Context Navigation

source: mod_gnutls/src/gnutls_config.c @ e5546be

Visit:

asyncioproxy-ticket

Last change on this file since e5546be was 4e388b0, checked in by Fiona Klute <fiona.klute@…>, 2 years ago
Consistently use strcasecmp() instead of mixing in apr_strnatcasecmp()
Property mode set to `100644`
File size: 33.2 KB

Line
1	/*
2	* Copyright 2004-2005 Paul Querna
3	* Copyright 2008, 2014 Nikos Mavrogiannopoulos
4	* Copyright 2011 Dash Shendy
5	* Copyright 2015-2018 Fiona Klute
6	*
7	* Licensed under the Apache License, Version 2.0 (the "License");
8	* you may not use this file except in compliance with the License.
9	* You may obtain a copy of the License at
10	*
11	* http://www.apache.org/licenses/LICENSE-2.0
12	*
13	* Unless required by applicable law or agreed to in writing, software
14	* distributed under the License is distributed on an "AS IS" BASIS,
15	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16	* See the License for the specific language governing permissions and
17	* limitations under the License.
18	*/
19
20	#include "gnutls_cache.h"
21	#include "gnutls_config.h"
22	#include "mod_gnutls.h"
23	#include "gnutls_ocsp.h"
24
25	#include "apr_lib.h"
26	#include <apr_strings.h>
27	#include <gnutls/abstract.h>
28
29	#define INIT_CA_SIZE 128
30
31	#ifdef APLOG_USE_MODULE
32	APLOG_USE_MODULE(gnutls);
33	#endif
34
35	static int pin_callback(void *user, int attempt __attribute__((unused)),
36	const char *token_url __attribute__((unused)),
37	const char *token_label, unsigned int flags,
38	char *pin, size_t pin_max)
39	{
40	mgs_srvconf_rec *sc = user;
41
42	if (sc->pin == NULL \|\| flags & GNUTLS_PIN_FINAL_TRY \|\|
43	flags & GNUTLS_PIN_WRONG) {
44	return -1;
45	}
46
47	if (token_label && strcmp(token_label, "SRK") == 0) {
48	snprintf(pin, pin_max, "%s", sc->srk_pin);
49	} else {
50	snprintf(pin, pin_max, "%s", sc->pin);
51	}
52	return 0;
53	}
54
55	static int load_datum_from_file(apr_pool_t * pool,
56	const char file, gnutls_datum_t data)
57	{
58	apr_file_t *fp;
59	apr_finfo_t finfo;
60	apr_status_t rv;
61	apr_size_t br = 0;
62
63	rv = apr_file_open(&fp, file, APR_READ \| APR_BINARY,
64	APR_OS_DEFAULT, pool);
65	if (rv != APR_SUCCESS) {
66	return rv;
67	}
68
69	rv = apr_file_info_get(&finfo, APR_FINFO_SIZE, fp);
70
71	if (rv != APR_SUCCESS) {
72	return rv;
73	}
74
75	data->data = apr_palloc(pool, finfo.size + 1);
76	rv = apr_file_read_full(fp, data->data, finfo.size, &br);
77
78	if (rv != APR_SUCCESS) {
79	return rv;
80	}
81	apr_file_close(fp);
82
83	data->data[br] = '\0';
84	data->size = br;
85
86	return 0;
87	}
88
89
90
91	/**
92	* Clean up the various GnuTLS data structures allocated by
93	* mgs_load_files()
94	*/
95	static apr_status_t mgs_pool_free_credentials(void *arg)
96	{
97	mgs_srvconf_rec sc = (mgs_srvconf_rec ) arg;
98
99	if (sc->certs)
100	{
101	gnutls_certificate_free_credentials(sc->certs);
102	sc->certs = NULL;
103	}
104
105	if (sc->anon_creds)
106	{
107	gnutls_anon_free_server_credentials(sc->anon_creds);
108	sc->anon_creds = NULL;
109	}
110
111	#ifdef ENABLE_SRP
112	if (sc->srp_creds)
113	{
114	gnutls_srp_free_server_credentials(sc->srp_creds);
115	sc->srp_creds = NULL;
116	}
117	#endif
118
119	if (sc->dh_params)
120	{
121	gnutls_dh_params_deinit(sc->dh_params);
122	sc->dh_params = NULL;
123	}
124
125	for (unsigned int i = 0; i < sc->certs_x509_chain_num; i++)
126	{
127	gnutls_pcert_deinit(&sc->certs_x509_chain[i]);
128	gnutls_x509_crt_deinit(sc->certs_x509_crt_chain[i]);
129	}
130
131	if (sc->privkey_x509)
132	{
133	gnutls_privkey_deinit(sc->privkey_x509);
134	sc->privkey_x509 = NULL;
135	}
136
137	if (sc->ca_list)
138	{
139	for (unsigned int i = 0; i < sc->ca_list_size; i++)
140	{
141	gnutls_x509_crt_deinit(sc->ca_list[i]);
142	}
143	gnutls_free(sc->ca_list);
144	sc->ca_list = NULL;
145	}
146
147	/* Deinit server priorities only if set from
148	* sc->priorities_str. Otherwise the server is using the default
149	* global priority cache, which must not be deinitialized here. */
150	if (sc->priorities_str && sc->priorities)
151	{
152	gnutls_priority_deinit(sc->priorities);
153	sc->priorities = NULL;
154	}
155
156	return APR_SUCCESS;
157	}
158
