Changeset 9d9b093 in mod_gnutls


Ignore:
Timestamp:
Jan 11, 2013, 12:56:51 AM (6 years ago)
Author:
Daniel Kahn Gillmor <dkg@…>
Branches:
debian/master, debian/stretch-backports, jessie-backports, upstream
Children:
2dd044f, 8ce897a
Parents:
8df5b25
Message:

Imported Upstream version 0.5.1

Files:
12 edited

Legend:

Unmodified
Added
Removed
  • Makefile.in

    r8df5b25 r9d9b093  
    138138LIBGNUTLS_CERTTOOL = @LIBGNUTLS_CERTTOOL@
    139139LIBGNUTLS_CFLAGS = @LIBGNUTLS_CFLAGS@
    140 LIBGNUTLS_CONFIG = @LIBGNUTLS_CONFIG@
     140LIBGNUTLS_EXTRA_CFLAGS = @LIBGNUTLS_EXTRA_CFLAGS@
     141LIBGNUTLS_EXTRA_CONFIG = @LIBGNUTLS_EXTRA_CONFIG@
     142LIBGNUTLS_EXTRA_LIBS = @LIBGNUTLS_EXTRA_LIBS@
    141143LIBGNUTLS_LIBS = @LIBGNUTLS_LIBS@
    142144LIBGNUTLS_PREFIX = @LIBGNUTLS_PREFIX@
  • NEWS

    r8df5b25 r9d9b093  
    1 ** Version 0.4.3 (2008-03-05)
     1** Version 0.5.1 (2008-03-05)
    22
    33- Added --disable-srp configure option
     
    55- Better check for memcache (patch by Guillaume Rousse)
    66
    7 - Corrected possible memory leak in DBM support for resuming sessions.
     7- Corrected possible memory leak in DBM support for resuming sessions.
     8
     9** Version 0.5.0-alpha (2008-01-24)
     10
     11- Added support for OpenPGP keys. The new directives are:
     12  GnuTLSPGPKeyringFile, GnuTLSPGPCertificateFile, GnuTLSPGPKeyFile
    813
    914** Version 0.4.2 (2007-12-10)
  • NOTICE

    r8df5b25 r9d9b093  
     1This product includes software developed by
     2Nikos Mavrogiannopoulos (http://www.gnutls.org/).
     3
    14This product includes software developed by
    25Paul Querna (http://www.outoforder.cc/).
  • README

    r8df5b25 r9d9b093  
    5555
    5656    # This is the Private key for your server.
    57     GnuTLSKeyFile conf/server.key
     57    GnuTLSX509KeyFile conf/server.key
    5858
    5959    # This is the Server Certificate. 
    60     GnuTLSCertificateFile conf/server.cert
     60    GnuTLSX509CertificateFile conf/server.cert
    6161</VirtualHost>
    62 
    6362
    6463# a more advanced configuration
     
    7473        GNUTLSExportCertificates on
    7574
    76         GnuTLSCertificateFile /etc/apache2/server-cert.pem
    77         GnuTLSKeyFile /etc/apache2/server-key.pem
     75        GnuTLSX509CertificateFile /etc/apache2/server-cert.pem
     76        GnuTLSX509KeyFile /etc/apache2/server-key.pem
    7877
    7978# To enable SRP you must have these files installed. Check the gnutls srptool.
     
    8584# contains the CAs to verify client certificates.
    8685        GnuTLSClientVerify request
    87         GnuTLSClientCAFile ca.pem
     86        GnuTLSX509CAFile ca.pem
    8887        ...
    8988</VirtualHost>
     89
     90# A setup for OpenPGP and X.509 authentication
     91<VirtualHost 1.2.3.4:443>
     92        Servername crystal.lan:443
     93        GnuTLSEnable on
     94        GnuTLSPriorities NORMAL:+COMP-NULL
     95
     96# setup the openpgp keys
     97        GnuTLSPGPCertificateFile /etc/apache2/test.pub.asc
     98        GnuTLSPGPKeyFile /etc/apache2/test.sec.asc
     99
     100# and the X.509 keys
     101        GnuTLSCertificateFile /etc/apache2/server-cert.pem
     102        GnuTLSKeyFile /etc/apache2/server-key.pem
     103        GnuTLSClientVerify ignore
     104
     105# To avoid using the default DH params
     106        GnuTLSDHFile /etc/apache2/dh.pem
     107
     108# these are only needed if GnuTLSClientVerify != ignore
     109        GnuTLSClientCAFile ca.pem
     110        GnuTLSPGPKeyringFile /etc/apache2/ring.asc
     111</VirtualHost>
  • configure

    r8df5b25 r9d9b093  
    11#! /bin/sh
    22# Guess values for system-dependent variables and create Makefiles.
    3 # Generated by GNU Autoconf 2.61 for mod_gnutls 0.4.3.
     3# Generated by GNU Autoconf 2.61 for mod_gnutls 0.5.1.
    44#
    55# Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
     
    727727PACKAGE_NAME='mod_gnutls'
    728728PACKAGE_TARNAME='mod_gnutls'
    729 PACKAGE_VERSION='0.4.3'
    730 PACKAGE_STRING='mod_gnutls 0.4.3'
     729PACKAGE_VERSION='0.5.1'
     730PACKAGE_STRING='mod_gnutls 0.5.1'
    731731PACKAGE_BUGREPORT=''
    732732
     
    903903APXS_EXTENSION
    904904APXS_CFLAGS
    905 LIBGNUTLS_CONFIG
     905LIBGNUTLS_EXTRA_CONFIG
     906LIBGNUTLS_EXTRA_CFLAGS
     907LIBGNUTLS_EXTRA_LIBS
    906908LIBGNUTLS_CFLAGS
    907909LIBGNUTLS_LIBS
     
    14341436  # This message is too long to be a string in the A/UX 3.1 sh.
    14351437  cat <<_ACEOF
    1436 \`configure' configures mod_gnutls 0.4.3 to adapt to many kinds of systems.
     1438\`configure' configures mod_gnutls 0.5.1 to adapt to many kinds of systems.
    14371439
    14381440Usage: $0 [OPTION]... [VAR=VALUE]...
     
    15051507if test -n "$ac_init_help"; then
    15061508  case $ac_init_help in
    1507      short | recursive ) echo "Configuration of mod_gnutls 0.4.3:";;
     1509     short | recursive ) echo "Configuration of mod_gnutls 0.5.1:";;
    15081510   esac
    15091511  cat <<\_ACEOF
     
    15341536  --with-tags[=TAGS]      include additional configurations [automatic]
    15351537  --with-apxs=PATH        Path to apxs
    1536   --with-libgnutls-prefix=PFX   Prefix where libgnutls is installed (optional)
     1538  --with-libgnutls-extra-prefix=PFX   Prefix where libgnutls-extra is installed (optional)
    15371539  --with-apr-memcache-prefix=PATH
    15381540                          Install prefix for apr_memcache
     
    16201622if $ac_init_version; then
    16211623  cat <<\_ACEOF
    1622 mod_gnutls configure 0.4.3
     1624mod_gnutls configure 0.5.1
    16231625generated by GNU Autoconf 2.61
    16241626
     
    16341636running configure, to aid debugging if configure makes a mistake.
    16351637
    1636 It was created by mod_gnutls $as_me 0.4.3, which was
     1638It was created by mod_gnutls $as_me 0.5.1, which was
    16371639generated by GNU Autoconf 2.61.  Invocation command line was
    16381640
     
    20052007  chmod +x config.nice
    20062008
    2007 MOD_GNUTLS_VERSION=0.4.3
     2009MOD_GNUTLS_VERSION=0.5.1
    20082010
    20092011
     
    25062508# Define the identity of the package.
    25072509 PACKAGE=mod_gnutls
    2508  VERSION=0.4.3
     2510 VERSION=0.5.1
    25092511
    25102512
     
    45514553*-*-irix6*)
    45524554  # Find out which ABI we are using.
    4553   echo '#line 4553 "configure"' > conftest.$ac_ext
     4555  echo '#line 4555 "configure"' > conftest.$ac_ext
    45544556  if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
    45554557  (eval $ac_compile) 2>&5
     
    72887290   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    72897291   -e 's:$: $lt_compiler_flag:'`
    7290    (eval echo "\"\$as_me:7290: $lt_compile\"" >&5)
     7292   (eval echo "\"\$as_me:7292: $lt_compile\"" >&5)
    72917293   (eval "$lt_compile" 2>conftest.err)
    72927294   ac_status=$?
    72937295   cat conftest.err >&5
    7294    echo "$as_me:7294: \$? = $ac_status" >&5
     7296   echo "$as_me:7296: \$? = $ac_status" >&5
    72957297   if (exit $ac_status) && test -s "$ac_outfile"; then
    72967298     # The compiler can only warn and ignore the option if not recognized
     
    75787580   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    75797581   -e 's:$: $lt_compiler_flag:'`
    7580    (eval echo "\"\$as_me:7580: $lt_compile\"" >&5)
     7582   (eval echo "\"\$as_me:7582: $lt_compile\"" >&5)
    75817583   (eval "$lt_compile" 2>conftest.err)
    75827584   ac_status=$?
    75837585   cat conftest.err >&5
    7584    echo "$as_me:7584: \$? = $ac_status" >&5
     7586   echo "$as_me:7586: \$? = $ac_status" >&5
    75857587   if (exit $ac_status) && test -s "$ac_outfile"; then
    75867588     # The compiler can only warn and ignore the option if not recognized
     
    76827684   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    76837685   -e 's:$: $lt_compiler_flag:'`
    7684    (eval echo "\"\$as_me:7684: $lt_compile\"" >&5)
     7686   (eval echo "\"\$as_me:7686: $lt_compile\"" >&5)
    76857687   (eval "$lt_compile" 2>out/conftest.err)
    76867688   ac_status=$?
    76877689   cat out/conftest.err >&5
    7688    echo "$as_me:7688: \$? = $ac_status" >&5
     7690   echo "$as_me:7690: \$? = $ac_status" >&5
    76897691   if (exit $ac_status) && test -s out/conftest2.$ac_objext
    76907692   then
     
    1004410046  lt_status=$lt_dlunknown
    1004510047  cat > conftest.$ac_ext <<EOF
    10046 #line 10046 "configure"
     10048#line 10048 "configure"
    1004710049#include "confdefs.h"
    1004810050
     
