Changeset 8663ace in mod_gnutls

Timestamp:

Jan 24, 2009, 12:47:18 PM (14 years ago)

Author:

Nokis Mavrogiannopoulos <nmav@…>

Branches:

asyncio, debian/master, debian/stretch-backports, jessie-backports, main, master, msva, proxy-ticket, upstream

Children:

7ef38d4

Parents:

f46e1f2

git-author:

Nikos Mavrogiannopoulos <nmav@…> (01/24/09 12:47:18)

git-committer:

Nokis Mavrogiannopoulos <nmav@…> (01/24/09 12:47:18)

Message:

removed limit on ca certificates' number

Files:

• NEWS (modified) (1 diff)
• include/mod_gnutls.h.in (modified) (2 diffs)
• src/gnutls_config.c (modified) (2 diffs)

NEWS

@@ -1 @@
-** Verison 0.5.4 (2009-01-04)
+** Version 0.5.5 (unreleased)
+
+- Removed limits on CA certificate loading. Reported by
+  Sander Marechal and Jack Bates.
+
+** Version 0.5.4 (2009-01-04)
 
 - mod_gnutls.h: modified definition to extern to avoid compilation

include/mod_gnutls.h.in

@@ -79 +79 @@
 } mgs_dirconf_rec;
 
-
-/* The maximum number of client CA certificates allowed.
- */
-#define MAX_CA_CRTS 128
 
 /* The maximum number of certificates to send in a chain
@@ -112 +108 @@
     const char* srp_tpasswd_file;
     const char* srp_tpasswd_conf_file;
-    gnutls_x509_crt_t ca_list[MAX_CA_CRTS];
+    gnutls_x509_crt_t *ca_list;
     gnutls_openpgp_keyring_t pgp_list;
     unsigned int ca_list_size;

src/gnutls_config.c

@@ -399 +399 @@
 }
 
+#define INIT_CA_SIZE 128
 const char *mgs_set_client_ca_file(cmd_parms * parms, void *dummy,
                                    const char *arg)
@@ -420 +421 @@
     }
 
-    sc->ca_list_size = MAX_CA_CRTS;
+    sc->ca_list_size = INIT_CA_SIZE;
+    sc->ca_list = malloc(sc->ca_list_size * sizeof(*sc->ca_list));
+    if (sc->ca_list == NULL) {
+                return apr_psprintf(parms->pool, "mod_gnutls: Memory allocation error");
+    }
+
     rv = gnutls_x509_crt_list_import(sc->ca_list, &sc->ca_list_size,
-                                     &data, GNUTLS_X509_FMT_PEM,
-                                     GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED);
-    if (rv < 0) {
-        return apr_psprintf(parms->pool, "GnuTLS: Failed to load "
+                                     &data, GNUTLS_X509_FMT_PEM, GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED);
+    if (rv < 0 && rv != GNUTLS_E_SHORT_MEMORY_BUFFER) {
+                        return apr_psprintf(parms->pool, "GnuTLS: Failed to load "
                             "Client CA File '%s': (%d) %s", file, rv,
                             gnutls_strerror(rv));
+    }
+    
+    if (INIT_CA_SIZE < sc->ca_list_size) {
+                    sc->ca_list = realloc(sc->ca_list, sc->ca_list_size*sizeof(*sc->ca_list));
+                    if (sc->ca_list == NULL) {
+                                return apr_psprintf(parms->pool, "mod_gnutls: Memory allocation error");
+                    }
+
+                /* re-read */
+                rv = gnutls_x509_crt_list_import(sc->ca_list, &sc->ca_list_size,
+                                     &data, GNUTLS_X509_FMT_PEM, 0);
+
+                    if (rv < 0) {
+                                        return apr_psprintf(parms->pool, "GnuTLS: Failed to load "
+                                            "Client CA File '%s': (%d) %s", file, rv,
+                                            gnutls_strerror(rv));
+                    }
     }