/*

 * GnuTLS public key support

 * Copyright (C) 2010-2012 Free Software Foundation, Inc.

 * Copyright (C) 2017 Red Hat, Inc.

 * 

 * Author: Nikos Mavrogiannopoulos

 *

 * The GnuTLS is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public License

 * as published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <https://www.gnu.org/licenses/>

 */

#include "gnutls_int.h"

#include <gnutls/pkcs11.h>

#include <stdio.h>

#include <string.h>

#include "errors.h"

#include <datum.h>

#include <pkcs11_int.h>

#include <gnutls/abstract.h>

#include <tls-sig.h>

#include <pk.h>

#include <x509_int.h>

#include <num.h>

#include <x509/common.h>

#include <x509_b64.h>

#include <abstract_int.h>

#include <fips.h>

#include "urls.h"

#include <ecc.h>

static int

pubkey_verify_hashed_data(const gnutls_sign_entry_st *se,

			  const mac_entry_st *me,

			  const gnutls_datum_t * hash,

			  const gnutls_datum_t * signature,

			  gnutls_pk_params_st * params,

			  gnutls_x509_spki_st * sign_params,

			  unsigned flags);

static

int pubkey_supports_sig(gnutls_pubkey_t pubkey,

			const gnutls_sign_entry_st *se);

unsigned pubkey_to_bits(const gnutls_pk_params_st * params)

{

	switch (params->algo) {

	case GNUTLS_PK_RSA:

	case GNUTLS_PK_RSA_PSS:

		return _gnutls_mpi_get_nbits(params->params[RSA_MODULUS]);

	case GNUTLS_PK_DSA:

		return _gnutls_mpi_get_nbits(params->params[DSA_P]);

	case GNUTLS_PK_ECDSA:

	case GNUTLS_PK_EDDSA_ED25519:

	case GNUTLS_PK_EDDSA_ED448:

	case GNUTLS_PK_GOST_01:

	case GNUTLS_PK_GOST_12_256:

	case GNUTLS_PK_GOST_12_512:

		return gnutls_ecc_curve_get_size(params->curve) * 8;

	default:

		return 0;

	}

}

/**

 * gnutls_pubkey_get_pk_algorithm:

 * @key: should contain a #gnutls_pubkey_t type

 * @bits: If set will return the number of bits of the parameters (may be NULL)

 *

 * This function will return the public key algorithm of a public

 * key and if possible will return a number of bits that indicates

 * the security parameter of the key.

 *

 * Returns: a member of the #gnutls_pk_algorithm_t enumeration on

 *   success, or a negative error code on error.

 *

 * Since: 2.12.0

 **/

int gnutls_pubkey_get_pk_algorithm(gnutls_pubkey_t key, unsigned int *bits)

{

	if (bits)

		*bits = key->bits;

	return key->params.algo;

}

/**

 * gnutls_pubkey_get_key_usage:

 * @key: should contain a #gnutls_pubkey_t type

 * @usage: If set will return the number of bits of the parameters (may be NULL)

 *

 * This function will return the key usage of the public key.

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a

 *   negative error value.

 *

 * Since: 2.12.0

 **/

int gnutls_pubkey_get_key_usage(gnutls_pubkey_t key, unsigned int *usage)

{

	if (usage)

		*usage = key->key_usage;

	return 0;

}

/**

 * gnutls_pubkey_init:

 * @key: A pointer to the type to be initialized

 *

 * This function will initialize a public key.

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a

 *   negative error value.

 *

 * Since: 2.12.0

 **/

int gnutls_pubkey_init(gnutls_pubkey_t * key)

{

	FAIL_IF_LIB_ERROR;

	*key = gnutls_calloc(1, sizeof(struct gnutls_pubkey_st));

	if (*key == NULL) {

		gnutls_assert();

		return GNUTLS_E_MEMORY_ERROR;

	}

	return 0;

}

/**

 * gnutls_pubkey_deinit:

 * @key: The key to be deinitialized

 *

 * This function will deinitialize a public key structure.

 *

 * Since: 2.12.0

 **/

void gnutls_pubkey_deinit(gnutls_pubkey_t key)

{

	if (!key)

		return;

	gnutls_pk_params_release(&key->params);

	gnutls_free(key);

}

/**

 * gnutls_pubkey_import_x509:

 * @key: The public key

 * @crt: The certificate to be imported

 * @flags: should be zero

 *

 * This function will import the given public key to the abstract

 * #gnutls_pubkey_t type.

