Changeset 65c84e5 in mod_gnutls

Timestamp:

Jul 23, 2019, 2:25:59 AM (8 months ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

master

Children:

81018a4

Parents:

7cfc02b

Message:

Set certificates via gnutls_certificate_set_retrieve_function3()

The new API allows stapling multiple OCSP responses (to be implemented
later). Requires GnuTLS 3.6.3 or newer.

Files:

• README (modified) (1 diff)
• configure.ac (modified) (1 diff)
• src/gnutls_hooks.c (modified) (3 diffs)

README

@@ -22 +22 @@
 -------------
 
- * GnuTLS          >= 3.3 <https://www.gnutls.org/> (3.4 or newer recommended)
+ * GnuTLS          >= 3.6.3 <https://www.gnutls.org/>
  * Apache HTTPD    >= 2.4.17 <https://httpd.apache.org/>
  * autotools, GNU make, & GCC

configure.ac

@@ -46 +46 @@
         ], [])
 
-PKG_CHECK_MODULES([LIBGNUTLS], [gnutls >= 3.3.0])
+PKG_CHECK_MODULES([LIBGNUTLS], [gnutls >= 3.6.3])
 
 LIBGNUTLS_VERSION=`pkg-config --modversion gnutls`

src/gnutls_hooks.c

@@ -384 +384 @@
 
 static int cert_retrieve_fn(gnutls_session_t session,
-                            const gnutls_datum_t * req_ca_rdn __attribute__((unused)),
-                            int nreqs __attribute__((unused)),
-                            const gnutls_pk_algorithm_t * pk_algos __attribute__((unused)),
-                            int pk_algos_length __attribute__((unused)),
+                            const struct gnutls_cert_retr_st *info __attribute__((unused)),
                             gnutls_pcert_st **pcerts,
                             unsigned int *pcert_length,
-                            gnutls_privkey_t *privkey)
+                            gnutls_ocsp_data_st **ocsp,
+                            unsigned int *ocsp_length,
+                            gnutls_privkey_t *privkey,
+                            unsigned int *flags)
 {
     _gnutls_log(debug_log_fp, "%s: %d\n", __func__, __LINE__);
@@ -407 +407 @@
         *pcerts = ctxt->sc->certs_x509_chain;
         *pcert_length = ctxt->sc->certs_x509_chain_num;
+        *ocsp = NULL;
+        *ocsp_length = 0;
         *privkey = ctxt->sc->privkey_x509;
+        *flags = 0;
         return 0;
     } else {
@@ -731 +734 @@
         }
 
-        /* The call after this comment is a workaround for bug in
-         * gnutls_certificate_set_retrieve_function2 that ignores
-         * supported certificate types. Should be fixed in GnuTLS
-         * 3.3.12.
-         *
-         * Details:
-         * https://lists.gnupg.org/pipermail/gnutls-devel/2015-January/007377.html
-         * Workaround from:
-         * https://github.com/vanrein/tlspool/commit/4938102d3d1b086491d147e6c8e4e2a02825fc12 */
-#if GNUTLS_VERSION_NUMBER < 0x030312
-        gnutls_certificate_set_retrieve_function(sc->certs, (void *) exit);
-#endif
-
-        gnutls_certificate_set_retrieve_function2(sc->certs, cert_retrieve_fn);
+        gnutls_certificate_set_retrieve_function3(sc->certs, cert_retrieve_fn);
 
         if ((sc->certs_x509_chain == NULL || sc->certs_x509_chain_num < 1) &&