generic-library/curl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

gnutls: Report actual GnuTLS error message for certificate errors

Browse Source 
If GnuTLS fails to read the certificate then include whatever reason it
provides in the failure message reported to the client.

Signed-off-by: Mike Crowe <mac@mcrowe.com>
This commit is contained in:
Mike Crowe 2015-09-23 13:31:29 +02:00 committed by Daniel Stenberg
parent 684bf30802
commit 5f87906e0e
1 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
lib/vtls/gtls.c
View File

@ -663,17 +663,18 @@ gtls_connect_step1(struct connectdata *conn,
GNUTLS_PKCS_USE_PKCS12_RC2_40 | GNUTLS_PKCS_USE_PBES2_3DES | GNUTLS_PKCS_USE_PKCS12_RC2_40 | GNUTLS_PKCS_USE_PBES2_3DES |
GNUTLS_PKCS_USE_PBES2_AES_128 | GNUTLS_PKCS_USE_PBES2_AES_192 | GNUTLS_PKCS_USE_PBES2_AES_128 | GNUTLS_PKCS_USE_PBES2_AES_192 |
GNUTLS_PKCS_USE_PBES2_AES_256; GNUTLS_PKCS_USE_PBES2_AES_256;
if(gnutls_certificate_set_x509_key_file2( rc = gnutls_certificate_set_x509_key_file2(
conn->ssl[sockindex].cred, conn->ssl[sockindex].cred,
data->set.str[STRING_CERT], data->set.str[STRING_CERT],
data->set.str[STRING_KEY] ? data->set.str[STRING_KEY] ?
data->set.str[STRING_KEY] : data->set.str[STRING_CERT], data->set.str[STRING_KEY] : data->set.str[STRING_CERT],
do_file_type(data->set.str[STRING_CERT_TYPE]), do_file_type(data->set.str[STRING_CERT_TYPE]),
data->set.str[STRING_KEY_PASSWD], data->set.str[STRING_KEY_PASSWD],
supported_key_encryption_algorithms) != supported_key_encryption_algorithms);
GNUTLS_E_SUCCESS) { if(rc != GNUTLS_E_SUCCESS) {
failf(data, failf(data,
"error reading X.509 potentially-encrypted key file"); "error reading X.509 potentially-encrypted key file: %s",
gnutls_strerror(rc));
return CURLE_SSL_CONNECT_ERROR; return CURLE_SSL_CONNECT_ERROR;
#else #else
failf(data, "gnutls lacks support for encrypted key files"); failf(data, "gnutls lacks support for encrypted key files");
@ -682,14 +683,15 @@ gtls_connect_step1(struct connectdata *conn,
} }
} }
else { else {
if(gnutls_certificate_set_x509_key_file( rc = gnutls_certificate_set_x509_key_file(
conn->ssl[sockindex].cred, conn->ssl[sockindex].cred,
data->set.str[STRING_CERT], data->set.str[STRING_CERT],
data->set.str[STRING_KEY] ? data->set.str[STRING_KEY] ?
data->set.str[STRING_KEY] : data->set.str[STRING_CERT], data->set.str[STRING_KEY] : data->set.str[STRING_CERT],
do_file_type(data->set.str[STRING_CERT_TYPE]) ) != do_file_type(data->set.str[STRING_CERT_TYPE]) );
GNUTLS_E_SUCCESS) { if(rc != GNUTLS_E_SUCCESS) {
failf(data, "error reading X.509 key or certificate file"); failf(data, "error reading X.509 key or certificate file: %s",
gnutls_strerror(rc));
return CURLE_SSL_CONNECT_ERROR; return CURLE_SSL_CONNECT_ERROR;
} }
} }