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a

 *   negative error value.

 *

 * Since: 2.12.0

 **/

int

gnutls_pubkey_import_x509(gnutls_pubkey_t key, gnutls_x509_crt_t crt,

			  unsigned int flags)

{

	int ret;

	gnutls_pk_params_release(&key->params);

	/* params initialized in _gnutls_x509_crt_get_mpis */

	ret = gnutls_x509_crt_get_pk_algorithm(crt, &key->bits);

	if (ret < 0)

		return gnutls_assert_val(ret);

	key->params.algo = ret;

	ret = gnutls_x509_crt_get_key_usage(crt, &key->key_usage, NULL);

	if (ret < 0)

		key->key_usage = 0;

	ret = _gnutls_x509_crt_get_mpis(crt, &key->params);

	if (ret < 0) {

		gnutls_assert();

		return ret;

	}

	return 0;

}

/**

 * gnutls_pubkey_import_x509_crq:

 * @key: The public key

 * @crq: The certificate to be imported

 * @flags: should be zero

 *

 * This function will import the given public key to the abstract

 * #gnutls_pubkey_t type.

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a

 *   negative error value.

 *

 * Since: 3.1.5

 **/

int

gnutls_pubkey_import_x509_crq(gnutls_pubkey_t key, gnutls_x509_crq_t crq,

			      unsigned int flags)

{

	int ret;

	gnutls_pk_params_release(&key->params);

	/* params initialized in _gnutls_x509_crq_get_mpis */

	key->params.algo = gnutls_x509_crq_get_pk_algorithm(crq, &key->bits);

	ret = gnutls_x509_crq_get_key_usage(crq, &key->key_usage, NULL);

	if (ret < 0)

		key->key_usage = 0;

	ret = _gnutls_x509_crq_get_mpis(crq, &key->params);

	if (ret < 0) {

		gnutls_assert();

		return ret;

	}

	return 0;

}

/**

 * gnutls_pubkey_import_privkey:

 * @key: The public key

 * @pkey: The private key

 * @usage: GNUTLS_KEY_* key usage flags.

 * @flags: should be zero

 *

 * Imports the public key from a private.  This function will import

 * the given public key to the abstract #gnutls_pubkey_t type.

 *

 * Note that in certain keys this operation may not be possible, e.g.,

 * in other than RSA PKCS#11 keys.

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a

 *   negative error value.

 *

 * Since: 2.12.0

 **/

int

gnutls_pubkey_import_privkey(gnutls_pubkey_t key, gnutls_privkey_t pkey,

			     unsigned int usage, unsigned int flags)

{

	gnutls_pk_params_release(&key->params);

	gnutls_pk_params_init(&key->params);

	key->key_usage = usage;

	key->params.algo = gnutls_privkey_get_pk_algorithm(pkey, &key->bits);

	return _gnutls_privkey_get_public_mpis(pkey, &key->params);

}

/**

 * gnutls_pubkey_get_preferred_hash_algorithm:

 * @key: Holds the certificate

 * @hash: The result of the call with the hash algorithm used for signature

 * @mand: If non zero it means that the algorithm MUST use this hash. May be NULL.

 *

 * This function will read the certificate and return the appropriate digest

 * algorithm to use for signing with this certificate. Some certificates (i.e.

 * DSA might not be able to sign without the preferred algorithm).

 *

 * To get the signature algorithm instead of just the hash use gnutls_pk_to_sign()

 * with the algorithm of the certificate/key and the provided @hash.

 *

 * Returns: the 0 if the hash algorithm is found. A negative error code is

 * returned on error.

 *

 * Since: 2.12.0

 **/

int

gnutls_pubkey_get_preferred_hash_algorithm(gnutls_pubkey_t key,

					   gnutls_digest_algorithm_t *

					   hash, unsigned int *mand)

{

	int ret;

	const mac_entry_st *me;

	if (key == NULL) {

		gnutls_assert();

		return GNUTLS_E_INVALID_REQUEST;

	}

	if (mand)

		*mand = 0;

	switch (key->params.algo) {

	case GNUTLS_PK_DSA:

		if (mand)

			*mand = 1;

		FALLTHROUGH;

	case GNUTLS_PK_ECDSA:

		me = _gnutls_dsa_q_to_hash(&key->params, NULL);

		if (hash)

			*hash = (gnutls_digest_algorithm_t)me->id;

		ret = 0;

		break;

	case GNUTLS_PK_EDDSA_ED25519:

		if (hash)