    1014410146  lt_status=$lt_dlunknown
    1014510147  cat > conftest.$ac_ext <<EOF
    10146 #line 10146 "configure"
     10148#line 10148 "configure"
    1014710149#include "confdefs.h"
    1014810150
     
    1256412566   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    1256512567   -e 's:$: $lt_compiler_flag:'`
    12566    (eval echo "\"\$as_me:12566: $lt_compile\"" >&5)
     12568   (eval echo "\"\$as_me:12568: $lt_compile\"" >&5)
    1256712569   (eval "$lt_compile" 2>conftest.err)
    1256812570   ac_status=$?
    1256912571   cat conftest.err >&5
    12570    echo "$as_me:12570: \$? = $ac_status" >&5
     12572   echo "$as_me:12572: \$? = $ac_status" >&5
    1257112573   if (exit $ac_status) && test -s "$ac_outfile"; then
    1257212574     # The compiler can only warn and ignore the option if not recognized
     
    1266812670   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    1266912671   -e 's:$: $lt_compiler_flag:'`
    12670    (eval echo "\"\$as_me:12670: $lt_compile\"" >&5)
     12672   (eval echo "\"\$as_me:12672: $lt_compile\"" >&5)
    1267112673   (eval "$lt_compile" 2>out/conftest.err)
    1267212674   ac_status=$?
    1267312675   cat out/conftest.err >&5
    12674    echo "$as_me:12674: \$? = $ac_status" >&5
     12676   echo "$as_me:12676: \$? = $ac_status" >&5
    1267512677   if (exit $ac_status) && test -s out/conftest2.$ac_objext
    1267612678   then
     
    1424514247   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    1424614248   -e 's:$: $lt_compiler_flag:'`
    14247    (eval echo "\"\$as_me:14247: $lt_compile\"" >&5)
     14249   (eval echo "\"\$as_me:14249: $lt_compile\"" >&5)
    1424814250   (eval "$lt_compile" 2>conftest.err)
    1424914251   ac_status=$?
    1425014252   cat conftest.err >&5
    14251    echo "$as_me:14251: \$? = $ac_status" >&5
     14253   echo "$as_me:14253: \$? = $ac_status" >&5
    1425214254   if (exit $ac_status) && test -s "$ac_outfile"; then
    1425314255     # The compiler can only warn and ignore the option if not recognized
     
    1434914351   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    1435014352   -e 's:$: $lt_compiler_flag:'`
    14351    (eval echo "\"\$as_me:14351: $lt_compile\"" >&5)
     14353   (eval echo "\"\$as_me:14353: $lt_compile\"" >&5)
    1435214354   (eval "$lt_compile" 2>out/conftest.err)
    1435314355   ac_status=$?
    1435414356   cat out/conftest.err >&5
    14355    echo "$as_me:14355: \$? = $ac_status" >&5
     14357   echo "$as_me:14357: \$? = $ac_status" >&5
    1435614358   if (exit $ac_status) && test -s out/conftest2.$ac_objext
    1435714359   then
     
    1654916551   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    1655016552   -e 's:$: $lt_compiler_flag:'`
    16551    (eval echo "\"\$as_me:16551: $lt_compile\"" >&5)
     16553   (eval echo "\"\$as_me:16553: $lt_compile\"" >&5)
    1655216554   (eval "$lt_compile" 2>conftest.err)
    1655316555   ac_status=$?
    1655416556   cat conftest.err >&5
    16555    echo "$as_me:16555: \$? = $ac_status" >&5
     16557   echo "$as_me:16557: \$? = $ac_status" >&5
    1655616558   if (exit $ac_status) && test -s "$ac_outfile"; then
    1655716559     # The compiler can only warn and ignore the option if not recognized
     
    1683916841   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    1684016842   -e 's:$: $lt_compiler_flag:'`
    16841    (eval echo "\"\$as_me:16841: $lt_compile\"" >&5)
     16843   (eval echo "\"\$as_me:16843: $lt_compile\"" >&5)
    1684216844   (eval "$lt_compile" 2>conftest.err)
    1684316845   ac_status=$?
    1684416846   cat conftest.err >&5
    16845    echo "$as_me:16845: \$? = $ac_status" >&5
     16847   echo "$as_me:16847: \$? = $ac_status" >&5
    1684616848   if (exit $ac_status) && test -s "$ac_outfile"; then
    1684716849     # The compiler can only warn and ignore the option if not recognized
     
    1694316945   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    1694416946   -e 's:$: $lt_compiler_flag:'`
    16945    (eval echo "\"\$as_me:16945: $lt_compile\"" >&5)
     16947   (eval echo "\"\$as_me:16947: $lt_compile\"" >&5)
    1694616948   (eval "$lt_compile" 2>out/conftest.err)
    1694716949   ac_status=$?
    1694816950   cat out/conftest.err >&5
    16949    echo "$as_me:16949: \$? = $ac_status" >&5
     16951   echo "$as_me:16951: \$? = $ac_status" >&5
    1695016952   if (exit $ac_status) && test -s out/conftest2.$ac_objext
    1695116953   then
     
    2023420236MIN_TLS_VERSION=2.2.1
    2023520237
    20236 # Check whether --with-libgnutls-prefix was given.
    20237 if test "${with_libgnutls_prefix+set}" = set; then
    20238   withval=$with_libgnutls_prefix; libgnutls_config_prefix="$withval"
    20239 else
    20240   libgnutls_config_prefix=""
    20241 fi
    20242 
    20243 
    20244   if test x$libgnutls_config_prefix != x ; then
    20245      if test x${LIBGNUTLS_CONFIG+set} != xset ; then
    20246         LIBGNUTLS_CONFIG=$libgnutls_config_prefix/bin/libgnutls-config
     20238# Check whether --with-libgnutls-extra-prefix was given.
     20239if test "${with_libgnutls_extra_prefix+set}" = set; then
     20240  withval=$with_libgnutls_extra_prefix; libgnutls_extra_config_prefix="$withval"
     20241else
     20242  libgnutls_extra_config_prefix=""
     20243fi
     20244
     20245
     20246  if test x$libgnutls_extra_config_prefix != x ; then
     20247     if test x${LIBGNUTLS_EXTRA_CONFIG+set} != xset ; then
     20248        LIBGNUTLS_EXTRA_CONFIG=$libgnutls_extra_config_prefix/bin/libgnutls-extra-config
    2024720249     fi
    2024820250  fi
    2024920251
    20250   # Extract the first word of "libgnutls-config", so it can be a program name with args.
    20251 set dummy libgnutls-config; ac_word=$2
     20252  # Extract the first word of "libgnutls-extra-config", so it can be a program name with args.
     20253set dummy libgnutls-extra-config; ac_word=$2
    2025220254{ echo "$as_me:$LINENO: checking for $ac_word" >&5
    2025320255echo $ECHO_N "checking for $ac_word... $ECHO_C" >&6; }
    20254 if test "${ac_cv_path_LIBGNUTLS_CONFIG+set}" = set; then
     20256if test "${ac_cv_path_LIBGNUTLS_EXTRA_CONFIG+set}" = set; then
    2025520257  echo $ECHO_N "(cached) $ECHO_C" >&6
    2025620258else
    20257   case $LIBGNUTLS_CONFIG in
     20259  case $LIBGNUTLS_EXTRA_CONFIG in
    2025820260  [\\/]* | ?:[\\/]*)
    20259   ac_cv_path_LIBGNUTLS_CONFIG="$LIBGNUTLS_CONFIG" # Let the user override the test with a path.
     20261  ac_cv_path_LIBGNUTLS_EXTRA_CONFIG="$LIBGNUTLS_EXTRA_CONFIG" # Let the user override the test with a path.
    2026020262  ;;
    2026120263  *)
     
    2026720269  for ac_exec_ext in '' $ac_executable_extensions; do
    2026820270  if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then
    20269     ac_cv_path_LIBGNUTLS_CONFIG="$as_dir/$ac_word$ac_exec_ext"
     20271    ac_cv_path_LIBGNUTLS_EXTRA_CONFIG="$as_dir/$ac_word$ac_exec_ext"
    2027020272    echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
    2027120273    break 2
     
    2027520277IFS=$as_save_IFS
    2027620278
    20277   test -z "$ac_cv_path_LIBGNUTLS_CONFIG" && ac_cv_path_LIBGNUTLS_CONFIG="no"
     20279  test -z "$ac_cv_path_LIBGNUTLS_EXTRA_CONFIG" && ac_cv_path_LIBGNUTLS_EXTRA_CONFIG="no"
    2027820280  ;;
    2027920281esac
    2028020282fi
    20281 LIBGNUTLS_CONFIG=$ac_cv_path_LIBGNUTLS_CONFIG
    20282 if test -n "$LIBGNUTLS_CONFIG"; then
    20283   { echo "$as_me:$LINENO: result: $LIBGNUTLS_CONFIG" >&5
    20284 echo "${ECHO_T}$LIBGNUTLS_CONFIG" >&6; }
     20283LIBGNUTLS_EXTRA_CONFIG=$ac_cv_path_LIBGNUTLS_EXTRA_CONFIG
     20284if test -n "$LIBGNUTLS_EXTRA_CONFIG"; then
     20285  { echo "$as_me:$LINENO: result: $LIBGNUTLS_EXTRA_CONFIG" >&5
     20286echo "${ECHO_T}$LIBGNUTLS_EXTRA_CONFIG" >&6; }
    2028520287else
    2028620288  { echo "$as_me:$LINENO: result: no" >&5
     
