source: mod_gnutls/debian/patches/enable-tls-per-connection.patch @ 2db6923

From: Thomas Klute <thomas2.klute@uni-dortmund.de>
Date: Tue, 20 Jan 2015 16:30:36 +0100
Subject: Enable/disable TLS per connection in ssl_engine_disable

Previously, ssl_engine_disable set the server wide variable sc->enabled
to GNUTLS_ENABLED_FALSE, leading to mod_gnutls refusing to serve any
connection, including incoming client connections. The general HTTP
handler cannot process raw TLS traffic, so all further requests using
TLS failed.

This commit adds a new element "enabled" to struct mgs_handle_t, which
is used to disable TLS per connection, making it possible to disable TLS
for proxy back end connections while continuing to serve TLS clients.
---
 include/mod_gnutls.h.in |  2 ++
 src/gnutls_hooks.c      | 50 +++++++++++++++++++++++++++++++------------------
 src/mod_gnutls.c        | 23 +++++++++++++++++++----
 3 files changed, 53 insertions(+), 22 deletions(-)

diff --git a/include/mod_gnutls.h.in b/include/mod_gnutls.h.in
index 57aa52e..eba4cb2 100644
--- a/include/mod_gnutls.h.in
+++ b/include/mod_gnutls.h.in
@@ -170,6 +170,8 @@ typedef struct {
     mgs_srvconf_rec *sc;
        /* Connection record */
     conn_rec* c;
+       /* Is TLS enabled for this connection? */
+    int enabled;
        /* GnuTLS Session handle */
     gnutls_session_t session;
        /* module input status */
diff --git a/src/gnutls_hooks.c b/src/gnutls_hooks.c
index e6e7a67..9ba4ca1 100644
--- a/src/gnutls_hooks.c
+++ b/src/gnutls_hooks.c
@@ -674,14 +674,23 @@ mgs_srvconf_rec *mgs_find_sni_server(gnutls_session_t session) {
     return NULL;
 }
 
-static void create_gnutls_handle(conn_rec * c) {
-    mgs_handle_t *ctxt;
-    /* Get mod_gnutls Configuration Record */
-    mgs_srvconf_rec *sc =(mgs_srvconf_rec *)
-            ap_get_module_config(c->base_server->module_config,&gnutls_module);
+static void create_gnutls_handle(conn_rec * c)
+{
+    /* Get mod_gnutls server configuration */
+    mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
+            ap_get_module_config(c->base_server->module_config, &gnutls_module);
 
     _gnutls_log(debug_log_fp, "%s: %d\n", __func__, __LINE__);
-    ctxt = apr_pcalloc(c->pool, sizeof (*ctxt));
+
+    /* Get connection specific configuration */
+    mgs_handle_t *ctxt = (mgs_handle_t *) ap_get_module_config(c->conn_config, &gnutls_module);
+    if (ctxt == NULL)
+    {
+        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, "%s: allocating connection memory", __func__);
+        ctxt = apr_pcalloc(c->pool, sizeof (*ctxt));
+        ap_set_module_config(c->conn_config, &gnutls_module, ctxt);
+    }
+    ctxt->enabled = GNUTLS_ENABLED_TRUE;
     ctxt->c = c;
     ctxt->sc = sc;
     ctxt->status = 0;
@@ -692,6 +701,7 @@ static void create_gnutls_handle(conn_rec * c) {
     ctxt->output_bb = apr_brigade_create(c->pool, c->bucket_alloc);
     ctxt->output_blen = 0;
     ctxt->output_length = 0;
+
     /* Initialize GnuTLS Library */
     gnutls_init(&ctxt->session, GNUTLS_SERVER);
     /* Initialize Session Tickets */
@@ -707,8 +717,6 @@ static void create_gnutls_handle(conn_rec * c) {
     /* Initialize Session Cache */
     mgs_cache_session_init(ctxt);
 
-    /* Set this config for this connection */
-    ap_set_module_config(c->conn_config, &gnutls_module, ctxt);
     /* Set pull, push & ptr functions */
     gnutls_transport_set_pull_function(ctxt->session,
             mgs_transport_read);
@@ -722,15 +730,20 @@ static void create_gnutls_handle(conn_rec * c) {
             ctxt, NULL, c);
 }
 
