1 | /* |
---|
2 | * Copyright 2004-2005 Paul Querna |
---|
3 | * Copyright 2008 Nikos Mavrogiannopoulos |
---|
4 | * Copyright 2011 Dash Shendy |
---|
5 | * Copyright 2015-2018 Fiona Klute |
---|
6 | * |
---|
7 | * Licensed under the Apache License, Version 2.0 (the "License"); |
---|
8 | * you may not use this file except in compliance with the License. |
---|
9 | * You may obtain a copy of the License at |
---|
10 | * |
---|
11 | * http://www.apache.org/licenses/LICENSE-2.0 |
---|
12 | * |
---|
13 | * Unless required by applicable law or agreed to in writing, software |
---|
14 | * distributed under the License is distributed on an "AS IS" BASIS, |
---|
15 | * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
---|
16 | * See the License for the specific language governing permissions and |
---|
17 | * limitations under the License. |
---|
18 | */ |
---|
19 | |
---|
20 | /** |
---|
21 | * @file gnutls_cache.c |
---|
22 | * |
---|
23 | * The signatures of the `(dbm|mc)_cache_...()` functions may be a bit |
---|
24 | * confusing: "store" and "expire" take a server_rec, "fetch" an |
---|
25 | * mgs_handle_t, and "delete" the `void*` required for a |
---|
26 | * `gnutls_db_remove_func`. The first two have matching `..._session` |
---|
27 | * functions to fit their respective GnuTLS session cache signatures. |
---|
28 | * |
---|
29 | * This is because "store", "expire" (dbm only), and "fetch" are also |
---|
30 | * needed for the OCSP cache. Their `..._session` variants have been |
---|
31 | * created to take care of the session cache specific parts, mainly |
---|
32 | * calculating the DB key from the session ID. They have to match the |
---|
33 | * appropriate GnuTLS DB function signatures. |
---|
34 | * |
---|
35 | * Additionally, there are the `mc_cache_(store|fetch)_generic()` |
---|
36 | * functions. They exist because memcached requires string keys while |
---|
37 | * DBM accepts binary keys, and provide wrappers to turn binary keys |
---|
38 | * into hex strings with a `mod_gnutls:` prefix. |
---|
39 | * |
---|
40 | * To update cached OCSP responses independent of client connections, |
---|
41 | * "store" and "expire" have to work without a connection context. On |
---|
42 | * the other hand "fetch" does not need to do that, because cached |
---|
43 | * OCSP responses will be retrieved for use in client connections. |
---|
44 | */ |
---|
45 | |
---|
46 | #include "gnutls_cache.h" |
---|
47 | #include "mod_gnutls.h" |
---|
48 | #include "gnutls_config.h" |
---|
49 | |
---|
50 | #if HAVE_APR_MEMCACHE |
---|
51 | #include "apr_memcache.h" |
---|
52 | #endif |
---|
53 | |
---|
54 | #include "apr_dbm.h" |
---|
55 | #include <apr_escape.h> |
---|
56 | |
---|
57 | #include "ap_mpm.h" |
---|
58 | #include <util_mutex.h> |
---|
59 | |
---|
60 | #include <unistd.h> |
---|
61 | #include <sys/types.h> |
---|
62 | |
---|
63 | #if !defined(OS2) && !defined(WIN32) && !defined(BEOS) && !defined(NETWARE) |
---|
64 | #include "unixd.h" |
---|
65 | #endif |
---|
66 | |
---|
67 | /** Default session cache timeout */ |
---|
68 | #define MGS_DEFAULT_CACHE_TIMEOUT 300 |
---|
69 | |
---|
70 | /** Prefix for keys used with a memcached cache */ |
---|
71 | #define MC_TAG "mod_gnutls:" |
---|
72 | /** Maximum length of the hex string representation of a GnuTLS |
---|
73 | * session ID: two characters per byte, plus one more for `\0` */ |
---|
74 | #if GNUTLS_VERSION_NUMBER >= 0x030400 |
---|
75 | #define GNUTLS_SESSION_ID_STRING_LEN ((GNUTLS_MAX_SESSION_ID_SIZE * 2) + 1) |
---|
76 | #else |
---|
77 | #define GNUTLS_SESSION_ID_STRING_LEN ((GNUTLS_MAX_SESSION_ID * 2) + 1) |
---|
78 | #endif |
---|
79 | |
---|
80 | #if MODULE_MAGIC_NUMBER_MAJOR < 20081201 |
---|