			*hash = GNUTLS_DIG_SHA512;

		ret = 0;

		break;

	case GNUTLS_PK_EDDSA_ED448:

		if (hash)

			*hash = GNUTLS_DIG_SHAKE_256;

		ret = 0;

		break;

	case GNUTLS_PK_GOST_01:

	case GNUTLS_PK_GOST_12_256:

	case GNUTLS_PK_GOST_12_512:

		if (hash)

			*hash = _gnutls_gost_digest(key->params.algo);

		if (mand)

			*mand = 1;

		ret = 0;

		break;

	case GNUTLS_PK_RSA_PSS:

		if (mand && key->params.spki.rsa_pss_dig)

			*mand = 1;

		if (hash) {

			if (key->params.spki.rsa_pss_dig) {

				*hash = key->params.spki.rsa_pss_dig;

			} else {

				*hash = _gnutls_pk_bits_to_sha_hash(pubkey_to_bits(&key->params));

			}

		}

		ret = 0;

		break;

	case GNUTLS_PK_RSA:

		if (hash)

			*hash = _gnutls_pk_bits_to_sha_hash(pubkey_to_bits(&key->params));

		ret = 0;

		break;

	default:

		gnutls_assert();

		ret = GNUTLS_E_INTERNAL_ERROR;

	}

	return ret;

}

#ifdef ENABLE_PKCS11

/* The EC_PARAMS attribute can contain either printable string with curve name

 * or OID defined in RFC 8410 */

static int

gnutls_pubkey_parse_ecc_eddsa_params(const gnutls_datum_t *parameters,

				     gnutls_ecc_curve_t *outcurve)

{

	gnutls_ecc_curve_t curve = GNUTLS_ECC_CURVE_INVALID;

	ASN1_TYPE asn1 = ASN1_TYPE_EMPTY;

	unsigned int etype = ASN1_ETYPE_INVALID;

	char str[MAX_OID_SIZE];

	int str_size;

	int ret;

	ret = asn1_create_element(_gnutls_get_gnutls_asn(),

				  "GNUTLS.pkcs-11-ec-Parameters", &asn1);

	if (ret != ASN1_SUCCESS) {

		gnutls_assert();

		return _gnutls_asn2err(ret);

	}

	ret = asn1_der_decoding(&asn1, parameters->data, parameters->size,

				NULL);

	if (ret != ASN1_SUCCESS) {

		gnutls_assert();

		ret = _gnutls_asn2err(ret);

		goto cleanup;

	}

	/* Read the type of choice.

	 */

	str_size = sizeof(str) - 1;

	ret = asn1_read_value(asn1, "", str, &str_size);

	if (ret != ASN1_SUCCESS) {

		gnutls_assert();

		ret = _gnutls_asn2err(ret);

		goto cleanup;

	}

	str[str_size] = 0;

	/* Convert the choice to enum type */

	if (strcmp(str, "oId") == 0) {

		etype = ASN1_ETYPE_OBJECT_ID;

	} else if (strcmp(str, "curveName") == 0) {

		etype = ASN1_ETYPE_PRINTABLE_STRING;

	}

	str_size = sizeof(str) - 1;

	switch (etype) {

	case ASN1_ETYPE_OBJECT_ID:

		ret = asn1_read_value(asn1, "oId", str, &str_size);

		if (ret != ASN1_SUCCESS) {

			gnutls_assert();

			ret = _gnutls_asn2err(ret);

			break;

		}

		curve = gnutls_oid_to_ecc_curve(str);

		if (curve != GNUTLS_ECC_CURVE_ED25519 &&

		    curve != GNUTLS_ECC_CURVE_ED448) {

			_gnutls_debug_log("Curve %s is not supported for EdDSA\n", str);

			gnutls_assert();

			curve = GNUTLS_ECC_CURVE_INVALID;

			ret = GNUTLS_E_ECC_UNSUPPORTED_CURVE;

			break;

		}

		ret = GNUTLS_E_SUCCESS;

		break;

	case ASN1_ETYPE_PRINTABLE_STRING:

		ret = asn1_read_value(asn1, "curveName", str, &str_size);

		if (ret != ASN1_SUCCESS) {

			gnutls_assert();

			ret = _gnutls_asn2err(ret);

			break;

		}

		if (str_size == strlen("edwards25519") &&

		    strncmp(str, "edwards25519", str_size) == 0) {

			curve = GNUTLS_ECC_CURVE_ED25519;

			ret = GNUTLS_E_SUCCESS;

			break;

