Skip to content

Commit 6cea3a0

Browse files
scottmayhewscottmayhew
committed
tlshd: deduplicate client and server config functions
The client and server variants of tlshd_config_get_* are identical except for 1) the stanza they're looking at in the config file, and 2) whether the word "client" or "server" gets written in a log message Add new parameter 'peer_type' to each of these functions so we can use the same function for both the client and server code. Signed-off-by: Scott Mayhew <[email protected]>
1 parent 41ea1d4 commit 6cea3a0

File tree

4 files changed

+62
-191
lines changed

4 files changed

+62
-191
lines changed

‎src/tlshd/client.c‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ static int tlshd_client_get_truststore(gnutls_certificate_credentials_t cred)
4848
char *pathname;
4949
int ret;
5050

51-
if (tlshd_config_get_client_truststore(&pathname)) {
51+
if (tlshd_config_get_truststore(PEER_TYPE_CLIENT, &pathname)) {
5252
ret = gnutls_certificate_set_x509_trust_file(cred, pathname,
5353
GNUTLS_X509_FMT_PEM);
5454
free(pathname);
@@ -60,7 +60,7 @@ static int tlshd_client_get_truststore(gnutls_certificate_credentials_t cred)
6060
}
6161
tlshd_log_debug("System trust: Loaded %d certificate(s).", ret);
6262

63-
if (tlshd_config_get_client_crl(&pathname)) {
63+
if (tlshd_config_get_crl(PEER_TYPE_CLIENT, &pathname)) {
6464
ret = gnutls_certificate_set_x509_crl_file(cred, pathname,
6565
GNUTLS_X509_FMT_PEM);
6666
free(pathname);
@@ -143,7 +143,8 @@ static bool tlshd_x509_client_get_certs(struct tlshd_handshake_parms *parms)
143143
if (parms->x509_cert != TLS_NO_CERT)
144144
return tlshd_keyring_get_certs(parms->x509_cert, tlshd_certs,
145145
&tlshd_certs_len);
146-
return tlshd_config_get_client_certs(tlshd_certs, &tlshd_certs_len);
146+
return tlshd_config_get_certs(PEER_TYPE_CLIENT, tlshd_certs,
147+
&tlshd_certs_len);
147148
}
148149

149150
static void tlshd_x509_client_put_certs(void)
@@ -159,7 +160,7 @@ static bool tlshd_x509_client_get_privkey(struct tlshd_handshake_parms *parms)
159160
if (parms->x509_privkey != TLS_NO_PRIVKEY)
160161
return tlshd_keyring_get_privkey(parms->x509_privkey,
161162
&tlshd_privkey);
162-
return tlshd_config_get_client_privkey(&tlshd_privkey);
163+
return tlshd_config_get_privkey(PEER_TYPE_CLIENT, &tlshd_privkey);
163164
}
164165

165166
static void tlshd_x509_client_put_privkey(void)

‎src/tlshd/config.c‎

Lines changed: 41 additions & 172 deletions
Original file line numberDiff line numberDiff line change
@@ -187,18 +187,22 @@ static bool tlshd_config_read_datum(const char *pathname, gnutls_datum_t *data,
187187
}
188188

189189
/**
190-
* tlshd_config_get_client_truststore - Get truststore for ClientHello from .conf
190+
* tlshd_config_get_truststore - Get truststore for {Client,Server}Hello from .conf
191+
* @peer_type: IN: peer type
191192
* @bundle: OUT: pathname to truststore
192193
*
193194
* Return values:
194195
* %false: pathname not retrieved
195196
* %true: pathname retrieved successfully; caller must free @bundle using free(3)
196197
*/
197-
bool tlshd_config_get_client_truststore(char **bundle)
198+
bool tlshd_config_get_truststore(int peer_type, char **bundle)
198199
{
199200
gchar *pathname;
200201

201-
pathname = g_key_file_get_string(tlshd_configuration, "authenticate.client",
202+
pathname = g_key_file_get_string(tlshd_configuration,
203+
peer_type == PEER_TYPE_CLIENT ?
204+
"authenticate.client" :
205+
"authenticate.server",
202206
"x509.truststore", NULL);
203207
if (!pathname)
204208
return false;
@@ -213,23 +217,29 @@ bool tlshd_config_get_client_truststore(char **bundle)
213217
if (!*bundle)
214218
return false;
215219

