181                  const int rc, const char * const msg)  in elog()  argument
185               msg, gnutls_strerror_name(rc), gnutls_strerror(rc));  in elog()
193                   const int rc, const char * const fmt, ...)  in elogf()  argument
200     elog(errh, file, line, rc, msg);  in elogf()
220     int rc = gnutls_load_file(fn, d);  in mod_gnutls_load_file()
221     if (rc < 0)  in mod_gnutls_load_file()
222         elogf(errh, __FILE__, __LINE__, rc, "%s() %s", __func__, fn);  in mod_gnutls_load_file()
223     return rc;  in mod_gnutls_load_file()
290     int rc = gnutls_session_ticket_key_generate(&session_ticket_key);  in mod_gnutls_session_ticket_key_init()  local
291     if (rc < 0) {  in mod_gnutls_session_ticket_key_init()
294         elog(srv->errh, __FILE__, __LINE__, rc,  in mod_gnutls_session_ticket_key_init()
340     int rc = 0; /*(will retry on next check interval upon any error)*/  in mod_gnutls_session_ticket_key_file()  local
342         return rc;  in mod_gnutls_session_ticket_key_file()
356         rc = 1;  in mod_gnutls_session_ticket_key_file()
360     return rc;  in mod_gnutls_session_ticket_key_file()
509     int rc = mod_gnutls_load_file(fn, &f, errh);  in mod_gnutls_load_config_crts()  local
510     if (rc < 0) return NULL;  in mod_gnutls_load_config_crts()
518     rc = gnutls_x509_crt_list_import2((gnutls_x509_crt_t **)&d->data, &d->size,  in mod_gnutls_load_config_crts()
521     if (rc < 0) {  in mod_gnutls_load_config_crts()
528             rc = 0;  in mod_gnutls_load_config_crts()
531     if (rc < 0) {  in mod_gnutls_load_config_crts()
532         elogf(errh, __FILE__, __LINE__, rc,  in mod_gnutls_load_config_crts()
554     int rc = mod_gnutls_load_file(fn, &f, errh);  in mod_gnutls_load_config_crls()  local
555     if (rc < 0) return NULL;  in mod_gnutls_load_config_crls()
563     rc = gnutls_x509_crl_list_import2((gnutls_x509_crl_t **)&d->data, &d->size,  in mod_gnutls_load_config_crls()
566     if (rc < 0) {  in mod_gnutls_load_config_crls()
567         elogf(errh, __FILE__, __LINE__, rc,  in mod_gnutls_load_config_crls()
584     int rc = mod_gnutls_load_file(fn, &f, errh);  in mod_gnutls_load_config_pkey()  local
585     if (rc < 0) return NULL;  in mod_gnutls_load_config_pkey()
587     rc = gnutls_privkey_init(&pkey);  in mod_gnutls_load_config_pkey()
588     if (rc < 0) {  in mod_gnutls_load_config_pkey()
592     rc = gnutls_privkey_import_x509_raw(pkey, &f, GNUTLS_X509_FMT_PEM, NULL, 0);  in mod_gnutls_load_config_pkey()
593     if (rc < 0) {  in mod_gnutls_load_config_pkey()
598             rc = 0;  in mod_gnutls_load_config_pkey()
601     if (rc < 0) {  in mod_gnutls_load_config_pkey()
602         elogf(errh, __FILE__, __LINE__, rc,  in mod_gnutls_load_config_pkey()
784     int rc;  in mod_gnutls_verify_set_tlist()  local
801     rc = gnutls_x509_trust_list_init(&tlist, 0);  in mod_gnutls_verify_set_tlist()
802     if (rc < 0) {  in mod_gnutls_verify_set_tlist()
803         elog(hctx->r->conf.errh, __FILE__, __LINE__, rc,  in mod_gnutls_verify_set_tlist()
805         return rc;  in mod_gnutls_verify_set_tlist()
809     rc = gnutls_x509_trust_list_add_cas(tlist, clist, d->size, 0);  in mod_gnutls_verify_set_tlist()
