Changeset 59cd92b for lib/ssl_gnutls.c

Timestamp:

2011-12-29T20:30:43Z (12 years ago)

Author:

Wilmer van der Gaast <wilmer@…>

Branches:

master

Children:

6451d27

Parents:

3558fea

Message:

Keep only one xcred object globally instead of one per connection. With
verification, this object gets pretty huge and there's no need to have it
more than once.

File:

• lib/ssl_gnutls.c (modified) (11 diffs)

lib/ssl_gnutls.c

@@ -2 +2 @@
   * BitlBee -- An IRC to other IM-networks gateway                     *
   *                                                                    *
-  * Copyright 2002-2004 Wilmer van der Gaast and others                *
+  * Copyright 2002-2011 Wilmer van der Gaast and others                *
   \********************************************************************/
 
@@ -38 +38 @@
 
 static gboolean initialized = FALSE;
+gnutls_certificate_credentials xcred;
 
 #include <limits.h>
@@ -60 +61 @@
         
         gnutls_session session;
-        gnutls_certificate_credentials xcred;
 };
 
@@ -67 +67 @@
 static gboolean ssl_handshake( gpointer data, gint source, b_input_condition cond );
 
+static void ssl_deinit( void );
 
 void ssl_init( void )
@@ -74 +75 @@
         
         gnutls_global_init();
+        gnutls_certificate_allocate_credentials( &xcred );
+        if( global.conf->cafile )
+        {
+                gnutls_certificate_set_x509_trust_file( xcred, global.conf->cafile, GNUTLS_X509_FMT_PEM );
+                /* TODO: Do we want/need this? */
+                gnutls_certificate_set_verify_flags( xcred, GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT );
+        }
         initialized = TRUE;
-        atexit( gnutls_global_deinit );
+        
+        atexit( ssl_deinit );
+}
+
+static void ssl_deinit( void )
+{
+        gnutls_global_deinit();
+        gnutls_certificate_free_credentials( xcred );
 }
 
@@ -145 +160 @@
         const char *hostname;
         
-        hostname = gnutls_session_get_ptr(session );
+        hostname = gnutls_session_get_ptr( session );
 
         gnutlsret = gnutls_certificate_verify_peers2( session, &status );
@@ -245 +260 @@
         ssl_init();
         
-        gnutls_certificate_allocate_credentials( &conn->xcred );
-        if( conn->verify && global.conf->cafile )
-        {
-                gnutls_certificate_set_x509_trust_file( conn->xcred, global.conf->cafile, GNUTLS_X509_FMT_PEM );
-                gnutls_certificate_set_verify_flags( conn->xcred, GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT );
-        }
-
         gnutls_init( &conn->session, GNUTLS_CLIENT );
         if( conn->verify )
@@ -259 +267 @@
 #endif
         gnutls_set_default_priority( conn->session );
-        gnutls_credentials_set( conn->session, GNUTLS_CRD_CERTIFICATE, conn->xcred );
+        gnutls_credentials_set( conn->session, GNUTLS_CRD_CERTIFICATE, xcred );
         
         sock_make_nonblocking( conn->fd );
@@ -284 +292 @@
                         
                         gnutls_deinit( conn->session );
-                        gnutls_certificate_free_credentials( conn->xcred );
                         closesocket( conn->fd );
                         
@@ -297 +304 @@
 
                         gnutls_deinit( conn->session );
-                        gnutls_certificate_free_credentials( conn->xcred );
                         closesocket( conn->fd );
 
@@ -385 +391 @@
         if( conn->session )
                 gnutls_deinit( conn->session );
-        if( conn->xcred )
-                gnutls_certificate_free_credentials( conn->xcred );
         g_free( conn );
 }