[de80d66] | 1 | /** |
---|
| 2 | * Copyright 2004-2005 Paul Querna |
---|
| 3 | * |
---|
| 4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
---|
| 5 | * you may not use this file except in compliance with the License. |
---|
| 6 | * You may obtain a copy of the License at |
---|
| 7 | * |
---|
| 8 | * http://www.apache.org/licenses/LICENSE-2.0 |
---|
| 9 | * |
---|
| 10 | * Unless required by applicable law or agreed to in writing, software |
---|
| 11 | * distributed under the License is distributed on an "AS IS" BASIS, |
---|
| 12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
---|
| 13 | * See the License for the specific language governing permissions and |
---|
| 14 | * limitations under the License. |
---|
| 15 | * |
---|
| 16 | */ |
---|
| 17 | |
---|
| 18 | #include "httpd.h" |
---|
| 19 | #include "http_config.h" |
---|
| 20 | #include "http_protocol.h" |
---|
| 21 | #include "http_connection.h" |
---|
| 22 | #include "http_request.h" |
---|
| 23 | #include "http_core.h" |
---|
| 24 | #include "http_log.h" |
---|
| 25 | #include "apr_buckets.h" |
---|
| 26 | #include "apr_strings.h" |
---|
| 27 | #include "apr_tables.h" |
---|
[8eb6ccd] | 28 | #include "ap_release.h" |
---|
[de80d66] | 29 | |
---|
[3e94bd3] | 30 | #include <gcrypt.h> |
---|
| 31 | #include <gnutls/gnutls.h> |
---|
[9d9b093] | 32 | #include <gnutls/extra.h> |
---|
| 33 | #include <gnutls/openpgp.h> |
---|
[3e94bd3] | 34 | #include <gnutls/x509.h> |
---|
| 35 | |
---|
[de80d66] | 36 | #ifndef __mod_gnutls_h_inc |
---|
| 37 | #define __mod_gnutls_h_inc |
---|
| 38 | |
---|
| 39 | #define HAVE_APR_MEMCACHE @have_apr_memcache@ |
---|
| 40 | |
---|
| 41 | module AP_MODULE_DECLARE_DATA gnutls_module; |
---|
| 42 | |
---|
| 43 | #define GNUTLS_OUTPUT_FILTER_NAME "gnutls_output_filter" |
---|
| 44 | #define GNUTLS_INPUT_FILTER_NAME "gnutls_input_filter" |
---|
| 45 | |
---|
| 46 | #define GNUTLS_ENABLED_FALSE 0 |
---|
| 47 | #define GNUTLS_ENABLED_TRUE 1 |
---|
| 48 | |
---|
| 49 | #define MOD_GNUTLS_VERSION "@MOD_GNUTLS_VERSION@" |
---|
| 50 | |
---|
[8eb6ccd] | 51 | #define MOD_GNUTLS_DEBUG @OOO_MAINTAIN@ |
---|
| 52 | |
---|
| 53 | /* Recent Versions of 2.1 renamed several hooks. This allows us to |
---|
| 54 | compile on 2.0.xx */ |
---|
| 55 | #if AP_SERVER_MINORVERSION_NUMBER >= 1 |
---|
| 56 | #if AP_SERVER_PATCHLEVEL_NUMBER >= 3 |
---|
| 57 | #define USING_2_1_RECENT 1 |
---|
| 58 | #endif |
---|
| 59 | #endif |
---|
| 60 | |
---|
| 61 | #ifndef USING_2_1_RECENT |
---|
| 62 | #define USING_2_1_RECENT 0 |
---|
| 63 | #endif |
---|
| 64 | |
---|
[de80d66] | 65 | typedef enum |
---|
| 66 | { |
---|
[3e94bd3] | 67 | mgs_cache_none, |
---|
| 68 | mgs_cache_dbm, |
---|
[de80d66] | 69 | #if HAVE_APR_MEMCACHE |
---|
[3e94bd3] | 70 | mgs_cache_memcache |
---|
[de80d66] | 71 | #endif |
---|
[3e94bd3] | 72 | } mgs_cache_e; |
---|
| 73 | |
---|
| 74 | typedef struct |
---|
| 75 | { |
---|
| 76 | int client_verify_mode; |
---|
[70c2d86] | 77 | const char* lua_bytecode; |
---|
| 78 | apr_size_t lua_bytecode_len; |
---|
[3e94bd3] | 79 | } mgs_dirconf_rec; |
---|
[de80d66] | 80 | |
---|
[70c2d86] | 81 | |
---|
| 82 | /* The maximum number of client CA certificates allowed. |
---|
| 83 | */ |
---|
| 84 | #define MAX_CA_CRTS 128 |
---|
[2a2272d] | 85 | |
---|
| 86 | /* The maximum number of certificates to send in a chain |
---|
| 87 | */ |
---|
| 88 | #define MAX_CHAIN_SIZE 8 |
---|
[70c2d86] | 89 | |
---|
[de80d66] | 90 | typedef struct |
---|
| 91 | { |
---|
