Context Navigation

source: mod_gnutls/src/gnutls_hooks.c @ 836417f

Visit:

asynciodebian/masterdebian/stretch-backportsjessie-backportsmsvaproxy-ticketupstream

Last change on this file since 836417f was 836417f, checked in by Paul Querna <chip@…>, 16 years ago
Refactor finding the correct server record to fix resumed sessions.
Property mode set to `100644`
File size: 21.1 KB

Rev	Line
[c301152]	1	/**
	2	* Copyright 2004-2005 Paul Querna
	3	*
	4	* Licensed under the Apache License, Version 2.0 (the "License");
	5	* you may not use this file except in compliance with the License.
	6	* You may obtain a copy of the License at
	7	*
	8	* http://www.apache.org/licenses/LICENSE-2.0
	9	*
	10	* Unless required by applicable law or agreed to in writing, software
	11	* distributed under the License is distributed on an "AS IS" BASIS,
	12	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	13	* See the License for the specific language governing permissions and
	14	* limitations under the License.
	15	*
	16	*/
	17
	18	#include "mod_gnutls.h"
	19	#include "http_vhost.h"
	20
	21	#if !USING_2_1_RECENT
	22	extern server_rec *ap_server_conf;
	23	#endif
	24
	25	#if APR_HAS_THREADS
	26	GCRY_THREAD_OPTION_PTHREAD_IMPL;
	27	#endif
	28
	29	#if MOD_GNUTLS_DEBUG
	30	static apr_file_t* debug_log_fp;
	31	#endif
	32
	33	static apr_status_t mgs_cleanup_pre_config(void *data)
	34	{
	35	gnutls_global_deinit();
	36	return APR_SUCCESS;
	37	}
	38
	39	#if MOD_GNUTLS_DEBUG
	40	static void gnutls_debug_log_all( int level, const char* str)
	41	{
	42	apr_file_printf(debug_log_fp, "<%d> %s\n", level, str);
	43	}
	44	#endif
	45
	46	int mgs_hook_pre_config(apr_pool_t * pconf,
	47	apr_pool_t * plog, apr_pool_t * ptemp)
	48	{
	49
	50	#if APR_HAS_THREADS
	51	/* TODO: Check MPM Type here */
	52	gcry_control(GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread);
	53	#endif
	54
	55	gnutls_global_init();
	56
	57	apr_pool_cleanup_register(pconf, NULL, mgs_cleanup_pre_config,
	58	apr_pool_cleanup_null);
	59
	60	#if MOD_GNUTLS_DEBUG
	61	apr_file_open(&debug_log_fp, "/tmp/gnutls_debug",
	62	APR_APPEND\|APR_WRITE\|APR_CREATE, APR_OS_DEFAULT, pconf);
	63
	64	gnutls_global_set_log_level(9);
	65	gnutls_global_set_log_function(gnutls_debug_log_all);
	66	#endif
	67
	68	return OK;
	69	}
	70
	71
	72	static gnutls_datum load_params(const char* file, server_rec* s,
	73	apr_pool_t* pool)
	74	{
	75	gnutls_datum ret = { NULL, 0 };
	76	apr_file_t* fp;
	77	apr_finfo_t finfo;
	78	apr_status_t rv;
	79	apr_size_t br = 0;
	80
	81	rv = apr_file_open(&fp, file, APR_READ\|APR_BINARY, APR_OS_DEFAULT,
	82	pool);
	83	if (rv != APR_SUCCESS) {
	84	ap_log_error(APLOG_MARK, APLOG_STARTUP, rv, s,
	85	"GnuTLS failed to load params file at: %s", file);
	86	return ret;
	87	}
	88
	89	rv = apr_file_info_get(&finfo, APR_FINFO_SIZE, fp);
	90