81 | #define ap_unixd_config unixd_config |
---|
82 | #endif |
---|
83 | |
---|
84 | #ifdef APLOG_USE_MODULE |
---|
85 | APLOG_USE_MODULE(gnutls); |
---|
86 | #endif |
---|
87 | |
---|
88 | /** |
---|
89 | * Turn a GnuTLS session ID into the key format we use with DBM |
---|
90 | * caches. Name the Session ID as `server:port.SessionID` to disallow |
---|
91 | * resuming sessions on different servers. |
---|
92 | * |
---|
93 | * @return `0` on success, `-1` on failure |
---|
94 | */ |
---|
95 | static int mgs_session_id2dbm(conn_rec *c, unsigned char *id, int idlen, |
---|
96 | gnutls_datum_t *dbmkey) |
---|
97 | { |
---|
98 | char sz[GNUTLS_SESSION_ID_STRING_LEN]; |
---|
99 | apr_status_t rv = apr_escape_hex(sz, id, idlen, 0, NULL); |
---|
100 | if (rv != APR_SUCCESS) |
---|
101 | return -1; |
---|
102 | |
---|
103 | char *newkey = apr_psprintf(c->pool, "%s:%d.%s", |
---|
104 | c->base_server->server_hostname, |
---|
105 | c->base_server->port, sz); |
---|
106 | dbmkey->size = strlen(newkey); |
---|
107 | /* signedness does not matter for arbitrary bits */ |
---|
108 | dbmkey->data = (unsigned char*) newkey; |
---|
109 | return 0; |
---|
110 | } |
---|
111 | |
---|
112 | /** The OPENSSL_TIME_FORMAT macro and mgs_time2sz() serve to print |
---|
113 | * time in a format compatible with OpenSSL's `ASN1_TIME_print()` |
---|
114 | * function. */ |
---|
115 | #define OPENSSL_TIME_FORMAT "%b %d %k:%M:%S %Y %Z" |
---|
116 | |
---|
117 | char *mgs_time2sz(time_t in_time, char *str, int strsize) |
---|
118 | { |
---|
119 | apr_time_exp_t vtm; |
---|
120 | apr_size_t ret_size; |
---|
121 | apr_time_t t; |
---|
122 | |
---|
123 | |
---|
124 | apr_time_ansi_put(&t, in_time); |
---|
125 | apr_time_exp_gmt(&vtm, t); |
---|
126 | apr_strftime(str, &ret_size, strsize - 1, OPENSSL_TIME_FORMAT, &vtm); |
---|
127 | |
---|
128 | return str; |
---|
129 | } |
---|
130 | |
---|
131 | #if HAVE_APR_MEMCACHE |
---|
132 | |
---|
133 | /** |
---|
134 | * Turn a GnuTLS session ID into the key format we use with memcached |
---|
135 | * caches. Name the Session ID as `server:port.SessionID` to disallow |
---|
136 | * resuming sessions on different servers. |
---|
137 | * |
---|
138 | * @return `0` on success, `-1` on failure |
---|
139 | */ |
---|
140 | static char *mgs_session_id2mc(conn_rec * c, unsigned char *id, int idlen) |
---|
141 | { |
---|
142 | char sz[GNUTLS_SESSION_ID_STRING_LEN]; |
---|
143 | apr_status_t rv = apr_escape_hex(sz, id, idlen, 0, NULL); |
---|
144 | if (rv != APR_SUCCESS) |
---|
145 | return NULL; |
---|
146 | |
---|
147 | return apr_psprintf(c->pool, MC_TAG "%s:%d.%s", |
---|
148 | c->base_server->server_hostname, |
---|
149 | c->base_server->port, sz); |
---|
150 | } |
---|
151 | |
---|
152 | /** |
---|
153 | * GnuTLS Session Cache using libmemcached |
---|
154 | * |
---|
155 | */ |
---|
156 | |
---|
157 | /* The underlying apr_memcache system is thread safe... woohoo */ |
---|
158 | static apr_memcache_t *mc; |
---|
159 | |
---|
160 | static int mc_cache_child_init(apr_pool_t * p, server_rec * s, |
---|
161 | mgs_srvconf_rec * sc) { |
---|
162 | apr_status_t rv = APR_SUCCESS; |
---|
163 | int thread_limit = 0; |
---|
164 | int nservers = 0; |
---|
165 | char *cache_config; |
---|
166 | char *split; |
---|
167 | char *tok; |
---|
168 | |
---|
169 | ap_mpm_query(AP_MPMQ_HARD_LIMIT_THREADS, &thread_limit); |
---|
170 | |
---|
171 | /* Find all the servers in the first run to get a total count */ |
---|
172 | cache_config = apr_pstrdup(p, sc->cache_config); |
---|
173 | split = apr_strtok(cache_config, " ", &tok); |
---|
174 | while (split) { |
---|
175 | nservers++; |
---|
176 | split = apr_strtok(NULL, " ", &tok); |
---|
177 | } |
---|
178 | |
---|
179 | rv = apr_memcache_create(p, nservers, 0, &mc); |
