35#if defined(ENABLE_PKCS11) && defined(ENABLE_CRYPTO_MBEDTLS)
40#include <mbedtls/x509.h>
43pkcs11_get_x509_cert(pkcs11h_certificate_t pkcs11_cert, mbedtls_x509_crt *cert)
45 unsigned char *cert_blob = NULL;
46 size_t cert_blob_size = 0;
49 if (pkcs11h_certificate_getCertificateBlob(pkcs11_cert, NULL, &cert_blob_size) != CKR_OK)
51 msg(
M_WARN,
"PKCS#11: Cannot retrieve certificate object size");
56 if (pkcs11h_certificate_getCertificateBlob(pkcs11_cert, cert_blob, &cert_blob_size) != CKR_OK)
58 msg(
M_WARN,
"PKCS#11: Cannot retrieve certificate object");
62 if (!
mbed_ok(mbedtls_x509_crt_parse(cert, cert_blob, cert_blob_size)))
64 msg(
M_WARN,
"PKCS#11: Could not parse certificate");
75pkcs11_sign(
void *pkcs11_cert,
const void *src,
size_t src_len,
void *dst,
size_t dst_len)
78 == pkcs11h_certificate_signAny(pkcs11_cert, CKM_RSA_PKCS, src, src_len, dst, &dst_len);
82pkcs11_init_tls_session(pkcs11h_certificate_t certificate,
struct tls_root_ctx *
const ssl_ctx)
86 ssl_ctx->pkcs11_cert = certificate;
89 if (!pkcs11_get_x509_cert(certificate, ssl_ctx->
crt_chain))
91 msg(
M_WARN,
"PKCS#11: Cannot initialize certificate");
97 msg(
M_WARN,
"PKCS#11: Cannot register signing function");
105pkcs11_certificate_dn(pkcs11h_certificate_t cert,
struct gc_arena *
gc)
108 mbedtls_x509_crt mbed_crt = { 0 };
110 if (!pkcs11_get_x509_cert(cert, &mbed_crt))
112 msg(
M_WARN,
"PKCS#11: Cannot retrieve mbed TLS certificate object");
118 msg(
M_WARN,
"PKCS#11: mbed TLS cannot parse subject");
123 mbedtls_x509_crt_free(&mbed_crt);
129pkcs11_certificate_serial(pkcs11h_certificate_t cert,
char *serial,
size_t serial_len)
132 mbedtls_x509_crt mbed_crt = { 0 };
134 if (!pkcs11_get_x509_cert(cert, &mbed_crt))
136 msg(
M_WARN,
"PKCS#11: Cannot retrieve mbed TLS certificate object");
140 if (mbedtls_x509_serial_gets(serial, serial_len, &mbed_crt.serial) < 0)
142 msg(
M_WARN,
"PKCS#11: mbed TLS cannot parse serial");
148 mbedtls_x509_crt_free(&mbed_crt);
static void check_malloc_return(void *p)
#define ALLOC_OBJ_CLEAR(dptr, type)
#define mbed_ok(errval)
Check errval and log on error.
PKCS #11 SSL library-specific backend.
int tls_ctx_use_external_signing_func(struct tls_root_ctx *ctx, external_sign_func sign_func, void *sign_ctx)
Call the supplied signing function to create a TLS signature during the TLS handshake.
Control Channel Verification Module library-specific backend interface.
char * x509_get_subject(openvpn_x509_cert_t *cert, struct gc_arena *gc)
Garbage collection arena used to keep track of dynamically allocated memory.
Structure that wraps the TLS context.
mbedtls_x509_crt * crt_chain
Local Certificate chain.
static int cleanup(void **state)