| 1671 | } |
| 1672 | |
| 1673 | apr_status_t md_chain_fappend(struct apr_array_header_t *certs, apr_pool_t *p, const char *fname) |
| 1674 | { |
| 1675 | FILE *f; |
| 1676 | apr_status_t rv; |
| 1677 | X509 *x509; |
| 1678 | md_cert_t *cert; |
| 1679 | unsigned long err; |
| 1680 | |
| 1681 | rv = md_util_fopen(&f, fname, "r"); |
| 1682 | if (rv == APR_SUCCESS) { |
| 1683 | ERR_clear_error(); |
| 1684 | while (NULL != (x509 = PEM_read_X509(f, NULL, NULL, NULL))) { |
| 1685 | cert = md_cert_make(p, x509); |
| 1686 | APR_ARRAY_PUSH(certs, md_cert_t *) = cert; |
| 1687 | } |
| 1688 | fclose(f); |
| 1689 | |
| 1690 | if (0 < (err = ERR_get_error()) |
| 1691 | && !(ERR_GET_LIB(err) == ERR_LIB_PEM && ERR_GET_REASON(err) == PEM_R_NO_START_LINE)) { |
| 1692 | /* not the expected one when no more PEM encodings are found */ |
| 1693 | rv = APR_EINVAL; |
| 1694 | goto out; |
| 1695 | } |
| 1696 | |
| 1697 | if (certs->nelts == 0) { |
| 1698 | /* Did not find any. This is acceptable unless the file has a certain size |
| 1699 | * when we no longer accept it as empty chain file. Something seems to be |
| 1700 | * wrong then. */ |
| 1701 | apr_finfo_t info; |
| 1702 | if (APR_SUCCESS == apr_stat(&info, fname, APR_FINFO_SIZE, p) && info.size >= 1024) { |
| 1703 | /* "Too big for a moon." */ |
| 1704 | rv = APR_EINVAL; |
| 1705 | md_log_perror(MD_LOG_MARK, MD_LOG_ERR, rv, p, |
| 1706 | "no certificates in non-empty chain %s", fname); |
| 1707 | goto out; |
| 1708 | } |
| 1709 | } |
| 1710 | } |
| 1711 | out: |
| 1712 | md_log_perror(MD_LOG_MARK, MD_LOG_TRACE3, rv, p, "read chain file %s, found %d certs", |
| 1713 | fname, certs? certs->nelts : 0); |
| 1714 | return rv; |
| 1715 | } |
| 1716 | |
| 1717 | apr_status_t md_chain_fload(apr_array_header_t **pcerts, apr_pool_t *p, const char *fname) |
| 1718 | { |
no test coverage detected