---|
180 | if (rv != APR_SUCCESS) { |
---|
181 | ap_log_error(APLOG_MARK, APLOG_CRIT, rv, s, |
---|
182 | "Failed to create Memcache object of size '%d'.", |
---|
183 | nservers); |
---|
184 | return rv; |
---|
185 | } |
---|
186 | |
---|
187 | /* Now add each server to the memcache */ |
---|
188 | cache_config = apr_pstrdup(p, sc->cache_config); |
---|
189 | split = apr_strtok(cache_config, " ", &tok); |
---|
190 | while (split) { |
---|
191 | apr_memcache_server_t *st; |
---|
192 | char *host_str; |
---|
193 | char *scope_id; |
---|
194 | apr_port_t port; |
---|
195 | |
---|
196 | rv = apr_parse_addr_port(&host_str, &scope_id, &port, |
---|
197 | split, p); |
---|
198 | if (rv != APR_SUCCESS) { |
---|
199 | ap_log_error(APLOG_MARK, APLOG_CRIT, rv, s, |
---|
200 | "Failed to parse server: '%s'", split); |
---|
201 | return rv; |
---|
202 | } |
---|
203 | |
---|
204 | if (host_str == NULL) { |
---|
205 | ap_log_error(APLOG_MARK, APLOG_CRIT, rv, s, |
---|
206 | "Failed to parse server, " |
---|
207 | "no hostname specified: '%s'", split); |
---|
208 | return rv; |
---|
209 | } |
---|
210 | |
---|
211 | if (port == 0) { |
---|
212 | port = 11211; /* default port */ |
---|
213 | } |
---|
214 | |
---|
215 | /* Should Max Conns be (thread_limit / nservers) ? */ |
---|
216 | rv = apr_memcache_server_create(p, |
---|
217 | host_str, port, |
---|
218 | 0, |
---|
219 | 1, thread_limit, 600, &st); |
---|
220 | if (rv != APR_SUCCESS) { |
---|
221 | ap_log_error(APLOG_MARK, APLOG_CRIT, rv, s, |
---|
222 | "Failed to create server: %s:%d", |
---|
223 | host_str, port); |
---|
224 | return rv; |
---|
225 | } |
---|
226 | |
---|
227 | rv = apr_memcache_add_server(mc, st); |
---|
228 | if (rv != APR_SUCCESS) { |
---|
229 | ap_log_error(APLOG_MARK, APLOG_CRIT, rv, s, |
---|
230 | "Failed to add server: %s:%d", |
---|
231 | host_str, port); |
---|
232 | return rv; |
---|
233 | } |
---|
234 | |
---|
235 | split = apr_strtok(NULL, " ", &tok); |
---|
236 | } |
---|
237 | return rv; |
---|
238 | } |
---|
239 | |
---|
240 | static int mc_cache_store(server_rec *s, const char *key, |
---|
241 | gnutls_datum_t data, apr_uint32_t timeout) |
---|
242 | { |
---|
243 | apr_status_t rv = apr_memcache_set(mc, key, (char *) data.data, |
---|
244 | data.size, timeout, 0); |
---|
245 | |
---|
246 | if (rv != APR_SUCCESS) |
---|
247 | { |
---|
248 | ap_log_error(APLOG_MARK, APLOG_CRIT, rv, s, |
---|
249 | "error storing key '%s' with %d bytes of data", |
---|
250 | key, data.size); |
---|
251 | return -1; |
---|
252 | } |
---|
253 | |
---|
254 | return 0; |
---|
255 | } |
---|
256 | |
---|
257 | static int mc_cache_store_generic(server_rec *s, gnutls_datum_t key, |
---|
258 | gnutls_datum_t data, apr_time_t expiry) |
---|
259 | { |
---|
260 | apr_uint32_t timeout = apr_time_sec(expiry - apr_time_now()); |
---|
261 | |
---|
262 | apr_pool_t *p; |
---|
263 | apr_pool_create(&p, NULL); |
---|
264 | |
---|
265 | const char *hex = apr_pescape_hex(p, key.data, key.size, 1); |
---|
266 | if (hex == NULL) |
---|
267 | { |
---|
268 | apr_pool_destroy(p); |
---|
269 | return -1; |
---|
270 | } |
---|
271 | |
---|
272 | const char *strkey = apr_psprintf(p, MC_TAG "%s", hex); |
---|
273 | |
---|
274 | int ret = mc_cache_store(s, strkey, data, timeout); |
---|
275 | |
---|
276 | apr_pool_destroy(p); |
---|
277 | return ret; |
---|
278 | } |
---|
279 | |
---|
280 | static int mc_cache_store_session(void *baton, gnutls_datum_t key, |
---|
281 | gnutls_datum_t data) |
---|
282 | { |
---|
283 | mgs_handle_t *ctxt = baton; |
---|
284 | |
---|
285 | const char *strkey = mgs_session_id2mc(ctxt->c, key.data, key.size); |
---|
286 | if (!strkey) |
---|
287 | return -1; |
---|
288 | |
---|