	91	if (rv != APR_SUCCESS) {
	92	ap_log_error(APLOG_MARK, APLOG_STARTUP, rv, s,
	93	"GnuTLS failed to stat params file at: %s", file);
	94	return ret;
	95	}
	96
	97	ret.data = apr_palloc(pool, finfo.size+1);
	98	rv = apr_file_read_full(fp, ret.data, finfo.size, &br);
	99
	100	if (rv != APR_SUCCESS) {
	101	ap_log_error(APLOG_MARK, APLOG_STARTUP, rv, s,
	102	"GnuTLS failed to read params file at: %s", file);
	103	return ret;
	104	}
	105	apr_file_close(fp);
	106	ret.data[br] = '\0';
	107	ret.size = br;
	108
	109	return ret;
	110	}
	111
	112	int mgs_hook_post_config(apr_pool_t * p, apr_pool_t * plog,
	113	apr_pool_t * ptemp,
	114	server_rec * base_server)
	115	{
	116	int rv;
	117	int data_len;
	118	server_rec *s;
	119	gnutls_dh_params_t dh_params;
	120	gnutls_rsa_params_t rsa_params;
	121	mgs_srvconf_rec *sc;
	122	mgs_srvconf_rec *sc_base;
	123	void *data = NULL;
	124	int first_run = 0;
	125	const char *userdata_key = "mgs_init";
	126
	127	apr_pool_userdata_get(&data, userdata_key, base_server->process->pool);
	128	if (data == NULL) {
	129	first_run = 1;
	130	apr_pool_userdata_set((const void *)1, userdata_key,
	131	apr_pool_cleanup_null,
	132	base_server->process->pool);
	133	}
	134
	135
	136	{
	137	gnutls_datum pdata;
	138	apr_pool_t* tpool;
	139	s = base_server;
	140	sc_base = (mgs_srvconf_rec *) ap_get_module_config(s->module_config,
	141	&gnutls_module);
	142
	143	apr_pool_create(&tpool, p);
	144
	145	gnutls_dh_params_init(&dh_params);
	146
	147	pdata = load_params(sc_base->dh_params_file, s, tpool);
	148
	149	if (pdata.size != 0) {
	150	rv = gnutls_dh_params_import_pkcs3(dh_params, &pdata,
	151	GNUTLS_X509_FMT_PEM);
	152	if (rv != 0) {
	153	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
	154	"GnuTLS: Unable to load DH Params: (%d) %s",
	155	rv, gnutls_strerror(rv));
	156	exit(rv);
	157	}
	158	}
	159	else {
	160	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
	161	"GnuTLS: Unable to load DH Params."
	162	" Shutting Down.");
	163	exit(-1);
	164	}
	165	apr_pool_clear(tpool);
	166
	167	gnutls_rsa_params_init(&rsa_params);
	168
	169	pdata = load_params(sc_base->rsa_params_file, s, tpool);
	170
	171	if (pdata.size != 0) {
	172	rv = gnutls_rsa_params_import_pkcs1(rsa_params, &pdata,
	173	GNUTLS_X509_FMT_PEM);
	174	if (rv != 0) {
	175	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
	176	"GnuTLS: Unable to load RSA Params: (%d) %s",
	177	rv, gnutls_strerror(rv));
	178	exit(rv);
	179	}
	180	}
	181	else {
	182	ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
	183	"GnuTLS: Unable to load RSA Params."
	184	" Shutting Down.");
	185	exit(-1);
	186	}
	187
	188	apr_pool_destroy(tpool);
	189	rv = mgs_cache_post_config(p, s, sc_base);
	190	if (rv != 0) {
	191	ap_log_error(APLOG_MARK, APLOG_STARTUP, rv, s,
	192	"GnuTLS: Post Config for GnuTLSCache Failed."
