From afdad06633c537144eee5d2f2cfc23211fff52d8 Mon Sep 17 00:00:00 2001
From: Charles-Henri Bruyand <charles-henri.bruyand@open-xchange.com>
Date: Wed, 24 Nov 2021 11:37:10 +0100
Subject: [PATCH] Apply rgacogne's suggestions from code review, thanks :)

---
 pdns/dnsdist-lua.cc                        |  6 +++---
 pdns/dnsdistdist/docs/reference/config.rst | 12 +++++++-----
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/pdns/dnsdist-lua.cc b/pdns/dnsdist-lua.cc
index 769f62d794..4793ce3568 100644
--- a/pdns/dnsdist-lua.cc
+++ b/pdns/dnsdist-lua.cc
@@ -132,13 +132,13 @@ static void parseLocalBindVars(boost::optional<localbind_t> vars, bool& reusePor
 }
 
 #if defined(HAVE_DNS_OVER_TLS) || defined(HAVE_DNS_OVER_HTTPS)
-static bool loadTLSCertificateAndKeys(const std::string& context, std::vector<TLSCertKeyPair>& pairs, boost::variant<std::string, std::shared_ptr<TLSCertKeyPair>, std::vector<std::pair<int, std::string>>, std::vector<std::pair<int, std::shared_ptr<TLSCertKeyPair>>>> certFiles, boost::variant<std::string, std::vector<std::pair<int, std::string>>> keyFiles, std::optional<std::string> password = std::nullopt)
+static bool loadTLSCertificateAndKeys(const std::string& context, std::vector<TLSCertKeyPair>& pairs, boost::variant<std::string, std::shared_ptr<TLSCertKeyPair>, std::vector<std::pair<int, std::string>>, std::vector<std::pair<int, std::shared_ptr<TLSCertKeyPair>>>> certFiles, boost::variant<std::string, std::vector<std::pair<int, std::string>>> keyFiles)
 {
   if (certFiles.type() == typeid(std::string) && keyFiles.type() == typeid(std::string)) {
     auto certFile = boost::get<std::string>(certFiles);
     auto keyFile = boost::get<std::string>(keyFiles);
     pairs.clear();
-    pairs.emplace_back(certFile, keyFile, password);
+    pairs.emplace_back(certFile, keyFile);
   }
   else if (certFiles.type() == typeid(std::shared_ptr<TLSCertKeyPair>)) {
     auto cert = boost::get<std::shared_ptr<TLSCertKeyPair>>(certFiles);
@@ -158,7 +158,7 @@ static bool loadTLSCertificateAndKeys(const std::string& context, std::vector<TL
     if (certFilesVect.size() == keyFilesVect.size()) {
       pairs.clear();
       for (size_t idx = 0; idx < certFilesVect.size(); idx++) {
-        pairs.emplace_back(certFilesVect.at(idx).second, keyFilesVect.at(idx).second, password);
+        pairs.emplace_back(certFilesVect.at(idx).second, keyFilesVect.at(idx).second);
       }
     }
     else {
diff --git a/pdns/dnsdistdist/docs/reference/config.rst b/pdns/dnsdistdist/docs/reference/config.rst
index 1863757a56..0308cfa372 100644
--- a/pdns/dnsdistdist/docs/reference/config.rst
+++ b/pdns/dnsdistdist/docs/reference/config.rst
@@ -118,7 +118,7 @@ Listen Sockets
     ``enableRenegotiation``, ``exactPathMatching``, ``maxConcurrentTCPConnections`` and ``releaseBuffers`` options added.
     ``internalPipeBufferSize`` now defaults to 1048576 on Linux.
 
-  .. versionchanged:: 1.x.0
+  .. versionchanged:: 1.8.0
      ``certFile`` now accepts a TLSCertificate object or a list of such objects (see :func:`newTLSCertificate`)
 
   Listen on the specified address and TCP port for incoming DNS over HTTPS connections, presenting the specified X.509 certificate.
@@ -1650,9 +1650,11 @@ Other functions
 
   .. versionadded:: 1.8.0
 
-  Creates a TLSCertificate object suited to be used with functions like :func:`addDOHLocal` and :func:`addTLSLocal` for TLS certificate configuration
+  Creates a TLSCertificate object suited to be used with functions like :func:`addDOHLocal` and :func:`addTLSLocal` for TLS certificate configuration.
+
+  PKCS12 files are only supported by the ``openssl`` provider, password-protected or not.
 
-  :param string pathToCert: Path to a file containing the certificate or a PCKS12 file containing both certificate and the key
+  :param string pathToCert: Path to a file containing the certificate or a PCKS12 file containing both a certificate and a key.
   :param table options: A table with key: value pairs with additional options.
 
   Options:
@@ -1662,7 +1664,7 @@ Other functions
 
   .. code-block:: lua
 
-    newTLSCertificate("path/to/pub.crt", {key="pat/to/private.pem"})
+    newTLSCertificate("path/to/pub.crt", {key="path/to/private.pem"})
     newTLSCertificate("path/to/domain.p12", {password="passphrase"}) -- use a password protected PCKS12 file
 
 DOHFrontend
@@ -1678,7 +1680,7 @@ DOHFrontend
 
      .. versionadded:: 1.6.1
 
-     .. versionchanged:: 1.x.0
+     .. versionchanged:: 1.8.0
         ``certFile`` now accepts a TLSCertificate object or a list of such objects (see :func:`newTLSCertificate`)
 
      :param str certFile(s): The path to a X.509 certificate file in PEM format, a list of paths to such files, or a TLSCertificate object.
-- 
2.47.2