289 | apr_uint32_t timeout = apr_time_sec(ctxt->sc->cache_timeout); |
---|
290 | |
---|
291 | return mc_cache_store(ctxt->c->base_server, strkey, data, timeout); |
---|
292 | } |
---|
293 | |
---|
294 | /** |
---|
295 | * @param s server reference for logging |
---|
296 | * @param key the key to fetch |
---|
297 | * @param pool pool from which to allocate memory for the result |
---|
298 | */ |
---|
299 | static gnutls_datum_t mc_cache_fetch(server_rec *s, const char *key, |
---|
300 | apr_pool_t *pool) |
---|
301 | { |
---|
302 | apr_status_t rv = APR_SUCCESS; |
---|
303 | char *value; |
---|
304 | apr_size_t value_len; |
---|
305 | gnutls_datum_t data = {NULL, 0}; |
---|
306 | |
---|
307 | rv = apr_memcache_getp(mc, pool, key, &value, &value_len, NULL); |
---|
308 | |
---|
309 | if (rv != APR_SUCCESS) |
---|
310 | { |
---|
311 | ap_log_error(APLOG_MARK, APLOG_TRACE2, rv, s, |
---|
312 | "error fetching key '%s'", |
---|
313 | key); |
---|
314 | return data; |
---|
315 | } |
---|
316 | |
---|
317 | /* TODO: Eliminate this memcpy. gnutls-- */ |
---|
318 | data.data = gnutls_malloc(value_len); |
---|
319 | if (data.data == NULL) |
---|
320 | return data; |
---|
321 | |
---|
322 | data.size = value_len; |
---|
323 | memcpy(data.data, value, value_len); |
---|
324 | |
---|
325 | return data; |
---|
326 | } |
---|
327 | |
---|
328 | static gnutls_datum_t mc_cache_fetch_generic(server_rec *server, |
---|
329 | gnutls_datum_t key, |
---|
330 | apr_pool_t *pool) |
---|
331 | { |
---|
332 | gnutls_datum_t data = {NULL, 0}; |
---|
333 | const char *hex = apr_pescape_hex(pool, key.data, key.size, 1); |
---|
334 | if (hex == NULL) |
---|
335 | return data; |
---|
336 | |
---|
337 | const char *strkey = apr_psprintf(pool, MC_TAG "%s", hex); |
---|
338 | return mc_cache_fetch(server, strkey, pool); |
---|
339 | } |
---|
340 | |
---|
341 | static gnutls_datum_t mc_cache_fetch_session(void *baton, gnutls_datum_t key) |
---|
342 | { |
---|
343 | mgs_handle_t *ctxt = baton; |
---|
344 | gnutls_datum_t data = {NULL, 0}; |
---|
345 | |
---|
346 | const char *strkey = mgs_session_id2mc(ctxt->c, key.data, key.size); |
---|
347 | if (!strkey) |
---|
348 | return data; |
---|
349 | |
---|
350 | return mc_cache_fetch(ctxt->c->base_server, strkey, ctxt->c->pool); |
---|
351 | } |
---|
352 | |
---|
353 | static int mc_cache_delete(void *baton, gnutls_datum_t key) { |
---|
354 | apr_status_t rv = APR_SUCCESS; |
---|
355 | mgs_handle_t *ctxt = baton; |
---|
356 | char *strkey = NULL; |
---|
357 | |
---|
358 | strkey = mgs_session_id2mc(ctxt->c, key.data, key.size); |
---|
359 | if (!strkey) |
---|
360 | return -1; |
---|
361 | |
---|
362 | rv = apr_memcache_delete(mc, strkey, 0); |
---|
363 | |
---|
364 | if (rv != APR_SUCCESS) { |
---|
365 | ap_log_error(APLOG_MARK, APLOG_DEBUG, rv, |
---|
366 | ctxt->c->base_server, |
---|
367 | "error deleting key '%s'", |
---|
368 | strkey); |
---|
369 | return -1; |
---|
370 | } |
---|
371 | |
---|
372 | return 0; |
---|
373 | } |
---|
374 | |
---|
375 | #endif /* have_apr_memcache */ |
---|
376 | |
---|
377 | static const char *db_type(mgs_srvconf_rec * sc) { |
---|
378 | if (sc->cache_type == mgs_cache_gdbm) |
---|
379 | return "gdbm"; |
---|
380 | else |
---|
381 | return "db"; |
---|
382 | } |
---|
383 | |
---|
384 | #define SSL_DBM_FILE_MODE ( APR_UREAD | APR_UWRITE | APR_GREAD | APR_WREAD ) |
---|
385 | |
---|
386 | static void dbm_cache_expire(server_rec *s) |
---|
387 | { |
---|
388 | mgs_srvconf_rec *sc = (mgs_srvconf_rec *) |
---|
389 | ap_get_module_config(s->module_config, &gnutls_module); |
---|
390 | |
---|
391 | apr_status_t rv; |
---|
392 | apr_dbm_t *dbm; |
---|
393 | apr_datum_t dbmkey; |
---|
394 | apr_datum_t dbmval; |
---|