	193	" Shutting Down.");
	194	exit(-1);
	195	}
	196
	197	for (s = base_server; s; s = s->next) {
	198	sc = (mgs_srvconf_rec *) ap_get_module_config(s->module_config,
	199	&gnutls_module);
	200	sc->cache_type = sc_base->cache_type;
	201	sc->cache_config = sc_base->cache_config;
	202
	203	gnutls_certificate_set_rsa_export_params(sc->certs,
	204	rsa_params);
	205	gnutls_certificate_set_dh_params(sc->certs, dh_params);
	206
	207	if (sc->cert_x509 == NULL && sc->enabled == GNUTLS_ENABLED_TRUE) {
	208	ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,
	209	"[GnuTLS] - Host '%s:%d' is missing a "
	210	"Certificate File!",
	211	s->server_hostname, s->port);
	212	exit(-1);
	213	}
	214
	215	if (sc->privkey_x509 == NULL && sc->enabled == GNUTLS_ENABLED_TRUE) {
	216	ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,
	217	"[GnuTLS] - Host '%s:%d' is missing a "
	218	"Private Key File!",
	219	s->server_hostname, s->port);
	220	exit(-1);
	221	}
	222
	223	rv = gnutls_x509_crt_get_dn_by_oid(sc->cert_x509,
	224	GNUTLS_OID_X520_COMMON_NAME, 0, 0,
	225	NULL, &data_len);
	226
	227	if (data_len < 1) {
	228	sc->enabled = GNUTLS_ENABLED_FALSE;
	229	sc->cert_cn = NULL;
	230	continue;
	231	}
	232
	233	sc->cert_cn = apr_palloc(p, data_len);
	234	rv = gnutls_x509_crt_get_dn_by_oid(sc->cert_x509,
	235	GNUTLS_OID_X520_COMMON_NAME, 0, 0,
	236	sc->cert_cn, &data_len);
	237	ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,
	238	s,
	239	"GnuTLS: sni-x509 cn: %s/%d pk: %s s: 0x%08X sc: 0x%08X", sc->cert_cn, rv,
	240	gnutls_pk_algorithm_get_name(gnutls_x509_privkey_get_pk_algorithm(sc->privkey_x509)),
	241	(unsigned int)s, (unsigned int)sc);
	242	}
	243	}
	244
	245	ap_add_version_component(p, "mod_gnutls/" MOD_GNUTLS_VERSION);
	246
	247	return OK;
	248	}
	249
	250	void mgs_hook_child_init(apr_pool_t p, server_rec s)
	251	{
	252	apr_status_t rv = APR_SUCCESS;
	253	mgs_srvconf_rec *sc = ap_get_module_config(s->module_config,
	254	&gnutls_module);
	255
	256	if (sc->cache_type != mgs_cache_none) {
	257	rv = mgs_cache_child_init(p, s, sc);
	258	if(rv != APR_SUCCESS) {
	259	ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s,
	260	"[GnuTLS] - Failed to run Cache Init");
	261	}
	262	}
	263	else {
	264	ap_log_error(APLOG_MARK, APLOG_CRIT, 0, s,
	265	"[GnuTLS] - No Cache Configured. Hint: GnuTLSCache");
	266	}
	267	}
	268
	269	const char mgs_hook_http_scheme(const request_rec r)
	270	{
	271	mgs_srvconf_rec *sc =
	272	(mgs_srvconf_rec *) ap_get_module_config(r->server->
	273	module_config,
	274	&gnutls_module);
	275
	276	if (sc->enabled == GNUTLS_ENABLED_FALSE) {
	277	return NULL;
	278	}
	279
	280	return "https";
	281	}
	282
	283	apr_port_t mgs_hook_default_port(const request_rec * r)
	284	{
	285	mgs_srvconf_rec *sc =
	286	(mgs_srvconf_rec *) ap_get_module_config(r->server->
	287	module_config,
	288	&gnutls_module);
	289
	290	if (sc->enabled == GNUTLS_ENABLED_FALSE) {
	291	return 0;
	292	}
	293
	294	return 443;
	295	}
	296
	297	#define MAX_HOST_LEN 255
	298
	299	#if USING_2_1_RECENT
	300	typedef struct
	301	{
	302	mgs_handle_t *ctxt;
[836417f]	303	mgs_srvconf_rec *sc;
[c301152]	304	const char* sni_name;
	305	} vhost_cb_rec;
	306
	307	static int vhost_cb (void* baton, conn_rec* conn, server_rec* s)
	308	{
	309	mgs_srvconf_rec *tsc;
	310	vhost_cb_rec* x = baton;
	311
	312	tsc = (mgs_srvconf_rec *) ap_get_module_config(s->module_config,
	313	&gnutls_module);
	314
	315	if (tsc->enabled != GNUTLS_ENABLED_TRUE \|\| tsc->cert_cn == NULL) {
	316	return 0;
	317	}
	318
	319	/* The CN can contain a * -- this will match those too. */
	320	if (ap_strcasecmp_match(x->sni_name, tsc->cert_cn) == 0) {
	321	/* found a match */
	322	#if MOD_GNUTLS_DEBUG
	323	ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,
	324	x->ctxt->c->base_server,
	325	"GnuTLS: Virtual Host CB: "
	326	"'%s' == '%s'", tsc->cert_cn, x->sni_name);
	327	#endif
	328	/* Because we actually change the server used here, we need to reset
	329	* things like ClientVerify.