    2029320295echo $ECHO_N "checking for libgnutls - version >= $min_libgnutls_version... $ECHO_C" >&6; }
    2029420296  no_libgnutls=""
    20295   if test "$LIBGNUTLS_CONFIG" = "no" ; then
     20297  if test "$LIBGNUTLS_EXTRA_CONFIG" = "no" ; then
    2029620298    no_libgnutls=yes
    2029720299  else
    20298     LIBGNUTLS_CFLAGS=`$LIBGNUTLS_CONFIG $libgnutls_config_args --cflags`
    20299     LIBGNUTLS_LIBS=`$LIBGNUTLS_CONFIG $libgnutls_config_args --libs`
    20300     libgnutls_config_version=`$LIBGNUTLS_CONFIG $libgnutls_config_args --version`
     20300    LIBGNUTLS_EXTRA_CFLAGS=`$LIBGNUTLS_EXTRA_CONFIG $libgnutls_extra_config_args --cflags`
     20301    LIBGNUTLS_EXTRA_LIBS=`$LIBGNUTLS_EXTRA_CONFIG $libgnutls_extra_config_args --libs`
     20302    libgnutls_extra_config_version=`$LIBGNUTLS_EXTRA_CONFIG $libgnutls_extra_config_args --version`
    2030120303
    2030220304
    2030320305      ac_save_CFLAGS="$CFLAGS"
    2030420306      ac_save_LIBS="$LIBS"
    20305       CFLAGS="$CFLAGS $LIBGNUTLS_CFLAGS"
    20306       LIBS="$LIBS $LIBGNUTLS_LIBS"
     20307      CFLAGS="$CFLAGS $LIBGNUTLS_EXTRA_CFLAGS"
     20308      LIBS="$LIBS $LIBGNUTLS_EXTRA_LIBS"
    2030720309      rm -f conf.libgnutlstest
    2030820310      if test "$cross_compiling" = yes; then
     
    2031920321#include <stdlib.h>
    2032020322#include <string.h>
    20321 #include <gnutls/gnutls.h>
     20323#include <gnutls/extra.h>
    2032220324
    2032320325int
     
    2032620328    system ("touch conf.libgnutlstest");
    2032720329
    20328     if( strcmp( gnutls_check_version(NULL), "$libgnutls_config_version" ) )
     20330    if( strcmp( gnutls_extra_check_version(NULL), "$libgnutls_extra_config_version" ) )
    2032920331    {
    20330       printf("\n*** 'libgnutls-config --version' returned %s, but LIBGNUTLS (%s)\n",
    20331              "$libgnutls_config_version", gnutls_check_version(NULL) );
    20332       printf("*** was found! If libgnutls-config was correct, then it is best\n");
    20333       printf("*** to remove the old version of LIBGNUTLS. You may also be able to fix the error\n");
     20332      printf("\n*** 'libgnutls-extra-config --version' returned %s, but LIBGNUTLS_EXTRA (%s)\n",
     20333             "$libgnutls_extra_config_version", gnutls_extra_check_version(NULL) );
     20334      printf("*** was found! If libgnutls-extra-config was correct, then it is best\n");
     20335      printf("*** to remove the old version of LIBGNUTLS_EXTRA. You may also be able to fix the error\n");
    2033420336      printf("*** by modifying your LD_LIBRARY_PATH enviroment variable, or by editing\n");
    2033520337      printf("*** /etc/ld.so.conf. Make sure you have run ldconfig if that is\n");
    2033620338      printf("*** required on your system.\n");
    20337       printf("*** If libgnutls-config was wrong, set the environment variable LIBGNUTLS_CONFIG\n");
    20338       printf("*** to point to the correct copy of libgnutls-config, and remove the file config.cache\n");
     20339      printf("*** If libgnutls-extra-config was wrong, set the environment variable LIBGNUTLS_EXTRA_CONFIG\n");
     20340      printf("*** to point to the correct copy of libgnutls-extra-config, and remove the file config.cache\n");
    2033920341      printf("*** before re-running configure\n");
    2034020342    }
    20341     else if ( strcmp(gnutls_check_version(NULL), LIBGNUTLS_VERSION ) )
     20343    else if ( strcmp(gnutls_extra_check_version(NULL), LIBGNUTLS_EXTRA_VERSION ) )
    2034220344    {
    20343       printf("\n*** LIBGNUTLS header file (version %s) does not match\n", LIBGNUTLS_VERSION);
    20344       printf("*** library (version %s)\n", gnutls_check_version(NULL) );
     20345      printf("\n*** LIBGNUTLS_EXTRA header file (version %s) does not match\n", LIBGNUTLS_EXTRA_VERSION);
     20346      printf("*** library (version %s). This is may be due to a different version of gnutls\n", gnutls_extra_check_version(NULL) );
     20347      printf("*** and gnutls-extra.\n");
    2034520348    }
    2034620349    else
    2034720350    {
    20348       if ( gnutls_check_version( "$min_libgnutls_version" ) )
     20351      if ( gnutls_extra_check_version( "$min_libgnutls_version" ) )
    2034920352      {
    2035020353        return 0;
     
    2035220355     else
    2035320356      {
    20354         printf("no\n*** An old version of LIBGNUTLS (%s) was found.\n",
    20355                 gnutls_check_version(NULL) );
    20356         printf("*** You need a version of LIBGNUTLS newer than %s. The latest version of\n",
     20357        printf("no\n*** An old version of LIBGNUTLS_EXTRA (%s) was found.\n",
     20358                gnutls_extra_check_version(NULL) );
     20359        printf("*** You need a version of LIBGNUTLS_EXTRA newer than %s. The latest version of\n",
    2035720360               "$min_libgnutls_version" );
    20358         printf("*** LIBGNUTLS is always available from ftp://gnutls.hellug.gr/pub/gnutls.\n");
     20361        printf("*** LIBGNUTLS_EXTRA is always available from ftp://gnutls.hellug.gr/pub/gnutls.\n");
    2035920362        printf("*** \n");
    2036020363        printf("*** If you have already installed a sufficiently new version, this error\n");
    20361         printf("*** probably means that the wrong copy of the libgnutls-config shell script is\n");
     20364        printf("*** probably means that the wrong copy of the libgnutls-extra-config shell script is\n");
    2036220365        printf("*** being found. The easiest way to fix this is to remove the old version\n");
    20363         printf("*** of LIBGNUTLS, but you can also set the LIBGNUTLS_CONFIG environment to point to the\n");
    20364         printf("*** correct copy of libgnutls-config. (In this case, you will have to\n");
     20366        printf("*** of LIBGNUTLS_EXTRA, but you can also set the LIBGNUTLS_EXTRA_CONFIG environment to point to the\n");
     20367        printf("*** correct copy of libgnutls-extra-config. (In this case, you will have to\n");
    2036520368        printf("*** modify your LD_LIBRARY_PATH enviroment variable, or edit /etc/ld.so.conf\n");
    2036620369        printf("*** so that the correct libraries are found at run-time))\n");
     
    2041920422echo "${ECHO_T}no" >&6; }
    2042020423     fi
    20421      if test "$LIBGNUTLS_CONFIG" = "no" ; then
    20422        echo "*** The libgnutls-config script installed by LIBGNUTLS could not be found"
    20423        echo "*** If LIBGNUTLS was installed in PREFIX, make sure PREFIX/bin is in"
    20424        echo "*** your path, or set the LIBGNUTLS_CONFIG environment variable to the"
    20425        echo "*** full path to libgnutls-config."
     20424     if test "$LIBGNUTLS_EXTRA_CONFIG" = "no" ; then
     20425       echo "*** The libgnutls-extra-config script installed by LIBGNUTLS_EXTRA could not be found"
     20426       echo "*** If LIBGNUTLS_EXTRA was installed in PREFIX, make sure PREFIX/bin is in"
     20427       echo "*** your path, or set the LIBGNUTLS_EXTRA_CONFIG environment variable to the"
     20428       echo "*** full path to libgnutls-extra-config."
    2042620429     else
    2042720430       if test -f conf.libgnutlstest ; then
     
    2042920432       else
    2043020433          echo "*** Could not run libgnutls test program, checking why..."
    20431           CFLAGS="$CFLAGS $LIBGNUTLS_CFLAGS"
    20432           LIBS="$LIBS $LIBGNUTLS_LIBS"
     20434          CFLAGS="$CFLAGS $LIBGNUTLS_EXTRA_CFLAGS"
     20435          LIBS="$LIBS $LIBGNUTLS_EXTRA_LIBS"
    2043320436          cat >conftest.$ac_ext <<_ACEOF
    2043420437/* confdefs.h.  */
     
    2044120444#include <stdlib.h>
    2044220445#include <string.h>
    20443 #include <gnutls/gnutls.h>
     20446#include <gnutls/extra.h>
    2044420447
    2044520448int
    2044620449main ()
    2044720450{
    20448  return !!gnutls_check_version(NULL);
     20451 return !!gnutls_extra_check_version(NULL);
    2044920452  ;
    2045020453  return 0;
     
    2047020473       $as_test_x conftest$ac_exeext; then
    2047120474   echo "*** The test program compiled, but did not run. This usually means"
    20472           echo "*** that the run-time linker is not finding LIBGNUTLS or finding the wrong"
    20473           echo "*** version of LIBGNUTLS. If it is not finding LIBGNUTLS, you'll need to set your"
     20475          echo "*** that the run-time linker is not finding LIBGNUTLS_EXTRA or finding the wrong"
     20476          echo "*** version of LIBGNUTLS_EXTRA. If it is not finding LIBGNUTLS_EXTRA, you'll need to set your"
    2047420477          echo "*** LD_LIBRARY_PATH environment variable, or edit /etc/ld.so.conf to point"
    2047520478          echo "*** to the installed location  Also, make sure you have run ldconfig if that"
     
    2048420487
    2048520488         echo "*** The test program failed to compile or link. See the file config.log for the"
    20486           echo "*** exact error that occured. This usually means LIBGNUTLS was incorrectly installed"
    20487           echo "*** or that you have moved LIBGNUTLS since it was installed. In the latter case, you"
    20488           echo "*** may want to edit the libgnutls-config script: $LIBGNUTLS_CONFIG"
     20489          echo "*** exact error that occured. This usually means LIBGNUTLS_EXTRA was incorrectly installed"
     20490          echo "*** or that you have moved LIBGNUTLS_EXTRA since it was installed. In the latter case, you"
     20491          echo "*** may want to edit the libgnutls-extra-config script: $LIBGNUTLS_EXTRA_CONFIG"
    2048920492fi
    2049020493
     
    2049520498       fi
    2049620499     fi
    20497      LIBGNUTLS_CFLAGS=""
    20498      LIBGNUTLS_LIBS=""
     20500     LIBGNUTLS_EXTRA_CFLAGS=""
     20501     LIBGNUTLS_EXTRA_LIBS=""
    2049920502     { { echo "$as_me:$LINENO: error:
    2050020503***
    20501 *** libgnutls were not found. You may want to get it from
     20504*** libgnutls and libgnutls-extra were not found. You may want to get it from
    2050220505*** http://www.gnutls.org/
    2050320506***
     