395 | apr_time_t dtime; |
---|
396 | apr_pool_t *spool; |
---|
397 | int total, deleted; |
---|
398 | |
---|
399 | apr_time_t now = apr_time_now(); |
---|
400 | |
---|
401 | if (now - sc->last_cache_check < (sc->cache_timeout) / 2) |
---|
402 | return; |
---|
403 | |
---|
404 | sc->last_cache_check = now; |
---|
405 | |
---|
406 | apr_pool_create(&spool, NULL); |
---|
407 | |
---|
408 | total = 0; |
---|
409 | deleted = 0; |
---|
410 | |
---|
411 | apr_global_mutex_lock(sc->cache->mutex); |
---|
412 | |
---|
413 | rv = apr_dbm_open_ex(&dbm, db_type(sc), |
---|
414 | sc->cache_config, APR_DBM_RWCREATE, |
---|
415 | SSL_DBM_FILE_MODE, spool); |
---|
416 | if (rv != APR_SUCCESS) { |
---|
417 | ap_log_error(APLOG_MARK, APLOG_NOTICE, rv, s, |
---|
418 | "error opening cache '%s'", |
---|
419 | sc->cache_config); |
---|
420 | apr_global_mutex_unlock(sc->cache->mutex); |
---|
421 | apr_pool_destroy(spool); |
---|
422 | return; |
---|
423 | } |
---|
424 | |
---|
425 | apr_dbm_firstkey(dbm, &dbmkey); |
---|
426 | while (dbmkey.dptr != NULL) { |
---|
427 | apr_dbm_fetch(dbm, dbmkey, &dbmval); |
---|
428 | if (dbmval.dptr != NULL |
---|
429 | && dbmval.dsize >= sizeof (apr_time_t)) { |
---|
430 | memcpy(&dtime, dbmval.dptr, sizeof (apr_time_t)); |
---|
431 | |
---|
432 | if (now >= dtime) { |
---|
433 | apr_dbm_delete(dbm, dbmkey); |
---|
434 | deleted++; |
---|
435 | } |
---|
436 | apr_dbm_freedatum(dbm, dbmval); |
---|
437 | } else { |
---|
438 | apr_dbm_delete(dbm, dbmkey); |
---|
439 | deleted++; |
---|
440 | } |
---|
441 | total++; |
---|
442 | apr_dbm_nextkey(dbm, &dbmkey); |
---|
443 | } |
---|
444 | apr_dbm_close(dbm); |
---|
445 | |
---|
446 | rv = apr_global_mutex_unlock(sc->cache->mutex); |
---|
447 | |
---|
448 | ap_log_error(APLOG_MARK, APLOG_DEBUG, rv, s, |
---|
449 | "Cleaned up cache '%s'. Deleted %d and left %d", |
---|
450 | sc->cache_config, deleted, total - deleted); |
---|
451 | |
---|
452 | apr_pool_destroy(spool); |
---|
453 | |
---|
454 | return; |
---|
455 | } |
---|
456 | |
---|
457 | |
---|
458 | |
---|
459 | static gnutls_datum_t dbm_cache_fetch(server_rec *server, gnutls_datum_t key, |
---|
460 | apr_pool_t *pool) |
---|
461 | { |
---|
462 | mgs_srvconf_rec *sc = (mgs_srvconf_rec *) |
---|
463 | ap_get_module_config(server->module_config, &gnutls_module); |
---|
464 | |
---|
465 | gnutls_datum_t data = {NULL, 0}; |
---|
466 | apr_dbm_t *dbm; |
---|
467 | apr_datum_t dbmkey = {(char*) key.data, key.size}; |
---|
468 | apr_datum_t dbmval; |
---|
469 | apr_time_t expiry = 0; |
---|
470 | apr_status_t rv; |
---|
471 | |
---|
472 | /* check if it is time for cache expiration */ |
---|
473 | dbm_cache_expire(server); |
---|
474 | |
---|
475 | apr_global_mutex_lock(sc->cache->mutex); |
---|
476 | |
---|
477 | rv = apr_dbm_open_ex(&dbm, db_type(sc), |
---|
478 | sc->cache_config, APR_DBM_READONLY, |
---|
479 | SSL_DBM_FILE_MODE, pool); |
---|
480 | if (rv != APR_SUCCESS) { |
---|
481 | ap_log_error(APLOG_MARK, APLOG_NOTICE, rv, server, |
---|
482 | "error opening cache '%s'", |
---|
483 | sc->cache_config); |
---|
484 | apr_global_mutex_unlock(sc->cache->mutex); |
---|
485 | return data; |
---|
486 | } |
---|
487 | |
---|
488 | rv = apr_dbm_fetch(dbm, dbmkey, &dbmval); |
---|
489 | |
---|
490 | if (rv != APR_SUCCESS) |
---|
491 | goto close_db; |
---|
492 | |
---|
493 | if (dbmval.dptr == NULL || dbmval.dsize <= sizeof (apr_time_t)) |
---|
494 | goto cleanup; |
---|
495 | |
---|
496 | data.size = dbmval.dsize - sizeof (apr_time_t); |
---|
497 | /* get data expiration tag */ |
---|
498 | expiry = *((apr_time_t *) dbmval.dptr); |
---|
499 | |
---|
500 | data.data = gnutls_malloc(data.size); |
---|
501 | if (data.data == NULL) |
---|
502 | { |
---|
503 | data.size = 0; |
