/*

 * Copyright (C) 2002-2016 Free Software Foundation, Inc.

 * Copyright (C) 2016-2017 Red Hat, Inc.

 *

 * Author: Nikos Mavrogiannopoulos

 *

 * This file is part of GnuTLS.

 *

 * The GnuTLS is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public License

 * as published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>

 *

 */

#include "gnutls_int.h"

#include "auth.h"

#include "errors.h"

#include <auth/cert.h>

#include "dh.h"

#include "num.h"

#include "datum.h"

#include <pk.h>

#include <algorithms.h>

#include <global.h>

#include <record.h>

#include <tls-sig.h>

#include <state.h>

#include <pk.h>

#include "str.h"

#include <debug.h>

#include <x509_b64.h>

#include <x509.h>

#include "x509/common.h"

#include "x509/x509_int.h"

#include <str_array.h>

#include <gnutls/x509.h>

#include "read-file.h"

#include "system-keys.h"

#include "urls.h"

#include "cert-cred.h"

#ifdef _WIN32

#include <wincrypt.h>

#endif

/*

 * This file includes functions related to adding certificates and other

 * related objects in a certificate credentials structure.

 */

/* Returns the name of the certificate of a null name

 */

int _gnutls_get_x509_name(gnutls_x509_crt_t crt, gnutls_str_array_t * names)

{

	size_t max_size;

	int i, ret = 0, ret2;

	char name[MAX_CN];

	unsigned have_dns_name = 0;

	for (i = 0; !(ret < 0); i++) {

		max_size = sizeof(name);

		ret =

		    gnutls_x509_crt_get_subject_alt_name(crt, i, name,

							 &max_size, NULL);

		if (ret == GNUTLS_SAN_DNSNAME) {

			have_dns_name = 1;

			ret2 =

			    _gnutls_str_array_append_idna(names, name,

						  max_size);

			if (ret2 < 0) {

				_gnutls_str_array_clear(names);

				return gnutls_assert_val(ret2);

			}

		}

	}

	if (have_dns_name == 0) {

		max_size = sizeof(name);

		ret =

		    gnutls_x509_crt_get_dn_by_oid(crt, OID_X520_COMMON_NAME, 0, 0,

						  name, &max_size);

		if (ret >= 0) {

			ret = _gnutls_str_array_append_idna(names, name, max_size);

			if (ret < 0) {

				_gnutls_str_array_clear(names);

				return gnutls_assert_val(ret);

			}

		}

	}

	return 0;

}

/* Reads a DER encoded certificate list from memory and stores it to a

 * gnutls_cert structure. Returns the number of certificates parsed.

 */

static int

parse_der_cert_mem(gnutls_certificate_credentials_t res,

		   gnutls_privkey_t key,

		   const void *input_cert, int input_cert_size)

{

	gnutls_datum_t tmp;

	gnutls_x509_crt_t crt;

	gnutls_pcert_st *ccert;

	int ret;

	gnutls_str_array_t names;

	_gnutls_str_array_init(&names);

	ccert = gnutls_malloc(sizeof(*ccert));

	if (ccert == NULL) {

		gnutls_assert();

		return GNUTLS_E_MEMORY_ERROR;

	}

	ret = gnutls_x509_crt_init(&crt;;

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	tmp.data = (uint8_t *) input_cert;

	tmp.size = input_cert_size;

	ret = gnutls_x509_crt_import(crt, &tmp, GNUTLS_X509_FMT_DER);

	if (ret < 0) {

		gnutls_assert();

		gnutls_x509_crt_deinit(crt);

		goto cleanup;

	}

	ret = _gnutls_get_x509_name(crt, &names);

	if (ret < 0) {

		gnutls_assert();

		gnutls_x509_crt_deinit(crt);

		goto cleanup;

	}

	ret = gnutls_pcert_import_x509(ccert, crt, 0);

	gnutls_x509_crt_deinit(crt);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	ret = _gnutls_certificate_credential_append_keypair(res, key, names, ccert, 1);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	return ret;

      cleanup:

	_gnutls_str_array_clear(&names);

	gnutls_free(ccert);

	return ret;

}

/* Reads a base64 encoded certificate list from memory and stores it to

 * a gnutls_cert structure. Returns the number of certificate parsed.