		} else if (str_size == strlen("edwards448") &&

			   strncmp(str, "edwards448", str_size) == 0) {

			curve = GNUTLS_ECC_CURVE_ED448;

			ret = GNUTLS_E_SUCCESS;

			break;

		}

		/* FALLTHROUGH */

	default:

		/* Neither of CHOICEs found. Fail */

		gnutls_assert();

		ret = GNUTLS_E_ECC_UNSUPPORTED_CURVE;

		curve = GNUTLS_ECC_CURVE_INVALID;

		break;

	}

      cleanup:

	asn1_delete_structure(&asn1);

	*outcurve = curve;

	return ret;

}

static int

gnutls_pubkey_import_ecc_eddsa(gnutls_pubkey_t key,

			       const gnutls_datum_t * parameters,

			       const gnutls_datum_t * ecpoint)

{

	int ret;

	gnutls_ecc_curve_t curve = GNUTLS_ECC_CURVE_INVALID;

	gnutls_datum_t raw_point = {NULL, 0};

	ret = gnutls_pubkey_parse_ecc_eddsa_params(parameters, &curve);

	if (ret < 0) {

		return gnutls_assert_val(ret);

	}

	ret = _gnutls_x509_decode_string(ASN1_ETYPE_OCTET_STRING,

					 ecpoint->data, ecpoint->size,

					 &raw_point, 0);

	if (ret < 0) {

		gnutls_assert();

		gnutls_free(raw_point.data);

		return ret;

	}

	ret = gnutls_pubkey_import_ecc_raw(key, curve, &raw_point, NULL);

	gnutls_free(raw_point.data);

	return ret;

}

/**

 * gnutls_pubkey_import_pkcs11:

 * @key: The public key

 * @obj: The parameters to be imported

 * @flags: should be zero

 *

 * Imports a public key from a pkcs11 key. This function will import

 * the given public key to the abstract #gnutls_pubkey_t type.

 *

 * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a

 *   negative error value.

 *

 * Since: 2.12.0

 **/

int

gnutls_pubkey_import_pkcs11(gnutls_pubkey_t key,

			    gnutls_pkcs11_obj_t obj, unsigned int flags)

{

	int ret, type;

	type = gnutls_pkcs11_obj_get_type(obj);

	if (type != GNUTLS_PKCS11_OBJ_PUBKEY

	    && type != GNUTLS_PKCS11_OBJ_X509_CRT) {

		gnutls_assert();

		return GNUTLS_E_INVALID_REQUEST;

	}

	if (type == GNUTLS_PKCS11_OBJ_X509_CRT) {

		gnutls_x509_crt_t xcrt;

		ret = gnutls_x509_crt_init(&xcrt);

		if (ret < 0) {

			gnutls_assert()

			    return ret;

		}

		ret = gnutls_x509_crt_import_pkcs11(xcrt, obj);

		if (ret < 0) {

			gnutls_assert();

			goto cleanup_crt;

		}

		ret = gnutls_pubkey_import_x509(key, xcrt, 0);

		if (ret < 0) {

			gnutls_assert();

			goto cleanup_crt;

		}

		ret = gnutls_x509_crt_get_key_usage(xcrt, &key->key_usage, NULL);

		if (ret < 0)

		  key->key_usage = 0;

		ret = 0;

	      cleanup_crt:

		gnutls_x509_crt_deinit(xcrt);

		return ret;

	}

	key->key_usage = obj->key_usage;

	switch (obj->pk_algorithm) {

	case GNUTLS_PK_RSA:

	case GNUTLS_PK_RSA_PSS:

		ret = gnutls_pubkey_import_rsa_raw(key, &obj->pubkey[0],

						   &obj->pubkey[1]);

		break;

	case GNUTLS_PK_DSA:

		ret = gnutls_pubkey_import_dsa_raw(key, &obj->pubkey[0],

						   &obj->pubkey[1],

						   &obj->pubkey[2],

						   &obj->pubkey[3]);

		break;

	case GNUTLS_PK_EC:

		ret = gnutls_pubkey_import_ecc_x962(key, &obj->pubkey[0],

						    &obj->pubkey[1]);

		break;

	case GNUTLS_PK_EDDSA_ED25519:

		ret = gnutls_pubkey_import_ecc_eddsa(key, &obj->pubkey[0],

						     &obj->pubkey[1]);

		break;

	default:

		gnutls_assert();

		return GNUTLS_E_UNIMPLEMENTED_FEATURE;

	}

	if (ret < 0) {

		gnutls_assert();

		return ret;

	}

	return 0;

}

#endif				/* ENABLE_PKCS11 */

/**

 * gnutls_pubkey_export:

 * @key: Holds the certificate

 * @format: the format of output params. One of PEM or DER.