810     if (rc < 0) {  in mod_gnutls_verify_set_tlist()
811         elog(hctx->r->conf.errh, __FILE__, __LINE__, rc,  in mod_gnutls_verify_set_tlist()
814         return rc;  in mod_gnutls_verify_set_tlist()
822         rc = gnutls_x509_trust_list_add_crls(tlist, crl_list, d->size, 0, 0);  in mod_gnutls_verify_set_tlist()
823         if (rc < 0) {  in mod_gnutls_verify_set_tlist()
824             elog(hctx->r->conf.errh, __FILE__, __LINE__, rc,  in mod_gnutls_verify_set_tlist()
827             return rc;  in mod_gnutls_verify_set_tlist()
853     int rc;  in mod_gnutls_verify_cb()  local
858         rc = mod_gnutls_verify_set_tlist(hctx, 0); /* for client cert verify */  in mod_gnutls_verify_cb()
859         if (rc < 0) return rc;  in mod_gnutls_verify_cb()
876     rc = gnutls_certificate_verify_peers2(ssl, &hctx->verify_status);  in mod_gnutls_verify_cb()
877     if (rc < 0) return rc;  in mod_gnutls_verify_cb()
922     int rc = mod_gnutls_load_file(pc->ssl_stapling_file->ptr, &f, errh);  in mod_gnutls_ocsp_next_update()  local
923     if (rc < 0) return (time_t)-1;  in mod_gnutls_ocsp_next_update()
992     int rc = gnutls_certificate_set_ocsp_status_request_file(pc->ssl_cred,fn,0);  in mod_gnutls_reload_stapling_file()  local
993     if (rc < 0)  in mod_gnutls_reload_stapling_file()
994         return rc;  in mod_gnutls_reload_stapling_file()
1061     int rc;  in mod_gnutls_crt_must_staple()  local
1070         rc = gnutls_x509_crt_get_extension_info(crt, i, oid, &oidsz, NULL);  in mod_gnutls_crt_must_staple()
1071         if (rc < 0 || 0 == strcmp(oid, GNUTLS_X509EXT_OID_TLSFEATURES)) break;  in mod_gnutls_crt_must_staple()
1074     if (rc < 0) return rc;  in mod_gnutls_crt_must_staple()
1077     rc = gnutls_x509_crt_get_extension_data2(crt, i, &der);  in mod_gnutls_crt_must_staple()
1078     if (rc < 0) return rc;  in mod_gnutls_crt_must_staple()
1085     rc = (der.size >= 5 && der.data[0] == 0x30 && der.data[1] >= 0x03  in mod_gnutls_crt_must_staple()
1095     rc = gnutls_x509_tlsfeatures_init(&f);  in mod_gnutls_crt_must_staple()
1096     if (rc < 0) return rc;  in mod_gnutls_crt_must_staple()
1097     rc = gnutls_x509_tlsfeatures_add(f, 5); /* 5 = OCSP Must-Staple */  in mod_gnutls_crt_must_staple()
1098     if (rc < 0) return rc;  in mod_gnutls_crt_must_staple()
1099     rc = (0 != gnutls_x509_tlsfeatures_check_crt(f, crt));  in mod_gnutls_crt_must_staple()
1104     return rc; /* 1 if OCSP Must-Staple found; 0 if not */  in mod_gnutls_crt_must_staple()
1119     int rc = gnutls_certificate_allocate_credentials(&ssl_cred);  in mod_gnutls_construct_crt_chain()  local
1120     if (rc < 0) return rc;  in mod_gnutls_construct_crt_chain()
1130     rc = 0;  in mod_gnutls_construct_crt_chain()
1136         rc = gnutls_pcert_import_x509(pcert_list, crts[0], 0);  in mod_gnutls_construct_crt_chain()
1139     if (0 == rc && ncrt) {  in mod_gnutls_construct_crt_chain()
1143         rc = gnutls_pcert_import_x509_list(pcert_list+off, crts, &ncrt, 0);  in mod_gnutls_construct_crt_chain()
1145         rc = 0;  in mod_gnutls_construct_crt_chain()
