Refactor: libcrmcommon: Use gnutls_session_set_verify_cert()
Instead of calling gnutls_certificate_set_verify_function() with the
custom callback verify_peer_cert().
gnutls_session_set_verify_cert() is available since GnuTLS 3.4.6. It
sets a verify function for the entire session, overriding any verify
function set for a particular certificate (for example, using
gnutls_certificate_set_verify_function()). For our purposes, each
session has a unique certificate anyway, so the effect is the same
either way.
gnutls_session_set_verify_cert() sets up a verify callback function
automatically, using hostname and flags parameters. At the time of this
commit, it's called auto_verify_cb(); it calls
gnutls_certificate_verify_peers() or a related function and returns 0 on
success or GNUTLS_E_CERTIFICATE_ERROR or
GNUTLS_E_CERTIFICATE_VERIFICATION_ERROR on error.
- Our verify_peer_cert() function passes NULL to gnutls_certificate_verify_peers3() to disable hostname verification. Accordingly, we pass NULL to gnutls_session_set_verify_cert().
- We don't currently override the default verify flags (which would have required a call to gnutls_certificate_set_verify_flags()). So we pass 0 for the flags argument here, which says to use the defaults.
There will be changes in the output upon error, as we lose our custom
error processing from verify_peer_cert(), but that seems acceptable.
Closes T967
Signed-off-by: Reid Wahl <nrwahl@protonmail.com>