159	int mgs_load_files(apr_pool_t pconf, apr_pool_t ptemp, server_rec *s)
160	{
161	apr_pool_t *spool;
162	const char *file;
163	gnutls_datum_t data;
164	int ret;
165	mgs_srvconf_rec *sc =
166	(mgs_srvconf_rec *) ap_get_module_config(s->module_config,
167	&gnutls_module);
168
169	apr_pool_create(&spool, ptemp);
170
171	/* Cleanup function for the GnuTLS structures allocated below */
172	apr_pool_cleanup_register(pconf, sc, mgs_pool_free_credentials,
173	apr_pool_cleanup_null);
174
175	if (sc->certs == NULL)
176	{
177	ret = gnutls_certificate_allocate_credentials(&sc->certs);
178	if (ret < 0) {
179	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
180	"GnuTLS: Failed to initialize" ": (%d) %s", ret,
181	gnutls_strerror(ret));
182	ret = -1;
183	goto cleanup;
184	}
185	}
186
187	if (sc->anon_creds == NULL)
188	{
189	ret = gnutls_anon_allocate_server_credentials(&sc->anon_creds);
190	if (ret < 0) {
191	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
192	"GnuTLS: Failed to initialize" ": (%d) %s", ret,
193	gnutls_strerror(ret));
194	ret = -1;
195	goto cleanup;
196	}
197	}
198
199	/* Load SRP parameters */
200	#ifdef ENABLE_SRP
201	if (sc->srp_creds == NULL)
202	{
203	ret = gnutls_srp_allocate_server_credentials(&sc->srp_creds);
204	if (ret < 0) {
205	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
206	"GnuTLS: Failed to initialize" ": (%d) %s", ret,
207	gnutls_strerror(ret));
208	ret = -1;
209	goto cleanup;
210	}
211	}
212
213	if (sc->srp_tpasswd_conf_file != NULL && sc->srp_tpasswd_file != NULL)
214	{
215	ret = gnutls_srp_set_server_credentials_file
216	(sc->srp_creds, sc->srp_tpasswd_file,
217	sc->srp_tpasswd_conf_file);
218
219	if (ret < 0 && sc->enabled == GNUTLS_ENABLED_TRUE) {
220	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
221	"GnuTLS: Host '%s:%d' is missing a "
222	"SRP password or conf File!",
223	s->server_hostname, s->port);
224	ret = -1;
225	goto cleanup;
226	}
227	}
228	#endif
229
230	/* Load user provided DH parameters, if any */
231	if (sc->dh_file)
232	{
233	if (sc->dh_params == NULL)
234	{
235	ret = gnutls_dh_params_init(&sc->dh_params);
236	if (ret < 0) {
237	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
238	"GnuTLS: Failed to initialize"
239	": (%d) %s", ret, gnutls_strerror(ret));
240	ret = -1;
241	goto cleanup;
242	}
243	}
244
245	if (load_datum_from_file(spool, sc->dh_file, &data) != 0) {
246	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
247	"GnuTLS: Error Reading " "DH params '%s'", sc->dh_file);
248	ret = -1;
249	goto cleanup;
250	}
251
252	ret =
253	gnutls_dh_params_import_pkcs3(sc->dh_params, &data,
254	GNUTLS_X509_FMT_PEM);
255	if (ret < 0) {
256	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
257	"GnuTLS: Failed to Import "
258	"DH params '%s': (%d) %s", sc->dh_file, ret,
259	gnutls_strerror(ret));
260	ret = -1;
261	goto cleanup;
262	}
263	}
264
265	if (sc->x509_cert_file != NULL && sc->certs_x509_crt_chain == NULL)
266	{
267	sc->certs_x509_chain =
268	apr_pcalloc(pconf,
269	MAX_CHAIN_SIZE * sizeof(sc->certs_x509_chain[0]));
270	sc->certs_x509_crt_chain =
271	apr_pcalloc(pconf,
272	MAX_CHAIN_SIZE * sizeof(sc->certs_x509_crt_chain[0]));
273	unsigned int chain_num = MAX_CHAIN_SIZE;
274	unsigned format = GNUTLS_X509_FMT_PEM;
275
276	/* Load X.509 certificate */
277	if (strncmp(sc->x509_cert_file, "pkcs11:", 7) == 0) {
278	gnutls_pkcs11_obj_t obj;
279
280	file = sc->x509_cert_file;
281
282	ret = gnutls_pkcs11_obj_init(&obj);
283	if (ret < 0) {
284	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
285	"GnuTLS: Error Initializing PKCS #11 object");
286	ret = -1;
287	goto cleanup;
288	}
289
290	gnutls_pkcs11_obj_set_pin_function(obj, pin_callback, sc);
291
292	ret = gnutls_pkcs11_obj_import_url(obj, file,
293	GNUTLS_PKCS11_OBJ_FLAG_LOGIN);
294	if (ret < 0) {
295	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
296	"GnuTLS: Error Importing PKCS #11 object: "
297	"'%s': %s",
298	file, gnutls_strerror(ret));
299	ret = -1;
300	goto cleanup;
301	}
302
303	format = GNUTLS_X509_FMT_DER;
304	ret = gnutls_pkcs11_obj_export2(obj, &data);
305	if (ret < 0) {
306	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
