HomeClusterLabs Projects

Refactor: libcrmcommon: Use gnutls_session_set_verify_cert()
939fd116824bUnpublished

Unpublished Commit ยท Learn More

Not On Permanent Ref: This commit is not an ancestor of any permanent ref.

Description

Refactor: libcrmcommon: Use gnutls_session_set_verify_cert()

Instead of calling gnutls_certificate_set_verify_function() with the
custom callback verify_peer_cert().

gnutls_session_set_verify_cert() is available since GnuTLS 3.4.6. It
sets a verify function for the entire session, overriding any verify
function set for a particular certificate (for example, using
gnutls_certificate_set_verify_function()). For our purposes, each
session has a unique certificate anyway, so the effect is the same
either way.

gnutls_session_set_verify_cert() sets up a verify callback function
automatically, using hostname and flags parameters. At the time of this
commit, it's called auto_verify_cb(); it calls
gnutls_certificate_verify_peers() or a related function and returns 0 on
success or GNUTLS_E_CERTIFICATE_ERROR or
GNUTLS_E_CERTIFICATE_VERIFICATION_ERROR on error.

  • Our verify_peer_cert() function passes NULL to gnutls_certificate_verify_peers3() to disable hostname verification. Accordingly, we pass NULL to gnutls_session_set_verify_cert().
  • We don't currently override the default verify flags (which would have required a call to gnutls_certificate_set_verify_flags()). So we pass 0 for the flags argument here, which says to use the defaults.

There will be changes in the output upon error, as we lose our custom
error processing from verify_peer_cert(), but that seems acceptable.

Closes T967

Signed-off-by: Reid Wahl <nrwahl@protonmail.com>

Details

Provenance
nrwahl2Authored on Jan 8 2025, 5:56 PM
Parents
rP73526d8e0145: Refactor: libcrmcommon: Drop calls to gnutls_global_init()/deinit()
Branches
Unknown
Tags
Unknown

Event Timeline