1147             rc = gnutls_pcert_import_x509(pcert_list+off+i, crts[i], 0);  in mod_gnutls_construct_crt_chain()
1148             if (rc < 0) break;  in mod_gnutls_construct_crt_chain()
1153     if (0 == rc)  in mod_gnutls_construct_crt_chain()
1154         rc = gnutls_certificate_set_key(ssl_cred, NULL, 0, pcert_list, ncrt,  in mod_gnutls_construct_crt_chain()
1156     if (rc < 0) {  in mod_gnutls_construct_crt_chain()
1161         elog(errh, __FILE__, __LINE__, rc, "gnutls_certificate_set_key()");  in mod_gnutls_construct_crt_chain()
1162         return rc;  in mod_gnutls_construct_crt_chain()
1187     int rc;  in network_gnutls_load_pemfile()
1189     rc = gnutls_certificate_allocate_credentials(&ssl_cred);  in network_gnutls_load_pemfile()
1190     if (rc < 0) return NULL;  in network_gnutls_load_pemfile()
1192     rc = gnutls_certificate_set_x509_key_file2(ssl_cred,  in network_gnutls_load_pemfile()
1195     if (rc < 0) {  in network_gnutls_load_pemfile()
1196         elogf(srv->errh, __FILE__, __LINE__, rc,  in network_gnutls_load_pemfile()
1236         int rc = mod_gnutls_construct_crt_chain(pc, d, srv->errh);  in network_gnutls_load_pemfile()  local
1237         if (rc < 0) {  in network_gnutls_load_pemfile()
1275     int rc = GNUTLS_E_INVALID_REQUEST;  in mod_gnutls_acme_tls_1()  local
1284     if (buffer_is_blank(name))          return rc;  in mod_gnutls_acme_tls_1()
1285     if (NULL != strchr(name->ptr, '/')) return rc;  in mod_gnutls_acme_tls_1()
1286     if (name->ptr[0] == '.')            return rc;  in mod_gnutls_acme_tls_1()
1289         return rc;  in mod_gnutls_acme_tls_1()
1302     rc = gnutls_certificate_allocate_credentials(&ssl_cred);  in mod_gnutls_acme_tls_1()
1303     if (rc < 0) { buffer_free(privkey); return rc; }  in mod_gnutls_acme_tls_1()
1304     rc = gnutls_certificate_set_x509_key_file2(ssl_cred,  in mod_gnutls_acme_tls_1()
1307     if (rc < 0) {  in mod_gnutls_acme_tls_1()
1308         elogf(errh, __FILE__, __LINE__, rc,  in mod_gnutls_acme_tls_1()
1313         return rc;  in mod_gnutls_acme_tls_1()
1349     rc = mod_gnutls_construct_crt_chain(&pc, d, errh);  in mod_gnutls_acme_tls_1()
1350     if (rc < 0) {  in mod_gnutls_acme_tls_1()
1353         return rc;  in mod_gnutls_acme_tls_1()
1363     rc = gnutls_credentials_set(hctx->ssl, GNUTLS_CRD_CERTIFICATE, ssl_cred);  in mod_gnutls_acme_tls_1()
1364     if (rc < 0) {  in mod_gnutls_acme_tls_1()
1365         elogf(hctx->r->conf.errh, __FILE__, __LINE__, rc,  in mod_gnutls_acme_tls_1()
1368         return rc;  in mod_gnutls_acme_tls_1()
1441                 int rc = mod_gnutls_acme_tls_1(hctx);  in mod_gnutls_ALPN()  local
1442                 if (0 == rc) {  in mod_gnutls_ALPN()
1446                 return rc;  in mod_gnutls_ALPN()
1547     int rc = gnutls_ext_raw_parse(hctx, mod_gnutls_client_hello_ext_cb, msg,  in mod_gnutls_client_hello_hook()  local
1549     if (rc < 0) {  in mod_gnutls_client_hello_hook()
1551         elog(errh, __FILE__, __LINE__, rc, "gnutls_ext_raw_parse()");  in mod_gnutls_client_hello_hook()
1552         return rc;  in mod_gnutls_client_hello_hook()
1570     rc = gnutls_alpn_set_protocols(hctx->ssl, alpn_protos, n, 0);  in mod_gnutls_client_hello_hook()