| 92 | gnutls_certificate_credentials_t certs; |
---|
[70c2d86] | 93 | gnutls_srp_server_credentials_t srp_creds; |
---|
| 94 | gnutls_anon_server_credentials_t anon_creds; |
---|
[3e94bd3] | 95 | char* cert_cn; |
---|
[2a2272d] | 96 | gnutls_x509_crt_t certs_x509[MAX_CHAIN_SIZE]; /* A certificate chain */ |
---|
| 97 | unsigned int certs_x509_num; |
---|
[3e94bd3] | 98 | gnutls_x509_privkey_t privkey_x509; |
---|
[9d9b093] | 99 | gnutls_openpgp_crt_t cert_pgp; /* A certificate chain */ |
---|
| 100 | gnutls_openpgp_privkey_t privkey_pgp; |
---|
[de80d66] | 101 | int enabled; |
---|
[70c2d86] | 102 | /* whether to send the PEM encoded certificates |
---|
| 103 | * to CGIs |
---|
| 104 | */ |
---|
| 105 | int export_certificates_enabled; |
---|
[ec06980] | 106 | gnutls_priority_t priorities; |
---|
[a4839ae] | 107 | gnutls_rsa_params_t rsa_params; |
---|
| 108 | gnutls_dh_params_t dh_params; |
---|
[ec06980] | 109 | int cache_timeout; |
---|
[3e94bd3] | 110 | mgs_cache_e cache_type; |
---|
[de80d66] | 111 | const char* cache_config; |
---|
[70c2d86] | 112 | const char* srp_tpasswd_file; |
---|
| 113 | const char* srp_tpasswd_conf_file; |
---|
| 114 | gnutls_x509_crt_t ca_list[MAX_CA_CRTS]; |
---|
[9d9b093] | 115 | gnutls_openpgp_keyring_t pgp_list; |
---|
[70c2d86] | 116 | unsigned int ca_list_size; |
---|
[3e94bd3] | 117 | int client_verify_mode; |
---|
| 118 | } mgs_srvconf_rec; |
---|
[de80d66] | 119 | |
---|
| 120 | typedef struct { |
---|
| 121 | int length; |
---|
| 122 | char *value; |
---|
[3e94bd3] | 123 | } mgs_char_buffer_t; |
---|
[de80d66] | 124 | |
---|
| 125 | typedef struct |
---|
| 126 | { |
---|
[3e94bd3] | 127 | mgs_srvconf_rec *sc; |
---|
[de80d66] | 128 | conn_rec* c; |
---|
| 129 | gnutls_session_t session; |
---|
| 130 | |
---|
| 131 | apr_status_t input_rc; |
---|
| 132 | ap_filter_t *input_filter; |
---|
| 133 | apr_bucket_brigade *input_bb; |
---|
| 134 | apr_read_type_e input_block; |
---|
| 135 | ap_input_mode_t input_mode; |
---|
[3e94bd3] | 136 | mgs_char_buffer_t input_cbuf; |
---|
[de80d66] | 137 | char input_buffer[AP_IOBUFSIZE]; |
---|
| 138 | |
---|
| 139 | apr_status_t output_rc; |
---|
| 140 | ap_filter_t *output_filter; |
---|
| 141 | apr_bucket_brigade *output_bb; |
---|
| 142 | char output_buffer[AP_IOBUFSIZE]; |
---|
| 143 | apr_size_t output_blen; |
---|
| 144 | apr_size_t output_length; |
---|
| 145 | |
---|
| 146 | int status; |
---|
| 147 | int non_https; |
---|
[3e94bd3] | 148 | } mgs_handle_t; |
---|
[de80d66] | 149 | |
---|
| 150 | /** Functions in gnutls_io.c **/ |
---|
| 151 | |
---|
| 152 | /** |
---|
[3e94bd3] | 153 | * mgs_filter_input will filter the input data |
---|
[de80d66] | 154 | * by decrypting it using GnuTLS and passes it cleartext. |
---|
| 155 | * |
---|
| 156 | * @param f the filter info record |
---|
| 157 | * @param bb the bucket brigade, where to store the result to |
---|
| 158 | * @param mode what shall we read? |
---|
| 159 | * @param block a block index we shall read from? |
---|
| 160 | * @return result status |
---|
| 161 | */ |
---|
[3e94bd3] | 162 | apr_status_t mgs_filter_input(ap_filter_t * f, |
---|
[de80d66] | 163 | apr_bucket_brigade * bb, |
---|
| 164 | ap_input_mode_t mode, |
---|
| 165 | apr_read_type_e block, |
---|
| 166 | apr_off_t readbytes); |
---|
| 167 | |
---|
| 168 | /** |
---|
[3e94bd3] | 169 | * mgs_filter_output will filter the encrypt |
---|
[de80d66] | 170 | * the incoming bucket using GnuTLS and passes it onto the next filter. |
---|
| 171 | * |
