Changeset 410d216 in mod_gnutls for src/gnutls_hooks.c


Ignore:
Timestamp:
Oct 3, 2011, 7:28:42 AM (8 years ago)
Author:
Dash Shendy <neuromancer@…>
Branches:
debian/master, debian/stretch-backports, jessie-backports, master, msva, upstream
Children:
fe42bfb
Parents:
b3eb741
Message:

Generate DH params instead of using the static ones

File:
1 edited

Legend:

Unmodified
Added
Removed
  • src/gnutls_hooks.c

    rb3eb741 r410d216  
    192192}
    193193
    194 /* 2048-bit group parameters from SRP specification */
     194/* 2048-bit group parameters from SRP specification
    195195const char static_dh_params[] = "-----BEGIN DH PARAMETERS-----\n"
    196196        "MIIBBwKCAQCsa9tBMkqam/Fm3l4TiVgvr3K2ZRmH7gf8MZKUPbVgUKNzKcu0oJnt\n"
     
    201201        "Nd4jbVJfVHWbZeNy/NaO8g+nER+eSv9zAgEC\n"
    202202        "-----END DH PARAMETERS-----\n";
     203*/
    203204
    204205/* Read the common name or the alternative name of the certificate.
     
    291292    server_rec *s;
    292293    gnutls_dh_params_t dh_params = NULL;
    293     gnutls_rsa_params_t rsa_params = NULL;
    294294    mgs_srvconf_rec *sc;
    295295    mgs_srvconf_rec *sc_base;
     
    317317
    318318    if (sc_base->dh_params == NULL) {
    319         gnutls_datum pdata = {
    320             (void *) static_dh_params,
    321             sizeof (static_dh_params)
    322         };
    323         /* loading defaults */
    324         rv = gnutls_dh_params_import_pkcs3(dh_params, &pdata,
    325                 GNUTLS_X509_FMT_PEM);
    326 
     319        gnutls_dh_params_generate2 (dh_params,
     320                gnutls_sec_param_to_pk_bits(GNUTLS_PK_DH,GNUTLS_SEC_PARAM_HIGH));
    327321        if (rv < 0) {
    328322            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
    329                     "GnuTLS: Unable to load DH Params: (%d) %s",
     323                    "GnuTLS: Unable to generate DH Params: (%d) %s",
    330324                    rv, gnutls_strerror(rv));
    331325            exit(rv);
    332326        }
    333     } else
     327    } else {
    334328        dh_params = sc_base->dh_params;
    335 
    336     if (sc_base->rsa_params != NULL)
    337         rsa_params = sc_base->rsa_params;
    338 
    339     /* else not an error but RSA-EXPORT ciphersuites are not available
    340      */
     329    }
    341330
    342331    rv = mgs_cache_post_config(p, s, sc_base);
     
    349338
    350339    for (s = base_server; s; s = s->next) {
    351         void *load = NULL;
    352340        sc = (mgs_srvconf_rec *)
    353341                ap_get_module_config(s->module_config, &gnutls_module);
     
    365353
    366354        /* Check if DH or RSA params have been set per host */
    367         if (sc->rsa_params != NULL)
    368             load = sc->rsa_params;
    369         else if (rsa_params)
    370             load = rsa_params;
    371 
    372         if (load != NULL)
    373             gnutls_certificate_set_rsa_export_params(sc->certs,
    374                 load);
    375 
    376 
    377         load = NULL;
    378         if (sc->dh_params != NULL)
    379             load = sc->dh_params;
    380         else if (dh_params)
    381             load = dh_params;
    382 
    383         if (load != NULL) { /* not needed but anyway */
    384             gnutls_certificate_set_dh_params(sc->certs, load);
    385             gnutls_anon_set_server_dh_params(sc->anon_creds,
    386                     load);
     355        if (sc->rsa_params != NULL) {
     356            gnutls_certificate_set_rsa_export_params(sc->certs, sc->rsa_params);       
     357        }
     358        /* else not an error but RSA-EXPORT ciphersuites are not available */
     359
     360        void *load = NULL;
     361        if (sc->dh_params != NULL) {
     362            gnutls_certificate_set_dh_params(sc->certs, sc->dh_params);
     363            gnutls_anon_set_server_dh_params(sc->anon_creds, sc->dh_params);       
     364        } else if (dh_params) {
     365            gnutls_certificate_set_dh_params(sc->certs, dh_params);
     366            gnutls_anon_set_server_dh_params(sc->anon_creds, dh_params);                   
    387367        }
    388368
Note: See TracChangeset for help on using the changeset viewer.