+/* We only have one certificate to authenticate with, as both client and server. Unfortunately,
+ * GnuTLS tries to be clever, and as client, will attempt to use a certificate that the server
+ * will trust. We usually use self-signed certs, though, so the result of this search is always
+ * nothing. Therefore, it uses no certificate to authenticate as a client. This is undesirable
+ * as it breaks fingerprint auth. Thus, we use this callback to force GnuTLS to always
+ * authenticate with our certificate at all times.
+ */
+#if GNUTLS_VERSION_MAJOR < 3
+static int
+cert_callback(gnutls_session_t session, const gnutls_datum_t *req_ca_rdn, int nreqs,
+ const gnutls_pk_algorithm_t *sign_algos, int sign_algos_len, gnutls_retr_st *st)
+#else
+static int
+cert_callback(gnutls_session_t session, const gnutls_datum_t *req_ca_rdn, int nreqs,
+ const gnutls_pk_algorithm_t *sign_algos, int sign_algos_len, gnutls_retr2_st *st)
+#endif
+{
+ /* XXX - ugly hack. Tell GnuTLS to use the first (only) certificate we have for auth. */
+#if (GNUTLS_VERSION_MAJOR < 3)
+ st->type = GNUTLS_CRT_X509;
+#else
+ st->cert_type = GNUTLS_CRT_X509;
+ st->key_type = GNUTLS_PRIVKEY_X509;
+#endif
+ st->ncerts = x509_cert_count;
+ st->cert.x509 = x509_cert;
+ st->key.x509 = x509_key;
+ st->deinit_all = 0;
+
+ return 0;
+}
+