216-
tlshd_log_debug("Client x.509 truststore is %s", *bundle);
220+
tlshd_log_debug("%s x.509 truststore is %s",
221+
peer_type == PEER_TYPE_CLIENT ? "Client" : "Server",
222+
*bundle);
217223
return true;
218224
}
219225

220226
/**
221-
* tlshd_config_get_client_crl - Get CRL for ClientHello from .conf
227+
* tlshd_config_get_crl - Get CRL for {Client,Server}Hello from .conf
228+
* @peer_type: IN: peer type
222229
* @result: OUT: pathname to CRL
223230
*
224231
* Return values:
225232
* %false: pathname not retrieved
226233
* %true: pathname retrieved successfully; caller must free @result using free(3)
227234
*/
228-
bool tlshd_config_get_client_crl(char **result)
235+
bool tlshd_config_get_crl(int peer_type, char **result)
229236
{
230237
gchar *pathname;
231238

232-
pathname = g_key_file_get_string(tlshd_configuration, "authenticate.client",
239+
pathname = g_key_file_get_string(tlshd_configuration,
240+
peer_type == PEER_TYPE_CLIENT ?
241+
"authenticate.client" :
242+
"authenticate.server",
233243
"x509.crl", NULL);
234244
if (!pathname)
235245
return false;
@@ -244,28 +254,34 @@ bool tlshd_config_get_client_crl(char **result)
244254
if (!*result)
245255
return false;
246256

247-
tlshd_log_debug("Client x.509 crl is %s", *result);
257+
tlshd_log_debug("%s x.509 crl is %s",
258+
peer_type == PEER_TYPE_CLIENT ? "Client" : "Server",
259+
*result);
248260
return true;
249261
}
250262

251263
/**
252-
* tlshd_config_get_client_certs - Get certs for ClientHello from .conf
264+
* tlshd_config_get_certs - Get certs for {Client,Server} Hello from .conf
265+
* @peer_type: IN: peer type
253266
* @certs: OUT: in-memory certificates
254267
* @certs_len: IN: maximum number of certs to get, OUT: number of certs found
255268
*
256269
* Return values:
257270
* %true: certificate retrieved successfully
258271
* %false: certificate not retrieved
259272
*/
260-
bool tlshd_config_get_client_certs(gnutls_pcert_st *certs,
261-
unsigned int *certs_len)
273+
bool tlshd_config_get_certs(int peer_type, gnutls_pcert_st *certs,
274+
unsigned int *certs_len)
262275
{
263276
gnutls_datum_t data;
264277
gchar *pathname;
265278
int ret;
266279

267-
pathname = g_key_file_get_string(tlshd_configuration, "authenticate.client",
268-
"x509.certificate", NULL);
280+
pathname = g_key_file_get_string(tlshd_configuration,
281+
peer_type == PEER_TYPE_CLIENT ?
282+
"authenticate.client" :
283+
"authenticate.server",
284+
"x509.certificate", NULL);
269285
if (!pathname)
270286
return false;
271287

@@ -285,181 +301,34 @@ bool tlshd_config_get_client_certs(gnutls_pcert_st *certs,
285301
return false;
286302
}
287303

288-
tlshd_log_debug("Retrieved %u x.509 client certificate(s) from %s",
289-
*certs_len, pathname);
304+
tlshd_log_debug("Retrieved %u x.509 %s certificate(s) from %s",
305+
*certs_len,
306+
peer_type == PEER_TYPE_CLIENT ? "client" : "server",
307+
pathname);
290308
g_free(pathname);
291309
return true;
292310
}
293311

294312
/**
295-
* tlshd_config_get_client_privkey - Get private key for ClientHello from .conf
313+
* tlshd_config_get_privkey - Get private key for {Client,Server}Hello from .conf
314+
* @peer_type: IN: peer type
296315
* @privkey: OUT: in-memory private key
297316
*
298317
* Return values:
299318
* %true: private key retrieved successfully
300319
* %false: private key not retrieved
301320
*/
302-
bool tlshd_config_get_client_privkey(gnutls_privkey_t *privkey)
321+
bool tlshd_config_get_privkey(int peer_type, gnutls_privkey_t *privkey)
303322
{
304323
gnutls_datum_t data;
305324
gchar *pathname;
306325
int ret;
307326