    2050520508echo "$as_me: error:
    2050620509***
    20507 *** libgnutls were not found. You may want to get it from
     20510*** libgnutls and libgnutls-extra were not found. You may want to get it from
    2050820511*** http://www.gnutls.org/
    2050920512***
     
    2051520518
    2051620519
    20517   LIBGNUTLS_VERSION=`$LIBGNUTLS_CONFIG $libgnutls_config_args --version`
    20518   LIBGNUTLS_PREFIX="`$LIBGNUTLS_CONFIG $libgnutls_config_args --prefix`"
     20520  LIBGNUTLS_LIBS=$LIBGNUTLS_EXTRA_LIBS
     20521  LIBGNUTLS_CFLAGS=$LIBGNUTLS_EXTRA_CFLAGS
     20522  LIBGNUTLS_VERSION=`$LIBGNUTLS_EXTRA_CONFIG $libgnutls_extra_config_args --version`
     20523  LIBGNUTLS_PREFIX="`$LIBGNUTLS_EXTRA_CONFIG $libgnutls_extra_config_args --prefix`"
    2051920524  GNUTLS_CERTTOOL="${LIBGNUTLS_PREFIX}/bin/certtool"
    2052020525
     
    2052620531
    2052720532
     20533
     20534# Check whether --enable-srp was given.
     20535if test "${enable_srp+set}" = set; then
     20536  enableval=$enable_srp; use_srp=$enableval
     20537else
     20538  use_srp=yes
     20539fi
     20540
     20541
     20542SRP_CFLAGS=""
     20543if test "$use_srp" != "no"; then
     20544        SRP_CFLAGS="-DENABLE_SRP=1"
     20545fi
     20546{ echo "$as_me:$LINENO: checking whether to enable SRP functionality" >&5
     20547echo $ECHO_N "checking whether to enable SRP functionality... $ECHO_C" >&6; }
     20548{ echo "$as_me:$LINENO: result: $use_srp" >&5
     20549echo "${ECHO_T}$use_srp" >&6; }
    2052820550
    2052920551
     
    2127321295
    2127421296
    21275 # Check whether --enable-srp was given.
    21276 if test "${enable_srp+set}" = set; then
    21277   enableval=$enable_srp; use_srp=$enableval
    21278 else
    21279   use_srp=yes
    21280 fi
    21281 
    21282 
    21283 SRP_CFLAGS=""
    21284 if test "$use_srp" != "no"; then
    21285         SRP_CFLAGS="-DENABLE_SRP=1"
    21286 fi
    21287 { echo "$as_me:$LINENO: checking whether to enable SRP functionality" >&5
    21288 echo $ECHO_N "checking whether to enable SRP functionality... $ECHO_C" >&6; }
    21289 { echo "$as_me:$LINENO: result: $use_srp" >&5
    21290 echo "${ECHO_T}$use_srp" >&6; }
    21291 
    21292 MODULE_CFLAGS="${LIBGNUTLS_CFLAGS} ${SRP_CFLAGS} ${APR_MEMCACHE_CFLAGS} ${APXS_CFLAGS} ${AP_INCLUDES} ${APR_INCLUDES} ${APU_INCLUDES}"
    21293 MODULE_LIBS="${APR_MEMCACHE_LIBS} ${LIBGNUTLS_LIBS}"
     21297MODULE_CFLAGS="${LIBGNUTLS_EXTRA_CFLAGS} ${SRP_CFLAGS} ${APR_MEMCACHE_CFLAGS} ${APXS_CFLAGS} ${AP_INCLUDES} ${APR_INCLUDES} ${APU_INCLUDES}"
     21298MODULE_LIBS="${APR_MEMCACHE_LIBS} ${LIBGNUTLS_EXTRA_LIBS}"
    2129421299
    2129521300
     
    2172221727# values after options handling.
    2172321728ac_log="
    21724 This file was extended by mod_gnutls $as_me 0.4.3, which was
     21729This file was extended by mod_gnutls $as_me 0.5.1, which was
    2172521730generated by GNU Autoconf 2.61.  Invocation command line was
    2172621731
     
    2177521780cat >>$CONFIG_STATUS <<_ACEOF
    2177621781ac_cs_version="\\
    21777 mod_gnutls config.status 0.4.3
     21782mod_gnutls config.status 0.5.1
    2177821783configured by $0, generated by GNU Autoconf 2.61,
    2177921784  with options \\"`echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"
     
    2213222137APXS_EXTENSION!$APXS_EXTENSION$ac_delim
    2213322138APXS_CFLAGS!$APXS_CFLAGS$ac_delim
    22134 LIBGNUTLS_CONFIG!$LIBGNUTLS_CONFIG$ac_delim
     22139LIBGNUTLS_EXTRA_CONFIG!$LIBGNUTLS_EXTRA_CONFIG$ac_delim
     22140LIBGNUTLS_EXTRA_CFLAGS!$LIBGNUTLS_EXTRA_CFLAGS$ac_delim
     22141LIBGNUTLS_EXTRA_LIBS!$LIBGNUTLS_EXTRA_LIBS$ac_delim
    2213522142LIBGNUTLS_CFLAGS!$LIBGNUTLS_CFLAGS$ac_delim
    2213622143LIBGNUTLS_LIBS!$LIBGNUTLS_LIBS$ac_delim
     
    2214722154_ACEOF
    2214822155
    22149   if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 51; then
     22156  if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 53; then
    2215022157    break
    2215122158  elif $ac_last_try; then
     
    2275222759echo "   * Apache Modules directory:    ${AP_LIBEXECDIR}"
    2275322760echo "   * GnuTLS Library version:      ${LIBGNUTLS_VERSION}"
    22754 echo "   * SRP authentication:          ${use_srp}"
     22761echo "   * SRP Authentication:          ${use_srp}"
    2275522762echo ""
    2275622763echo "---"
  • configure.ac

    r8df5b25 r9d9b093  
    11dnl
    2 AC_INIT(mod_gnutls, 0.4.3)
     2AC_INIT(mod_gnutls, 0.5.1)
    33OOO_CONFIG_NICE(config.nice)
    44MOD_GNUTLS_VERSION=AC_PACKAGE_VERSION
     
    3030
    3131MIN_TLS_VERSION=2.2.1
    32 AM_PATH_LIBGNUTLS($MIN_TLS_VERSION,,
     32AM_PATH_LIBGNUTLS_EXTRA($MIN_TLS_VERSION,,
    3333        AC_MSG_ERROR([[
    3434*** 
    35 *** libgnutls were not found. You may want to get it from
     35*** libgnutls and libgnutls-extra were not found. You may want to get it from
    3636*** http://www.gnutls.org/
    3737***
    3838]]))
    39 
    40 dnl CHECK_LUA()
    41 
    42 have_apr_memcache=0
    43 CHECK_APR_MEMCACHE([have_apr_memcache=1], [have_apr_memcache=0])
    44 AC_SUBST(have_apr_memcache)
    4539
    4640AC_ARG_ENABLE(srp,
     
    5145SRP_CFLAGS=""
    5246if test "$use_srp" != "no"; then
    53         SRP_CFLAGS="-DENABLE_SRP=1"
     47        SRP_CFLAGS="-DENABLE_SRP=1"
    5448fi
    5549AC_MSG_CHECKING([whether to enable SRP functionality])
    5650AC_MSG_RESULT($use_srp)
    5751
    58 MODULE_CFLAGS="${LIBGNUTLS_CFLAGS} ${SRP_CFLAGS} ${APR_MEMCACHE_CFLAGS} ${APXS_CFLAGS} ${AP_INCLUDES} ${APR_INCLUDES} ${APU_INCLUDES}"
    59 MODULE_LIBS="${APR_MEMCACHE_LIBS} ${LIBGNUTLS_LIBS}"
     52dnl CHECK_LUA()
     53
     54have_apr_memcache=0
     55CHECK_APR_MEMCACHE([have_apr_memcache=1], [have_apr_memcache=0])
     56AC_SUBST(have_apr_memcache)
     57
     58MODULE_CFLAGS="${LIBGNUTLS_EXTRA_CFLAGS} ${SRP_CFLAGS} ${APR_MEMCACHE_CFLAGS} ${APXS_CFLAGS} ${AP_INCLUDES} ${APR_INCLUDES} ${APU_INCLUDES}"
     59MODULE_LIBS="${APR_MEMCACHE_LIBS} ${LIBGNUTLS_EXTRA_LIBS}"
    6060
    6161AC_SUBST(MODULE_CFLAGS)
     
    6868echo "Configuration summary for mod_gnutls:"
    6969echo ""
    70 echo "   * mod_gnutls version:          ${MOD_GNUTLS_VERSION}"
    71 echo "   * Apache Modules directory:    ${AP_LIBEXECDIR}"
    72 echo "   * GnuTLS Library version:      ${LIBGNUTLS_VERSION}"
    73 echo "   * SRP authentication:          ${use_srp}"
     70echo "   * mod_gnutls version:  ${MOD_GNUTLS_VERSION}"
     71echo "   * Apache Modules directory:    ${AP_LIBEXECDIR}"
     72echo "   * GnuTLS Library version:      ${LIBGNUTLS_VERSION}"
     73echo "   * SRP Authentication:          ${use_srp}"
    7474echo ""
    7575echo "---"
  • include/mod_gnutls.h.in

    r8df5b25 r9d9b093  
    3030#include <gcrypt.h>
    3131#include <gnutls/gnutls.h>
     32#include <gnutls/extra.h>
     33#include <gnutls/openpgp.h>
    3234#include <gnutls/x509.h>
    3335
     
    9597    unsigned int certs_x509_num;
    9698    gnutls_x509_privkey_t privkey_x509;
     99    gnutls_openpgp_crt_t cert_pgp; /* A certificate chain */
     100    gnutls_openpgp_privkey_t privkey_pgp;
    97101    int enabled;
    98102    /* whether to send the PEM encoded certificates
     