---|
| 172 | * @param f the filter info record |
---|
| 173 | * @param bb the bucket brigade, where to store the result to |
---|
| 174 | * @return result status |
---|
| 175 | */ |
---|
[3e94bd3] | 176 | apr_status_t mgs_filter_output(ap_filter_t * f, |
---|
[de80d66] | 177 | apr_bucket_brigade * bb); |
---|
| 178 | |
---|
| 179 | |
---|
| 180 | /** |
---|
[3e94bd3] | 181 | * mgs_transport_read is called from GnuTLS to provide encrypted |
---|
[de80d66] | 182 | * data from the client. |
---|
| 183 | * |
---|
| 184 | * @param ptr pointer to the filter context |
---|
| 185 | * @param buffer place to put data |
---|
| 186 | * @param len maximum size |
---|
| 187 | * @return size length of the data stored in buffer |
---|
| 188 | */ |
---|
[3e94bd3] | 189 | ssize_t mgs_transport_read(gnutls_transport_ptr_t ptr, |
---|
[de80d66] | 190 | void *buffer, size_t len); |
---|
| 191 | |
---|
| 192 | /** |
---|
[3e94bd3] | 193 | * mgs_transport_write is called from GnuTLS to |
---|
[de80d66] | 194 | * write data to the client. |
---|
| 195 | * |
---|
| 196 | * @param ptr pointer to the filter context |
---|
| 197 | * @param buffer buffer to write to the client |
---|
| 198 | * @param len size of the buffer |
---|
| 199 | * @return size length of the data written |
---|
| 200 | */ |
---|
[3e94bd3] | 201 | ssize_t mgs_transport_write(gnutls_transport_ptr_t ptr, |
---|
[de80d66] | 202 | const void *buffer, size_t len); |
---|
| 203 | |
---|
| 204 | |
---|
[3e94bd3] | 205 | int mgs_rehandshake(mgs_handle_t * ctxt); |
---|
| 206 | |
---|
| 207 | |
---|
| 208 | |
---|
[de80d66] | 209 | /** |
---|
| 210 | * Init the Cache after Configuration is done |
---|
| 211 | */ |
---|
[3e94bd3] | 212 | int mgs_cache_post_config(apr_pool_t *p, server_rec *s, |
---|
| 213 | mgs_srvconf_rec *sc); |
---|
[de80d66] | 214 | /** |
---|
| 215 | * Init the Cache inside each Process |
---|
| 216 | */ |
---|
[3e94bd3] | 217 | int mgs_cache_child_init(apr_pool_t *p, server_rec *s, |
---|
| 218 | mgs_srvconf_rec *sc); |
---|
[de80d66] | 219 | /** |
---|
| 220 | * Setup the Session Caching |
---|
| 221 | */ |
---|
[3e94bd3] | 222 | int mgs_cache_session_init(mgs_handle_t *ctxt); |
---|
[de80d66] | 223 | |
---|
| 224 | #define GNUTLS_SESSION_ID_STRING_LEN \ |
---|
| 225 | ((GNUTLS_MAX_SESSION_ID + 1) * 2) |
---|
| 226 | |
---|
| 227 | /** |
---|
| 228 | * Convert a SSL Session ID into a Null Terminated Hex Encoded String |
---|
| 229 | * @param id raw SSL Session ID |
---|
| 230 | * @param idlen Length of the raw Session ID |
---|
| 231 | * @param str Location to store the Hex Encoded String |
---|
| 232 | * @param strsize The Maximum Length that can be stored in str |
---|
| 233 | */ |
---|
[3e94bd3] | 234 | char *mgs_session_id2sz(unsigned char *id, int idlen, |
---|
[de80d66] | 235 | char *str, int strsize); |
---|
| 236 | |
---|
[70c2d86] | 237 | /** |
---|
| 238 | * Convert a time_t into a Null Terminated String |
---|
| 239 | * @param t time_t time |
---|
| 240 | * @param str Location to store the Hex Encoded String |
---|
| 241 | * @param strsize The Maximum Length that can be stored in str |
---|
| 242 | */ |
---|
| 243 | char *mgs_time2sz(time_t t, char *str, int strsize); |
---|
| 244 | |
---|
[3e94bd3] | 245 | |
---|
| 246 | /* Configuration Functions */ |
---|
| 247 | |
---|
[70c2d86] | 248 | const char *mgs_set_srp_tpasswd_conf_file(cmd_parms * parms, void *dummy, |
---|
| 249 | const char *arg); |
---|
| 250 | const char *mgs_set_srp_tpasswd_file(cmd_parms * parms, void *dummy, |