 * @output_data: will contain a certificate PEM or DER encoded

 * @output_data_size: holds the size of output_data (and will be

 *   replaced by the actual size of parameters)

 *

 * This function will export the public key to DER or PEM format.

 * The contents of the exported data is the SubjectPublicKeyInfo

 * X.509 structure.

 *

 * If the buffer provided is not long enough to hold the output, then

 * *output_data_size is updated and %GNUTLS_E_SHORT_MEMORY_BUFFER will

 * be returned.

 *

 * If the structure is PEM encoded, it will have a header

 * of "BEGIN CERTIFICATE".

 *

 * Returns: In case of failure a negative error code will be

 *   returned, and 0 on success.

 *

 * Since: 2.12.0

 **/

int

gnutls_pubkey_export(gnutls_pubkey_t key,

		     gnutls_x509_crt_fmt_t format, void *output_data,

		     size_t * output_data_size)

{

	int result;

	ASN1_TYPE spk = ASN1_TYPE_EMPTY;

	if (key == NULL) {

		gnutls_assert();

		return GNUTLS_E_INVALID_REQUEST;

	}

	if ((result = asn1_create_element

	     (_gnutls_get_pkix(), "PKIX1.SubjectPublicKeyInfo", &spk))

	    != ASN1_SUCCESS) {

		gnutls_assert();

		return _gnutls_asn2err(result);

	}

	result =

	    _gnutls_x509_encode_and_copy_PKI_params(spk, "",

						    &key->params);

	if (result < 0) {

		gnutls_assert();

		goto cleanup;

	}

	result = _gnutls_x509_export_int_named(spk, "",

					       format, PEM_PK,

					       output_data,

					       output_data_size);

	if (result < 0) {

		gnutls_assert();

		goto cleanup;

	}

	result = 0;

      cleanup:

	asn1_delete_structure(&spk;;

	return result;

}

/**

 * gnutls_pubkey_export2:

 * @key: Holds the certificate

 * @format: the format of output params. One of PEM or DER.

 * @out: will contain a certificate PEM or DER encoded

 *

 * This function will export the public key to DER or PEM format.

 * The contents of the exported data is the SubjectPublicKeyInfo

 * X.509 structure.

 *

 * The output buffer will be allocated using gnutls_malloc().

 *

 * If the structure is PEM encoded, it will have a header

 * of "BEGIN CERTIFICATE".

 *

 * Returns: In case of failure a negative error code will be

 *   returned, and 0 on success.

 *

 * Since: 3.1.3

 **/

int

gnutls_pubkey_export2(gnutls_pubkey_t key,

		      gnutls_x509_crt_fmt_t format, gnutls_datum_t * out)

{

	int result;

	ASN1_TYPE spk = ASN1_TYPE_EMPTY;

	if (key == NULL) {

		gnutls_assert();

		return GNUTLS_E_INVALID_REQUEST;

	}

	if ((result = asn1_create_element

	     (_gnutls_get_pkix(), "PKIX1.SubjectPublicKeyInfo", &spk))

	    != ASN1_SUCCESS) {

		gnutls_assert();

		return _gnutls_asn2err(result);

	}

	result =

	    _gnutls_x509_encode_and_copy_PKI_params(spk, "",

						    &key->params);

	if (result < 0) {

		gnutls_assert();

		goto cleanup;

	}

	result = _gnutls_x509_export_int_named2(spk, "",

						format, PEM_PK,

						out);

	if (result < 0) {

		gnutls_assert();

		goto cleanup;

	}

	result = 0;

      cleanup:

	asn1_delete_structure(&spk;;

	return result;

}

/**

 * gnutls_pubkey_get_key_id:

 * @key: Holds the public key

 * @flags: should be one of the flags from %gnutls_keyid_flags_t

 * @output_data: will contain the key ID

 * @output_data_size: holds the size of output_data (and will be

 *   replaced by the actual size of parameters)

 *

 * This function will return a unique ID that depends on the public

 * key parameters. This ID can be used in checking whether a

 * certificate corresponds to the given public key.