    109113    const char* srp_tpasswd_conf_file;
    110114    gnutls_x509_crt_t ca_list[MAX_CA_CRTS];
     115    gnutls_openpgp_keyring_t pgp_list;
    111116    unsigned int ca_list_size;
    112117    int client_verify_mode;
     
    255260                             const char *arg);
    256261
     262const char *mgs_set_pgpcert_file(cmd_parms * parms, void *dummy,
     263                                        const char *arg);
     264
     265const char *mgs_set_pgpkey_file(cmd_parms * parms, void *dummy,
     266                             const char *arg);
     267
    257268const char *mgs_set_cache(cmd_parms * parms, void *dummy,
    258269                          const char *type, const char* arg);
     
    265276
    266277const char *mgs_set_client_ca_file(cmd_parms * parms, void *dummy,
     278                                   const char *arg);
     279
     280const char *mgs_set_keyring_file(cmd_parms * parms, void *dummy,
    267281                                   const char *arg);
    268282
  • m4/libgnutls.m4

    r8df5b25 r9d9b093  
    1 dnl Autoconf macros for libgnutls
     1dnl Autoconf macros for libgnutls-extra
    22dnl $id$
    33
    4 # Modified for LIBGNUTLS -- nmav
     4# Modified for LIBGNUTLS_EXTRA -- nmav
    55# Configure paths for LIBGCRYPT
    66# Shamelessly stolen from the one of XDELTA by Owen Taylor
    77# Werner Koch   99-12-09
    88
    9 dnl AM_PATH_LIBGNUTLS([MINIMUM-VERSION, [ACTION-IF-FOUND [, ACTION-IF-NOT-FOUND ]]])
    10 dnl Test for libgnutls, and define LIBGNUTLS_CFLAGS and LIBGNUTLS_LIBS
     9dnl AM_PATH_LIBGNUTLS_EXTRA([MINIMUM-VERSION, [ACTION-IF-FOUND [, ACTION-IF-NOT-FOUND ]]])
     10dnl Test for libgnutls-extra, and define LIBGNUTLS_EXTRA_CFLAGS and LIBGNUTLS_EXTRA_LIBS
    1111dnl
    12 AC_DEFUN([AM_PATH_LIBGNUTLS],
     12AC_DEFUN([AM_PATH_LIBGNUTLS_EXTRA],
    1313[dnl
    14 dnl Get the cflags and libraries from the libgnutls-config script
     14dnl Get the cflags and libraries from the libgnutls-extra-config script
    1515dnl
    16 AC_ARG_WITH(libgnutls-prefix,
    17           [  --with-libgnutls-prefix=PFX   Prefix where libgnutls is installed (optional)],
    18           libgnutls_config_prefix="$withval", libgnutls_config_prefix="")
     16AC_ARG_WITH(libgnutls-extra-prefix,
     17          [  --with-libgnutls-extra-prefix=PFX   Prefix where libgnutls-extra is installed (optional)],
     18          libgnutls_extra_config_prefix="$withval", libgnutls_extra_config_prefix="")
    1919
    20   if test x$libgnutls_config_prefix != x ; then
    21      if test x${LIBGNUTLS_CONFIG+set} != xset ; then
    22         LIBGNUTLS_CONFIG=$libgnutls_config_prefix/bin/libgnutls-config
     20  if test x$libgnutls_extra_config_prefix != x ; then
     21     if test x${LIBGNUTLS_EXTRA_CONFIG+set} != xset ; then
     22        LIBGNUTLS_EXTRA_CONFIG=$libgnutls_extra_config_prefix/bin/libgnutls-extra-config
    2323     fi
    2424  fi
    2525
    26   AC_PATH_PROG(LIBGNUTLS_CONFIG, libgnutls-config, no)
     26  AC_PATH_PROG(LIBGNUTLS_EXTRA_CONFIG, libgnutls-extra-config, no)
    2727  min_libgnutls_version=ifelse([$1], ,0.1.0,$1)
    2828  AC_MSG_CHECKING(for libgnutls - version >= $min_libgnutls_version)
    2929  no_libgnutls=""
    30   if test "$LIBGNUTLS_CONFIG" = "no" ; then
     30  if test "$LIBGNUTLS_EXTRA_CONFIG" = "no" ; then
    3131    no_libgnutls=yes
    3232  else
    33     LIBGNUTLS_CFLAGS=`$LIBGNUTLS_CONFIG $libgnutls_config_args --cflags`
    34     LIBGNUTLS_LIBS=`$LIBGNUTLS_CONFIG $libgnutls_config_args --libs`
    35     libgnutls_config_version=`$LIBGNUTLS_CONFIG $libgnutls_config_args --version`
     33    LIBGNUTLS_EXTRA_CFLAGS=`$LIBGNUTLS_EXTRA_CONFIG $libgnutls_extra_config_args --cflags`
     34    LIBGNUTLS_EXTRA_LIBS=`$LIBGNUTLS_EXTRA_CONFIG $libgnutls_extra_config_args --libs`
     35    libgnutls_extra_config_version=`$LIBGNUTLS_EXTRA_CONFIG $libgnutls_extra_config_args --version`
    3636
    3737
    3838      ac_save_CFLAGS="$CFLAGS"
    3939      ac_save_LIBS="$LIBS"
    40       CFLAGS="$CFLAGS $LIBGNUTLS_CFLAGS"
    41       LIBS="$LIBS $LIBGNUTLS_LIBS"
     40      CFLAGS="$CFLAGS $LIBGNUTLS_EXTRA_CFLAGS"
     41      LIBS="$LIBS $LIBGNUTLS_EXTRA_LIBS"
    4242dnl
    4343dnl Now check if the installed libgnutls is sufficiently new. Also sanity
    44 dnl checks the results of libgnutls-config to some extent
     44dnl checks the results of libgnutls-extra-config to some extent
    4545dnl
    4646      rm -f conf.libgnutlstest
     
    4949#include <stdlib.h>
    5050#include <string.h>
    51 #include <gnutls/gnutls.h>
     51#include <gnutls/extra.h>
    5252
    5353int
     
    5656    system ("touch conf.libgnutlstest");
    5757
    58     if( strcmp( gnutls_check_version(NULL), "$libgnutls_config_version" ) )
     58    if( strcmp( gnutls_extra_check_version(NULL), "$libgnutls_extra_config_version" ) )
    5959    {
    60       printf("\n*** 'libgnutls-config --version' returned %s, but LIBGNUTLS (%s)\n",
    61              "$libgnutls_config_version", gnutls_check_version(NULL) );
    62       printf("*** was found! If libgnutls-config was correct, then it is best\n");
    63       printf("*** to remove the old version of LIBGNUTLS. You may also be able to fix the error\n");
     60      printf("\n*** 'libgnutls-extra-config --version' returned %s, but LIBGNUTLS_EXTRA (%s)\n",
     61             "$libgnutls_extra_config_version", gnutls_extra_check_version(NULL) );
     62      printf("*** was found! If libgnutls-extra-config was correct, then it is best\n");
     63      printf("*** to remove the old version of LIBGNUTLS_EXTRA. You may also be able to fix the error\n");
    6464      printf("*** by modifying your LD_LIBRARY_PATH enviroment variable, or by editing\n");
    6565      printf("*** /etc/ld.so.conf. Make sure you have run ldconfig if that is\n");
    6666      printf("*** required on your system.\n");
    67       printf("*** If libgnutls-config was wrong, set the environment variable LIBGNUTLS_CONFIG\n");
    68       printf("*** to point to the correct copy of libgnutls-config, and remove the file config.cache\n");
     67      printf("*** If libgnutls-extra-config was wrong, set the environment variable LIBGNUTLS_EXTRA_CONFIG\n");
     68      printf("*** to point to the correct copy of libgnutls-extra-config, and remove the file config.cache\n");
    6969      printf("*** before re-running configure\n");
    7070    }
    71     else if ( strcmp(gnutls_check_version(NULL), LIBGNUTLS_VERSION ) )
     71    else if ( strcmp(gnutls_extra_check_version(NULL), LIBGNUTLS_EXTRA_VERSION ) )
    7272    {
    73       printf("\n*** LIBGNUTLS header file (version %s) does not match\n", LIBGNUTLS_VERSION);
    74       printf("*** library (version %s)\n", gnutls_check_version(NULL) );
     73      printf("\n*** LIBGNUTLS_EXTRA header file (version %s) does not match\n", LIBGNUTLS_EXTRA_VERSION);
     74      printf("*** library (version %s). This is may be due to a different version of gnutls\n", gnutls_extra_check_version(NULL) );
     75      printf("*** and gnutls-extra.\n");
    7576    }
    7677    else
    7778    {
    78       if ( gnutls_check_version( "$min_libgnutls_version" ) )
     79      if ( gnutls_extra_check_version( "$min_libgnutls_version" ) )
    7980      {
    8081        return 0;
     
    8283     else
    8384      {
    84         printf("no\n*** An old version of LIBGNUTLS (%s) was found.\n",
    85                 gnutls_check_version(NULL) );
    86         printf("*** You need a version of LIBGNUTLS newer than %s. The latest version of\n",
     85        printf("no\n*** An old version of LIBGNUTLS_EXTRA (%s) was found.\n",
     86                gnutls_extra_check_version(NULL) );
     87        printf("*** You need a version of LIBGNUTLS_EXTRA newer than %s. The latest version of\n",
    8788               "$min_libgnutls_version" );
    88         printf("*** LIBGNUTLS is always available from ftp://gnutls.hellug.gr/pub/gnutls.\n");
     89        printf("*** LIBGNUTLS_EXTRA is always available from ftp://gnutls.hellug.gr/pub/gnutls.\n");
    8990        printf("*** \n");
    9091        printf("*** If you have already installed a sufficiently new version, this error\n");
    91         printf("*** probably means that the wrong copy of the libgnutls-config shell script is\n");
     92        printf("*** probably means that the wrong copy of the libgnutls-extra-config shell script is\n");
    9293        printf("*** being found. The easiest way to fix this is to remove the old version\n");
    93         printf("*** of LIBGNUTLS, but you can also set the LIBGNUTLS_CONFIG environment to point to the\n");
    94         printf("*** correct copy of libgnutls-config. (In this case, you will have to\n");
     94        printf("*** of LIBGNUTLS_EXTRA, but you can also set the LIBGNUTLS_EXTRA_CONFIG environment to point to the\n");
     95        printf("*** correct copy of libgnutls-extra-config. (In this case, you will have to\n");
    9596        printf("*** modify your LD_LIBRARY_PATH enviroment variable, or edit /etc/ld.so.conf\n");
    9697        printf("*** so that the correct libraries are found at run-time))\n");
     