308-
pathname = g_key_file_get_string(tlshd_configuration, "authenticate.client",
309-
"x509.private_key", NULL);
310-
if (!pathname)
311-
return false;
312-
313-
if (!tlshd_config_read_datum(pathname, &data, TLSHD_OWNER,
314-
TLSHD_PRIVKEY_MODE)) {
315-
g_free(pathname);
316-
return false;
317-
}
318-
319-
ret = gnutls_privkey_init(privkey);
320-
if (ret != GNUTLS_E_SUCCESS) {
321-
tlshd_log_gnutls_error(ret);
322-
free(data.data);
323-
g_free(pathname);
324-
return false;
325-
}
326-
327-
/* Config file supports only PEM-encoded keys */
328-
ret = gnutls_privkey_import_x509_raw(*privkey, &data,
329-
GNUTLS_X509_FMT_PEM, NULL, 0);
330-
free(data.data);
331-
if (ret != GNUTLS_E_SUCCESS) {
332-
tlshd_log_gnutls_error(ret);
333-
g_free(pathname);
334-
return false;
335-
}
336-
337-
tlshd_log_debug("Retrieved private key from %s", pathname);
338-
g_free(pathname);
339-
return true;
340-
}
341-
342-
/**
343-
* tlshd_config_get_server_truststore - Get truststore for ServerHello from .conf
344-
* @bundle: OUT: pathname to truststore
345-
*
346-
* Return values:
347-
* %false: pathname not retrieved
348-
* %true: pathname retrieved successfully; caller must free @bundle using free(3)
349-
*/
350-
bool tlshd_config_get_server_truststore(char **bundle)
351-
{
352-
gchar *pathname;
353-
354-
pathname = g_key_file_get_string(tlshd_configuration, "authenticate.server",
355-
"x509.truststore", NULL);
356-
if (!pathname)
357-
return false;
358-
if (access(pathname, F_OK)) {
359-
tlshd_log_debug("tlshd cannot access \"%s\"", pathname);
360-
g_free(pathname);
361-
return false;
362-
}
363-
364-
*bundle = strdup(pathname);
365-
g_free(pathname);
366-
if (!*bundle)
367-
return false;
368-
369-
tlshd_log_debug("Server x.509 truststore is %s", *bundle);
370-
return true;
371-
}
372-
373-
/**
374-
* tlshd_config_get_server_crl - Get CRL for ServerHello from .conf
375-
* @result: OUT: pathname to CRL
376-
*
377-
* Return values:
378-
* %false: pathname not retrieved
379-
* %true: pathname retrieved successfully; caller must free @result using free(3)
380-
*/
381-
bool tlshd_config_get_server_crl(char **result)
382-
{
383-
gchar *pathname;
384-
385-
pathname = g_key_file_get_string(tlshd_configuration, "authenticate.server",
386-
"x509.crl", NULL);
387-
if (!pathname)
388-
return false;
389-
if (access(pathname, F_OK)) {
390-
tlshd_log_debug("tlshd cannot access \"%s\"", pathname);
391-
g_free(pathname);
392-
return false;
393-
}
394-
395-
*result = strdup(pathname);
396-
g_free(pathname);
397-
if (!*result)
398-
return false;
399-
400-
tlshd_log_debug("Server x.509 crl is %s", *result);
401-
return true;
402-
}
403-
404-
/**
405-
* tlshd_config_get_server_certs - Get certs for ServerHello from .conf
406-
* @certs: OUT: in-memory certificates
407-
* @certs_len: IN: maximum number of certs to get, OUT: number of certs found
408-
*
409-
* Return values:
410-
* %true: certificate retrieved successfully
411-
* %false: certificate not retrieved
412-
*/
413-
bool tlshd_config_get_server_certs(gnutls_pcert_st *certs,
414-
unsigned int *certs_len)
415-
{
416-
gnutls_datum_t data;
417-
gchar *pathname;
418-
int ret;
419-
420-
pathname = g_key_file_get_string(tlshd_configuration, "authenticate.server",
421-
"x509.certificate", NULL);
422-
if (!pathname)
423-
return false;
424-
425-
if (!tlshd_config_read_datum(pathname, &data, TLSHD_OWNER,
426-
TLSHD_CERT_MODE)) {
427-
g_free(pathname);
428-
return false;
429-
}
430-
431-
/* Config file supports only PEM-encoded certificates */
432-
ret = gnutls_pcert_list_import_x509_raw(certs, certs_len, &data,
433-
GNUTLS_X509_FMT_PEM, 0);
434-
free(data.data);
435-
if (ret != GNUTLS_E_SUCCESS) {
436-
tlshd_log_gnutls_error(ret);
437-
g_free(pathname);
438-
return false;
439-
}
440-
441-
tlshd_log_debug("Retrieved %u x.509 server certificate(s) from %s",
442-
*certs_len, pathname);
443-
g_free(pathname);
444-
return true;
445-
}
446-
447-
/**
448-
* tlshd_config_get_server_privkey - Get private key for ServerHello from .conf
449-
* @privkey: OUT: in-memory private key
450-
*
451-
* Return values:
452-
* %true: private key retrieved successfully
453-
* %false: private key not retrieved
454-
*/
455-
bool tlshd_config_get_server_privkey(gnutls_privkey_t *privkey)
456-
{
457-
gnutls_datum_t data;
458-
gchar *pathname;
459-
int ret;
460-
461-
pathname = g_key_file_get_string(tlshd_configuration, "authenticate.server",
462-
"x509.private_key", NULL);
327+
pathname = g_key_file_get_string(tlshd_configuration,
328+
peer_type == PEER_TYPE_CLIENT ?
329+
"authenticate.client" :
330+
"authenticate.server",
331+
"x509.private_key", NULL);
463332
if (!pathname)
464333
return false;
465334

