/*

 * Copyright (C) 2002-2016 Free Software Foundation, Inc.

 * Copyright (C) 2016-2017 Red Hat, Inc.

 *

 * Author: Nikos Mavrogiannopoulos

 *

 * This file is part of GnuTLS.

 *

 * The GnuTLS is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public License

 * as published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public License

 * along with this program.  If not, see <http://www.gnu.org/licenses/>

 *

 */

#include "gnutls_int.h"

#include "auth.h"

#include "errors.h"

#include "extensions.h"

#include <auth/cert.h>

#include "dh.h"

#include "num.h"

#include "datum.h"

#include <pk.h>

#include <algorithms.h>

#include <global.h>

#include <record.h>

#include <tls-sig.h>

#include <state.h>

#include <pk.h>

#include "str.h"

#include <debug.h>

#include <x509_b64.h>

#include <x509.h>

#include <gnutls/ocsp.h>

#include "x509/common.h"

#include "x509/x509_int.h"

#include <str_array.h>

#include <gnutls/x509.h>

#include "read-file.h"

#include "system-keys.h"

#include "urls.h"

#ifdef _WIN32

#include <wincrypt.h>

#endif

/*

 * some x509 certificate parsing functions.

 */

static int

certificate_credential_append_crt_list(gnutls_certificate_credentials_t res,

				       gnutls_privkey_t key,

				       gnutls_str_array_t names,

				       gnutls_pcert_st * crt, int nr);

#define CRED_RET_SUCCESS(cred) \

	if (cred->flags & GNUTLS_CERTIFICATE_API_V2) { \

		return cred->ncerts-1; \

	} else { \

		return 0; \

	}

/* fifteen days */

#define MAX_OCSP_VALIDITY_SECS (15*60*60*24)

#ifdef ENABLE_OCSP

/* If the certificate is revoked status will be GNUTLS_CERT_REVOKED.

 * 

 * Returns:

 *  Zero on success, a negative error code otherwise.

 */

static int

check_ocsp_response(gnutls_session_t session, gnutls_x509_crt_t cert,

		    gnutls_x509_trust_list_t tl,

		    unsigned verify_flags,

		    gnutls_x509_crt_t *cand_issuers, unsigned cand_issuers_size,

		    gnutls_datum_t * data, unsigned int *ostatus)

{

	gnutls_ocsp_resp_t resp;

	int ret;

	unsigned int status, cert_status;

	time_t rtime, vtime, ntime, now;

	int check_failed = 0;

	now = gnutls_time(0);

	ret = gnutls_ocsp_resp_init(&resp);

	if (ret < 0)

		return gnutls_assert_val(ret);

	ret = gnutls_ocsp_resp_import(resp, data);

	if (ret < 0) {

		_gnutls_audit_log(session,

				  "There was an error parsing the OCSP response: %s.\n",

				  gnutls_strerror(ret));

		ret = gnutls_assert_val(0);

		check_failed = 1;

		*ostatus |= GNUTLS_CERT_INVALID_OCSP_STATUS;

		goto cleanup;

	}

	ret = gnutls_ocsp_resp_check_crt(resp, 0, cert);

	if (ret < 0) {

		ret = gnutls_assert_val(0);

		_gnutls_audit_log(session,

				  "Got OCSP response with an unrelated certificate.\n");

		check_failed = 1;

		*ostatus |= GNUTLS_CERT_INVALID_OCSP_STATUS;

		goto cleanup;

	}

	/* Attempt to verify against our trusted list */

	ret = gnutls_ocsp_resp_verify(resp, tl, &status, verify_flags);

	if ((ret < 0 || status != 0) && cand_issuers_size > 0) {

		/* Attempt to verify against the certificate list provided by the server */

		ret = gnutls_ocsp_resp_verify_direct(resp, cand_issuers[0], &status, verify_flags);

		/* if verification fails attempt to find whether any of the other

		 * bundled CAs is an issuer of the OCSP response */

		if ((ret < 0 || status != 0) && cand_issuers_size > 1) {

			int ret2;

			unsigned status2, i;

			for (i=1;i

				ret2 = gnutls_ocsp_resp_verify_direct(resp, cand_issuers[i], &status2, verify_flags);

				if (ret2 >= 0 && status2 == 0) {

					status = status2;

					ret = ret2;

					break;