-int mgs_hook_pre_connection(conn_rec * c, void *csd) {
-    mgs_srvconf_rec *sc;
-
+int mgs_hook_pre_connection(conn_rec * c, void *csd)
+{
     _gnutls_log(debug_log_fp, "%s: %d\n", __func__, __LINE__);
 
-    sc = (mgs_srvconf_rec *) ap_get_module_config(c->base_server->module_config,
-            &gnutls_module);
+    mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
+        ap_get_module_config(c->base_server->module_config, &gnutls_module);
+    mgs_handle_t *ctxt = (mgs_handle_t *)
+        ap_get_module_config(c->conn_config, &gnutls_module);
 
-    if (sc && (!sc->enabled || sc->proxy_enabled == GNUTLS_ENABLED_TRUE)) {
+    if ((sc && (!sc->enabled || sc->proxy_enabled == GNUTLS_ENABLED_TRUE))
+        || (ctxt && ctxt->enabled == GNUTLS_ENABLED_FALSE))
+    {
+        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, "%s declined connection",
+                      __func__);
         return DECLINED;
     }
 
@@ -752,11 +765,12 @@ int mgs_hook_fixups(request_rec * r) {
     _gnutls_log(debug_log_fp, "%s: %d\n", __func__, __LINE__);
     apr_table_t *env = r->subprocess_env;
 
-    ctxt =
-            ap_get_module_config(r->connection->conn_config,
-            &gnutls_module);
+    ctxt = ap_get_module_config(r->connection->conn_config,
+                                &gnutls_module);
 
-    if (!ctxt || ctxt->session == NULL) {
+    if (!ctxt || ctxt->enabled != GNUTLS_ENABLED_TRUE || ctxt->session == NULL)
+    {
+        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "request declined in %s", __func__);
         return DECLINED;
     }
 
diff --git a/src/mod_gnutls.c b/src/mod_gnutls.c
index 0a32ffd..e974ae8 100644
--- a/src/mod_gnutls.c
+++ b/src/mod_gnutls.c
@@ -19,8 +19,12 @@
 
 #include "mod_gnutls.h"
 
-static void gnutls_hooks(apr_pool_t * p) {
+#ifdef APLOG_USE_MODULE
+APLOG_USE_MODULE(gnutls);
+#endif
 
+static void gnutls_hooks(apr_pool_t * p)
+{
     /* Try Run Post-Config Hook After mod_proxy */
     static const char * const aszPre[] = { "mod_proxy.c", NULL };
     ap_hook_post_config(mgs_hook_post_config, aszPre, NULL,APR_HOOK_REALLY_LAST);
@@ -74,18 +78,29 @@ int ssl_is_https(conn_rec *c) {
     return 1;
 }
 
-int ssl_engine_disable(conn_rec *c) {
+int ssl_engine_disable(conn_rec *c)
+{
     mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
-            ap_get_module_config(c->base_server->module_config, &gnutls_module);
+        ap_get_module_config(c->base_server->module_config, &gnutls_module);
     if(sc->enabled == GNUTLS_ENABLED_FALSE) {
         return 1;
     }
+
+    /* disable TLS for this connection */
+    mgs_handle_t *ctxt = (mgs_handle_t *) ap_get_module_config(c->conn_config, &gnutls_module);
+    if (ctxt == NULL)
+    {
+        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, "%s: allocating connection memory", __func__);
+        ctxt = apr_pcalloc(c->pool, sizeof (*ctxt));
+        ap_set_module_config(c->conn_config, &gnutls_module, ctxt);
+    }
+    ctxt->enabled = GNUTLS_ENABLED_FALSE;
+
     if (c->input_filters)
         ap_remove_input_filter(c->input_filters);
     if (c->output_filters)
         ap_remove_output_filter(c->output_filters);
     mgs_cleanup_pre_config(c->pool);
-    sc->enabled = 0;
     return 1;
 }