Add public API to query for CRT frame and PK
This commit unconditionally adds two convenience API functions:
- mbedtls_x509_crt_get_frame()
- mbedtls_x509_crt_get_pk()
which allow users to extract a CRT frame or PK context
from a certificate.
The difference with the existing acquire/release API for frame and PK
contexts is that in contrast to the latter, the structures returned by
the new API are owned by the user (and, in case of the PK context, need
to be freed by him). This makes the API easier to use, but comes at the
cost of additional memory overhead.
diff --git a/library/x509_crt.c b/library/x509_crt.c
index 20f0bb0..960296d 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -195,6 +195,45 @@
return( 0 );
}
+int mbedtls_x509_crt_get_frame( mbedtls_x509_crt const *crt,
+ mbedtls_x509_crt_frame *dst )
+{
+ int ret;
+ mbedtls_x509_crt_frame *frame;
+ ret = mbedtls_x509_crt_frame_acquire( crt, &frame );
+ if( ret != 0 )
+ return( ret );
+ *dst = *frame;
+ mbedtls_x509_crt_frame_release( crt, frame );
+ return( 0 );
+}
+
+int mbedtls_x509_crt_get_pk( mbedtls_x509_crt const *crt,
+ mbedtls_pk_context *dst )
+{
+#if !defined(MBEDTLS_X509_ON_DEMAND_PARSING)
+ mbedtls_x509_buf_raw pk_raw = crt->cache->pk_raw;
+ return( mbedtls_pk_parse_subpubkey( &pk_raw.p,
+ pk_raw.p + pk_raw.len,
+ dst ) );
+#else /* !MBEDTLS_X509_ON_DEMAND_PARSING */
+ int ret;
+ mbedtls_pk_context *pk;
+ ret = mbedtls_x509_crt_pk_acquire( crt, &pk );
+ if( ret != 0 )
+ return( ret );
+
+ /* Move PK from CRT cache to destination pointer
+ * to avoid a copy. */
+ *dst = *pk;
+ mbedtls_free( crt->cache->pk );
+ crt->cache->pk = NULL;
+
+ mbedtls_x509_crt_pk_release( crt, pk );
+ return( 0 );
+#endif /* MBEDTLS_X509_ON_DEMAND_PARSING */
+}
+
/*
* Item in a verification chain: cert and flags for it
*/