				}

			}

		}

	}

	if (ret < 0) {

		ret = gnutls_assert_val(0);

		gnutls_assert();

		check_failed = 1;

		*ostatus |= GNUTLS_CERT_INVALID_OCSP_STATUS;

		goto cleanup;

	}

	/* do not consider revocation data if response was not verified */

	if (status != 0) {

		ret = gnutls_assert_val(0);

		check_failed = 1;

		*ostatus |= GNUTLS_CERT_INVALID_OCSP_STATUS;

		goto cleanup;

	}

	ret = gnutls_ocsp_resp_get_single(resp, 0, NULL, NULL, NULL, NULL,

					  &cert_status, &vtime, &ntime,

					  &rtime, NULL);

	if (ret < 0) {

		_gnutls_audit_log(session,

				  "There was an error parsing the OCSP response: %s.\n",

				  gnutls_strerror(ret));

		ret = gnutls_assert_val(0);

		check_failed = 1;

		*ostatus |= GNUTLS_CERT_INVALID_OCSP_STATUS;

		goto cleanup;

	}

	if (cert_status == GNUTLS_OCSP_CERT_REVOKED) {

		_gnutls_audit_log(session,

				  "The certificate was revoked via OCSP\n");

		check_failed = 1;

		*ostatus |= GNUTLS_CERT_REVOKED;

		ret = gnutls_assert_val(0);

		goto cleanup;

	}

	/* Report but do not fail on the following errors. That is

	 * because including the OCSP response in the handshake shouldn't 

	 * cause more problems that not including it.

	 */

	if (ntime == -1) {

		if (now - vtime > MAX_OCSP_VALIDITY_SECS) {

			_gnutls_audit_log(session,

					  "The OCSP response is old\n");

			check_failed = 1;

			*ostatus |= GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED;

			goto cleanup;

		}

	} else {

		/* there is a newer OCSP answer, don't trust this one */

		if (ntime < now) {

			_gnutls_audit_log(session,

					  "There is a newer OCSP response but was not provided by the server\n");

			check_failed = 1;

			*ostatus |= GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED;

			goto cleanup;

		}

	}

	ret = 0;

      cleanup:

	if (check_failed == 0)

		session->internals.ocsp_check_ok = 1;

	gnutls_ocsp_resp_deinit(resp);

	return ret;

}

#endif

#define CLEAR_CERTS for(x=0;x

	if (peer_certificate_list[x]) \

		gnutls_x509_crt_deinit(peer_certificate_list[x]); \

	} \

	gnutls_free( peer_certificate_list)

#ifdef ENABLE_OCSP

static int

_gnutls_ocsp_verify_mandatory_stapling(gnutls_session_t session,

				       gnutls_x509_crt_t cert,

				       unsigned int * ocsp_status)

{

	gnutls_x509_tlsfeatures_t tlsfeatures;

	int i, ret;

	unsigned feature;

	/* RFC 7633: If cert has TLS feature GNUTLS_EXTENSION_STATUS_REQUEST, stapling is mandatory.

	 *

	 * At this point, we know that we did not get the certificate status.

	 *

	 * To proceed, first check whether we have requested the certificate status

	 */

	if (_gnutls_extension_list_check(session, GNUTLS_EXTENSION_STATUS_REQUEST) < 0) {

		return 0;

	}

	ret = gnutls_x509_tlsfeatures_init(&tlsfeatures);

	if (ret < 0) {

		gnutls_assert();

		return ret;

	}

	/* We have requested the status, now check whether the certificate mandates a response */

	if (gnutls_x509_crt_get_tlsfeatures(cert, tlsfeatures, 0, NULL) == 0) {

		for (i = 0;; ++i) {

			ret = gnutls_x509_tlsfeatures_get(tlsfeatures, i, &feature);

			if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {

				break;

			}

			if (ret < 0) {

				gnutls_assert();

				goto cleanup;

			}

			if (feature == GNUTLS_EXTENSION_STATUS_REQUEST) {

				/* We sent a status request, the certificate mandates a reply, but we did not get any. */

				*ocsp_status |= GNUTLS_CERT_MISSING_OCSP_STATUS;

				break;

			}

		}

	}

	ret = 0;

 cleanup:

	gnutls_x509_tlsfeatures_deinit(tlsfeatures);

	return ret;

}

#endif

/*-

 * _gnutls_x509_cert_verify_peers - return the peer's certificate status

 * @session: is a gnutls session

 *

 * This function will try to verify the peer's certificate and return its status (TRUSTED, REVOKED etc.).