307	"GnuTLS: Error Exporting a PKCS #11 object: "
308	"'%s': %s",
309	file, gnutls_strerror(ret));
310	ret = -1;
311	goto cleanup;
312	}
313
314	gnutls_pkcs11_obj_deinit(obj);
315	} else {
316	file = ap_server_root_relative(spool, sc->x509_cert_file);
317
318	ret = gnutls_load_file(file, &data);
319	if (ret < 0) {
320	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
321	"GnuTLS: Error Reading Certificate '%s': %s",
322	file, gnutls_strerror(ret));
323	ret = -1;
324	goto cleanup;
325	}
326	}
327
328	ret = gnutls_x509_crt_list_import(sc->certs_x509_crt_chain,
329	&chain_num, &data, format,
330	GNUTLS_X509_CRT_LIST_FAIL_IF_UNSORTED);
331	gnutls_free(data.data);
332	sc->certs_x509_chain_num = chain_num;
333
334	if (ret < 0) {
335	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
336	"GnuTLS: Failed to Import Certificate Chain "
337	"'%s': (%d) %s",
338	file, ret, gnutls_strerror(ret));
339	ret = -1;
340	goto cleanup;
341	}
342
343	for (unsigned int i = 0; i < chain_num; i++)
344	{
345	ret =
346	gnutls_pcert_import_x509(&sc->certs_x509_chain[i],
347	sc->certs_x509_crt_chain[i], 0);
348	if (ret < 0) {
349	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
350	"GnuTLS: Failed to Import pCertificate "
351	"'%s': (%d) %s",
352	file, ret, gnutls_strerror(ret));
353	ret = -1;
354	goto cleanup;
355	}
356	}
357	sc->certs_x509_chain_num = chain_num;
358	}
359
360	if (sc->x509_key_file && sc->privkey_x509 == NULL)
361	{
362	ret = gnutls_privkey_init(&sc->privkey_x509);
363	if (ret < 0) {
364	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
365	"GnuTLS: Failed to initialize: (%d) %s", ret,
366	gnutls_strerror(ret));
367	ret = -1;
368	goto cleanup;
369	}
370
371	if (gnutls_url_is_supported(sc->x509_key_file) != 0) {
372	file = sc->x509_key_file;
373
374	gnutls_privkey_set_pin_function(sc->privkey_x509, pin_callback,
375	sc);
376
377	ret = gnutls_privkey_import_url(sc->privkey_x509, file, 0);
378
379	if (ret < 0) {
380	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
381	"GnuTLS: Failed to Import Private Key URL "
382	"'%s': (%d) %s",
383	file, ret, gnutls_strerror(ret));
384	ret = -1;
385	goto cleanup;
386	}
387	} else {
388	file = ap_server_root_relative(spool, sc->x509_key_file);
389
390	if (load_datum_from_file(spool, file, &data) != 0) {
391	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
392	"GnuTLS: Error Reading Private Key '%s'",
393	file);
394	ret = -1;
395	goto cleanup;
396	}
397
398	ret =
399	gnutls_privkey_import_x509_raw(sc->privkey_x509, &data,
400	GNUTLS_X509_FMT_PEM, sc->pin,
401	0);
402
403	if (ret < 0) {
404	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
405	"GnuTLS: Failed to Import Private Key "
406	"'%s': (%d) %s",
407	file, ret, gnutls_strerror(ret));
408	ret = -1;
409	goto cleanup;
410	}
411	}
412	}
413
414	/* Load the X.509 CA file */
415	if (sc->x509_ca_file)
416	{
417	if (load_datum_from_file(spool, sc->x509_ca_file, &data) != 0) {
418	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
419	"GnuTLS: Error Reading " "Client CA File '%s'",
420	sc->x509_ca_file);
421	ret = -1;
422	goto cleanup;
423	}
424
425	ret = gnutls_x509_crt_list_import2(&sc->ca_list, &sc->ca_list_size,
426	&data, GNUTLS_X509_FMT_PEM, 0);
427	if (ret < 0) {
428	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
429	"GnuTLS: Failed to load "
430	"Client CA File '%s': (%d) %s", sc->x509_ca_file,
431	ret, gnutls_strerror(ret));
432	ret = -1;
433	goto cleanup;
434	}
435	}
436
437	if (sc->priorities_str && sc->priorities == NULL)
438	{
439	const char *err;
440	ret = gnutls_priority_init(&sc->priorities, sc->priorities_str, &err);
441
442	if (ret < 0) {
443	if (ret == GNUTLS_E_INVALID_REQUEST) {
444	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
445	"GnuTLS: Syntax error parsing priorities string at: %s",
446	err);
447	} else {
448	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
449	"GnuTLS: error parsing priorities string");
450
451	}
452	ret = -1;
453	goto cleanup;
454	}
455	}
456
457	ret = 0;
458	cleanup:
459	apr_pool_destroy(spool);
460
461	return ret;
462	}
463
464	int mgs_pkcs11_reinit(server_rec * base_server)
465	{
466	int ret;
467	server_rec *s;
468	mgs_srvconf_rec *sc;