 */

static int

parse_pem_cert_mem(gnutls_certificate_credentials_t res,

		   gnutls_privkey_t key,

		   const char *input_cert, int input_cert_size)

{

	int size;

	const char *ptr;

	gnutls_datum_t tmp;

	int ret, count, i;

	unsigned ncerts = 0;

	gnutls_pcert_st *pcerts = NULL;

	gnutls_str_array_t names;

	gnutls_x509_crt_t unsorted[DEFAULT_MAX_VERIFY_DEPTH];

	_gnutls_str_array_init(&names);

	/* move to the certificate

	 */

	ptr = memmem(input_cert, input_cert_size,

		     PEM_CERT_SEP, sizeof(PEM_CERT_SEP) - 1);

	if (ptr == NULL)

		ptr = memmem(input_cert, input_cert_size,

			     PEM_CERT_SEP2, sizeof(PEM_CERT_SEP2) - 1);

	if (ptr == NULL) {

		gnutls_assert();

		return GNUTLS_E_BASE64_DECODING_ERROR;

	}

	size = input_cert_size - (ptr - input_cert);

	count = 0;

	do {

		tmp.data = (void *) ptr;

		tmp.size = size;

		ret = gnutls_x509_crt_init(&unsorted[count]);

		if (ret < 0) {

			gnutls_assert();

			goto cleanup;

		}

		ret = gnutls_x509_crt_import(unsorted[count], &tmp, GNUTLS_X509_FMT_PEM);

		if (ret < 0) {

			gnutls_assert();

			goto cleanup;

		}

		count++;

		/* now we move ptr after the pem header

		 */

		ptr++;

		size--;

		/* find the next certificate (if any)

		 */

		if (size > 0) {

			char *ptr3;

			ptr3 =

			    memmem(ptr, size, PEM_CERT_SEP,

				   sizeof(PEM_CERT_SEP) - 1);

			if (ptr3 == NULL)

				ptr3 = memmem(ptr, size, PEM_CERT_SEP2,

					      sizeof(PEM_CERT_SEP2) - 1);

			ptr = ptr3;

			size = input_cert_size - (ptr - input_cert);

		} else

			ptr = NULL;

	}

	while (ptr != NULL && count < DEFAULT_MAX_VERIFY_DEPTH);

	ret =

	    _gnutls_get_x509_name(unsorted[0], &names);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	pcerts = gnutls_malloc(sizeof(gnutls_pcert_st) * count);

	if (pcerts == NULL) {

		gnutls_assert();

		return GNUTLS_E_MEMORY_ERROR;

	}

	ncerts = count;

	ret =

	    gnutls_pcert_import_x509_list(pcerts, unsorted, &ncerts, GNUTLS_X509_CRT_LIST_SORT);

	if (ret < 0) {

		gnutls_free(pcerts);

		gnutls_assert();

		goto cleanup;

	}

	ret =

	    _gnutls_certificate_credential_append_keypair(res, key, names, pcerts, ncerts);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	for (i = 0; i < count; i++)

		gnutls_x509_crt_deinit(unsorted[i]);

	return ncerts;

      cleanup:

	_gnutls_str_array_clear(&names);

	for (i = 0; i < count; i++)

		gnutls_x509_crt_deinit(unsorted[i]);

	if (pcerts) {

		for (i = 0; i < count; i++)

			gnutls_pcert_deinit(&pcerts[i]);

		gnutls_free(pcerts);

	}

	return ret;

}

/* Reads a DER or PEM certificate from memory

 */

static int

read_cert_mem(gnutls_certificate_credentials_t res,

	      gnutls_privkey_t key,

	      const void *cert,

	      int cert_size, gnutls_x509_crt_fmt_t type)

{

	int ret;

	if (type == GNUTLS_X509_FMT_DER)

		ret = parse_der_cert_mem(res, key, cert, cert_size);

	else

		ret = parse_pem_cert_mem(res, key, cert, cert_size);

	if (ret < 0) {

		gnutls_assert();

		return ret;

	}

	return ret;

}

static int tmp_pin_cb(void *userdata, int attempt, const char *token_url,

		      const char *token_label, unsigned int flags,

		      char *pin, size_t pin_max)

{

	const char *tmp_pin = userdata;

	if (attempt == 0) {

		snprintf(pin, pin_max, "%s", tmp_pin);

		return 0;

	}

	return -1;

}

/* Reads a PEM encoded PKCS-1 RSA/DSA private key from memory.  Type

 * indicates the certificate format.

