Support multiple certificates in GnuTLS certificate chain

git-svn-id: http://svn.inspircd.org/repository/trunk/inspircd@12491 e03df62e-2008-0410-955e-edbf42e46eb7

1 files changed, 16 insertions, 7 deletions

diff --git a/src/modules/extra/m_ssl_gnutls.cpp b/src/modules/extra/m_ssl_gnutls.cpp
index d20b8d53a..b34e2f9eb 100644
--- a/src/modules/extra/m_ssl_gnutls.cpp
+++ b/src/modules/extra/m_ssl_gnutls.cpp
@@ -28,14 +28,14 @@
 
 enum issl_status { ISSL_NONE, ISSL_HANDSHAKING_READ, ISSL_HANDSHAKING_WRITE, ISSL_HANDSHAKEN, ISSL_CLOSING, ISSL_CLOSED };
 
-static gnutls_x509_crt_t x509_cert;
+static std::vector<gnutls_x509_crt_t> x509_certs;
 static gnutls_x509_privkey_t x509_key;
 static int cert_callback (gnutls_session_t session, const gnutls_datum_t * req_ca_rdn, int nreqs,
 	const gnutls_pk_algorithm_t * sign_algos, int sign_algos_length, gnutls_retr_st * st) {
 
 	st->type = GNUTLS_CRT_X509;
-	st->ncerts = 1;
-	st->cert.x509 = &x509_cert;
+	st->ncerts = x509_certs.size();
+	st->cert.x509 = &x509_certs[0];
 	st->key.x509 = x509_key;
 	st->deinit_all = 0;
 
@@ -164,7 +164,6 @@ class ModuleSSLGnuTLS : public Module
 		sessions = new issl_session[ServerInstance->SE->GetMaxFds()];
 
 		gnutls_global_init(); // This must be called once in the program
-		gnutls_x509_crt_init(&x509_cert);
 		gnutls_x509_privkey_init(&x509_key);
 
 		cred_alloc = false;
@@ -252,6 +251,10 @@ class ModuleSSLGnuTLS : public Module
 			// Deallocate the old credentials
 			gnutls_dh_params_deinit(dh_params);
 			gnutls_certificate_free_credentials(x509_cred);
+
+			for(unsigned int i=0; i < x509_certs.size(); i++)
+				gnutls_x509_crt_deinit(x509_certs[i]);
+			x509_certs.clear();
 		}
 		else
 			cred_alloc = true;
@@ -276,13 +279,17 @@ class ModuleSSLGnuTLS : public Module
 		gnutls_datum_t key_datum = { (unsigned char*)key_string.data(), key_string.length() };
 
 		// If this fails, no SSL port will work. At all. So, do the smart thing - throw a ModuleException
-		if((ret = gnutls_x509_crt_import(x509_cert, &cert_datum, GNUTLS_X509_FMT_PEM)) < 0)
+		unsigned int certcount = Conf->getInt("certcount", 3);
+		x509_certs.resize(certcount);
+		ret = gnutls_x509_crt_list_import(&x509_certs[0], &certcount, &cert_datum, GNUTLS_X509_FMT_PEM, GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED);
+		if (ret < 0)
 			throw ModuleException("Unable to load GnuTLS server certificate (" + certfile + "): " + std::string(gnutls_strerror(ret)));
+		x509_certs.resize(certcount);
 
 		if((ret = gnutls_x509_privkey_import(x509_key, &key_datum, GNUTLS_X509_FMT_PEM)) < 0)
 			throw ModuleException("Unable to load GnuTLS server private key (" + keyfile + "): " + std::string(gnutls_strerror(ret)));
 
-		if((ret = gnutls_certificate_set_x509_key(x509_cred, &x509_cert, 1, x509_key)) < 0)
+		if((ret = gnutls_certificate_set_x509_key(x509_cred, &x509_certs[0], certcount, x509_key)) < 0)
 			throw ModuleException("Unable to set GnuTLS cert/key pair: " + std::string(gnutls_strerror(ret)));
 
 		gnutls_certificate_client_set_retrieve_function (x509_cred, cert_callback);
@@ -309,7 +316,9 @@ class ModuleSSLGnuTLS : public Module
 
 	~ModuleSSLGnuTLS()
 	{
-		gnutls_x509_crt_deinit(x509_cert);
+		for(unsigned int i=0; i < x509_certs.size(); i++)
+			gnutls_x509_crt_deinit(x509_certs[i]);
+		x509_certs.clear();
 		gnutls_x509_privkey_deinit(x509_key);
 		if (cred_alloc)
 		{