---|
504 | goto cleanup; |
---|
505 | } |
---|
506 | |
---|
507 | ap_log_error(APLOG_MARK, APLOG_TRACE1, rv, server, |
---|
508 | "fetched %" APR_SIZE_T_FMT " bytes from cache", |
---|
509 | dbmval.dsize); |
---|
510 | |
---|
511 | memcpy(data.data, dbmval.dptr + sizeof (apr_time_t), data.size); |
---|
512 | |
---|
513 | cleanup: |
---|
514 | apr_dbm_freedatum(dbm, dbmval); |
---|
515 | close_db: |
---|
516 | apr_dbm_close(dbm); |
---|
517 | apr_global_mutex_unlock(sc->cache->mutex); |
---|
518 | |
---|
519 | /* cache entry might have expired since last cache cleanup */ |
---|
520 | if (expiry != 0 && expiry < apr_time_now()) |
---|
521 | { |
---|
522 | gnutls_free(data.data); |
---|
523 | data.data = NULL; |
---|
524 | data.size = 0; |
---|
525 | ap_log_error(APLOG_MARK, APLOG_TRACE1, APR_SUCCESS, server, |
---|
526 | "dropped expired cache data"); |
---|
527 | } |
---|
528 | |
---|
529 | return data; |
---|
530 | } |
---|
531 | |
---|
532 | static gnutls_datum_t dbm_cache_fetch_session(void *baton, gnutls_datum_t key) |
---|
533 | { |
---|
534 | gnutls_datum_t data = {NULL, 0}; |
---|
535 | gnutls_datum_t dbmkey; |
---|
536 | mgs_handle_t *ctxt = baton; |
---|
537 | |
---|
538 | if (mgs_session_id2dbm(ctxt->c, key.data, key.size, &dbmkey) < 0) |
---|
539 | return data; |
---|
540 | |
---|
541 | return dbm_cache_fetch(ctxt->c->base_server, dbmkey, ctxt->c->pool); |
---|
542 | } |
---|
543 | |
---|
544 | static int dbm_cache_store(server_rec *s, gnutls_datum_t key, |
---|
545 | gnutls_datum_t data, apr_time_t expiry) |
---|
546 | { |
---|
547 | mgs_srvconf_rec *sc = (mgs_srvconf_rec *) |
---|
548 | ap_get_module_config(s->module_config, &gnutls_module); |
---|
549 | |
---|
550 | apr_dbm_t *dbm; |
---|
551 | apr_datum_t dbmkey = {(char*) key.data, key.size}; |
---|
552 | apr_datum_t dbmval; |
---|
553 | apr_status_t rv; |
---|
554 | apr_pool_t *spool; |
---|
555 | |
---|
556 | /* check if it is time for cache expiration */ |
---|
557 | dbm_cache_expire(s); |
---|
558 | |
---|
559 | apr_pool_create(&spool, NULL); |
---|
560 | |
---|
561 | /* create DBM value */ |
---|
562 | dbmval.dsize = data.size + sizeof (apr_time_t); |
---|
563 | dbmval.dptr = (char *) apr_palloc(spool, dbmval.dsize); |
---|
564 | |
---|
565 | /* prepend expiration time */ |
---|
566 | memcpy((char *) dbmval.dptr, &expiry, sizeof (apr_time_t)); |
---|
567 | memcpy((char *) dbmval.dptr + sizeof (apr_time_t), |
---|
568 | data.data, data.size); |
---|
569 | |
---|
570 | apr_global_mutex_lock(sc->cache->mutex); |
---|
571 | |
---|
572 | rv = apr_dbm_open_ex(&dbm, db_type(sc), |
---|
573 | sc->cache_config, APR_DBM_RWCREATE, |
---|
574 | SSL_DBM_FILE_MODE, spool); |
---|
575 | if (rv != APR_SUCCESS) |
---|
576 | { |
---|
577 | ap_log_error(APLOG_MARK, APLOG_NOTICE, rv, s, |
---|
578 | "error opening cache '%s'", |
---|
579 | sc->cache_config); |
---|
580 | apr_global_mutex_unlock(sc->cache->mutex); |
---|
581 | apr_pool_destroy(spool); |
---|
582 | return -1; |
---|
583 | } |
---|
584 | |
---|
585 | rv = apr_dbm_store(dbm, dbmkey, dbmval); |
---|
586 | if (rv != APR_SUCCESS) |
---|
587 | { |
---|
588 | ap_log_error(APLOG_MARK, APLOG_DEBUG, rv, s, |
---|
589 | "error storing in cache '%s'", |
---|
590 | sc->cache_config); |
---|
591 | apr_dbm_close(dbm); |
---|
592 | apr_global_mutex_unlock(sc->cache->mutex); |
---|
593 | apr_pool_destroy(spool); |
---|
594 | return -1; |
---|
595 | } |
---|
596 | |
---|
597 | apr_dbm_close(dbm); |
---|
598 | apr_global_mutex_unlock(sc->cache->mutex); |
---|
599 | |
---|
600 | ap_log_error(APLOG_MARK, APLOG_TRACE1, rv, s, |
---|
601 | "stored %" APR_SIZE_T_FMT " bytes of data (%" |
---|
602 | APR_SIZE_T_FMT " byte key) in cache '%s'", |
---|
