1 | /** |
---|
2 | * Copyright 2004-2005 Paul Querna |
---|
3 | * |
---|
4 | * Licensed under the Apache License, Version 2.0 (the "License"); |
---|
5 | * you may not use this file except in compliance with the License. |
---|
6 | * You may obtain a copy of the License at |
---|
7 | * |
---|
8 | * http://www.apache.org/licenses/LICENSE-2.0 |
---|
9 | * |
---|
10 | * Unless required by applicable law or agreed to in writing, software |
---|
11 | * distributed under the License is distributed on an "AS IS" BASIS, |
---|
12 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
---|
13 | * See the License for the specific language governing permissions and |
---|
14 | * limitations under the License. |
---|
15 | * |
---|
16 | */ |
---|
17 | |
---|
18 | #include "httpd.h" |
---|
19 | #include "http_config.h" |
---|
20 | #include "http_protocol.h" |
---|
21 | #include "http_connection.h" |
---|
22 | #include "http_request.h" |
---|
23 | #include "http_core.h" |
---|
24 | #include "http_log.h" |
---|
25 | #include "apr_buckets.h" |
---|
26 | #include "apr_strings.h" |
---|
27 | #include "apr_tables.h" |
---|
28 | #include "ap_release.h" |
---|
29 | |
---|
30 | #include <gcrypt.h> |
---|
31 | #include <gnutls/gnutls.h> |
---|
32 | #include <gnutls/x509.h> |
---|
33 | |
---|
34 | #ifndef __mod_gnutls_h_inc |
---|
35 | #define __mod_gnutls_h_inc |
---|
36 | |
---|
37 | #define HAVE_APR_MEMCACHE @have_apr_memcache@ |
---|
38 | |
---|
39 | module AP_MODULE_DECLARE_DATA gnutls_module; |
---|
40 | |
---|
41 | #define GNUTLS_OUTPUT_FILTER_NAME "gnutls_output_filter" |
---|
42 | #define GNUTLS_INPUT_FILTER_NAME "gnutls_input_filter" |
---|
43 | |
---|
44 | #define GNUTLS_ENABLED_FALSE 0 |
---|
45 | #define GNUTLS_ENABLED_TRUE 1 |
---|
46 | |
---|
47 | #define MOD_GNUTLS_VERSION "@MOD_GNUTLS_VERSION@" |
---|
48 | |
---|
49 | #define MOD_GNUTLS_DEBUG @OOO_MAINTAIN@ |
---|
50 | |
---|
51 | /* Recent Versions of 2.1 renamed several hooks. This allows us to |
---|
52 | compile on 2.0.xx */ |
---|
53 | #if AP_SERVER_MINORVERSION_NUMBER >= 1 |
---|
54 | #if AP_SERVER_PATCHLEVEL_NUMBER >= 3 |
---|
55 | #define USING_2_1_RECENT 1 |
---|
56 | #endif |
---|
57 | #endif |
---|
58 | |
---|
59 | #ifndef USING_2_1_RECENT |
---|
60 | #define USING_2_1_RECENT 0 |
---|
61 | #endif |
---|
62 | |
---|
63 | typedef enum |
---|
64 | { |
---|
65 | mod_gnutls_cache_none, |
---|
66 | mod_gnutls_cache_dbm, |
---|
67 | #if HAVE_APR_MEMCACHE |
---|
68 | mod_gnutls_cache_memcache |
---|
69 | #endif |
---|
70 | } mod_gnutls_cache_e; |
---|
71 | |
---|
72 | typedef struct |
---|
73 | { |
---|
74 | int client_verify_mode; |
---|
75 | } mod_gnutls_dirconf_rec; |
---|
76 | |
---|
77 | typedef struct |
---|
78 | { |
---|
79 | gnutls_certificate_credentials_t certs; |
---|
80 | char* cert_cn; |
---|
81 | gnutls_x509_crt_t cert_x509; |
---|
82 | gnutls_x509_privkey_t privkey_x509; |
---|
83 | int enabled; |
---|
84 | int ciphers[16]; |
---|
85 | int key_exchange[16]; |
---|
86 | int macs[16]; |
---|
87 | int protocol[16]; |
---|
88 | int compression[16]; |
---|
89 | int cert_types[16]; |
---|
90 | apr_time_t cache_timeout; |
---|
91 | mod_gnutls_cache_e cache_type; |
---|
92 | const char* cache_config; |
---|
93 | const char* rsa_params_file; |
---|
94 | const char* dh_params_file; |
---|
95 | int client_verify_mode; |
---|
96 | } mod_gnutls_srvconf_rec; |
---|
97 | |
---|
98 | typedef struct { |
---|
99 | int length; |
---|
100 | char *value; |
---|
101 | } mod_gnutls_char_buffer_t; |
---|
102 | |
---|
103 | typedef struct |
---|
104 | { |
---|
105 | mod_gnutls_srvconf_rec *sc; |
---|
106 | conn_rec* c; |
---|
107 | gnutls_session_t session; |
---|
108 | |
---|
109 | apr_status_t input_rc; |
---|
110 | ap_filter_t *input_filter; |
---|
111 | apr_bucket_brigade *input_bb; |
---|
112 | apr_read_type_e input_block; |
---|
113 | ap_input_mode_t input_mode; |
---|
114 | mod_gnutls_char_buffer_t input_cbuf; |
---|
115 | char input_buffer[AP_IOBUFSIZE]; |