    113114        AC_MSG_RESULT(no)
    114115     fi
    115      if test "$LIBGNUTLS_CONFIG" = "no" ; then
    116        echo "*** The libgnutls-config script installed by LIBGNUTLS could not be found"
    117        echo "*** If LIBGNUTLS was installed in PREFIX, make sure PREFIX/bin is in"
    118        echo "*** your path, or set the LIBGNUTLS_CONFIG environment variable to the"
    119        echo "*** full path to libgnutls-config."
     116     if test "$LIBGNUTLS_EXTRA_CONFIG" = "no" ; then
     117       echo "*** The libgnutls-extra-config script installed by LIBGNUTLS_EXTRA could not be found"
     118       echo "*** If LIBGNUTLS_EXTRA was installed in PREFIX, make sure PREFIX/bin is in"
     119       echo "*** your path, or set the LIBGNUTLS_EXTRA_CONFIG environment variable to the"
     120       echo "*** full path to libgnutls-extra-config."
    120121     else
    121122       if test -f conf.libgnutlstest ; then
     
    123124       else
    124125          echo "*** Could not run libgnutls test program, checking why..."
    125           CFLAGS="$CFLAGS $LIBGNUTLS_CFLAGS"
    126           LIBS="$LIBS $LIBGNUTLS_LIBS"
     126          CFLAGS="$CFLAGS $LIBGNUTLS_EXTRA_CFLAGS"
     127          LIBS="$LIBS $LIBGNUTLS_EXTRA_LIBS"
    127128          AC_TRY_LINK([
    128129#include <stdio.h>
    129130#include <stdlib.h>
    130131#include <string.h>
    131 #include <gnutls/gnutls.h>
    132 ],      [ return !!gnutls_check_version(NULL); ],
     132#include <gnutls/extra.h>
     133],      [ return !!gnutls_extra_check_version(NULL); ],
    133134        [ echo "*** The test program compiled, but did not run. This usually means"
    134           echo "*** that the run-time linker is not finding LIBGNUTLS or finding the wrong"
    135           echo "*** version of LIBGNUTLS. If it is not finding LIBGNUTLS, you'll need to set your"
     135          echo "*** that the run-time linker is not finding LIBGNUTLS_EXTRA or finding the wrong"
     136          echo "*** version of LIBGNUTLS_EXTRA. If it is not finding LIBGNUTLS_EXTRA, you'll need to set your"
    136137          echo "*** LD_LIBRARY_PATH environment variable, or edit /etc/ld.so.conf to point"
    137138          echo "*** to the installed location  Also, make sure you have run ldconfig if that"
     
    142143          echo "***" ],
    143144        [ echo "*** The test program failed to compile or link. See the file config.log for the"
    144           echo "*** exact error that occured. This usually means LIBGNUTLS was incorrectly installed"
    145           echo "*** or that you have moved LIBGNUTLS since it was installed. In the latter case, you"
    146           echo "*** may want to edit the libgnutls-config script: $LIBGNUTLS_CONFIG" ])
     145          echo "*** exact error that occured. This usually means LIBGNUTLS_EXTRA was incorrectly installed"
     146          echo "*** or that you have moved LIBGNUTLS_EXTRA since it was installed. In the latter case, you"
     147          echo "*** may want to edit the libgnutls-extra-config script: $LIBGNUTLS_EXTRA_CONFIG" ])
    147148          CFLAGS="$ac_save_CFLAGS"
    148149          LIBS="$ac_save_LIBS"
    149150       fi
    150151     fi
    151      LIBGNUTLS_CFLAGS=""
    152      LIBGNUTLS_LIBS=""
     152     LIBGNUTLS_EXTRA_CFLAGS=""
     153     LIBGNUTLS_EXTRA_LIBS=""
    153154     ifelse([$3], , :, [$3])
    154155  fi
    155156  rm -f conf.libgnutlstest
    156   AC_SUBST(LIBGNUTLS_CFLAGS)
    157   AC_SUBST(LIBGNUTLS_LIBS)
     157  AC_SUBST(LIBGNUTLS_EXTRA_CFLAGS)
     158  AC_SUBST(LIBGNUTLS_EXTRA_LIBS)
    158159
    159   LIBGNUTLS_VERSION=`$LIBGNUTLS_CONFIG $libgnutls_config_args --version`
    160   LIBGNUTLS_PREFIX="`$LIBGNUTLS_CONFIG $libgnutls_config_args --prefix`"
     160  LIBGNUTLS_LIBS=$LIBGNUTLS_EXTRA_LIBS
     161  LIBGNUTLS_CFLAGS=$LIBGNUTLS_EXTRA_CFLAGS
     162  LIBGNUTLS_VERSION=`$LIBGNUTLS_EXTRA_CONFIG $libgnutls_extra_config_args --version`
     163  LIBGNUTLS_PREFIX="`$LIBGNUTLS_EXTRA_CONFIG $libgnutls_extra_config_args --prefix`"
    161164  GNUTLS_CERTTOOL="${LIBGNUTLS_PREFIX}/bin/certtool"
    162165
     
    166169  AC_SUBST(LIBGNUTLS_PREFIX)
    167170  AC_SUBST(LIBGNUTLS_CERTTOOL)
    168 
     171 
    169172])
    170173
  • src/Makefile.in

    r8df5b25 r9d9b093  
    143143LIBGNUTLS_CERTTOOL = @LIBGNUTLS_CERTTOOL@
    144144LIBGNUTLS_CFLAGS = @LIBGNUTLS_CFLAGS@
    145 LIBGNUTLS_CONFIG = @LIBGNUTLS_CONFIG@
     145LIBGNUTLS_EXTRA_CFLAGS = @LIBGNUTLS_EXTRA_CFLAGS@
     146LIBGNUTLS_EXTRA_CONFIG = @LIBGNUTLS_EXTRA_CONFIG@
     147LIBGNUTLS_EXTRA_LIBS = @LIBGNUTLS_EXTRA_LIBS@
    146148LIBGNUTLS_LIBS = @LIBGNUTLS_LIBS@
    147149LIBGNUTLS_PREFIX = @LIBGNUTLS_PREFIX@
  • src/gnutls_config.c

    r8df5b25 r9d9b093  
    11/**
    22 *  Copyright 2004-2005 Paul Querna
     3 *  Copyright 2007 Nikos Mavrogiannopoulos
    34 *
    45 *  Licensed under the Apache License, Version 2.0 (the "License");
     
    203204}
    204205
     206const char *mgs_set_pgpcert_file(cmd_parms * parms, void *dummy,
     207                              const char *arg)
     208{
     209    int ret;
     210    gnutls_datum_t data;
     211    const char *file;
     212    apr_pool_t *spool;
     213    mgs_srvconf_rec *sc =
     214        (mgs_srvconf_rec *) ap_get_module_config(parms->server->
     215                                                 module_config,
     216                                                 &gnutls_module);
     217    apr_pool_create(&spool, parms->pool);
     218
     219    file = ap_server_root_relative(spool, arg);
     220
     221    if (load_datum_from_file(spool, file, &data) != 0) {
     222        return apr_psprintf(parms->pool, "GnuTLS: Error Reading "
     223                            "Certificate '%s'", file);
     224    }
     225
     226    ret = gnutls_openpgp_crt_init( &sc->cert_pgp);
     227    if (ret < 0) {
     228        return apr_psprintf(parms->pool, "GnuTLS: Failed to Init "
     229                            "PGP Certificate: (%d) %s", ret,
     230                            gnutls_strerror(ret));
     231    }
     232     
     233    ret =
     234        gnutls_openpgp_crt_import(sc->cert_pgp, &data, GNUTLS_OPENPGP_FMT_BASE64);
     235    if (ret < 0) {
     236        return apr_psprintf(parms->pool, "GnuTLS: Failed to Import "
     237                            "PGP Certificate '%s': (%d) %s", file, ret,
     238                            gnutls_strerror(ret));
     239    }
     240
     241    apr_pool_destroy(spool);
     242    return NULL;
     243}
     244
     245const char *mgs_set_pgpkey_file(cmd_parms * parms, void *dummy,
     246                             const char *arg)
     247{
     248    int ret;
     249    gnutls_datum_t data;
     250    const char *file;
     251    apr_pool_t *spool;
     252    mgs_srvconf_rec *sc =
     253        (mgs_srvconf_rec *) ap_get_module_config(parms->server->
     254                                                 module_config,
     255                                                 &gnutls_module);
     256    apr_pool_create(&spool, parms->pool);
     257
     258    file = ap_server_root_relative(spool, arg);
     259
     260    if (load_datum_from_file(spool, file, &data) != 0) {
     261        return apr_psprintf(parms->pool, "GnuTLS: Error Reading "
     262                            "Private Key '%s'", file);
     263    }
     264
     265    ret = gnutls_openpgp_privkey_init(&sc->privkey_pgp);
     266    if (ret < 0) {
     267        return apr_psprintf(parms->pool, "GnuTLS: Failed to initialize"
     268                            ": (%d) %s", ret, gnutls_strerror(ret));
     269    }
     270
     271    ret =
     272        gnutls_openpgp_privkey_import(sc->privkey_pgp, &data,
     273                                   GNUTLS_OPENPGP_FMT_BASE64, NULL, 0);
     274    if (ret != 0) {
     275        return apr_psprintf(parms->pool, "GnuTLS: Failed to Import "
     276                            "PGP Private Key '%s': (%d) %s", file, ret,
     277                            gnutls_strerror(ret));
     278    }
     279    apr_pool_destroy(spool);
     280    return NULL;
     281}
     282
     283
    205284#ifdef ENABLE_SRP
    206285
     