1571     if (rc < 0) {  in mod_gnutls_client_hello_hook()
1573         elog(errh, __FILE__, __LINE__, rc, "gnutls_alpn_set_protocols()");  in mod_gnutls_client_hello_hook()
1574         return rc;  in mod_gnutls_client_hello_hook()
1589         rc = gnutls_session_ticket_enable_server(ssl, &session_ticket_key);  in mod_gnutls_client_hello_hook()
1590         if (rc < 0) {  in mod_gnutls_client_hello_hook()
1591             elog(hctx->r->conf.errh, __FILE__, __LINE__, rc,  in mod_gnutls_client_hello_hook()
1593             return rc;  in mod_gnutls_client_hello_hook()
1599         rc = mod_gnutls_construct_crt_chain(hctx->conf.pc,  in mod_gnutls_client_hello_hook()
1602         if (rc < 0) return rc;  in mod_gnutls_client_hello_hook()
1618         rc = mod_gnutls_verify_set_tlist(hctx, 1); /* for client cert request */  in mod_gnutls_client_hello_hook()
1619         if (rc < 0) return rc;  in mod_gnutls_client_hello_hook()
1632     rc = gnutls_credentials_set(ssl, GNUTLS_CRD_CERTIFICATE, ssl_cred);  in mod_gnutls_client_hello_hook()
1633     if (rc < 0) {  in mod_gnutls_client_hello_hook()
1634         elogf(hctx->r->conf.errh, __FILE__, __LINE__, rc,  in mod_gnutls_client_hello_hook()
1637         return rc;  in mod_gnutls_client_hello_hook()
1667     int rc = 0;  in mod_gnutls_ssl_conf_cmd()  local
1687                     rc = -1;  in mod_gnutls_ssl_conf_cmd()
1765         rc = -1;  in mod_gnutls_ssl_conf_cmd()
1771             rc = -1;  in mod_gnutls_ssl_conf_cmd()
1774     return rc;  in mod_gnutls_ssl_conf_cmd()
1781     int rc;  in network_init_ssl()  local
1856     rc = gnutls_priority_init(&s->priority_cache, b->ptr, &err_pos);  in network_init_ssl()
1857     if (rc < 0) {  in network_init_ssl()
1858         elogf(srv->errh, __FILE__, __LINE__, rc,  in network_init_ssl()
1899     int rc = HANDLER_GO_ON;  in mod_gnutls_set_defaults_sockets()  local
1963         if (HANDLER_GO_ON != rc) break;  in mod_gnutls_set_defaults_sockets()
2020                     rc = HANDLER_ERROR;  in mod_gnutls_set_defaults_sockets()
2030             rc = HANDLER_ERROR;  in mod_gnutls_set_defaults_sockets()
2036             rc = HANDLER_ERROR;  in mod_gnutls_set_defaults_sockets()
2056             rc = HANDLER_ERROR;  in mod_gnutls_set_defaults_sockets()
2061     if (rc == HANDLER_GO_ON && ssl_is_init)  in mod_gnutls_set_defaults_sockets()
2065     return rc;  in mod_gnutls_set_defaults_sockets()
2304 mod_gnutls_read_err(connection *con, handler_ctx *hctx, int rc)  in mod_gnutls_read_err()  argument
2306     switch (rc) {  in mod_gnutls_read_err()
2347                 elogf(hctx->r->conf.errh, __FILE__, __LINE__, rc,  in mod_gnutls_read_err()
2360         elog(hctx->r->conf.errh, __FILE__, __LINE__, rc, __func__);  in mod_gnutls_read_err()
2508     int rc = gnutls_handshake(hctx->ssl);  in mod_gnutls_ssl_handshake()  local
2509     if (rc < 0)  in mod_gnutls_ssl_handshake()
2510         return mod_gnutls_read_err(hctx->con, hctx, rc);  in mod_gnutls_ssl_handshake()
2553         int rc = mod_gnutls_ssl_handshake(hctx);  in connection_read_cq_ssl()  local
2554         if (1 != rc) return rc; /* !hctx->handshake; not done, or error */  in connection_read_cq_ssl()