 *

 * It returns the private key read in @rkey.

 */

int

_gnutls_read_key_mem(gnutls_certificate_credentials_t res,

	     const void *key, int key_size, gnutls_x509_crt_fmt_t type,

	     const char *pass, unsigned int flags,

	     gnutls_privkey_t *rkey)

{

	int ret;

	gnutls_datum_t tmp;

	gnutls_privkey_t privkey;

	if (key) {

		tmp.data = (uint8_t *) key;

		tmp.size = key_size;

		ret = gnutls_privkey_init(&privkey);

		if (ret < 0) {

			gnutls_assert();

			return ret;

		}

		if (res->pin.cb) {

			gnutls_privkey_set_pin_function(privkey,

							res->pin.cb,

							res->pin.data);

		} else if (pass != NULL) {

			snprintf(res->pin_tmp, sizeof(res->pin_tmp), "%s",

				 pass);

			gnutls_privkey_set_pin_function(privkey,

							tmp_pin_cb,

							res->pin_tmp);

		}

		ret =

		    gnutls_privkey_import_x509_raw(privkey, &tmp, type,

						   pass, flags);

		if (ret < 0) {

			gnutls_assert();

			gnutls_privkey_deinit(privkey);

			return ret;

		}

		*rkey = privkey;

	} else {

		gnutls_assert();

		return GNUTLS_E_INVALID_REQUEST;

	}

	return 0;

}

/* Reads a private key from a token.

 */

static int

read_key_url(gnutls_certificate_credentials_t res, const char *url, gnutls_privkey_t *rkey)

{

	int ret;

	gnutls_privkey_t pkey = NULL;

	/* allocate space for the pkey list

	 */

	ret = gnutls_privkey_init(&pkey);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	if (res->pin.cb)

		gnutls_privkey_set_pin_function(pkey, res->pin.cb,

						res->pin.data);

	ret = gnutls_privkey_import_url(pkey, url, 0);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	*rkey = pkey;

	return 0;

      cleanup:

	if (pkey)

		gnutls_privkey_deinit(pkey);

	return ret;

}

#define MAX_PKCS11_CERT_CHAIN 8

/* Reads a certificate key from a token.

 */

static int

read_cert_url(gnutls_certificate_credentials_t res, gnutls_privkey_t key, const char *url)

{

	int ret;

	gnutls_x509_crt_t crt = NULL;

	gnutls_pcert_st *ccert = NULL;

	gnutls_str_array_t names;

	gnutls_datum_t t = {NULL, 0};

	unsigned i, count = 0;

	_gnutls_str_array_init(&names);

	ccert = gnutls_malloc(sizeof(*ccert)*MAX_PKCS11_CERT_CHAIN);

	if (ccert == NULL) {

		gnutls_assert();

		ret = GNUTLS_E_MEMORY_ERROR;

		goto cleanup;

	}

	ret = gnutls_x509_crt_init(&crt;;

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	if (res->pin.cb)

		gnutls_x509_crt_set_pin_function(crt, res->pin.cb,

						 res->pin.data);

	ret = gnutls_x509_crt_import_url(crt, url, 0);

	if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)

		ret =

		    gnutls_x509_crt_import_url(crt, url,

					       GNUTLS_PKCS11_OBJ_FLAG_LOGIN);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	ret = _gnutls_get_x509_name(crt, &names);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	/* Try to load the whole certificate chain from the PKCS #11 token */

	for (i=0;i

		ret = gnutls_x509_crt_check_issuer(crt, crt);

		if (i > 0 && ret != 0) {

			/* self signed */

			break;

		}

		ret = gnutls_pcert_import_x509(&ccert[i], crt, 0);

		if (ret < 0) {

			gnutls_assert();

			goto cleanup;

		}

		count++;

		ret = _gnutls_get_raw_issuer(url, crt, &t, 0);

		if (ret < 0)

			break;

		gnutls_x509_crt_deinit(crt);

		crt = NULL;

		ret = gnutls_x509_crt_init(&crt;;

		if (ret < 0) {

			gnutls_assert();

			goto cleanup;

