

		g_simple_async_result_take_error (res, error);

		g_simple_async_result_complete (res);

	} else {

		_gcr_key_mechanisms_check_async (closure->request->private_key,

		                                 mechanisms, n_mechanisms, CKA_SIGN,

		                                 closure->cancellable, on_mechanism_check,

		                                 g_object_ref (res));

	}

	g_object_unref (res);

}

/**

 * gcr_certificate_request_complete_async:

 * @self: a certificate request

 * @cancellable: a cancellation object

 * @callback: called when the operation completes

 * @user_data: data to pass to the callback

 *

 * Asynchronously complete and sign a certificate request, so that it can

 * be encoded and sent to a certificate authority.

 *

 * This call will return immediately and complete later.

 */

void

gcr_certificate_request_complete_async (GcrCertificateRequest *self,

                                        GCancellable *cancellable,

                                        GAsyncReadyCallback callback,

                                        gpointer user_data)

{

	GSimpleAsyncResult *res;

	CompleteClosure *closure;

	g_return_if_fail (GCR_IS_CERTIFICATE_REQUEST (self));

	g_return_if_fail (cancellable == NULL || G_CANCELLABLE (cancellable));

	res = g_simple_async_result_new (G_OBJECT (self), callback, user_data,

	                                 gcr_certificate_request_complete_async);

	closure = g_new0 (CompleteClosure, 1);

	closure->cancellable = cancellable ? g_object_ref (cancellable) : NULL;

	closure->session = gck_object_get_session (self->private_key);

	closure->request = g_object_ref (self);

	g_simple_async_result_set_op_res_gpointer (res, closure, complete_closure_free);

	_gcr_subject_public_key_load_async (self->private_key, cancellable,

	                                    on_subject_public_key_loaded,

	                                    g_object_ref (res));

	g_object_unref (res);

}

/**

 * gcr_certificate_request_complete_finish:

 * @self: a certificate request

 * @result: result of the asynchronous operation

 * @error: location to place an error on failure

 *

 * Finish an asynchronous operation to complete and sign a certificate

 * request.

 *

 * Returns: whether certificate request was successfully completed or not

 */

gboolean

gcr_certificate_request_complete_finish (GcrCertificateRequest *self,

                                         GAsyncResult *result,

                                         GError **error)

{

	g_return_val_if_fail (GCR_IS_CERTIFICATE_REQUEST (self), FALSE);

	g_return_val_if_fail (error == NULL || *error == NULL, FALSE);

	g_return_val_if_fail (g_simple_async_result_is_valid (result, G_OBJECT (self),

	                      gcr_certificate_request_complete_async), FALSE);

	if (g_simple_async_result_propagate_error (G_SIMPLE_ASYNC_RESULT (result), error))

		return FALSE;

	return TRUE;

}

/**

 * gcr_certificate_request_encode:

 * @self: a certificate request

 * @textual: whether to encode output as text

 * @length: location to place length of returned data

 *

 * Encode the certificate request. It must have been completed with

 * gcr_certificate_request_complete() or gcr_certificate_request_complete_async()

 *

 * If @textual is %FALSE, the output is a DER encoded certificate request.

 *

 * If @textual is %TRUE, the output is encoded as text. For PKCS\#10 requests this

 * is done using the OpenSSL style PEM encoding.

 *

 * Returns: (transfer full) (array length=length): the encoded certificate request

 */

guchar *

gcr_certificate_request_encode (GcrCertificateRequest *self,

                                gboolean textual,

                                gsize *length)

{

	GBytes *bytes;

	gpointer encoded;

	gpointer data;

	gsize size;

	g_return_val_if_fail (GCR_IS_CERTIFICATE_REQUEST (self), NULL);

	g_return_val_if_fail (length != NULL, NULL);

	bytes = egg_asn1x_encode (self->asn, NULL);

	if (bytes == NULL) {

		g_warning ("couldn't encode certificate request: %s",

		           egg_asn1x_message (self->asn));

		return NULL;

	}

	size = g_bytes_get_size (bytes);

	encoded = g_byte_array_free (g_bytes_unref_to_array (bytes), FALSE);

	if (textual) {

		data = egg_armor_write (encoded, size,

		                        g_quark_from_static_string ("CERTIFICATE REQUEST"),

		                        NULL, length);

		g_free (encoded);

		encoded = data;

	} else {

		*length = size;

	}

	return encoded;

}

/**

 * gcr_certificate_request_capable:

 * @private_key: a private key

 * @cancellable: cancellation object

 * @error: location to place an error

 *

 * Check whether #GcrCertificateRequest is capable of creating a request

 * for the given @private_key.

 *

 * Returns: whether a request can be created

 */

gboolean

gcr_certificate_request_capable (GckObject *private_key,

                                 GCancellable *cancellable,

                                 GError **error)

{

	g_return_val_if_fail (GCK_IS_OBJECT (private_key), FALSE);

	g_return_val_if_fail (cancellable == NULL || G_IS_CANCELLABLE (cancellable), FALSE);

	g_return_val_if_fail (error == NULL || *error == NULL, FALSE);

	return _gcr_key_mechanisms_check (private_key, ALL_MECHANISMS,

	                                  G_N_ELEMENTS (ALL_MECHANISMS),

	                                 CKA_SIGN, cancellable, error);

}

/**

 * gcr_certificate_request_capable_async:

 * @private_key: a private key

 * @cancellable: cancellation object

 * @callback: will be called when the operation completes

 * @user_data: data to be passed to callback

 *

 * Asynchronously check whether #GcrCertificateRequest is capable of creating

 * a request for the given @private_key.

 */

void

gcr_certificate_request_capable_async (GckObject *private_key,

                                       GCancellable *cancellable,

                                       GAsyncReadyCallback callback,

                                       gpointer user_data)

{

	g_return_if_fail (GCK_IS_OBJECT (private_key));

	g_return_if_fail (cancellable == NULL || G_IS_CANCELLABLE (cancellable));

	_gcr_key_mechanisms_check_async (private_key, ALL_MECHANISMS,

	                                 G_N_ELEMENTS (ALL_MECHANISMS),

	                                 CKA_SIGN, cancellable,

	                                 callback, user_data);

}

/**

 * gcr_certificate_request_capable_finish:

 * @result: asynchronous result

 * @error: location to place an error

 *

 * Get the result for asynchronously check whether #GcrCertificateRequest is

 * capable of creating a request for the given @private_key.

 *

 * Returns: whether a request can be created

 */

gboolean

gcr_certificate_request_capable_finish (GAsyncResult *result,

                                        GError **error)

{

	GObject *source;

	gulong mech;

	g_return_val_if_fail (G_IS_ASYNC_RESULT (result), FALSE);

	source = g_async_result_get_source_object (result);

	mech = _gcr_key_mechanisms_check_finish (GCK_OBJECT (source), result, error);

	g_object_unref (source);

	return mech != GCK_INVALID;

}