    355434}
    356435
     436const char *mgs_set_keyring_file(cmd_parms * parms, void *dummy,
     437                                   const char *arg)
     438{
     439    int rv;
     440    const char *file;
     441    apr_pool_t *spool;
     442    gnutls_datum_t data;
     443
     444    mgs_srvconf_rec *sc =
     445        (mgs_srvconf_rec *) ap_get_module_config(parms->server->
     446                                                 module_config,
     447                                                 &gnutls_module);
     448    apr_pool_create(&spool, parms->pool);
     449
     450    file = ap_server_root_relative(spool, arg);
     451
     452    if (load_datum_from_file(spool, file, &data) != 0) {
     453        return apr_psprintf(parms->pool, "GnuTLS: Error Reading "
     454                            "Keyring File '%s'", file);
     455    }
     456
     457    rv = gnutls_openpgp_keyring_init(&sc->pgp_list);
     458    if (rv < 0) {
     459        return apr_psprintf(parms->pool, "GnuTLS: Failed to initialize"
     460                            "keyring: (%d) %s", rv, gnutls_strerror(rv));
     461    }
     462
     463    rv = gnutls_openpgp_keyring_import(sc->pgp_list, &data, GNUTLS_OPENPGP_FMT_BASE64);
     464    if (rv < 0) {
     465        return apr_psprintf(parms->pool, "GnuTLS: Failed to load "
     466                            "Keyring File '%s': (%d) %s", file, rv,
     467                            gnutls_strerror(rv));
     468    }
     469
     470    apr_pool_destroy(spool);
     471    return NULL;
     472}
     473
    357474const char *mgs_set_enabled(cmd_parms * parms, void *dummy,
    358475                            const char *arg)
  • src/gnutls_hooks.c

    r8df5b25 r9d9b093  
    3737static int mgs_cert_verify(request_rec * r, mgs_handle_t * ctxt);
    3838/* use side==0 for server and side==1 for client */
    39 static void mgs_add_common_cert_vars(request_rec * r, gnutls_x509_crt cert,
     39static void mgs_add_common_cert_vars(request_rec * r, gnutls_x509_crt_t cert,
     40                                     int side,
     41                                     int export_certificates_enabled);
     42static void mgs_add_common_pgpcert_vars(request_rec * r, gnutls_openpgp_crt_t cert,
    4043                                     int side,
    4144                                     int export_certificates_enabled);
     
    6972#endif
    7073
     74    if (gnutls_check_version(LIBGNUTLS_VERSION)==NULL) {
     75        fprintf(stderr, "gnutls_check_version() failed. Required: gnutls-%s Found: gnutls-%s\n",
     76          LIBGNUTLS_VERSION, gnutls_check_version(NULL));
     77        return -3;
     78    }
     79
    7180    ret = gnutls_global_init();
    72     if (ret < 0) /* FIXME: can we print here? */
    73         exit(ret);
     81    if (ret < 0) {
     82        fprintf(stderr, "gnutls_global_init: %s\n", gnutls_strerror(ret));
     83        return -3;
     84    }
     85
     86    ret = gnutls_global_init_extra();
     87    if (ret < 0) {
     88        fprintf(stderr, "gnutls_global_init_extra: %s\n", gnutls_strerror(ret));
     89        return -3;
     90    }
    7491                                           
    7592    apr_pool_cleanup_register(pconf, NULL, mgs_cleanup_pre_config,
     
    83100    gnutls_global_set_log_level(9);
    84101    gnutls_global_set_log_function(gnutls_debug_log_all);
     102    apr_file_printf(debug_log_fp, "gnutls: %s\n", gnutls_check_version(NULL));
    85103#endif
    86104
    87105    return OK;
    88106}
    89 
    90 /* We don't support openpgp certificates, yet */
    91 const static int cert_type_prio[2] = { GNUTLS_CRT_X509, 0 };
    92107
    93108static int mgs_select_virtual_server_cb(gnutls_session_t session)
     
    96111    mgs_srvconf_rec *tsc;
    97112    int ret;
     113    int cprio[2];
    98114
    99115    ctxt = gnutls_transport_get_ptr(session);
     
    129145     */
    130146    ret = gnutls_priority_set(session, ctxt->sc->priorities);
    131     gnutls_certificate_type_set_priority(session, cert_type_prio);
    132 
    133 
    134147    /* actually it shouldn't fail since we have checked at startup */
    135148    if (ret < 0)
    136149        return ret;
    137150
     151    /* If both certificate types are not present disallow them from
     152     * being negotiated.
     153     */
     154    if (ctxt->sc->certs_x509[0] != NULL && ctxt->sc->cert_pgp == NULL) {
     155        cprio[0] = GNUTLS_CRT_X509;
     156        cprio[1] = 0;
     157        gnutls_certificate_type_set_priority( session, cprio);
     158    } else if (ctxt->sc->cert_pgp != NULL && ctxt->sc->certs_x509[0]==NULL) {
     159        cprio[0] = GNUTLS_CRT_OPENPGP;
     160        cprio[1] = 0;
     161        gnutls_certificate_type_set_priority( session, cprio);
     162    }
    138163
    139164    return 0;
     
    146171    ctxt = gnutls_transport_get_ptr(session);
    147172
    148     ret->type = GNUTLS_CRT_X509;
    149     ret->ncerts = ctxt->sc->certs_x509_num;
    150     ret->deinit_all = 0;
    151 
    152     ret->cert.x509 = ctxt->sc->certs_x509;
    153     ret->key.x509 = ctxt->sc->privkey_x509;
    154     return 0;
    155 }
    156 
     173    if (gnutls_certificate_type_get( session) == GNUTLS_CRT_X509) {
     174        ret->type = GNUTLS_CRT_X509;
     175        ret->ncerts = ctxt->sc->certs_x509_num;
     176        ret->deinit_all = 0;
     177
     178        ret->cert.x509 = ctxt->sc->certs_x509;
     179        ret->key.x509 = ctxt->sc->privkey_x509;
     180       
     181        return 0;
     182    } else if (gnutls_certificate_type_get( session) == GNUTLS_CRT_OPENPGP) {
     183        ret->type = GNUTLS_CRT_OPENPGP;
     184        ret->ncerts = 1;
     185        ret->deinit_all = 0;
     186
     187        ret->cert.pgp = ctxt->sc->cert_pgp;
     188        ret->key.pgp = ctxt->sc->privkey_pgp;
     189
     190        return 0;
     191   
     192    }
     193
     194    return GNUTLS_E_INTERNAL_ERROR;
     195}
     196
     197/* 2048-bit group parameters from SRP specification */
    157198const char static_dh_params[] = "-----BEGIN DH PARAMETERS-----\n"
    158199    "MIIBBwKCAQCsa9tBMkqam/Fm3l4TiVgvr3K2ZRmH7gf8MZKUPbVgUKNzKcu0oJnt\n"
     
    170211 */
    171212static int read_crt_cn(server_rec * s, apr_pool_t * p,
    172                        gnutls_x509_crt cert, char **cert_cn)
     213                       gnutls_x509_crt_t cert, char **cert_cn)
    173214{
    174215    int rv = 0, i;
     
    178219    *cert_cn = NULL;
    179220
     221    data_len = 0;
    180222    rv = gnutls_x509_crt_get_dn_by_oid(cert,
    181223                                       GNUTLS_OID_X520_COMMON_NAME,
     
    188230                                           0, *cert_cn, &data_len);
    189231    } else {                    /* No CN return subject alternative name */
    190         ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
    191                      "No common name found in certificate for '%s:%d'. Looking for subject alternative name.",
     232        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
     233                     "No common name found in certificate for '%s:%d'. Looking for subject alternative name...",
    192234                     s->server_hostname, s->port);
    193235        rv = 0;
     
    217259
    218260    return rv;
    219 
    220 }
     261}
     262
     263static int read_pgpcrt_cn(server_rec * s, apr_pool_t * p,
     264                       gnutls_openpgp_crt_t cert, char **cert_cn)
     265{
     266    int rv = 0;
     267    size_t data_len;
     268
     269
     270    *cert_cn = NULL;
     271
     272    data_len = 0;
     273    rv = gnutls_openpgp_crt_get_name(cert, 0, NULL, &data_len);
     274
     275    if (rv == GNUTLS_E_SHORT_MEMORY_BUFFER && data_len > 1) {
     276        *cert_cn = apr_palloc(p, data_len);
     277        rv = gnutls_openpgp_crt_get_name(cert, 0, *cert_cn, &data_len);
     278    } else {                    /* No CN return subject alternative name */
     279        ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
     280                     "No name found in PGP certificate for '%s:%d'.",
     281                     s->server_hostname, s->port);
     282    }
     283
     284    return rv;
     285}
     286
    221287
    222288int
     
    355421            if (sc->enabled == GNUTLS_ENABLED_TRUE) {
    356422                rv = read_crt_cn(s, p, sc->certs_x509[0], &sc->cert_cn);
     423                if (rv < 0 && sc->cert_pgp != NULL)  /* try openpgp certificate */
     424                    rv = read_pgpcrt_cn(s, p, sc->cert_pgp, &sc->cert_cn);
     425
    357426                if (rv < 0) {
    358427                    ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,
     
    483552    ctxt = gnutls_transport_get_ptr(session);
    484553
    485     sni_type = gnutls_certificate_type_get(session);
    486     if (sni_type != GNUTLS_CRT_X509) {
    487         /* In theory, we could support OpenPGP Certificates. Theory != code. */
    488         ap_log_error(APLOG_MARK, APLOG_CRIT, 0,
    489                      ctxt->c->base_server,
    490                      "GnuTLS: Only x509 Certificates are currently supported.");
    491         return NULL;
    492     }
    493 
    494554    rv = gnutls_server_name_get(ctxt->session, sni_name,
    495555                                &data_len, &sni_type, 0);
     
    691751    apr_table_setn(env, "SSL_SESSION_ID", apr_pstrdup(r->pool, tmp));
    692752
    693     mgs_add_common_cert_vars(r, ctxt->sc->certs_x509[0], 0,
     753    if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509)
     754        mgs_add_common_cert_vars(r, ctxt->sc->certs_x509[0], 0,
     755                             ctxt->sc->export_certificates_enabled);
     756    else if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_OPENPGP)
     757        mgs_add_common_pgpcert_vars(r, ctxt->sc->cert_pgp, 0,
    694758                             ctxt->sc->export_certificates_enabled);
    695759
     
