Re: [PATCH 2/5] tlshd: Server-side dual certificate support

[Chuck Lever <chuck.lever@oracle.com>]

On 9/3/25 9:28 AM, Scott Mayhew wrote:
> On Fri, 29 Aug 2025, Chuck Lever wrote:
> 
>> On 8/28/25 6:23 PM, Scott Mayhew wrote:
>>> Add two new config options, "x509.pq.certificate" and
>>> "x509.pq.private_key" to configure tlshd to use an ML-DSA certificate.
>>> If the cert callback determines that the client supports ML-DSA, it will
>>> select this certificate.  Otherwise, it will fall back to the
>>> traditional certficate (i.e. the certificate configured via
>>> "x509.certificate" and "x509.private_key").
>>>
>>> Link: https://github.com/oracle/ktls-utils/issues/113
>>> Signed-off-by: Scott Mayhew <smayhew@redhat.com>
>>> ---
>>>  configure.ac             | 12 ++++++++
>>>  src/tlshd/config.c       | 12 +++++---
>>>  src/tlshd/server.c       | 59 ++++++++++++++++++++++++++++++++++++++--
>>>  src/tlshd/tlshd.conf     |  2 ++
>>>  src/tlshd/tlshd.conf.man | 13 +++++++++
>>>  src/tlshd/tlshd.h        |  6 ++--
>>>  6 files changed, 96 insertions(+), 8 deletions(-)
>>>
>>> diff --git a/configure.ac b/configure.ac
>>> index a6d9d09..0dd23f2 100644
>>> --- a/configure.ac
>>> +++ b/configure.ac
>>> @@ -79,6 +79,18 @@ AC_CHECK_LIB([gnutls], [gnutls_get_system_config_file],
>>>  AC_CHECK_LIB([gnutls], [gnutls_psk_allocate_client_credentials2],
>>>               [AC_DEFINE([HAVE_GNUTLS_PSK_ALLOCATE_CREDENTIALS2], [1],
>>>                          [Define to 1 if you have the gnutls_psk_allocate_client_credentials2 function.])])
>>> +
>>> +AC_MSG_CHECKING(for ML-DSA support in gnutls)
>>> +AC_COMPILE_IFELSE(
>>> +	[AC_LANG_PROGRAM([[ #include <gnutls/gnutls.h> ]],
>>> +		[[ (void) GNUTLS_SIGN_MLDSA65; ]])],
>>> +	[ have_mldsa=yes ],
>>> +	[ have_mldsa=no ])
>>> +AC_MSG_RESULT([$have_mldsa])
>>> +if test "x$have_mldsa" = xyes ; then
>>> +	AC_DEFINE([HAVE_GNUTLS_MLDSA], [1], [Define to 1 if gnutls supports ML-DSA])
>>> +fi
>>> +
>>>  AC_SUBST([AM_CPPFLAGS])
>>>  
>>>  AC_CONFIG_FILES([Makefile src/Makefile src/tlshd/Makefile systemd/Makefile])
>>
>> Nice.
>>
>>
>>> diff --git a/src/tlshd/config.c b/src/tlshd/config.c
>>> index 4c54d37..20634dd 100644
>>> --- a/src/tlshd/config.c
>>> +++ b/src/tlshd/config.c
>>> @@ -403,6 +403,7 @@ bool tlshd_config_get_server_crl(char **result)
>>>  
>>>  /**
>>>   * tlshd_config_get_server_certs - Get certs for ServerHello from .conf
>>> + * @key: IN: the key field name from .conf
>>
>> ETOOMANYTHINGSCALLEDKEY :-)
>>
>> Can you find a less overloaded name for the new function parameter, here
>> and below?
> 
> Yeah, I called it 'key' because that's what it's referred to in
> https://docs.gtk.org/glib/method.KeyFile.get_string.html
> I'm open to suggestions (gkey? gfile_key? option?)

How about @cert_type ?

If you need to keep this parameter, I would make it an enumerated
integer. Keep the knowledge about the config option name internal
to config.c.


-- 
Chuck Lever