 * The return value (status) should be one of the gnutls_certificate_status_t enumerated elements.

 * However you must also check the peer's name in order to check if the verified certificate belongs to the

 * actual peer. Returns a negative error code in case of an error, or GNUTLS_E_NO_CERTIFICATE_FOUND if no certificate was sent.

 -*/

int

_gnutls_x509_cert_verify_peers(gnutls_session_t session,

			       gnutls_typed_vdata_st * data,

			       unsigned int elements,

			       unsigned int *status)

{

	cert_auth_info_t info;

	gnutls_certificate_credentials_t cred;

	gnutls_x509_crt_t *peer_certificate_list;

	gnutls_datum_t resp;

	int peer_certificate_list_size, i, x, ret;

	gnutls_x509_crt_t *cand_issuers = NULL;

	unsigned cand_issuers_size = 0;

	unsigned int ocsp_status = 0;

	unsigned int verify_flags;

	/* No OCSP check so far */

	session->internals.ocsp_check_ok = 0;

	CHECK_AUTH(GNUTLS_CRD_CERTIFICATE, GNUTLS_E_INVALID_REQUEST);

	info = _gnutls_get_auth_info(session, GNUTLS_CRD_CERTIFICATE);

	if (info == NULL) {

		gnutls_assert();

		return GNUTLS_E_INVALID_REQUEST;

	}

	cred = (gnutls_certificate_credentials_t)

	    _gnutls_get_cred(session, GNUTLS_CRD_CERTIFICATE);

	if (cred == NULL) {

		gnutls_assert();

		return GNUTLS_E_INSUFFICIENT_CREDENTIALS;

	}

	if (info->raw_certificate_list == NULL || info->ncerts == 0)

		return GNUTLS_E_NO_CERTIFICATE_FOUND;

	if (info->ncerts > cred->verify_depth && cred->verify_depth > 0) {

		gnutls_assert();

		return GNUTLS_E_CONSTRAINT_ERROR;

	}

	verify_flags =

	    cred->verify_flags | session->internals.additional_verify_flags;

	/* generate a list of gnutls_certs based on the auth info

	 * raw certs.

	 */

	peer_certificate_list_size = info->ncerts;

	peer_certificate_list =

	    gnutls_calloc(peer_certificate_list_size,

			  sizeof(gnutls_x509_crt_t));

	if (peer_certificate_list == NULL) {

		gnutls_assert();

		return GNUTLS_E_MEMORY_ERROR;

	}

	for (i = 0; i < peer_certificate_list_size; i++) {

		ret = gnutls_x509_crt_init(&peer_certificate_list[i]);

		if (ret < 0) {

			gnutls_assert();

			CLEAR_CERTS;

			return ret;

		}

		ret =

		    gnutls_x509_crt_import(peer_certificate_list[i],

					   &info->raw_certificate_list[i],

					   GNUTLS_X509_FMT_DER);

		if (ret < 0) {

			gnutls_assert();

			CLEAR_CERTS;

			return ret;

		}

	}

	/* Use the OCSP extension if any */

#ifdef ENABLE_OCSP

	if (verify_flags & GNUTLS_VERIFY_DISABLE_CRL_CHECKS)

		goto skip_ocsp;

	ret = gnutls_ocsp_status_request_get(session, &resp);

	if (ret < 0) {

		ret = _gnutls_ocsp_verify_mandatory_stapling(session, peer_certificate_list[0], &ocsp_status);

		if (ret < 0) {

			gnutls_assert();

			CLEAR_CERTS;

			return ret;

		}

		goto skip_ocsp;

	}

	if (peer_certificate_list_size > 1) {

		cand_issuers = &peer_certificate_list[1];

		cand_issuers_size = peer_certificate_list_size-1;

	}

	ret =

		check_ocsp_response(session, peer_certificate_list[0], cred->tlist, 

				verify_flags, cand_issuers,

				cand_issuers_size, &resp, &ocsp_status);

	if (ret < 0) {

		CLEAR_CERTS;

		return gnutls_assert_val(ret);

