upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-05-27 20:25:55 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

Add utility functions to manipulate X509 certificate stores

Browse source 
This commit adds a set of high-level utility functions to manipulate
the certificate stores. The stores are needed to implement TLS
certificates verification efficiently.
This commit is contained in:
Artem Boldariev 2021-12-30 23:24:25 +02:00
parent cfcbdb6712
commit b975ee7be4
2 changed files with 73 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
lib/isc/include/isc/tls.h
View file

@ -21,6 +21,8 @@
typedef struct ssl_ctx_st isc_tlsctx_t;
typedef struct ssl_st isc_tls_t;
typedef struct x509_store_st isc_tls_cert_store_t;
void
isc_tlsctx_free(isc_tlsctx_t **ctpx);
/*%<
@ -196,6 +198,27 @@ isc_tlsctx_enable_dot_server_alpn(isc_tlsctx_t *ctx);
*\li 'ctx' is not NULL.
*/
isc_result_t
isc_tls_cert_store_create(const char *ca_bundle_filename,
isc_tls_cert_store_t **pstore);
/*%<
* Create X509 certificate store. The 'ca_bundle_filename' might be
* 'NULL' or an empty string, which means use the default system wide
* bundle/directory.
*
* Requires:
*\li 'pstore' is a valid pointer to a pointer containing 'NULL'.
*/
void
isc_tls_cert_store_free(isc_tls_cert_store_t **pstore);
/*%<
* Free X509 certificate store.
*
* Requires:
*\li 'pstore' is a valid pointer to a pointer containing a non-'NULL' value.
*/
typedef struct isc_tlsctx_cache isc_tlsctx_cache_t;
/*%<
* The TLS context cache is an object which allows retrieving a

50
lib/isc/tls.c
View file

@ -910,6 +910,56 @@ isc_tlsctx_enable_dot_server_alpn(isc_tlsctx_t *tls) {
#endif // OPENSSL_VERSION_NUMBER >= 0x10002000L
}
isc_result_t
isc_tls_cert_store_create(const char *ca_bundle_filename,
isc_tls_cert_store_t **pstore) {
int ret = 0;
isc_tls_cert_store_t *store = NULL;
REQUIRE(pstore != NULL && *pstore == NULL);
store = X509_STORE_new();
if (store == NULL) {
goto error;
}
/* Let's treat empty string as the default (system wide) store */
if (ca_bundle_filename != NULL && *ca_bundle_filename == '\0') {
ca_bundle_filename = NULL;
}
if (ca_bundle_filename == NULL) {
ret = X509_STORE_set_default_paths(store);
} else {
ret = X509_STORE_load_locations(store, ca_bundle_filename,
NULL);
}
if (ret == 0) {
goto error;
}
*pstore = store;
return (ISC_R_SUCCESS);
error:
if (store != NULL) {
X509_STORE_free(store);
}
return (ISC_R_FAILURE);
}
void
isc_tls_cert_store_free(isc_tls_cert_store_t **pstore) {
isc_tls_cert_store_t *store;
REQUIRE(pstore != NULL && *pstore != NULL);
store = *pstore;
X509_STORE_free(store);
*pstore = NULL;
}
#define TLSCTX_CACHE_MAGIC ISC_MAGIC('T', 'l', 'S', 'c')
#define VALID_TLSCTX_CACHE(t) ISC_MAGIC_VALID(t, TLSCTX_CACHE_MAGIC)