‎src/tlshd/server.c‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -52,8 +52,8 @@ static bool tlshd_x509_server_get_certs(struct tlshd_handshake_parms *parms)
5252
return tlshd_keyring_get_certs(parms->x509_cert,
5353
tlshd_server_certs,
5454
&tlshd_server_certs_len);
55-
return tlshd_config_get_server_certs(tlshd_server_certs,
56-
&tlshd_server_certs_len);
55+
return tlshd_config_get_certs(PEER_TYPE_SERVER, tlshd_server_certs,
56+
&tlshd_server_certs_len);
5757
}
5858

5959
static void tlshd_x509_server_put_certs(void)
@@ -69,7 +69,8 @@ static bool tlshd_x509_server_get_privkey(struct tlshd_handshake_parms *parms)
6969
if (parms->x509_privkey != TLS_NO_PRIVKEY)
7070
return tlshd_keyring_get_privkey(parms->x509_privkey,
7171
&tlshd_server_privkey);
72-
return tlshd_config_get_server_privkey(&tlshd_server_privkey);
72+
return tlshd_config_get_privkey(PEER_TYPE_SERVER,
73+
&tlshd_server_privkey);
7374
}
7475

7576
static void tlshd_x509_server_put_privkey(void)
@@ -140,7 +141,7 @@ static int tlshd_server_get_truststore(gnutls_certificate_credentials_t cred)
140141
char *pathname;
141142
int ret;
142143

143-
if (tlshd_config_get_server_truststore(&pathname)) {
144+
if (tlshd_config_get_truststore(PEER_TYPE_SERVER, &pathname)) {
144145
ret = gnutls_certificate_set_x509_trust_file(cred, pathname,
145146
GNUTLS_X509_FMT_PEM);
146147
free(pathname);
@@ -150,7 +151,7 @@ static int tlshd_server_get_truststore(gnutls_certificate_credentials_t cred)
150151
return ret;
151152
tlshd_log_debug("System trust: Loaded %d certificate(s).", ret);
152153

153-
if (tlshd_config_get_server_crl(&pathname)) {
154+
if (tlshd_config_get_crl(PEER_TYPE_SERVER, &pathname)) {
154155
ret = gnutls_certificate_set_x509_crl_file(cred, pathname,
155156
GNUTLS_X509_FMT_PEM);
156157
free(pathname);

0 commit comments

Comments
 (0)