603 | dbmval.dsize, dbmkey.dsize, sc->cache_config); |
---|
604 | |
---|
605 | apr_pool_destroy(spool); |
---|
606 | |
---|
607 | return 0; |
---|
608 | } |
---|
609 | |
---|
610 | static int dbm_cache_store_session(void *baton, gnutls_datum_t key, |
---|
611 | gnutls_datum_t data) |
---|
612 | { |
---|
613 | mgs_handle_t *ctxt = baton; |
---|
614 | gnutls_datum_t dbmkey; |
---|
615 | |
---|
616 | if (mgs_session_id2dbm(ctxt->c, key.data, key.size, &dbmkey) < 0) |
---|
617 | return -1; |
---|
618 | |
---|
619 | apr_time_t expiry = apr_time_now() + ctxt->sc->cache_timeout; |
---|
620 | |
---|
621 | return dbm_cache_store(ctxt->c->base_server, dbmkey, data, expiry); |
---|
622 | } |
---|
623 | |
---|
624 | static int dbm_cache_delete(void *baton, gnutls_datum_t key) |
---|
625 | { |
---|
626 | apr_dbm_t *dbm; |
---|
627 | gnutls_datum_t tmpkey; |
---|
628 | mgs_handle_t *ctxt = baton; |
---|
629 | apr_status_t rv; |
---|
630 | |
---|
631 | if (mgs_session_id2dbm(ctxt->c, key.data, key.size, &tmpkey) < 0) |
---|
632 | return -1; |
---|
633 | apr_datum_t dbmkey = {(char*) tmpkey.data, tmpkey.size}; |
---|
634 | |
---|
635 | apr_global_mutex_lock(ctxt->sc->cache->mutex); |
---|
636 | |
---|
637 | rv = apr_dbm_open_ex(&dbm, db_type(ctxt->sc), |
---|
638 | ctxt->sc->cache_config, APR_DBM_RWCREATE, |
---|
639 | SSL_DBM_FILE_MODE, ctxt->c->pool); |
---|
640 | if (rv != APR_SUCCESS) { |
---|
641 | ap_log_error(APLOG_MARK, APLOG_NOTICE, rv, |
---|
642 | ctxt->c->base_server, |
---|
643 | "error opening cache '%s'", |
---|
644 | ctxt->sc->cache_config); |
---|
645 | apr_global_mutex_unlock(ctxt->sc->cache->mutex); |
---|
646 | return -1; |
---|
647 | } |
---|
648 | |
---|
649 | rv = apr_dbm_delete(dbm, dbmkey); |
---|
650 | |
---|
651 | if (rv != APR_SUCCESS) { |
---|
652 | ap_log_error(APLOG_MARK, APLOG_NOTICE, rv, |
---|
653 | ctxt->c->base_server, |
---|
654 | "error deleting from cache '%s'", |
---|
655 | ctxt->sc->cache_config); |
---|
656 | apr_dbm_close(dbm); |
---|
657 | apr_global_mutex_unlock(ctxt->sc->cache->mutex); |
---|
658 | return -1; |
---|
659 | } |
---|
660 | |
---|
661 | apr_dbm_close(dbm); |
---|
662 | apr_global_mutex_unlock(ctxt->sc->cache->mutex); |
---|
663 | |
---|
664 | return 0; |
---|
665 | } |
---|
666 | |
---|
667 | static int dbm_cache_post_config(apr_pool_t * p, server_rec * s, |
---|
668 | mgs_srvconf_rec * sc) { |
---|
669 | apr_status_t rv; |
---|
670 | apr_dbm_t *dbm; |
---|
671 | const char *path1; |
---|
672 | const char *path2; |
---|
673 | |
---|
674 | rv = apr_dbm_open_ex(&dbm, db_type(sc), sc->cache_config, |
---|
675 | APR_DBM_RWCREATE, SSL_DBM_FILE_MODE, p); |
---|
676 | |
---|
677 | if (rv != APR_SUCCESS) { |
---|
678 | ap_log_error(APLOG_MARK, APLOG_ERR, rv, s, |
---|
679 | "GnuTLS: Cannot create DBM Cache at `%s'", |
---|
680 | sc->cache_config); |
---|
681 | return rv; |
---|
682 | } |
---|
683 | |
---|
684 | apr_dbm_close(dbm); |
---|
685 | |
---|
686 | apr_dbm_get_usednames_ex(p, db_type(sc), sc->cache_config, &path1, |
---|
687 | &path2); |
---|
688 | |
---|
689 | /* The Following Code takes logic directly from mod_ssl's DBM Cache */ |
---|
690 | #if !defined(OS2) && !defined(WIN32) && !defined(BEOS) && !defined(NETWARE) |
---|
691 | /* Running as Root */ |
---|
692 | if (path1 && geteuid() == 0) { |
---|
693 | if (0 != chown(path1, ap_unixd_config.user_id, -1)) |
---|
694 | ap_log_error(APLOG_MARK, APLOG_NOTICE, -1, s, |
---|
695 | "GnuTLS: could not chown cache path1 `%s' to uid %d (errno: %d)", |
---|
696 | path1, ap_unixd_config.user_id, errno); |
---|
697 | if (path2 != NULL) { |
---|
698 | if (0 != chown(path2, ap_unixd_config.user_id, -1)) |
---|
699 | ap_log_error(APLOG_MARK, APLOG_NOTICE, -1, s, |
---|
