add dictionary attributes, and allow for chain file

diff --git a/share/dictionary.freeradius.internal b/share/dictionary.freeradius.internal
index c9fae5507794091755d371c9822702396b2b17dc..a9e825b56e57f541e222c6ffc333a318593ee7cc 100644 (file)
--- a/share/dictionary.freeradius.internal
+++ b/share/dictionary.freeradius.internal
@@ -596,6 +596,10 @@ ATTRIBUTE  TLS-Cache-Filename                      1946    string
 ATTRIBUTE      TLS-Session-Version                     1947    string
 ATTRIBUTE      TLS-Session-Cipher-Suite                1948    string
 
+ATTRIBUTE      TLS-Session-Cert-File                   1949    string
+ATTRIBUTE      TLS-Session-Cert-Chain-File             1950    string
+ATTRIBUTE      TLS-Session-Cert-Private-Key-File       1951    string
+
 #
 #      Range:  1950-2099
 #              Free

diff --git a/src/main/tls.c b/src/main/tls.c
index 9e72a50d255cd1db6c02201169f46fb15cd0dd29..56500dd0eb434f8f75de6c69ff7b548c3a39eec5 100644 (file)
--- a/src/main/tls.c
+++ b/src/main/tls.c
@@ -709,6 +709,7 @@ tls_session_t *tls_new_session(TALLOC_CTX *ctx, fr_tls_server_conf_t *conf, REQU
        SSL_set_msg_callback_arg(new_tls, state);
        SSL_set_info_callback(new_tls, cbtls_info);
 
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
        /*
         *      Allow policies to load context-specific certificate chains.
         */
@@ -744,7 +745,36 @@ tls_session_t *tls_new_session(TALLOC_CTX *ctx, fr_tls_server_conf_t *conf, REQU
                                      vp->vp_strvalue);
                        goto error;
                }
+
+       } else if ((vp = fr_pair_find_by_num(request->config, PW_TLS_SESSION_CERT_CHAIN_FILE, 0, TAG_ANY)) != NULL) {
+               VALUE_PAIR *key = fr_pair_find_by_num(request->config, PW_TLS_SESSION_CERT_PRIVATE_KEY_FILE, 0, TAG_ANY);
+
+               if (!key) {
+                       tls_error_log(request, "Missing TLS-Cert-Private-Key-File for TLS-Session-Cert-Chain-File");
+                       goto error;
+               }
+
+               RDEBUG2("(TLS) Loading session certificate chain file \"%s\"", vp->vp_strvalue);
+
+               if (SSL_use_certificate_chain_file(state->ssl, vp->vp_strvalue) != 1) {
+                       tls_error_log(request, "Failed loading TLS session certificate chain \"%s\"",
+                                     vp->vp_strvalue);
+                       goto error;
+               }
+
+               if (SSL_use_PrivateKey_file(state->ssl, key->vp_strvalue, SSL_FILETYPE_PEM) != 1) {
+                       tls_error_log(request, "Failed loading TLS session certificate private key \"%s\"",
+                                     key->vp_strvalue);
+                       goto error;
+               }
+
+               if (SSL_check_private_key(state->ssl) != 1) {
+                       tls_error_log(request, "Failed validating TLS session certificate chain \"%s\"",
+                                     vp->vp_strvalue);
+                       goto error;
+               }
        }
+#endif
 
        /*
         *      In Server mode we only accept.