469
470	gnutls_pkcs11_reinit();
471
472	for (s = base_server; s; s = s->next) {
473	sc = (mgs_srvconf_rec *) ap_get_module_config(s->module_config, &gnutls_module);
474
475	/* gnutls caches the session in a private key, so we need to open
476	* a new one */
477	if (sc->x509_key_file && gnutls_url_is_supported(sc->x509_key_file) != 0) {
478	gnutls_privkey_deinit(sc->privkey_x509);
479
480	ret = gnutls_privkey_init(&sc->privkey_x509);
481	if (ret < 0) {
482	ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,
483	"GnuTLS: Failed to initialize: (%d) %s", ret,
484	gnutls_strerror(ret));
485	goto fail;
486	}
487
488	gnutls_privkey_set_pin_function(sc->privkey_x509, pin_callback, sc);
489
490	ret = gnutls_privkey_import_url(sc->privkey_x509, sc->x509_key_file, 0);
491	if (ret < 0) {
492	ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,
493	"GnuTLS: Failed to Re-Import Private Key URL '%s': (%d) %s",
494	sc->x509_key_file, ret, gnutls_strerror(ret));
495	goto fail;
496	}
497	}
498	}
499
500	return 0;
501
502	fail:
503	gnutls_privkey_deinit(sc->privkey_x509);
504	return -1;
505	}
506
507	const char mgs_set_dh_file(cmd_parms parms, void *dummy __attribute__((unused)),
508	const char *arg) {
509	mgs_srvconf_rec *sc =
510	(mgs_srvconf_rec *) ap_get_module_config(parms->server->
511	module_config,
512	&gnutls_module);
513
514	sc->dh_file = ap_server_root_relative(parms->pool, arg);
515
516	return NULL;
517	}
518
519	const char mgs_set_cert_file(cmd_parms parms, void dummy __attribute__((unused)), const char arg) {
520
521	mgs_srvconf_rec *sc =
522	(mgs_srvconf_rec *) ap_get_module_config(parms->
523	server->module_config,
524	&gnutls_module);
525
526	sc->x509_cert_file = apr_pstrdup(parms->pool, arg);
527
528	return NULL;
529
530	}
531
532	const char mgs_set_key_file(cmd_parms parms, void dummy __attribute__((unused)), const char arg) {
533
534	mgs_srvconf_rec *sc =
535	(mgs_srvconf_rec *) ap_get_module_config(parms->
536	server->module_config,
537	&gnutls_module);
538
539	sc->x509_key_file = apr_pstrdup(parms->pool, arg);
540
541	return NULL;
542	}
543
544	const char mgs_set_tickets(cmd_parms parms,
545	void *dummy __attribute__((unused)),
546	const int arg)
547	{
548	mgs_srvconf_rec sc = (mgs_srvconf_rec )
549	ap_get_module_config(parms->server->module_config, &gnutls_module);
550
551	if (arg)
552	sc->tickets = GNUTLS_ENABLED_TRUE;
553	else
554	sc->tickets = GNUTLS_ENABLED_FALSE;
555
556	return NULL;
557	}
558
559
560	#ifdef ENABLE_SRP
561
562	const char mgs_set_srp_tpasswd_file(cmd_parms parms, void *dummy __attribute__((unused)),
563	const char *arg) {
564	mgs_srvconf_rec *sc =
565	(mgs_srvconf_rec *) ap_get_module_config(parms->server->
566	module_config,
567	&gnutls_module);
568
569	sc->srp_tpasswd_file = ap_server_root_relative(parms->pool, arg);
570
571	return NULL;
572	}
573
574	const char mgs_set_srp_tpasswd_conf_file(cmd_parms parms, void *dummy __attribute__((unused)),
575	const char *arg) {
576	mgs_srvconf_rec *sc =
577	(mgs_srvconf_rec *) ap_get_module_config(parms->server->
578	module_config,
579	&gnutls_module);
580
581	sc->srp_tpasswd_conf_file = ap_server_root_relative(parms->pool, arg);
582
583	return NULL;
584	}
585
586	#endif
587
588	const char mgs_set_cache(cmd_parms parms,
589	void *dummy __attribute__((unused)),
590	const char type, const char arg)
591	{
592	const char *err;
593	mgs_srvconf_rec *sc =
594	ap_get_module_config(parms->server->module_config,
595	&gnutls_module);
596	if ((err = ap_check_cmd_context(parms, GLOBAL_ONLY)))
597	return err;
598
599	unsigned char enable = GNUTLS_ENABLED_TRUE;
600	/* none: disable cache */
601	if (strcasecmp("none", type) == 0)
602	enable = GNUTLS_ENABLED_FALSE;
603
604	/* Try to split socache "type:config" style configuration */
605	const char* sep = ap_strchr_c(type, ':');
606	if (sep)
607	{
608	type = apr_pstrmemdup(parms->temp_pool, type, sep - type);
609	if (arg != NULL)
610	{
611	/* No mixing of socache style and legacy config! */
612	return "GnuTLSCache appears to have a mod_socache style "
613	"type:config value, but there is a second parameter!";
614	}
615	arg = ++sep;
616	}
617
618	mgs_cache_t *cache = NULL;