	}

#endif

      skip_ocsp:

	/* Verify certificate 

	 */

	ret =

	    gnutls_x509_trust_list_verify_crt2(cred->tlist,

					       peer_certificate_list,

					       peer_certificate_list_size,

					       data, elements,

					       verify_flags, status, NULL);

	if (ret < 0) {

		gnutls_assert();

		CLEAR_CERTS;

		return ret;

	}

	CLEAR_CERTS;

	*status |= ocsp_status;

	return 0;

}

static int str_array_append_idna(gnutls_str_array_t * head, const char *name, size_t size)

{

	int ret;

	gnutls_datum_t ahost;

	/* convert the provided hostname to ACE-Labels domain. */

	ret = gnutls_idna_map(name, size, &ahost, 0);

	if (ret < 0) {

		_gnutls_debug_log("unable to convert hostname %s to IDNA format\n", name);

		/* insert the raw name */

		return _gnutls_str_array_append(head, name, size);

	}

	ret = _gnutls_str_array_append(head, (char*)ahost.data, ahost.size);

	gnutls_free(ahost.data);

	return ret;

}

/* Returns the name of the certificate of a null name

 */

static int get_x509_name(gnutls_x509_crt_t crt, gnutls_str_array_t * names)

{

	size_t max_size;

	int i, ret = 0, ret2;

	char name[MAX_CN];

	unsigned have_dns_name = 0;

	for (i = 0; !(ret < 0); i++) {

		max_size = sizeof(name);

		ret =

		    gnutls_x509_crt_get_subject_alt_name(crt, i, name,

							 &max_size, NULL);

		if (ret == GNUTLS_SAN_DNSNAME) {

			have_dns_name = 1;

			ret2 =

			    str_array_append_idna(names, name,

						  max_size);

			if (ret2 < 0) {

				_gnutls_str_array_clear(names);

				return gnutls_assert_val(ret2);

			}

		}

	}

	if (have_dns_name == 0) {

		max_size = sizeof(name);

		ret =

		    gnutls_x509_crt_get_dn_by_oid(crt, OID_X520_COMMON_NAME, 0, 0,

						  name, &max_size);

		if (ret >= 0) {

			ret = str_array_append_idna(names, name, max_size);

			if (ret < 0) {

				_gnutls_str_array_clear(names);

				return gnutls_assert_val(ret);

			}

		}

	}

	return 0;

}

/* Reads a DER encoded certificate list from memory and stores it to a

 * gnutls_cert structure. Returns the number of certificates parsed.

 */

static int

parse_der_cert_mem(gnutls_certificate_credentials_t res,

		   gnutls_privkey_t key,

		   const void *input_cert, int input_cert_size)

{

	gnutls_datum_t tmp;

	gnutls_x509_crt_t crt;

	gnutls_pcert_st *ccert;

	int ret;

	gnutls_str_array_t names;

	_gnutls_str_array_init(&names);

	ccert = gnutls_malloc(sizeof(*ccert));

	if (ccert == NULL) {

		gnutls_assert();

		return GNUTLS_E_MEMORY_ERROR;

	}

	ret = gnutls_x509_crt_init(&crt;;

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	tmp.data = (uint8_t *) input_cert;

	tmp.size = input_cert_size;

	ret = gnutls_x509_crt_import(crt, &tmp, GNUTLS_X509_FMT_DER);

	if (ret < 0) {

		gnutls_assert();

		gnutls_x509_crt_deinit(crt);

		goto cleanup;

	}

	ret = get_x509_name(crt, &names);

	if (ret < 0) {

		gnutls_assert();

		gnutls_x509_crt_deinit(crt);

		goto cleanup;

	}

	ret = gnutls_pcert_import_x509(ccert, crt, 0);

	gnutls_x509_crt_deinit(crt);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	ret = certificate_credential_append_crt_list(res, key, names, ccert, 1);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	return ret;

      cleanup:

	_gnutls_str_array_clear(&names);

	gnutls_free(ccert);

	return ret;

}

/* Reads a base64 encoded certificate list from memory and stores it to

 * a gnutls_cert structure. Returns the number of certificate parsed.

