Support multiple certificates in GnuTLS certificate chain

git-svn-id: http://svn.inspircd.org/repository/trunk/inspircd@12491 e03df62e-2008-0410-955e-edbf42e46eb7

diff --git a/src/modules/extra/m_ssl_gnutls.cpp b/src/modules/extra/m_ssl_gnutls.cpp
index d20b8d53a6d0f3b0c344cb586059b129e8a88743..b34e2f9eb28539a1f9f6051e15876d15422fafed 100644 (file)
--- a/src/modules/extra/m_ssl_gnutls.cpp
+++ b/src/modules/extra/m_ssl_gnutls.cpp
@@ -28,14 +28,14 @@
 
 enum issl_status { ISSL_NONE, ISSL_HANDSHAKING_READ, ISSL_HANDSHAKING_WRITE, ISSL_HANDSHAKEN, ISSL_CLOSING, ISSL_CLOSED };
 
 
 enum issl_status { ISSL_NONE, ISSL_HANDSHAKING_READ, ISSL_HANDSHAKING_WRITE, ISSL_HANDSHAKEN, ISSL_CLOSING, ISSL_CLOSED };
 

-static gnutls_x509_crt_t x509_cert;
+static std::vector<gnutls_x509_crt_t> x509_certs;

 static gnutls_x509_privkey_t x509_key;
 static int cert_callback (gnutls_session_t session, const gnutls_datum_t * req_ca_rdn, int nreqs,
        const gnutls_pk_algorithm_t * sign_algos, int sign_algos_length, gnutls_retr_st * st) {
 
        st->type = GNUTLS_CRT_X509;
 static gnutls_x509_privkey_t x509_key;
 static int cert_callback (gnutls_session_t session, const gnutls_datum_t * req_ca_rdn, int nreqs,
        const gnutls_pk_algorithm_t * sign_algos, int sign_algos_length, gnutls_retr_st * st) {
 
        st->type = GNUTLS_CRT_X509;

-       st->ncerts = 1;
-       st->cert.x509 = &x509_cert;
+       st->ncerts = x509_certs.size();
+       st->cert.x509 = &x509_certs[0];

        st->key.x509 = x509_key;
        st->deinit_all = 0;
 
        st->key.x509 = x509_key;
        st->deinit_all = 0;
 


@@ -164,7 +164,6 @@ class ModuleSSLGnuTLS : public Module
                sessions = new issl_session[ServerInstance->SE->GetMaxFds()];
 
                gnutls_global_init(); // This must be called once in the program
                sessions = new issl_session[ServerInstance->SE->GetMaxFds()];
 
                gnutls_global_init(); // This must be called once in the program

-               gnutls_x509_crt_init(&x509_cert);

                gnutls_x509_privkey_init(&x509_key);
 
                cred_alloc = false;
                gnutls_x509_privkey_init(&x509_key);
 
                cred_alloc = false;


@@ -252,6 +251,10 @@ class ModuleSSLGnuTLS : public Module
                        // Deallocate the old credentials
                        gnutls_dh_params_deinit(dh_params);
                        gnutls_certificate_free_credentials(x509_cred);
                        // Deallocate the old credentials
                        gnutls_dh_params_deinit(dh_params);
                        gnutls_certificate_free_credentials(x509_cred);

+
+                       for(unsigned int i=0; i < x509_certs.size(); i++)
+                               gnutls_x509_crt_deinit(x509_certs[i]);
+                       x509_certs.clear();

                }
                else
                        cred_alloc = true;
                }
                else
                        cred_alloc = true;


@@ -276,13 +279,17 @@ class ModuleSSLGnuTLS : public Module
                gnutls_datum_t key_datum = { (unsigned char*)key_string.data(), key_string.length() };
 
                // If this fails, no SSL port will work. At all. So, do the smart thing - throw a ModuleException
                gnutls_datum_t key_datum = { (unsigned char*)key_string.data(), key_string.length() };
 
                // If this fails, no SSL port will work. At all. So, do the smart thing - throw a ModuleException

-               if((ret = gnutls_x509_crt_import(x509_cert, &cert_datum, GNUTLS_X509_FMT_PEM)) < 0)
+               unsigned int certcount = Conf->getInt("certcount", 3);
+               x509_certs.resize(certcount);
+               ret = gnutls_x509_crt_list_import(&x509_certs[0], &certcount, &cert_datum, GNUTLS_X509_FMT_PEM, GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED);
+               if (ret < 0)

                        throw ModuleException("Unable to load GnuTLS server certificate (" + certfile + "): " + std::string(gnutls_strerror(ret)));
                        throw ModuleException("Unable to load GnuTLS server certificate (" + certfile + "): " + std::string(gnutls_strerror(ret)));

+               x509_certs.resize(certcount);

 
                if((ret = gnutls_x509_privkey_import(x509_key, &key_datum, GNUTLS_X509_FMT_PEM)) < 0)
                        throw ModuleException("Unable to load GnuTLS server private key (" + keyfile + "): " + std::string(gnutls_strerror(ret)));
 
 
                if((ret = gnutls_x509_privkey_import(x509_key, &key_datum, GNUTLS_X509_FMT_PEM)) < 0)
                        throw ModuleException("Unable to load GnuTLS server private key (" + keyfile + "): " + std::string(gnutls_strerror(ret)));
 

-               if((ret = gnutls_certificate_set_x509_key(x509_cred, &x509_cert, 1, x509_key)) < 0)
+               if((ret = gnutls_certificate_set_x509_key(x509_cred, &x509_certs[0], certcount, x509_key)) < 0)

                        throw ModuleException("Unable to set GnuTLS cert/key pair: " + std::string(gnutls_strerror(ret)));
 
                gnutls_certificate_client_set_retrieve_function (x509_cred, cert_callback);
                        throw ModuleException("Unable to set GnuTLS cert/key pair: " + std::string(gnutls_strerror(ret)));
 
                gnutls_certificate_client_set_retrieve_function (x509_cred, cert_callback);


@@ -309,7 +316,9 @@ class ModuleSSLGnuTLS : public Module
 
        ~ModuleSSLGnuTLS()
        {
 
        ~ModuleSSLGnuTLS()
        {

-               gnutls_x509_crt_deinit(x509_cert);
+               for(unsigned int i=0; i < x509_certs.size(); i++)
+                       gnutls_x509_crt_deinit(x509_certs[i]);
+               x509_certs.clear();

                gnutls_x509_privkey_deinit(x509_key);
                if (cred_alloc)
                {
                gnutls_x509_privkey_deinit(x509_key);
                if (cred_alloc)
                {