---|
| 251 | const char *arg); |
---|
| 252 | const char *mgs_set_dh_file(cmd_parms * parms, void *dummy, |
---|
| 253 | const char *arg); |
---|
| 254 | const char *mgs_set_rsa_export_file(cmd_parms * parms, void *dummy, |
---|
| 255 | const char *arg); |
---|
[3e94bd3] | 256 | const char *mgs_set_cert_file(cmd_parms * parms, void *dummy, |
---|
| 257 | const char *arg); |
---|
| 258 | |
---|
| 259 | const char *mgs_set_key_file(cmd_parms * parms, void *dummy, |
---|
| 260 | const char *arg); |
---|
| 261 | |
---|
[9d9b093] | 262 | const char *mgs_set_pgpcert_file(cmd_parms * parms, void *dummy, |
---|
| 263 | const char *arg); |
---|
| 264 | |
---|
| 265 | const char *mgs_set_pgpkey_file(cmd_parms * parms, void *dummy, |
---|
| 266 | const char *arg); |
---|
| 267 | |
---|
[3e94bd3] | 268 | const char *mgs_set_cache(cmd_parms * parms, void *dummy, |
---|
| 269 | const char *type, const char* arg); |
---|
| 270 | |
---|
| 271 | const char *mgs_set_cache_timeout(cmd_parms * parms, void *dummy, |
---|
| 272 | const char *arg); |
---|
| 273 | |
---|
| 274 | const char *mgs_set_client_verify(cmd_parms * parms, void *dummy, |
---|
| 275 | const char *arg); |
---|
| 276 | |
---|
| 277 | const char *mgs_set_client_ca_file(cmd_parms * parms, void *dummy, |
---|
| 278 | const char *arg); |
---|
| 279 | |
---|
[9d9b093] | 280 | const char *mgs_set_keyring_file(cmd_parms * parms, void *dummy, |
---|
| 281 | const char *arg); |
---|
| 282 | |
---|
[3e94bd3] | 283 | const char *mgs_set_enabled(cmd_parms * parms, void *dummy, |
---|
| 284 | const char *arg); |
---|
[70c2d86] | 285 | const char *mgs_set_export_certificates_enabled(cmd_parms * parms, void *dummy, |
---|
| 286 | const char *arg); |
---|
[ec06980] | 287 | const char *mgs_set_priorities(cmd_parms * parms, void *dummy, |
---|
[70c2d86] | 288 | const char *arg); |
---|
| 289 | |
---|
| 290 | const char *mgs_set_require_section(cmd_parms *cmd, |
---|
| 291 | void *mconfig, const char *arg); |
---|
[3e94bd3] | 292 | void *mgs_config_server_create(apr_pool_t * p, server_rec * s); |
---|
| 293 | |
---|
[70c2d86] | 294 | void *mgs_config_dir_merge(apr_pool_t *p, void *basev, void *addv); |
---|
| 295 | |
---|
[3e94bd3] | 296 | void *mgs_config_dir_create(apr_pool_t *p, char *dir); |
---|
| 297 | |
---|
[70c2d86] | 298 | const char *mgs_set_require_bytecode(cmd_parms *cmd, |
---|
| 299 | void *mconfig, const char *arg); |
---|
| 300 | |
---|
[3e94bd3] | 301 | mgs_srvconf_rec* mgs_find_sni_server(gnutls_session_t session); |
---|
| 302 | |
---|
| 303 | /* mod_gnutls Hooks. */ |
---|
| 304 | |
---|
| 305 | int mgs_hook_pre_config(apr_pool_t * pconf, |
---|
| 306 | apr_pool_t * plog, apr_pool_t * ptemp); |
---|
| 307 | |
---|
| 308 | int mgs_hook_post_config(apr_pool_t * p, apr_pool_t * plog, |
---|
| 309 | apr_pool_t * ptemp, |
---|
| 310 | server_rec * base_server); |
---|
| 311 | |
---|
| 312 | void mgs_hook_child_init(apr_pool_t *p, server_rec *s); |
---|
| 313 | |
---|
| 314 | const char *mgs_hook_http_scheme(const request_rec * r); |
---|
| 315 | |
---|
| 316 | apr_port_t mgs_hook_default_port(const request_rec * r); |
---|
| 317 | |
---|
| 318 | int mgs_hook_pre_connection(conn_rec * c, void *csd); |
---|
| 319 | |
---|
| 320 | int mgs_hook_fixups(request_rec *r); |
---|
| 321 | |
---|
| 322 | int mgs_hook_authz(request_rec *r); |
---|
| 323 | |
---|
[70c2d86] | 324 | int mgs_authz_lua(request_rec* r); |
---|
| 325 | |
---|
[de80d66] | 326 | #endif /* __mod_gnutls_h_inc */ |
---|