[gnutls-dev] sign callback for certificate authentication
ludovic.courtes at laas.fr
Mon Apr 16 14:15:22 CEST 2007
"Jacob Berkman" <jberkman at novell.com> writes:
> I've attached a patch to gnutls which adds a callback for the signing
> step of certificate-based authentication. This was needed because
> some smart card policies do not allow private keys to be read/exported
> from them. They implement signing directly on the card.
I think this is a very good idea.
However, in your patch, you defined signing functions as:
typedef int gnutls_certificate_client_sign_function (gnutls_session_t session,
gnutls_datum_t * cert,
const gnutls_datum_t *hash_concat,
I think this suffers from the same shortcomings as most call-backs
defined in GnuTLS: one cannot attach additional data to be passed along
to the sign function.
Thus, I would instead recommend adding a `void *' parameter to
`gnutls_certificate_client_set_sign_function ()' needs to be modified
gnutls_certificate_client_sign_function * func,
This way, USER_DATA would be passed as the last argument of FUNC each
time it is called.
Call-back APIs that fail to provide this make it hard to communicate
information to call-backs in a "safe" way: one has to resort to global
variables or some such, which makes code harder to read and is not
recommended in multi-threaded applications. Likewise, it makes it hard
to implement bindings for higher-level languages.
More information about the Gnutls-dev