summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMike Crowe <mac@mcrowe.com>2015-09-21 11:34:55 +0200
committerDaniel Stenberg <daniel@haxx.se>2015-09-22 17:30:33 +0200
commit6b56901b56e8d6247cdb86eeb042d6d4e2367003 (patch)
tree359370ff41205ba3f9cc9ad195156028b8fa7353
parent7362008c1cbd6bb3079eae2f8217cd905749dd57 (diff)
downloadcurl-6b56901b56e8d6247cdb86eeb042d6d4e2367003.tar.gz
gnutls: Support CURLOPT_KEYPASSWD
The gnutls vtls back-end was previously ignoring any password set via CURLOPT_KEYPASSWD. Presumably this was because gnutls_certificate_set_x509_key_file did not support encrypted keys. gnutls now has a gnutls_certificate_set_x509_key_file2 function that does support encrypted keys. Let's determine at compile time whether the available gnutls supports this new function. If it does then use it to pass the password. If it does not then emit a helpful diagnostic if a password is set. This is preferable to the previous behaviour of just failing to read the certificate without giving a reason in that case. Signed-off-by: Mike Crowe <mac@mcrowe.com>
-rw-r--r--configure.ac1
-rw-r--r--lib/vtls/gtls.c45
2 files changed, 37 insertions, 9 deletions
diff --git a/configure.ac b/configure.ac
index 843a3badf..26d77eb87 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1836,6 +1836,7 @@ if test "$curl_ssl_msg" = "$init_ssl_msg"; then
AC_MSG_NOTICE([Added $gtlslib to LD_LIBRARY_PATH])
fi
fi
+ AC_CHECK_FUNCS(gnutls_certificate_set_x509_key_file2)
fi
fi
diff --git a/lib/vtls/gtls.c b/lib/vtls/gtls.c
index 5f7041a30..1a41c05d7 100644
--- a/lib/vtls/gtls.c
+++ b/lib/vtls/gtls.c
@@ -656,15 +656,42 @@ gtls_connect_step1(struct connectdata *conn,
#endif
if(data->set.str[STRING_CERT]) {
- if(gnutls_certificate_set_x509_key_file(
- conn->ssl[sockindex].cred,
- data->set.str[STRING_CERT],
- data->set.str[STRING_KEY] ?
- data->set.str[STRING_KEY] : data->set.str[STRING_CERT],
- do_file_type(data->set.str[STRING_CERT_TYPE]) ) !=
- GNUTLS_E_SUCCESS) {
- failf(data, "error reading X.509 key or certificate file");
- return CURLE_SSL_CONNECT_ERROR;
+ if(data->set.str[STRING_KEY_PASSWD]) {
+#if HAVE_GNUTLS_CERTIFICATE_SET_X509_KEY_FILE2
+ const unsigned int supported_key_encryption_algorithms =
+ GNUTLS_PKCS_USE_PKCS12_3DES | GNUTLS_PKCS_USE_PKCS12_ARCFOUR |
+ GNUTLS_PKCS_USE_PKCS12_RC2_40 | GNUTLS_PKCS_USE_PBES2_3DES |
+ GNUTLS_PKCS_USE_PBES2_AES_128 | GNUTLS_PKCS_USE_PBES2_AES_192 |
+ GNUTLS_PKCS_USE_PBES2_AES_256;
+ if(gnutls_certificate_set_x509_key_file2(
+ conn->ssl[sockindex].cred,
+ data->set.str[STRING_CERT],
+ data->set.str[STRING_KEY] ?
+ data->set.str[STRING_KEY] : data->set.str[STRING_CERT],
+ do_file_type(data->set.str[STRING_CERT_TYPE]),
+ data->set.str[STRING_KEY_PASSWD],
+ supported_key_encryption_algorithms) !=
+ GNUTLS_E_SUCCESS) {
+ failf(data,
+ "error reading X.509 potentially-encrypted key file");
+ return CURLE_SSL_CONNECT_ERROR;
+#else
+ failf(data, "gnutls lacks support for encrypted key files");
+ return CURLE_SSL_CONNECT_ERROR;
+#endif
+ }
+ }
+ else {
+ if(gnutls_certificate_set_x509_key_file(
+ conn->ssl[sockindex].cred,
+ data->set.str[STRING_CERT],
+ data->set.str[STRING_KEY] ?
+ data->set.str[STRING_KEY] : data->set.str[STRING_CERT],
+ do_file_type(data->set.str[STRING_CERT_TYPE]) ) !=
+ GNUTLS_E_SUCCESS) {
+ failf(data, "error reading X.509 key or certificate file");
+ return CURLE_SSL_CONNECT_ERROR;
+ }
}
}