		}

		ret = gnutls_x509_crt_import(crt, &t, GNUTLS_X509_FMT_DER);

		if (ret < 0) {

			gnutls_assert();

			goto cleanup;

		}

		gnutls_free(t.data);

	}

	ret = _gnutls_certificate_credential_append_keypair(res, key, names, ccert, count);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	if (crt != NULL)

		gnutls_x509_crt_deinit(crt);

	return 0;

cleanup:

	if (crt != NULL)

		gnutls_x509_crt_deinit(crt);

	gnutls_free(t.data);

	_gnutls_str_array_clear(&names);

	gnutls_free(ccert);

	return ret;

}

/* Reads a certificate file

 */

static int

read_cert_file(gnutls_certificate_credentials_t res,

	       gnutls_privkey_t key,

	       const char *certfile, gnutls_x509_crt_fmt_t type)

{

	int ret;

	size_t size;

	char *data;

	if (gnutls_url_is_supported(certfile)) {

		return read_cert_url(res, key, certfile);

	}

	data = read_file(certfile, RF_BINARY, &size);

	if (data == NULL) {

		gnutls_assert();

		return GNUTLS_E_FILE_ERROR;

	}

	ret = read_cert_mem(res, key, data, size, type);

	free(data);

	return ret;

}

/* Reads PKCS-1 RSA private key file or a DSA file (in the format openssl

 * stores it).

 */

int

_gnutls_read_key_file(gnutls_certificate_credentials_t res,

	      const char *keyfile, gnutls_x509_crt_fmt_t type,

	      const char *pass, unsigned int flags,

	      gnutls_privkey_t *rkey)

{

	int ret;

	size_t size;

	char *data;

	if (_gnutls_url_is_known(keyfile)) {

		if (gnutls_url_is_supported(keyfile)) {

			/* if no PIN function is specified, and we have a PIN,

			 * specify one */

			if (pass != NULL && res->pin.cb == NULL) {

				snprintf(res->pin_tmp, sizeof(res->pin_tmp), "%s", pass);

				gnutls_certificate_set_pin_function(res, tmp_pin_cb, res->pin_tmp);

			}

			return read_key_url(res, keyfile, rkey);

		} else

			return

			    gnutls_assert_val

			    (GNUTLS_E_UNIMPLEMENTED_FEATURE);

	}

	data = read_file(keyfile, RF_BINARY | RF_SENSITIVE, &size);

	if (data == NULL) {

		gnutls_assert();

		return GNUTLS_E_FILE_ERROR;

	}

	ret = _gnutls_read_key_mem(res, data, size, type, pass, flags, rkey);

	zeroize_key(data, size);

	free(data);

	return ret;

}

/**

 * gnutls_certificate_set_x509_key_mem:

 * @res: is a #gnutls_certificate_credentials_t type.

 * @cert: contains a certificate list (path) for the specified private key

 * @key: is the private key, or %NULL

 * @type: is PEM or DER

 *

 * This function sets a certificate/private key pair in the

 * gnutls_certificate_credentials_t type. This function may be called

 * more than once, in case multiple keys/certificates exist for the

 * server.

 *

 * Note that the keyUsage (2.5.29.15) PKIX extension in X.509 certificates

 * is supported. This means that certificates intended for signing cannot

 * be used for ciphersuites that require encryption.

 *

 * If the certificate and the private key are given in PEM encoding

 * then the strings that hold their values must be null terminated.

 *

 * The @key may be %NULL if you are using a sign callback, see

 * gnutls_sign_callback_set().

 *

 * Note that, this function by default returns zero on success and a negative value on error.

 * Since 3.5.6, when the flag %GNUTLS_CERTIFICATE_API_V2 is set using gnutls_certificate_set_flags()

 * it returns an index (greater or equal to zero). That index can be used to other functions to refer to the added key-pair.

 *

 * Returns: On success this functions returns zero, and otherwise a negative value on error (see above for modifying that behavior).

 *

 **/

int

gnutls_certificate_set_x509_key_mem(gnutls_certificate_credentials_t res,

				    const gnutls_datum_t * cert,

				    const gnutls_datum_t * key,

				    gnutls_x509_crt_fmt_t type)

{

	return gnutls_certificate_set_x509_key_mem2(res, cert, key, type,

						    NULL, 0);

}

/**

 * gnutls_certificate_set_x509_key_mem2:

 * @res: is a #gnutls_certificate_credentials_t type.