619	/* parms->directive->directive contains the directive string */
620	if (!strcasecmp(parms->directive->directive, "GnuTLSCache"))
621	{
622	if (enable == GNUTLS_ENABLED_FALSE)
623	{
624	sc->cache_enable = GNUTLS_ENABLED_FALSE;
625	return NULL;
626	}
627	sc->cache_enable = GNUTLS_ENABLED_TRUE;
628	cache = &sc->cache;
629	}
630	else if (!strcasecmp(parms->directive->directive, "GnuTLSOCSPCache"))
631	{
632	if (enable == GNUTLS_ENABLED_FALSE)
633	return "\"GnuTLSOCSPCache none\" is invalid, use "
634	"\"GnuTLSOCSPStapling off\" if you want to disable "
635	"OCSP stapling.";
636	cache = &sc->ocsp_cache;
637	}
638	else
639	return apr_psprintf(parms->temp_pool, "Internal Error: %s "
640	"called for unknown directive %s",
641	__func__, parms->directive->directive);
642
643	return mgs_cache_inst_config(cache, parms->server,
644	type, arg,
645	parms->pool, parms->temp_pool);
646	}
647
648	const char mgs_set_timeout(cmd_parms parms,
649	void *dummy __attribute__((unused)),
650	const char *arg)
651	{
652	apr_int64_t argint = apr_atoi64(arg);
653	/* timeouts cannot be negative */
654	if (argint < 0)
655	return apr_psprintf(parms->pool, "%s: Invalid argument",
656	parms->directive->directive);
657
658	mgs_srvconf_rec sc = (mgs_srvconf_rec )
659	ap_get_module_config(parms->server->module_config, &gnutls_module);
660
661	if (!strcasecmp(parms->directive->directive, "GnuTLSCacheTimeout"))
662	sc->cache_timeout = apr_time_from_sec(argint);
663	else if (!strcasecmp(parms->directive->directive,
664	"GnuTLSOCSPCacheTimeout"))
665	sc->ocsp_cache_time = apr_time_from_sec(argint);
666	else if (!strcasecmp(parms->directive->directive,
667	"GnuTLSOCSPFailureTimeout"))
668	sc->ocsp_failure_timeout = apr_time_from_sec(argint);
669	else if (!strcasecmp(parms->directive->directive,
670	"GnuTLSOCSPFuzzTime"))
671	sc->ocsp_fuzz_time = apr_time_from_sec(argint);
672	else if (!strcasecmp(parms->directive->directive,
673	"GnuTLSOCSPSocketTimeout"))
674	sc->ocsp_socket_timeout = apr_time_from_sec(argint);
675	else
676	/* Can't happen unless there's a serious bug in mod_gnutls or Apache */
677	return apr_psprintf(parms->pool,
678	"mod_gnutls: %s called for invalid option '%s'",
679	__func__, parms->directive->directive);
680
681	return NULL;
682	}
683
684	const char mgs_set_client_verify_method(cmd_parms parms, void *dummy __attribute__((unused)),
685	const char *arg) {
686	mgs_srvconf_rec sc = (mgs_srvconf_rec )ap_get_module_config(parms->server->module_config, &gnutls_module);
687
688	if (strcasecmp("cartel", arg) == 0) {
689	sc->client_verify_method = mgs_cvm_cartel;
690	} else if (strcasecmp("msva", arg) == 0) {
691	#ifdef ENABLE_MSVA
692	sc->client_verify_method = mgs_cvm_msva;
693	#else
694	return "GnuTLSClientVerifyMethod: msva is not supported";
695	#endif
696	} else {
697	return "GnuTLSClientVerifyMethod: Invalid argument";
698	}
699
700	return NULL;
701	}
702
703	const char mgs_set_client_verify(cmd_parms parms,
704	void *dirconf,
705	const char *arg) {
706	int mode;
707
708	if (strcasecmp("none", arg) == 0 \|\| strcasecmp("ignore", arg) == 0) {
709	mode = GNUTLS_CERT_IGNORE;
710	} else if (strcasecmp("optional", arg) == 0
711	\|\| strcasecmp("request", arg) == 0) {
712	mode = GNUTLS_CERT_REQUEST;
713	} else if (strcasecmp("require", arg) == 0) {
714	mode = GNUTLS_CERT_REQUIRE;
715	} else {
716	return "GnuTLSClientVerify: Invalid argument";
717	}
718
719	/* This was set from a directory context */
720	if (parms->path) {
721	mgs_dirconf_rec dc = (mgs_dirconf_rec ) dirconf;
722	dc->client_verify_mode = mode;
723	} else {
724	mgs_srvconf_rec sc = (mgs_srvconf_rec )
725	ap_get_module_config(parms->server->module_config,
726	&gnutls_module);
727	sc->client_verify_mode = mode;
728	}
729
730	return NULL;
731	}
732
733	const char mgs_set_client_ca_file(cmd_parms parms, void *dummy __attribute__((unused)),
734	const char *arg) {
735	mgs_srvconf_rec *sc =
736	(mgs_srvconf_rec *) ap_get_module_config(parms->server->
737	module_config,
738	&gnutls_module);
739
740	sc->x509_ca_file = ap_server_root_relative(parms->pool, arg);
741
742	return NULL;
743	}
744
745	/*
746	* Enable TLS proxy operation if arg is true, disable it otherwise.