700 | "GnuTLS: could not chown cache path2 `%s' to uid %d (errno: %d)", |
---|
701 | path2, ap_unixd_config.user_id, errno); |
---|
702 | } |
---|
703 | } |
---|
704 | #endif |
---|
705 | |
---|
706 | return rv; |
---|
707 | } |
---|
708 | |
---|
709 | int mgs_cache_post_config(apr_pool_t * p, server_rec * s, |
---|
710 | mgs_srvconf_rec * sc) { |
---|
711 | |
---|
712 | /* if GnuTLSCache was never explicitly set: */ |
---|
713 | if (sc->cache_type == mgs_cache_unset) |
---|
714 | sc->cache_type = mgs_cache_none; |
---|
715 | /* if GnuTLSCacheTimeout was never explicitly set: */ |
---|
716 | if (sc->cache_timeout == MGS_TIMEOUT_UNSET) |
---|
717 | sc->cache_timeout = apr_time_from_sec(MGS_DEFAULT_CACHE_TIMEOUT); |
---|
718 | |
---|
719 | /* initialize mutex only once */ |
---|
720 | if (sc->cache == NULL) |
---|
721 | { |
---|
722 | sc->cache = apr_palloc(p, sizeof(struct mgs_cache)); |
---|
723 | apr_status_t rv = ap_global_mutex_create(&sc->cache->mutex, NULL, |
---|
724 | MGS_CACHE_MUTEX_NAME, |
---|
725 | NULL, s, p, 0); |
---|
726 | if (rv != APR_SUCCESS) |
---|
727 | return rv; |
---|
728 | } |
---|
729 | |
---|
730 | if (sc->cache_type == mgs_cache_dbm || sc->cache_type == mgs_cache_gdbm) |
---|
731 | { |
---|
732 | sc->cache->store = dbm_cache_store; |
---|
733 | sc->cache->fetch = dbm_cache_fetch; |
---|
734 | return dbm_cache_post_config(p, s, sc); |
---|
735 | } |
---|
736 | #if HAVE_APR_MEMCACHE |
---|
737 | else if (sc->cache_type == mgs_cache_memcache) |
---|
738 | { |
---|
739 | sc->cache->store = mc_cache_store_generic; |
---|
740 | sc->cache->fetch = mc_cache_fetch_generic; |
---|
741 | } |
---|
742 | #endif |
---|
743 | |
---|
744 | return APR_SUCCESS; |
---|
745 | } |
---|
746 | |
---|
747 | int mgs_cache_child_init(apr_pool_t * p, |
---|
748 | server_rec * s, |
---|
749 | mgs_srvconf_rec * sc) |
---|
750 | { |
---|
751 | /* reinit cache mutex */ |
---|
752 | const char *lockfile = apr_global_mutex_lockfile(sc->cache->mutex); |
---|
753 | apr_status_t rv = apr_global_mutex_child_init(&sc->cache->mutex, |
---|
754 | lockfile, p); |
---|
755 | if (rv != APR_SUCCESS) |
---|
756 | ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s, |
---|
757 | "Failed to reinit mutex '%s'", MGS_CACHE_MUTEX_NAME); |
---|
758 | |
---|
759 | if (sc->cache_type == mgs_cache_dbm |
---|
760 | || sc->cache_type == mgs_cache_gdbm) { |
---|
761 | return 0; |
---|
762 | } |
---|
763 | #if HAVE_APR_MEMCACHE |
---|
764 | else if (sc->cache_type == mgs_cache_memcache) { |
---|
765 | return mc_cache_child_init(p, s, sc); |
---|
766 | } |
---|
767 | #endif |
---|
768 | return 0; |
---|
769 | } |
---|
770 | |
---|
771 | #include <assert.h> |
---|
772 | |
---|
773 | int mgs_cache_session_init(mgs_handle_t * ctxt) { |
---|
774 | if (ctxt->sc->cache_type == mgs_cache_dbm |
---|
775 | || ctxt->sc->cache_type == mgs_cache_gdbm) { |
---|
776 | gnutls_db_set_retrieve_function(ctxt->session, |
---|
777 | dbm_cache_fetch_session); |
---|
778 | gnutls_db_set_remove_function(ctxt->session, |
---|
779 | dbm_cache_delete); |
---|
780 | gnutls_db_set_store_function(ctxt->session, |
---|
781 | dbm_cache_store_session); |
---|
782 | gnutls_db_set_ptr(ctxt->session, ctxt); |
---|
783 | } |
---|
784 | #if HAVE_APR_MEMCACHE |
---|
785 | else if (ctxt->sc->cache_type == mgs_cache_memcache) { |
---|
786 | gnutls_db_set_retrieve_function(ctxt->session, |
---|
787 | mc_cache_fetch_session); |
---|
788 | gnutls_db_set_remove_function(ctxt->session, |
---|
789 | mc_cache_delete); |
---|
790 | gnutls_db_set_store_function(ctxt->session, |
---|
791 | mc_cache_store_session); |
---|
792 | gnutls_db_set_ptr(ctxt->session, ctxt); |
---|
793 | } |
---|
794 | #endif |
---|
795 | |
---|
796 | return 0; |
---|
797 | } |
---|