Changeset bd24203 in mod_gnutls for src

Timestamp:

Apr 2, 2015, 7:51:48 PM (5 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, jessie-backports, master, proxy-ticket, upstream

Children:

809c422

Parents:

36db6c9

Message:

Explicitly build trust list for proxy connections

This change provides direct access to the trust list, which is required
for loading a CRL later.

File:

• src/gnutls_hooks.c (modified) (3 diffs)

src/gnutls_hooks.c

@@ -1753 +1753 @@
     int ret = APR_SUCCESS;
     int err = GNUTLS_E_SUCCESS;
+
+    /* load certificate and key for client auth, if configured */
     if (sc->proxy_x509_key_file && sc->proxy_x509_cert_file)
     {
@@ -1787 +1789 @@
     if (sc->proxy_x509_ca_file)
     {
-        /* returns number of loaded certificates */
-        err = gnutls_certificate_set_x509_trust_file(sc->proxy_x509_creds,
-                                                     sc->proxy_x509_ca_file,
-                                                     GNUTLS_X509_FMT_PEM);
+        /* initialize the trust list */
+        err = gnutls_x509_trust_list_init(&sc->proxy_x509_tl, 0);
+        if (err != GNUTLS_E_SUCCESS)
+        {
+            ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
+                         "%s: gnutls_x509_trust_list_init failed: %s (%d)",
+                         __func__, gnutls_strerror(err), err);
+            ret = APR_EGENERAL;
+        }
+
+        /* returns number of loaded elements */
+        err = gnutls_x509_trust_list_add_trust_file(sc->proxy_x509_tl,
+                                                    sc->proxy_x509_ca_file,
+                                                    NULL /* crl_file */,
+                                                    GNUTLS_X509_FMT_PEM,
+                                                    0 /* tl_flags */,
+                                                    0 /* tl_vflags */);
         if (err > 0)
             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
-                         "%s: proxy CA trust list: %d certificates loaded",
+                         "%s: proxy CA trust list: %d structures loaded",
                          __func__, err);
         else if (err == 0)
@@ -1803 +1818 @@
                          "%s: error loading proxy CA trust list: %s (%d)",
                          __func__, gnutls_strerror(err), err);
+
+        /* attach trust list to credentials */
+        gnutls_certificate_set_trust_list(sc->proxy_x509_creds,
+                                          sc->proxy_x509_tl, 0);
     }
     else
         ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s,
-                     "%s: no CA trust list for proxy connections missing, "
+                     "%s: no CA trust list for proxy connections, "
                      "TLS connections will fail!", __func__);