747	*/
748	const char mgs_set_proxy_engine(cmd_parms parms,
749	void *dummy __attribute__((unused)),
750	const int arg)
751	{
752	mgs_srvconf_rec sc = (mgs_srvconf_rec )
753	ap_get_module_config(parms->server->module_config, &gnutls_module);
754
755	if (arg)
756	sc->proxy_enabled = GNUTLS_ENABLED_TRUE;
757	else
758	sc->proxy_enabled = GNUTLS_ENABLED_FALSE;
759
760	return NULL;
761	}
762
763	/*
764	* Enable TLS for the server/vhost if arg is true, disable it
765	* otherwise.
766	*/
767	const char mgs_set_enabled(cmd_parms parms,
768	void *dummy __attribute__((unused)),
769	const int arg)
770	{
771	mgs_srvconf_rec sc = (mgs_srvconf_rec )
772	ap_get_module_config(parms->server->module_config, &gnutls_module);
773
774	if (arg)
775	sc->enabled = GNUTLS_ENABLED_TRUE;
776	else
777	sc->enabled = GNUTLS_ENABLED_FALSE;
778
779	return NULL;
780	}
781
782	const char mgs_set_export_certificates_size(cmd_parms parms, void dummy __attribute__((unused)), const char arg) {
783	mgs_srvconf_rec sc = (mgs_srvconf_rec ) ap_get_module_config(parms->server->module_config, &gnutls_module);
784	if (!strcasecmp(arg, "On")) {
785	sc->export_certificates_size = 16 * 1024;
786	} else if (!strcasecmp(arg, "Off")) {
787	sc->export_certificates_size = 0;
788	} else {
789	char *endptr;
790	sc->export_certificates_size = strtol(arg, &endptr, 10);
791	while (apr_isspace(*endptr))
792	endptr++;
793	if (endptr == '\0' \|\| endptr == 'b' \|\| *endptr == 'B') {
794	;
795	} else if (endptr == 'k' \|\| endptr == 'K') {
796	sc->export_certificates_size *= 1024;
797	} else {
798	return
799	"GnuTLSExportCertificates must be set to a size (in bytes) or 'On' or 'Off'";
800	}
801	}
802
803	return NULL;
804	}
805
806
807
808	/*
809	* Store GnuTLS priority strings. Used for GnuTLSPriorities and
810	* GnuTLSProxyPriorities.
811	*/
812	const char mgs_set_priorities(cmd_parms parms,
813	void *dummy __attribute__((unused)),
814	const char *arg)
815	{
816	mgs_srvconf_rec sc = (mgs_srvconf_rec )
817	ap_get_module_config(parms->server->module_config, &gnutls_module);
818
819	if (!strcasecmp(parms->directive->directive, "GnuTLSPriorities"))
820	sc->priorities_str = apr_pstrdup(parms->pool, arg);
821	else if (!strcasecmp(parms->directive->directive, "GnuTLSProxyPriorities"))
822	sc->proxy_priorities_str = apr_pstrdup(parms->pool, arg);
823	else
824	/* Can't happen unless there's a serious bug in mod_gnutls or Apache */
825	return apr_psprintf(parms->pool,
826	"mod_gnutls: %s called for invalid option '%s'",
827	__func__, parms->directive->directive);
828
829	return NULL;
830	}
831
832
833
834	const char mgs_set_pin(cmd_parms parms, void *dummy __attribute__((unused)),
835	const char *arg)
836	{
837
838	mgs_srvconf_rec sc = (mgs_srvconf_rec )
839	ap_get_module_config(parms->server->module_config, &gnutls_module);
840
841	sc->pin = apr_pstrdup(parms->pool, arg);
842
843	return NULL;
844	}
845
846	const char mgs_set_srk_pin(cmd_parms parms,
847	void *dummy __attribute__((unused)),
848	const char *arg)
849	{
850
851	mgs_srvconf_rec sc = (mgs_srvconf_rec )
852	ap_get_module_config(parms->server->module_config, &gnutls_module);
853
854	sc->srk_pin = apr_pstrdup(parms->pool, arg);
855
856	return NULL;
857	}
858
859
860
861	static mgs_srvconf_rec _mgs_config_server_create(apr_pool_t p,
862	char **err __attribute__((unused)))
863	{
864	mgs_srvconf_rec sc = apr_pcalloc(p, sizeof(sc));
865
866	sc->enabled = GNUTLS_ENABLED_UNSET;
867
868	sc->privkey_x509 = NULL;
869	sc->anon_creds = NULL;