---|
116 | |
---|
117 | apr_status_t output_rc; |
---|
118 | ap_filter_t *output_filter; |
---|
119 | apr_bucket_brigade *output_bb; |
---|
120 | char output_buffer[AP_IOBUFSIZE]; |
---|
121 | apr_size_t output_blen; |
---|
122 | apr_size_t output_length; |
---|
123 | |
---|
124 | int status; |
---|
125 | int non_https; |
---|
126 | } mod_gnutls_handle_t; |
---|
127 | |
---|
128 | /** Functions in gnutls_io.c **/ |
---|
129 | |
---|
130 | /** |
---|
131 | * mod_gnutls_filter_input will filter the input data |
---|
132 | * by decrypting it using GnuTLS and passes it cleartext. |
---|
133 | * |
---|
134 | * @param f the filter info record |
---|
135 | * @param bb the bucket brigade, where to store the result to |
---|
136 | * @param mode what shall we read? |
---|
137 | * @param block a block index we shall read from? |
---|
138 | * @return result status |
---|
139 | */ |
---|
140 | apr_status_t mod_gnutls_filter_input(ap_filter_t * f, |
---|
141 | apr_bucket_brigade * bb, |
---|
142 | ap_input_mode_t mode, |
---|
143 | apr_read_type_e block, |
---|
144 | apr_off_t readbytes); |
---|
145 | |
---|
146 | /** |
---|
147 | * mod_gnutls_filter_output will filter the encrypt |
---|
148 | * the incoming bucket using GnuTLS and passes it onto the next filter. |
---|
149 | * |
---|
150 | * @param f the filter info record |
---|
151 | * @param bb the bucket brigade, where to store the result to |
---|
152 | * @return result status |
---|
153 | */ |
---|
154 | apr_status_t mod_gnutls_filter_output(ap_filter_t * f, |
---|
155 | apr_bucket_brigade * bb); |
---|
156 | |
---|
157 | |
---|
158 | /** |
---|
159 | * mod_gnutls_transport_read is called from GnuTLS to provide encrypted |
---|
160 | * data from the client. |
---|
161 | * |
---|
162 | * @param ptr pointer to the filter context |
---|
163 | * @param buffer place to put data |
---|
164 | * @param len maximum size |
---|
165 | * @return size length of the data stored in buffer |
---|
166 | */ |
---|
167 | ssize_t mod_gnutls_transport_read(gnutls_transport_ptr_t ptr, |
---|
168 | void *buffer, size_t len); |
---|
169 | |
---|
170 | /** |
---|
171 | * mod_gnutls_transport_write is called from GnuTLS to |
---|
172 | * write data to the client. |
---|
173 | * |
---|
174 | * @param ptr pointer to the filter context |
---|
175 | * @param buffer buffer to write to the client |
---|
176 | * @param len size of the buffer |
---|
177 | * @return size length of the data written |
---|
178 | */ |
---|
179 | ssize_t mod_gnutls_transport_write(gnutls_transport_ptr_t ptr, |
---|
180 | const void *buffer, size_t len); |
---|
181 | |
---|
182 | |
---|
183 | int mod_gnutls_rehandshake(mod_gnutls_handle_t * ctxt); |
---|
184 | |
---|
185 | |
---|
186 | |
---|
187 | /** |
---|
188 | * Init the Cache after Configuration is done |
---|
189 | */ |
---|
190 | int mod_gnutls_cache_post_config(apr_pool_t *p, server_rec *s, |
---|
191 | mod_gnutls_srvconf_rec *sc); |
---|
192 | /** |
---|
193 | * Init the Cache inside each Process |
---|
194 | */ |
---|
195 | int mod_gnutls_cache_child_init(apr_pool_t *p, server_rec *s, |
---|
196 | mod_gnutls_srvconf_rec *sc); |
---|
197 | /** |
---|
198 | * Setup the Session Caching |
---|
199 | */ |
---|
200 | int mod_gnutls_cache_session_init(mod_gnutls_handle_t *ctxt); |
---|
201 | |
---|
202 | #define GNUTLS_SESSION_ID_STRING_LEN \ |
---|
203 | ((GNUTLS_MAX_SESSION_ID + 1) * 2) |
---|
204 | |
---|
205 | /** |
---|
206 | * Convert a SSL Session ID into a Null Terminated Hex Encoded String |
---|
207 | * @param id raw SSL Session ID |
---|
208 | * @param idlen Length of the raw Session ID |
---|
209 | * @param str Location to store the Hex Encoded String |
---|
210 | * @param strsize The Maximum Length that can be stored in str |
---|
211 | */ |
---|
212 | char *mod_gnutls_session_id2sz(unsigned char *id, int idlen, |
---|
213 | char *str, int strsize); |
---|
214 | |
---|
215 | #endif /* __mod_gnutls_h_inc */ |
---|