 */

static int

parse_pem_cert_mem(gnutls_certificate_credentials_t res,

		   gnutls_privkey_t key,

		   const char *input_cert, int input_cert_size)

{

	int size;

	const char *ptr;

	gnutls_datum_t tmp;

	int ret, count, i;

	unsigned ncerts = 0;

	gnutls_pcert_st *pcerts = NULL;

	gnutls_str_array_t names;

	gnutls_x509_crt_t unsorted[DEFAULT_MAX_VERIFY_DEPTH];

	_gnutls_str_array_init(&names);

	/* move to the certificate

	 */

	ptr = memmem(input_cert, input_cert_size,

		     PEM_CERT_SEP, sizeof(PEM_CERT_SEP) - 1);

	if (ptr == NULL)

		ptr = memmem(input_cert, input_cert_size,

			     PEM_CERT_SEP2, sizeof(PEM_CERT_SEP2) - 1);

	if (ptr == NULL) {

		gnutls_assert();

		return GNUTLS_E_BASE64_DECODING_ERROR;

	}

	size = input_cert_size - (ptr - input_cert);

	count = 0;

	do {

		tmp.data = (void *) ptr;

		tmp.size = size;

		ret = gnutls_x509_crt_init(&unsorted[count]);

		if (ret < 0) {

			gnutls_assert();

			goto cleanup;

		}

		ret = gnutls_x509_crt_import(unsorted[count], &tmp, GNUTLS_X509_FMT_PEM);

		if (ret < 0) {

			gnutls_assert();

			goto cleanup;

		}

		count++;

		/* now we move ptr after the pem header 

		 */

		ptr++;

		size--;

		/* find the next certificate (if any)

		 */

		if (size > 0) {

			char *ptr3;

			ptr3 =

			    memmem(ptr, size, PEM_CERT_SEP,

				   sizeof(PEM_CERT_SEP) - 1);

			if (ptr3 == NULL)

				ptr3 = memmem(ptr, size, PEM_CERT_SEP2,

					      sizeof(PEM_CERT_SEP2) - 1);

			ptr = ptr3;

			size = input_cert_size - (ptr - input_cert);

		} else

			ptr = NULL;

	}

	while (ptr != NULL && count < DEFAULT_MAX_VERIFY_DEPTH);

	ret =

	    get_x509_name(unsorted[0], &names);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	pcerts = gnutls_malloc(sizeof(gnutls_pcert_st) * count);

	if (pcerts == NULL) {

		gnutls_assert();

		return GNUTLS_E_MEMORY_ERROR;

	}

	ncerts = count;

	ret =

	    gnutls_pcert_import_x509_list(pcerts, unsorted, &ncerts, GNUTLS_X509_CRT_LIST_SORT);

	if (ret < 0) {

		gnutls_free(pcerts);

		pcerts = NULL;

		gnutls_assert();

		goto cleanup;

	}

	ret =

	    certificate_credential_append_crt_list(res, key, names, pcerts,

						   ncerts);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	for (i = 0; i < count; i++)

		gnutls_x509_crt_deinit(unsorted[i]);

	return ncerts;

      cleanup:

	_gnutls_str_array_clear(&names);

	for (i = 0; i < count; i++)

		gnutls_x509_crt_deinit(unsorted[i]);

	if (pcerts) {

		for (i = 0; i < count; i++)

			gnutls_pcert_deinit(&pcerts[i]);

		gnutls_free(pcerts);

	}

	return ret;

}

/* Reads a DER or PEM certificate from memory

 */

static int

read_cert_mem(gnutls_certificate_credentials_t res,

	      gnutls_privkey_t key,

	      const void *cert,

	      int cert_size, gnutls_x509_crt_fmt_t type)

{

	int ret;

	if (type == GNUTLS_X509_FMT_DER)

		ret = parse_der_cert_mem(res, key, cert, cert_size);

	else

		ret = parse_pem_cert_mem(res, key, cert, cert_size);

	if (ret < 0) {

		gnutls_assert();

		return ret;

	}

	return ret;

}

static int tmp_pin_cb(void *userdata, int attempt, const char *token_url,

		      const char *token_label, unsigned int flags,

		      char *pin, size_t pin_max)

{

	const char *tmp_pin = userdata;

	if (attempt == 0) {

		snprintf(pin, pin_max, "%s", tmp_pin);

		return 0;

	}

	return -1;

}

/* Reads a PEM encoded PKCS-1 RSA/DSA private key from memory.  Type

 * indicates the certificate format.