870	#ifdef ENABLE_SRP
871	sc->srp_creds = NULL;
872	#endif
873	sc->certs = NULL;
874	sc->certs_x509_chain = NULL;
875	sc->certs_x509_crt_chain = NULL;
876	sc->certs_x509_chain_num = 0;
877	sc->p11_modules = NULL;
878	sc->pin = NULL;
879
880	sc->priorities_str = NULL;
881	sc->cache_timeout = MGS_TIMEOUT_UNSET;
882	sc->cache_enable = GNUTLS_ENABLED_UNSET;
883	sc->cache = NULL;
884	sc->tickets = GNUTLS_ENABLED_UNSET;
885	sc->priorities = NULL;
886	sc->dh_params = NULL;
887	sc->dh_file = NULL;
888	sc->ca_list = NULL;
889	sc->ca_list_size = 0;
890	sc->proxy_enabled = GNUTLS_ENABLED_UNSET;
891	sc->export_certificates_size = -1;
892	sc->client_verify_method = mgs_cvm_unset;
893
894	sc->proxy_x509_key_file = NULL;
895	sc->proxy_x509_cert_file = NULL;
896	sc->proxy_x509_ca_file = NULL;
897	sc->proxy_x509_crl_file = NULL;
898	sc->proxy_priorities_str = NULL;
899	sc->proxy_x509_creds = NULL;
900	sc->anon_client_creds = NULL;
901	sc->proxy_priorities = NULL;
902	sc->proxy_x509_tl = NULL;
903
904	sc->ocsp_staple = GNUTLS_ENABLED_UNSET;
905	sc->ocsp_auto_refresh = GNUTLS_ENABLED_UNSET;
906	sc->ocsp_check_nonce = GNUTLS_ENABLED_UNSET;
907	sc->ocsp_response_file = NULL;
908	sc->ocsp_mutex = NULL;
909	sc->ocsp_cache = NULL;
910	sc->ocsp_cache_time = MGS_TIMEOUT_UNSET;
911	sc->ocsp_failure_timeout = MGS_TIMEOUT_UNSET;
912	sc->ocsp_fuzz_time = MGS_TIMEOUT_UNSET;
913	sc->ocsp_socket_timeout = MGS_TIMEOUT_UNSET;
914
915	sc->singleton_wd = NULL;
916
917	/* this relies on GnuTLS never changing the gnutls_certificate_request_t enum to define -1 */
918	sc->client_verify_mode = -1;
919
920	return sc;
921	}
922
923	void mgs_config_server_create(apr_pool_t p,
924	server_rec * s __attribute__((unused))) {
925	char *err = NULL;
926	mgs_srvconf_rec *sc = _mgs_config_server_create(p, &err);
927	if (sc)
928	return sc;
929	else
930	return err;
931	}
932
933	#define gnutls_srvconf_merge(t, unset) sc->t = (add->t == unset) ? base->t : add->t
934	#define gnutls_srvconf_assign(t) sc->t = add->t
935
936	void mgs_config_server_merge(apr_pool_t p, void BASE, void ADD)
937	{
938	char *err = NULL;
939	mgs_srvconf_rec base = (mgs_srvconf_rec ) BASE;
940	mgs_srvconf_rec add = (mgs_srvconf_rec ) ADD;
941	mgs_srvconf_rec *sc = _mgs_config_server_create(p, &err);
942	if (NULL == sc)
943	return err;
944
945	gnutls_srvconf_merge(enabled, GNUTLS_ENABLED_UNSET);
946	gnutls_srvconf_merge(tickets, GNUTLS_ENABLED_UNSET);
947	gnutls_srvconf_merge(proxy_enabled, GNUTLS_ENABLED_UNSET);
948	gnutls_srvconf_merge(export_certificates_size, -1);
949	gnutls_srvconf_merge(client_verify_method, mgs_cvm_unset);
950	gnutls_srvconf_merge(client_verify_mode, -1);
951	gnutls_srvconf_merge(srp_tpasswd_file, NULL);
952	gnutls_srvconf_merge(srp_tpasswd_conf_file, NULL);
953	gnutls_srvconf_merge(x509_cert_file, NULL);
954
955	gnutls_srvconf_merge(x509_key_file, NULL);
956	gnutls_srvconf_merge(x509_ca_file, NULL);
957	gnutls_srvconf_merge(p11_modules, NULL);
958	gnutls_srvconf_merge(pin, NULL);
959	gnutls_srvconf_merge(dh_file, NULL);
960	gnutls_srvconf_merge(priorities_str, NULL);
961	gnutls_srvconf_merge(cache_timeout, MGS_TIMEOUT_UNSET);
962
963	gnutls_srvconf_merge(proxy_x509_key_file, NULL);
964	gnutls_srvconf_merge(proxy_x509_cert_file, NULL);
965	gnutls_srvconf_merge(proxy_x509_ca_file, NULL);
966	gnutls_srvconf_merge(proxy_x509_crl_file, NULL);
967	gnutls_srvconf_merge(proxy_priorities_str, NULL);
968	gnutls_srvconf_merge(proxy_priorities, NULL);
969
970	gnutls_srvconf_merge(ocsp_staple, GNUTLS_ENABLED_UNSET);