 *

 * If the buffer provided is not long enough to hold the output, then

 * *output_data_size is updated and %GNUTLS_E_SHORT_MEMORY_BUFFER will

 * be returned.  The output will normally be a SHA-1 hash output,

 * which is 20 bytes.

 *

 * Returns: In case of failure a negative error code will be

 *   returned, and 0 on success.

 *

 * Since: 2.12.0

 **/

int

gnutls_pubkey_get_key_id(gnutls_pubkey_t key, unsigned int flags,

			 unsigned char *output_data,

			 size_t * output_data_size)

{

	int ret = 0;

	if (key == NULL) {

		gnutls_assert();

		return GNUTLS_E_INVALID_REQUEST;

	}

	ret =

	    _gnutls_get_key_id(&key->params,

			       output_data, output_data_size, flags);

	if (ret < 0) {

		gnutls_assert();

		return ret;

	}

	return 0;

}

/**

 * gnutls_pubkey_export_rsa_raw2:

 * @key: Holds the certificate

 * @m: will hold the modulus (may be %NULL)

 * @e: will hold the public exponent (may be %NULL)

 * @flags: flags from %gnutls_abstract_export_flags_t

 *

 * This function will export the RSA public key's parameters found in

 * the given structure.  The new parameters will be allocated using

 * gnutls_malloc() and will be stored in the appropriate datum.

 *

 * This function allows for %NULL parameters since 3.4.1.

 *

 * Returns: %GNUTLS_E_SUCCESS on success, otherwise a negative error code.

 *

 * Since: 3.6.0

 **/

int

gnutls_pubkey_export_rsa_raw2(gnutls_pubkey_t key,

			     gnutls_datum_t * m, gnutls_datum_t * e,

			     unsigned flags)

{

	int ret;

	mpi_dprint_func dprint = _gnutls_mpi_dprint_lz;

	if (flags & GNUTLS_EXPORT_FLAG_NO_LZ)

		dprint = _gnutls_mpi_dprint;

	if (key == NULL) {

		gnutls_assert();

		return GNUTLS_E_INVALID_REQUEST;

	}

	if (!GNUTLS_PK_IS_RSA(key->params.algo)) {

		gnutls_assert();

		return GNUTLS_E_INVALID_REQUEST;

	}

	if (m) {

		ret = dprint(key->params.params[0], m);

		if (ret < 0) {

			gnutls_assert();

			return ret;

		}

	}

	if (e) {

		ret = dprint(key->params.params[1], e);

		if (ret < 0) {

			gnutls_assert();

			_gnutls_free_datum(m);

			return ret;

		}

	}

	return 0;

}

/**

 * gnutls_pubkey_export_rsa_raw:

 * @key: Holds the certificate

 * @m: will hold the modulus (may be %NULL)

 * @e: will hold the public exponent (may be %NULL)

 *

 * This function will export the RSA public key's parameters found in

 * the given structure.  The new parameters will be allocated using

 * gnutls_malloc() and will be stored in the appropriate datum.

 *

 * This function allows for %NULL parameters since 3.4.1.

 *

 * Returns: %GNUTLS_E_SUCCESS on success, otherwise a negative error code.

 *

 * Since: 3.3.0

 **/

int

gnutls_pubkey_export_rsa_raw(gnutls_pubkey_t key,

			     gnutls_datum_t * m, gnutls_datum_t * e)

{

	return gnutls_pubkey_export_rsa_raw2(key, m, e, 0);

}

/**

 * gnutls_pubkey_export_dsa_raw:

 * @key: Holds the public key

 * @p: will hold the p (may be %NULL)

 * @q: will hold the q (may be %NULL)

 * @g: will hold the g (may be %NULL)

 * @y: will hold the y (may be %NULL)

 *

 * This function will export the DSA public key's parameters found in

 * the given certificate.  The new parameters will be allocated using

 * gnutls_malloc() and will be stored in the appropriate datum.

 *

 * This function allows for %NULL parameters since 3.4.1.

 *

 * Returns: %GNUTLS_E_SUCCESS on success, otherwise a negative error code.

 *

 * Since: 3.3.0

 **/

int

gnutls_pubkey_export_dsa_raw(gnutls_pubkey_t key,

			     gnutls_datum_t * p, gnutls_datum_t * q,

			     gnutls_datum_t * g, gnutls_datum_t * y)

{

	return gnutls_pubkey_export_dsa_raw2(key, p, q, g, y, 0);

}

/**