packaging
/
ostree
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add support for pkcs11 URIs in TLS client key/certificate 

Closes: #1183
Approved by: cgwalters
This commit is contained in:
Anton Gerasimov 2017-09-18 16:29:27 +02:00 committed by Atomic Bot
parent 5c4f26bd65
commit db10bf464f
1 changed files with 18 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
src/libostree/ostree-fetcher-curl.c
View File

@ -747,6 +747,24 @@ initiate_next_curl_request (FetcherRequest *req,
if (self->tls_client_cert_path) if (self->tls_client_cert_path)
{ {
/* Support for pkcs11:
* https://github.com/ostreedev/ostree/pull/1183
* This will be used by https://github.com/advancedtelematic/aktualizr
* at least to fetch certificates. No test coverage at the moment
* though. See https://gitlab.com/gnutls/gnutls/tree/master/tests/pkcs11
* and https://github.com/opendnssec/SoftHSMv2 and
* https://github.com/p11-glue/p11-kit/tree/master/p11-kit for
* possible ideas there.
*/
if (g_str_has_prefix (self->tls_client_key_path, "pkcs11:"))
{
curl_easy_setopt (req->easy, CURLOPT_SSLENGINE, "pkcs11");
curl_easy_setopt (req->easy, CURLOPT_SSLENGINE_DEFAULT, 1L);
curl_easy_setopt (req->easy, CURLOPT_SSLKEYTYPE, "ENG");
}
if (g_str_has_prefix (self->tls_client_cert_path, "pkcs11:"))
curl_easy_setopt (req->easy, CURLOPT_SSLCERTTYPE, "ENG");
curl_easy_setopt (req->easy, CURLOPT_SSLCERT, self->tls_client_cert_path); curl_easy_setopt (req->easy, CURLOPT_SSLCERT, self->tls_client_cert_path);
curl_easy_setopt (req->easy, CURLOPT_SSLKEY, self->tls_client_key_path); curl_easy_setopt (req->easy, CURLOPT_SSLKEY, self->tls_client_key_path);
} }