    753817#define MGS_SIDE ((side==0)?"SSL_SERVER":"SSL_CLIENT")
    754818static void
    755 mgs_add_common_cert_vars(request_rec * r, gnutls_x509_crt cert, int side,
     819mgs_add_common_cert_vars(request_rec * r, gnutls_x509_crt_t cert, int side,
    756820                         int export_certificates_enabled)
    757821{
     
    859923        }
    860924    }
    861 
    862 
    863 }
    864 
    865 
     925}
     926
     927static void
     928mgs_add_common_pgpcert_vars(request_rec * r, gnutls_openpgp_crt_t cert, int side,
     929                         int export_certificates_enabled)
     930{
     931    unsigned char sbuf[64];     /* buffer to hold serials */
     932    char buf[AP_IOBUFSIZE];
     933    const char *tmp;
     934    size_t len;
     935    int ret;
     936
     937    apr_table_t *env = r->subprocess_env;
     938
     939    if (export_certificates_enabled != 0) {
     940        char cert_buf[10 * 1024];
     941        len = sizeof(cert_buf);
     942
     943        if (gnutls_openpgp_crt_export
     944            (cert, GNUTLS_OPENPGP_FMT_BASE64, cert_buf, &len) >= 0)
     945            apr_table_setn(env,
     946                           apr_pstrcat(r->pool, MGS_SIDE, "_CERT", NULL),
     947                           apr_pstrmemdup(r->pool, cert_buf, len));
     948
     949    }
     950
     951    len = sizeof(buf);
     952    gnutls_openpgp_crt_get_name(cert, 0, buf, &len);
     953    apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_NAME", NULL),
     954                   apr_pstrmemdup(r->pool, buf, len));
     955
     956    len = sizeof(sbuf);
     957    gnutls_openpgp_crt_get_fingerprint(cert, sbuf, &len);
     958    tmp = mgs_session_id2sz(sbuf, len, buf, sizeof(buf));
     959    apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_FINGERPRINT", NULL),
     960                   apr_pstrdup(r->pool, tmp));
     961
     962    ret = gnutls_openpgp_crt_get_version(cert);
     963    if (ret > 0)
     964        apr_table_setn(env,
     965                       apr_pstrcat(r->pool, MGS_SIDE, "_M_VERSION", NULL),
     966                       apr_psprintf(r->pool, "%u", ret));
     967
     968    apr_table_setn(env,
     969       apr_pstrcat(r->pool, MGS_SIDE, "_CERT_TYPE", NULL), "OPENPGP");
     970
     971    tmp =
     972        mgs_time2sz(gnutls_openpgp_crt_get_expiration_time
     973                    (cert), buf, sizeof(buf));
     974    apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_V_END", NULL),
     975                   apr_pstrdup(r->pool, tmp));
     976
     977    tmp =
     978        mgs_time2sz(gnutls_openpgp_crt_get_creation_time
     979                    (cert), buf, sizeof(buf));
     980    apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_V_START", NULL),
     981                   apr_pstrdup(r->pool, tmp));
     982
     983    ret = gnutls_openpgp_crt_get_pk_algorithm(cert, NULL);
     984    if (ret >= 0) {
     985        apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_A_KEY", NULL),
     986                       gnutls_pk_algorithm_get_name(ret));
     987    }
     988
     989}
     990
     991/* TODO: Allow client sending a X.509 certificate chain */
    866992static int mgs_cert_verify(request_rec * r, mgs_handle_t * ctxt)
    867993{
     
    869995    unsigned int cert_list_size, status, expired;
    870996    int rv, ret;
    871     gnutls_x509_crt_t cert;
     997    union {
     998      gnutls_x509_crt_t x509;
     999      gnutls_openpgp_crt_t pgp;
     1000    } cert;
    8721001    apr_time_t activation_time, expiration_time, cur_time;
    8731002
     
    8951024    }
    8961025
    897     gnutls_x509_crt_init(&cert);
    898     rv = gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER);
     1026    if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509) {
     1027        gnutls_x509_crt_init(&cert.x509);
     1028        rv = gnutls_x509_crt_import(cert.x509, &cert_list[0], GNUTLS_X509_FMT_DER);
     1029    } else if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_OPENPGP) {
     1030        gnutls_openpgp_crt_init(&cert.pgp);
     1031        rv = gnutls_openpgp_crt_import(cert.pgp, &cert_list[0], GNUTLS_OPENPGP_FMT_RAW);
     1032    } else return HTTP_FORBIDDEN;
     1033 
    8991034    if (rv < 0) {
    900         ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
     1035       ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
    9011036                      "GnuTLS: Failed to Verify Peer: "
    9021037                      "Failed to import peer certificates.");
    903         ret = HTTP_FORBIDDEN;
    904         goto exit;
    905     }
    906 
    907     apr_time_ansi_put(&expiration_time,
    908                       gnutls_x509_crt_get_expiration_time(cert));
    909     apr_time_ansi_put(&activation_time,
    910                       gnutls_x509_crt_get_activation_time(cert));
    911 
    912     rv = gnutls_x509_crt_verify(cert, ctxt->sc->ca_list,
     1038       ret = HTTP_FORBIDDEN;
     1039       goto exit;
     1040    }
     1041
     1042    if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509) {
     1043        apr_time_ansi_put(&expiration_time,
     1044                      gnutls_x509_crt_get_expiration_time(cert.x509));
     1045        apr_time_ansi_put(&activation_time,
     1046                      gnutls_x509_crt_get_activation_time(cert.x509));
     1047
     1048        rv = gnutls_x509_crt_verify(cert.x509, ctxt->sc->ca_list,
    9131049                                ctxt->sc->ca_list_size, 0, &status);
     1050    } else {
     1051        apr_time_ansi_put(&expiration_time,
     1052                      gnutls_openpgp_crt_get_expiration_time(cert.pgp));
     1053        apr_time_ansi_put(&activation_time,
     1054                      gnutls_openpgp_crt_get_creation_time(cert.pgp));
     1055
     1056        rv = gnutls_openpgp_crt_verify_ring(cert.pgp, ctxt->sc->pgp_list,
     1057                      0, &status);
     1058    }
    9141059
    9151060    if (rv < 0) {
     
    9171062                      "GnuTLS: Failed to Verify Peer certificate: (%d) %s",
    9181063                      rv, gnutls_strerror(rv));
     1064        if (rv == GNUTLS_E_NO_CERTIFICATE_FOUND)
     1065            ap_log_rerror(APLOG_MARK, APLOG_EMERG, 0, r,
     1066                      "GnuTLS: No certificate was found for verification. Did you set the GnuTLSX509CAFile or GnuTLSPGPKeyringFile directives?");
    9191067        ret = HTTP_FORBIDDEN;
    9201068        goto exit;
    9211069    }
     1070
     1071    /* TODO: X509 CRL Verification. */
     1072    /* May add later if anyone needs it.
     1073     */
     1074    /* ret = gnutls_x509_crt_check_revocation(crt, crl_list, crl_list_size); */
    9221075
    9231076    expired = 0;
     
    9551108    }
    9561109
    957     /* TODO: Further Verification. */
    958     /* Revocation is X.509 non workable paradigm, I really doubt implementation
    959      * is worth doing --nmav
    960      */
    961 /// ret = gnutls_x509_crt_check_revocation(crt, crl_list, crl_list_size);
    962 
    963 //    mgs_hook_fixups(r);
    964 //    rv = mgs_authz_lua(r);
    965 
    966     mgs_add_common_cert_vars(r, cert, 1,
     1110    if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509)
     1111        mgs_add_common_cert_vars(r, cert.x509, 1,
     1112                             ctxt->sc->export_certificates_enabled);
     1113    else if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_OPENPGP)
     1114        mgs_add_common_pgpcert_vars(r, cert.pgp, 1,
    9671115                             ctxt->sc->export_certificates_enabled);
    9681116
     
    9881136
    9891137  exit:
    990     gnutls_x509_crt_deinit(cert);
     1138    if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509)
     1139        gnutls_x509_crt_deinit(cert.x509);
     1140    else if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_OPENPGP)
     1141        gnutls_openpgp_crt_deinit(cert.pgp);
    9911142    return ret;
    9921143
  • src/mod_gnutls.c

    r8df5b25 r9d9b093  
    6464                  RSRC_CONF,
    6565                  "Set the CA File to verify Client Certificates"),
     66    AP_INIT_TAKE1("GnuTLSX509CAFile", mgs_set_client_ca_file,
     67                  NULL,
     68                  RSRC_CONF,
     69                  "Set the CA File to verify Client Certificates"),
     70    AP_INIT_TAKE1("GnuTLSPGPKeyringFile", mgs_set_keyring_file,
     71                  NULL,
     72                  RSRC_CONF,
     73                  "Set the Keyring File to verify Client Certificates"),
    6674    AP_INIT_TAKE1("GnuTLSDHFile", mgs_set_dh_file,
    6775                  NULL,
     
    7583                  NULL,
    7684                  RSRC_CONF,
    77                   "SSL Server Key file"),
     85                  "SSL Server X509 Certificate file"),
    7886    AP_INIT_TAKE1("GnuTLSKeyFile", mgs_set_key_file,
    7987                  NULL,
    8088                  RSRC_CONF,
    81                   "SSL Server SRP Password file"),
     89                  "SSL Server X509 Private Key file"),
     90    AP_INIT_TAKE1("GnuTLSX509CertificateFile", mgs_set_cert_file,
     91                  NULL,
     92                  RSRC_CONF,
     93                  "SSL Server X509 Certificate file"),
     94    AP_INIT_TAKE1("GnuTLSX509KeyFile", mgs_set_key_file,
     95                  NULL,
     96                  RSRC_CONF,
     97                  "SSL Server X509 Private Key file"),
     98    AP_INIT_TAKE1("GnuTLSPGPCertificateFile", mgs_set_pgpcert_file,
     99                  NULL,
     100                  RSRC_CONF,
     101                  "SSL Server PGP Certificate file"),
     102    AP_INIT_TAKE1("GnuTLSPGPKeyFile", mgs_set_pgpkey_file,
     103                  NULL,
     104                  RSRC_CONF,
     105                  "SSL Server PGP Private key file"),
    82106#ifdef ENABLE_SRP
    83107    AP_INIT_TAKE1("GnuTLSSRPPasswdFile", mgs_set_srp_tpasswd_file,
Note: See TracChangeset for help on using the changeset viewer.