Changeset 0de1839 in mod_gnutls for include

Timestamp:

Mar 19, 2015, 8:27:45 AM (8 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

asyncio, debian/master, debian/stretch-backports, jessie-backports, main, master, proxy-ticket, upstream

Children:

91ccb87

Parents:

10b3370

Message:

Support X.509 auth for TLS proxy connections

This commit adds support for X.509 certificate based authentication for
TLS proxy back end connections, including both server certificate
checking and (optionally) TLS client authentication. Some functions used
for this require GnuTLS 3.1.4 or later, so requirements change
accordingly.

Three new configuration parameters are added:

GnuTLSProxyCAFile FILEPATH

The given file must contain trusted CA certificates for server
verification. Required.

GnuTLSProxyKeyFile FILEPATH
GnuTLSProxyCertificateFile FILEPATH

Key and certificate for TLS client auth towards TLS back end servers. If
not set, TLS client auth is disabled.

File:

• include/mod_gnutls.h.in (modified) (2 diffs)

include/mod_gnutls.h.in

@@ -104 +104 @@
 /* Server Configuration Record */
 typedef struct {
-        /* x509 Certificate Structure */
+    /* x509 Certificate Structure */
     gnutls_certificate_credentials_t certs;
-        /* SRP Certificate Structure*/
+    /* x509 credentials for proxy connections */
+    gnutls_certificate_credentials_t proxy_x509_creds;
+    const char* proxy_x509_key_file;
+    const char* proxy_x509_cert_file;
+    const char* proxy_x509_ca_file;
+    /* SRP Certificate Structure*/
     gnutls_srp_server_credentials_t srp_creds;
     /* Anonymous Certificate Structure */
@@ -388 +393 @@
 mgs_srvconf_rec* mgs_find_sni_server(gnutls_session_t session);
 
+const char *mgs_store_cred_path(cmd_parms * parms,
+                                void *dummy __attribute__((unused)),
+                                const char *arg);
+
 /* mod_gnutls Hooks. */