 * @cert: contains a certificate list (path) for the specified private key

 * @key: is the private key, or %NULL

 * @type: is PEM or DER

 * @pass: is the key's password

 * @flags: an ORed sequence of gnutls_pkcs_encrypt_flags_t

 *

 * This function sets a certificate/private key pair in the

 * gnutls_certificate_credentials_t type. This function may be called

 * more than once, in case multiple keys/certificates exist for the

 * server.

 *

 * Note that the keyUsage (2.5.29.15) PKIX extension in X.509 certificates

 * is supported. This means that certificates intended for signing cannot

 * be used for ciphersuites that require encryption.

 *

 * If the certificate and the private key are given in PEM encoding

 * then the strings that hold their values must be null terminated.

 *

 * The @key may be %NULL if you are using a sign callback, see

 * gnutls_sign_callback_set().

 *

 * Note that, this function by default returns zero on success and a negative value on error.

 * Since 3.5.6, when the flag %GNUTLS_CERTIFICATE_API_V2 is set using gnutls_certificate_set_flags()

 * it returns an index (greater or equal to zero). That index can be used to other functions to refer to the added key-pair.

 *

 * Returns: On success this functions returns zero, and otherwise a negative value on error (see above for modifying that behavior).

 **/

int

gnutls_certificate_set_x509_key_mem2(gnutls_certificate_credentials_t res,

				     const gnutls_datum_t * cert,

				     const gnutls_datum_t * key,

				     gnutls_x509_crt_fmt_t type,

				     const char *pass, unsigned int flags)

{

	int ret;

	gnutls_privkey_t rkey;

	/* this should be first

	 */

	if ((ret = _gnutls_read_key_mem(res, key ? key->data : NULL,

				key ? key->size : 0, type, pass,

				flags, &rkey)) < 0)

		return ret;

	if ((ret = read_cert_mem(res, rkey, cert->data, cert->size, type)) < 0) {

		gnutls_privkey_deinit(rkey);

		return ret;

	}

	res->ncerts++;

	if (key && (ret = _gnutls_check_key_cert_match(res)) < 0) {

		gnutls_assert();

		return ret;

	}

	CRED_RET_SUCCESS(res);

}

/**

 * gnutls_certificate_set_x509_key:

 * @res: is a #gnutls_certificate_credentials_t type.

 * @cert_list: contains a certificate list (path) for the specified private key

 * @cert_list_size: holds the size of the certificate list

 * @key: is a #gnutls_x509_privkey_t key

 *

 * This function sets a certificate/private key pair in the

 * gnutls_certificate_credentials_t type.  This function may be

 * called more than once, in case multiple keys/certificates exist for

 * the server.  For clients that wants to send more than their own end

 * entity certificate (e.g., also an intermediate CA cert) then put

 * the certificate chain in @cert_list.

 *

 * Note that the certificates and keys provided, can be safely deinitialized

 * after this function is called.

 *

 * If that function fails to load the @res type is at an undefined state, it must

 * not be reused to load other keys or certificates.

 *

 * Note that, this function by default returns zero on success and a negative value on error.

 * Since 3.5.6, when the flag %GNUTLS_CERTIFICATE_API_V2 is set using gnutls_certificate_set_flags()

 * it returns an index (greater or equal to zero). That index can be used to other functions to refer to the added key-pair.

 *

 * Returns: On success this functions returns zero, and otherwise a negative value on error (see above for modifying that behavior).

 *

 * Since: 2.4.0

 **/

int

gnutls_certificate_set_x509_key(gnutls_certificate_credentials_t res,

				gnutls_x509_crt_t * cert_list,

				int cert_list_size,

				gnutls_x509_privkey_t key)

{

	int ret;

	gnutls_privkey_t pkey;

	gnutls_pcert_st *pcerts = NULL;

	gnutls_str_array_t names;

	_gnutls_str_array_init(&names);

	/* this should be first

	 */

	ret = gnutls_privkey_init(&pkey);

	if (ret < 0) {

		gnutls_assert();

		return ret;

