tls: more generic function to set cafile and capath
MODIFY
include/re_tls.h
include/re_tls.h
@@ -33,6 +33,8 @@ enum tls_keytype {
int tls_alloc(struct tls **tlsp, enum tls_method method, const char *keyfile,
const char *pwd);
int tls_add_ca(struct tls *tls, const char *cafile);
+int tls_add_cafile_path(struct tls *tls, const char *cafile,
+ const char *capath);
int tls_add_capem(struct tls *tls, const char *capem);
int tls_set_selfsigned(struct tls *tls, const char *cn);
int tls_set_selfsigned_rsa(struct tls *tls, const char *cn, size_t bits);

MODIFY
src/tls/openssl/tls.c
src/tls/openssl/tls.c
@@ -249,12 +249,32 @@ int tls_alloc(struct tls **tlsp, enum tls_method method, const char *keyfile,
*/
int tls_add_ca(struct tls *tls, const char *cafile)
{
- if (!tls || !cafile || !tls->ctx)
+ return tls_add_cafile_path(tls, cafile, NULL);
+}
+
+
+/**
+ * Set default file and path for trusted CA certificates
+ *
+ * @param tls TLS Context
+ * @param cafile PEM file with CA certificate
+ * @param capath Path containing CA certificates
+ *
+ * @return 0 if success, otherwise errorcode
+ */
+int tls_add_cafile_path(struct tls *tls, const char *cafile,
+ const char *capath)
+{
+ if (!tls || (!cafile && !capath) || !tls->ctx)
return EINVAL;
/* Load the CAs we trust */
- if (!(SSL_CTX_load_verify_locations(tls->ctx, cafile, NULL))) {
+ if (!(SSL_CTX_load_verify_locations(tls->ctx, cafile, capath))) {
+ if (str_isset(cafile))
DEBUG_WARNING("Can't read CA file: %s\n", cafile);
+ if (str_isset(capath))
+ DEBUG_WARNING("Can't read CA path: %s\n", capath);
+
ERR_clear_error();
return EINVAL;
}

tls: more generic function to set cafile and capath