2612     int rc = gnutls_init(&hctx->ssl, flags);  in CONNECTION_FUNC()  local
2613     if (rc < 0) {  in CONNECTION_FUNC()
2614         elog(r->conf.errh, __FILE__, __LINE__, rc, "gnutls_init()");  in CONNECTION_FUNC()
2618     rc = gnutls_priority_set(hctx->ssl, s->priority_cache);  in CONNECTION_FUNC()
2619     if (rc < 0) {  in CONNECTION_FUNC()
2620         elog(r->conf.errh, __FILE__, __LINE__, rc, "gnutls_priority_set()");  in CONNECTION_FUNC()
2653         rc = gnutls_session_ticket_enable_server(hctx->ssl,&session_ticket_key);  in CONNECTION_FUNC()
2654         if (rc < 0) {  in CONNECTION_FUNC()
2655             elog(r->conf.errh, __FILE__, __LINE__, rc,  in CONNECTION_FUNC()
2701     int rc = gnutls_bye(hctx->ssl, GNUTLS_SHUT_WR);  in mod_gnutls_close_notify()  local
2702     switch (rc) {  in mod_gnutls_close_notify()
2710         elog(hctx->r->conf.errh, __FILE__, __LINE__, rc,  in mod_gnutls_close_notify()
2752     int irdn = 0, i, rc;  in https_add_ssl_client_subject()  local
2769         for (i=0; (rc = gnutls_x509_dn_get_rdn_ava(dn,irdn,i,&ava)) == 0; ++i) {  in https_add_ssl_client_subject()
2788     } while (rc == GNUTLS_E_ASN1_ELEMENT_NOT_FOUND && i > 0);  in https_add_ssl_client_subject()
2790     if (rc != GNUTLS_E_ASN1_ELEMENT_NOT_FOUND)  in https_add_ssl_client_subject()
2791         elog(r->conf.errh, __FILE__, __LINE__, rc,  in https_add_ssl_client_subject()
2852     int rc;  in https_add_ssl_client_entries()  local
2859     rc = gnutls_x509_crt_get_dn(crt, buf, &d.size);  in https_add_ssl_client_entries()
2861     rc = gnutls_x509_crt_get_dn3(crt, &d, 0);  in https_add_ssl_client_entries()
2863     if (rc >= 0)  in https_add_ssl_client_entries()
2870     rc = gnutls_x509_crt_get_subject(crt, &dn);  in https_add_ssl_client_entries()
2871     if (rc >= 0)  in https_add_ssl_client_entries()
3201         int rc = 1;  in mod_gnutls_ssl_conf_ciphersuites()  local
3337                 rc = 0;  in mod_gnutls_ssl_conf_ciphersuites()
3341         if (0 == rc) return 0;  in mod_gnutls_ssl_conf_ciphersuites()
3365         rc = gnutls_dh_params_init(&s->dh_params);  in mod_gnutls_ssl_conf_dhparameters()
3366         if (rc < 0) return 0;  in mod_gnutls_ssl_conf_dhparameters()
3367         rc = mod_gnutls_load_file(dhparameters->ptr, &f, srv->errh);  in mod_gnutls_ssl_conf_dhparameters()
3368         if (rc < 0) return 0;  in mod_gnutls_ssl_conf_dhparameters()
3369         rc = gnutls_dh_params_import_pkcs3(s->dh_params,&f,GNUTLS_X509_FMT_PEM);  in mod_gnutls_ssl_conf_dhparameters()
3371         if (rc < 0) {  in mod_gnutls_ssl_conf_dhparameters()
3372             elogf(srv->errh, __FILE__, __LINE__, rc,  in mod_gnutls_ssl_conf_dhparameters()
3380         rc = gnutls_dh_params_init(&s->dh_params);  in mod_gnutls_ssl_conf_dhparameters()
3381         if (rc < 0) return 0;  in mod_gnutls_ssl_conf_dhparameters()
3384         rc = gnutls_dh_params_generate2(s->dh_params, bits);  in mod_gnutls_ssl_conf_dhparameters()
3385         if (rc < 0) {  in mod_gnutls_ssl_conf_dhparameters()
3386             elogf(srv->errh, __FILE__, __LINE__, rc,  in mod_gnutls_ssl_conf_dhparameters()