	}

	if (res->pin.cb)

		gnutls_privkey_set_pin_function(pkey, res->pin.cb,

						res->pin.data);

	ret =

	    gnutls_privkey_import_x509(pkey, key,

				       GNUTLS_PRIVKEY_IMPORT_COPY);

	if (ret < 0) {

		gnutls_assert();

		return ret;

	}

	/* load certificates */

	pcerts = gnutls_malloc(sizeof(gnutls_pcert_st) * cert_list_size);

	if (pcerts == NULL) {

		gnutls_assert();

		return GNUTLS_E_MEMORY_ERROR;

	}

	ret = _gnutls_get_x509_name(cert_list[0], &names);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	ret =

		gnutls_pcert_import_x509_list(pcerts, cert_list, (unsigned int*)&cert_list_size,

					      GNUTLS_X509_CRT_LIST_SORT);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	ret =

	    _gnutls_certificate_credential_append_keypair(res, pkey, names, pcerts,

						   cert_list_size);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	res->ncerts++;

	/* after this point we do not deinitialize anything on failure to avoid

	 * double freeing. We intentionally keep everything as the credentials state

	 * is documented to be on undefined state. */

	if ((ret = _gnutls_check_key_cert_match(res)) < 0) {

		gnutls_assert();

		return ret;

	}

	CRED_RET_SUCCESS(res);

      cleanup:

	gnutls_free(pcerts);

	_gnutls_str_array_clear(&names);

	return ret;

}

/**

 * gnutls_certificate_get_x509_key:

 * @res: is a #gnutls_certificate_credentials_t type.

 * @index: The index of the key to obtain.

 * @key: Location to store the key.

 *

 * Obtains a X.509 private key that has been stored in @res with one of

 * gnutls_certificate_set_x509_key(), gnutls_certificate_set_key(),

 * gnutls_certificate_set_x509_key_file(),

 * gnutls_certificate_set_x509_key_file2(),

 * gnutls_certificate_set_x509_key_mem(), or

 * gnutls_certificate_set_x509_key_mem2(). The returned key must be deallocated

 * with gnutls_x509_privkey_deinit() when no longer needed.

 *

 * The @index matches the return value of gnutls_certificate_set_x509_key() and friends

 * functions, when the %GNUTLS_CERTIFICATE_API_V2 flag is set.

 *

 * If there is no key with the given index,

 * %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE is returned. If the key with the

 * given index is not a X.509 key, %GNUTLS_E_INVALID_REQUEST is returned.

 *

 * Returns: %GNUTLS_E_SUCCESS (0) on success, or a negative error code.

 *

 * Since: 3.4.0

 */

int

gnutls_certificate_get_x509_key(gnutls_certificate_credentials_t res,

				unsigned index,

				gnutls_x509_privkey_t *key)

{

	if (index >= res->ncerts) {

		gnutls_assert();

		return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE;

	}

	return gnutls_privkey_export_x509(res->certs[index].pkey, key);

}

/**

 * gnutls_certificate_get_x509_crt:

 * @res: is a #gnutls_certificate_credentials_t type.

 * @index: The index of the certificate list to obtain.

 * @crt_list: Where to store the certificate list.

 * @crt_list_size: Will hold the number of certificates.

 *

 * Obtains a X.509 certificate list that has been stored in @res with one of

 * gnutls_certificate_set_x509_key(), gnutls_certificate_set_key(),

 * gnutls_certificate_set_x509_key_file(),

 * gnutls_certificate_set_x509_key_file2(),

 * gnutls_certificate_set_x509_key_mem(), or

 * gnutls_certificate_set_x509_key_mem2(). Each certificate in the returned

 * certificate list must be deallocated with gnutls_x509_crt_deinit(), and the

 * list itself must be freed with gnutls_free().

 *

 * The @index matches the return value of gnutls_certificate_set_x509_key() and friends

 * functions, when the %GNUTLS_CERTIFICATE_API_V2 flag is set.

 *

 * If there is no certificate with the given index,

 * %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE is returned. If the certificate

 * with the given index is not a X.509 certificate, %GNUTLS_E_INVALID_REQUEST

 * is returned. The returned certificates must be deinitialized after

 * use, and the @crt_list pointer must be freed using gnutls_free().

 *

 * Returns: %GNUTLS_E_SUCCESS (0) on success, or a negative error code.

 *

 * Since: 3.4.0