 *

 * It returns the private key read in @rkey.

 */

static int

read_key_mem(gnutls_certificate_credentials_t res,

	     const void *key, int key_size, gnutls_x509_crt_fmt_t type,

	     const char *pass, unsigned int flags,

	     gnutls_privkey_t *rkey)

{

	int ret;

	gnutls_datum_t tmp;

	gnutls_privkey_t privkey;

	if (key) {

		tmp.data = (uint8_t *) key;

		tmp.size = key_size;

		ret = gnutls_privkey_init(&privkey);

		if (ret < 0) {

			gnutls_assert();

			return ret;

		}

		if (res->pin.cb) {

			gnutls_privkey_set_pin_function(privkey,

							res->pin.cb,

							res->pin.data);

		} else if (pass != NULL) {

			snprintf(res->pin_tmp, sizeof(res->pin_tmp), "%s",

				 pass);

			gnutls_privkey_set_pin_function(privkey,

							tmp_pin_cb,

							res->pin_tmp);

		}

		ret =

		    gnutls_privkey_import_x509_raw(privkey, &tmp, type,

						   pass, flags);

		if (ret < 0) {

			gnutls_assert();

			gnutls_privkey_deinit(privkey);

			return ret;

		}

		*rkey = privkey;

	} else {

		gnutls_assert();

		return GNUTLS_E_INVALID_REQUEST;

	}

	return 0;

}

/* Reads a private key from a token.

 */

static int

read_key_url(gnutls_certificate_credentials_t res, const char *url, gnutls_privkey_t *rkey)

{

	int ret;

	gnutls_privkey_t pkey = NULL;

	/* allocate space for the pkey list

	 */

	ret = gnutls_privkey_init(&pkey);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	if (res->pin.cb)

		gnutls_privkey_set_pin_function(pkey, res->pin.cb,

						res->pin.data);

	ret = gnutls_privkey_import_url(pkey, url, 0);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	*rkey = pkey;

	return 0;

      cleanup:

	if (pkey)

		gnutls_privkey_deinit(pkey);

	return ret;

}

#define MAX_PKCS11_CERT_CHAIN 8

/* Reads a certificate key from a token.

 */

static int

read_cert_url(gnutls_certificate_credentials_t res, gnutls_privkey_t key, const char *url)

{

	int ret;

	gnutls_x509_crt_t crt = NULL;

	gnutls_pcert_st *ccert = NULL;

	gnutls_str_array_t names;

	gnutls_datum_t t = {NULL, 0};

	unsigned i, count = 0;

	_gnutls_str_array_init(&names);

	ccert = gnutls_malloc(sizeof(*ccert)*MAX_PKCS11_CERT_CHAIN);

	if (ccert == NULL) {

		gnutls_assert();

		ret = GNUTLS_E_MEMORY_ERROR;

		goto cleanup;

	}

	ret = gnutls_x509_crt_init(&crt;;

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	if (res->pin.cb)

		gnutls_x509_crt_set_pin_function(crt, res->pin.cb,

						 res->pin.data);

	ret = gnutls_x509_crt_import_url(crt, url, 0);

	if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)

		ret =

		    gnutls_x509_crt_import_url(crt, url,

					       GNUTLS_PKCS11_OBJ_FLAG_LOGIN);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	ret = get_x509_name(crt, &names);

	if (ret < 0) {

		gnutls_assert();

		goto cleanup;

	}

	/* Try to load the whole certificate chain from the PKCS #11 token */

	for (i=0;i

		ret = gnutls_x509_crt_check_issuer(crt, crt);

		if (i > 0 && ret != 0) {

			/* self signed */

			break;

		}

		ret = gnutls_pcert_import_x509(&ccert[i], crt, 0);

		if (ret < 0) {

			gnutls_assert();

			goto cleanup;

		}

		count++;

		ret = _gnutls_get_raw_issuer(url, crt, &t, 0);

		if (ret < 0)

			break;

		gnutls_x509_crt_deinit(crt);

		crt = NULL;

		ret = gnutls_x509_crt_init(&crt;;

		if (ret < 0) {

			gnutls_assert();

			goto cleanup;

		}

		ret = gnutls_x509_crt_import(crt, &t, GNUTLS_X509_FMT_DER);