971	gnutls_srvconf_merge(ocsp_auto_refresh, GNUTLS_ENABLED_UNSET);
972	gnutls_srvconf_merge(ocsp_check_nonce, GNUTLS_ENABLED_UNSET);
973	gnutls_srvconf_assign(ocsp_response_file);
974	gnutls_srvconf_merge(ocsp_cache_time, MGS_TIMEOUT_UNSET);
975	gnutls_srvconf_merge(ocsp_failure_timeout, MGS_TIMEOUT_UNSET);
976	gnutls_srvconf_merge(ocsp_fuzz_time, MGS_TIMEOUT_UNSET);
977	gnutls_srvconf_merge(ocsp_socket_timeout, MGS_TIMEOUT_UNSET);
978
979	gnutls_srvconf_assign(ca_list);
980	gnutls_srvconf_assign(ca_list_size);
981	gnutls_srvconf_assign(certs);
982	gnutls_srvconf_assign(anon_creds);
983	gnutls_srvconf_assign(srp_creds);
984	gnutls_srvconf_assign(certs_x509_chain);
985	gnutls_srvconf_assign(certs_x509_crt_chain);
986	gnutls_srvconf_assign(certs_x509_chain_num);
987
988	return sc;
989	}
990
991	#undef gnutls_srvconf_merge
992	#undef gnutls_srvconf_assign
993
994	void mgs_config_dir_merge(apr_pool_t p,
995	void *basev __attribute__((unused)),
996	void *addv __attribute__((unused))) {
997	mgs_dirconf_rec *new;
998	/* mgs_dirconf_rec base = (mgs_dirconf_rec ) basev; */
999	mgs_dirconf_rec add = (mgs_dirconf_rec ) addv;
1000
1001	new = (mgs_dirconf_rec *) apr_pcalloc(p, sizeof(mgs_dirconf_rec));
1002	new->client_verify_mode = add->client_verify_mode;
1003	return new;
1004	}
1005
1006	void mgs_config_dir_create(apr_pool_t p,
1007	char *dir __attribute__((unused))) {
1008	mgs_dirconf_rec dc = apr_palloc(p, sizeof (dc));
1009	dc->client_verify_mode = -1;
1010	return dc;
1011	}
1012
1013
1014
1015	/*
1016	* Store paths to proxy credentials
1017	*
1018	* This function copies the paths provided in the configuration file
1019	* into the server configuration. The post configuration hook takes
1020	* care of actually loading the credentials, which means than invalid
1021	* paths or the like will be detected there.
1022	*/
1023	const char mgs_store_cred_path(cmd_parms parms,
1024	void *dummy __attribute__((unused)),
1025	const char *arg)
1026	{
1027	mgs_srvconf_rec sc = (mgs_srvconf_rec )
1028	ap_get_module_config(parms->server->module_config, &gnutls_module);
1029
1030	/* parms->directive->directive contains the directive string */
1031	if (!strcasecmp(parms->directive->directive, "GnuTLSProxyKeyFile"))
1032	sc->proxy_x509_key_file = apr_pstrdup(parms->pool, arg);
1033	else if (!strcasecmp(parms->directive->directive,
1034	"GnuTLSProxyCertificateFile"))
1035	sc->proxy_x509_cert_file = apr_pstrdup(parms->pool, arg);
1036	else if (!strcasecmp(parms->directive->directive, "GnuTLSProxyCAFile"))
1037	sc->proxy_x509_ca_file = apr_pstrdup(parms->pool, arg);
1038	else if (!strcasecmp(parms->directive->directive, "GnuTLSProxyCRLFile"))
1039	sc->proxy_x509_crl_file = apr_pstrdup(parms->pool, arg);
1040	return NULL;
1041	}
1042
1043
1044
1045	/*
1046	* Record PKCS #11 module to load. Note that the value is only used in
1047	* the base config, settings in virtual hosts are ignored.
1048	*/
1049	const char mgs_set_p11_module(cmd_parms parms,
1050	void *dummy __attribute__((unused)),
1051	const char *arg)
1052	{
1053	mgs_srvconf_rec sc = (mgs_srvconf_rec )
1054	ap_get_module_config(parms->server->module_config, &gnutls_module);
1055	/* initialize PKCS #11 module list if necessary */
1056	if (sc->p11_modules == NULL)
1057	sc->p11_modules = apr_array_make(parms->pool, 2, sizeof(char*));
1058
1059	(char *) apr_array_push(sc->p11_modules) = apr_pstrdup(parms->pool, arg);
1060
1061	return NULL;
1062	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: