From db10bf464fcf28e3c21724353ffd6168c9f77aae Mon Sep 17 00:00:00 2001 From: Anton Gerasimov Date: Mon, 18 Sep 2017 16:29:27 +0200 Subject: [PATCH] Add support for pkcs11 URIs in TLS client key/certificate Closes: #1183 Approved by: cgwalters --- src/libostree/ostree-fetcher-curl.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/src/libostree/ostree-fetcher-curl.c b/src/libostree/ostree-fetcher-curl.c index e3fd1a12..c22141ec 100644 --- a/src/libostree/ostree-fetcher-curl.c +++ b/src/libostree/ostree-fetcher-curl.c @@ -747,6 +747,24 @@ initiate_next_curl_request (FetcherRequest *req, if (self->tls_client_cert_path) { + /* Support for pkcs11: + * https://github.com/ostreedev/ostree/pull/1183 + * This will be used by https://github.com/advancedtelematic/aktualizr + * at least to fetch certificates. No test coverage at the moment + * though. See https://gitlab.com/gnutls/gnutls/tree/master/tests/pkcs11 + * and https://github.com/opendnssec/SoftHSMv2 and + * https://github.com/p11-glue/p11-kit/tree/master/p11-kit for + * possible ideas there. + */ + if (g_str_has_prefix (self->tls_client_key_path, "pkcs11:")) + { + curl_easy_setopt (req->easy, CURLOPT_SSLENGINE, "pkcs11"); + curl_easy_setopt (req->easy, CURLOPT_SSLENGINE_DEFAULT, 1L); + curl_easy_setopt (req->easy, CURLOPT_SSLKEYTYPE, "ENG"); + } + if (g_str_has_prefix (self->tls_client_cert_path, "pkcs11:")) + curl_easy_setopt (req->easy, CURLOPT_SSLCERTTYPE, "ENG"); + curl_easy_setopt (req->easy, CURLOPT_SSLCERT, self->tls_client_cert_path); curl_easy_setopt (req->easy, CURLOPT_SSLKEY, self->tls_client_key_path); }