	330	*/
[836417f]	331	x->sc = tsc;
[c301152]	332	/* Shit. Crap. Dammit. We really should rehandshake here, as our
	333	* certificate structure should change when the server changes.
	334	* acccckkkkkk.
	335	*/
	336	return 1;
	337	}
	338	return 0;
	339	}
	340	#endif
	341
[836417f]	342	mgs_srvconf_rec* mgs_find_sni_server(gnutls_session_t session)
[c301152]	343	{
	344	int rv;
	345	int sni_type;
	346	int data_len = MAX_HOST_LEN;
	347	char sni_name[MAX_HOST_LEN];
	348	mgs_handle_t *ctxt;
	349	#if USING_2_1_RECENT
	350	vhost_cb_rec cbx;
	351	#else
	352	server_rec* s;
	353	mgs_srvconf_rec *tsc;
	354	#endif
	355
	356	ctxt = gnutls_transport_get_ptr(session);
	357
	358	sni_type = gnutls_certificate_type_get(session);
	359	if (sni_type != GNUTLS_CRT_X509) {
	360	/* In theory, we could support OpenPGP Certificates. Theory != code. */
	361	ap_log_error(APLOG_MARK, APLOG_CRIT, 0,
	362	ctxt->c->base_server,
	363	"GnuTLS: Only x509 Certificates are currently supported.");
[836417f]	364	return NULL;
[c301152]	365	}
	366
	367	rv = gnutls_server_name_get(ctxt->session, sni_name,
	368	&data_len, &sni_type, 0);
[836417f]	369
[c301152]	370	if (rv != 0) {
[836417f]	371	return NULL;
[c301152]	372	}
[836417f]	373
[c301152]	374	if (sni_type != GNUTLS_NAME_DNS) {
	375	ap_log_error(APLOG_MARK, APLOG_CRIT, 0,
	376	ctxt->c->base_server,
	377	"GnuTLS: Unknown type '%d' for SNI: "
[836417f]	378	"'%s'", sni_type, sni_name);
	379	return NULL;
[c301152]	380	}
	381
	382	/**
	383	* Code in the Core already sets up the c->base_server as the base
	384	* for this IP/Port combo. Trust that the core did the 'right' thing.
	385	*/
	386	#if USING_2_1_RECENT
	387	cbx.ctxt = ctxt;
[836417f]	388	cbx.sc = NULL;
[c301152]	389	cbx.sni_name = sni_name;
[836417f]	390
[c301152]	391	rv = ap_vhost_iterate_given_conn(ctxt->c, vhost_cb, &cbx);
	392	if (rv == 1) {
[836417f]	393	return cbx.sc;
[c301152]	394	}
	395	#else
	396	for (s = ap_server_conf; s; s = s->next) {
	397
	398	tsc = (mgs_srvconf_rec *) ap_get_module_config(s->module_config,
[836417f]	399	&gnutls_module);
[c301152]	400	if (tsc->enabled != GNUTLS_ENABLED_TRUE) {
	401	continue;
	402	}
	403	#if MOD_GNUTLS_DEBUG
	404	ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,
	405	ctxt->c->base_server,
	406	"GnuTLS: sni-x509 cn: %s/%d pk: %s s: 0x%08X s->n: 0x%08X sc: 0x%08X", tsc->cert_cn, rv,
	407	gnutls_pk_algorithm_get_name(gnutls_x509_privkey_get_pk_algorithm(ctxt->sc->privkey_x509)),
	408	(unsigned int)s, (unsigned int)s->next, (unsigned int)tsc);
	409	#endif
	410	/* The CN can contain a * -- this will match those too. */
	411	if (ap_strcasecmp_match(sni_name, tsc->cert_cn) == 0) {
	412	#if MOD_GNUTLS_DEBUG
	413	ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,
	414	ctxt->c->base_server,
	415	"GnuTLS: Virtual Host: "
	416	"'%s' == '%s'", tsc->cert_cn, sni_name);
	417	#endif
[836417f]	418	return tsc;
[c301152]	419	}
	420	}
	421	#endif
[836417f]	422	return NULL;
	423	}
	424
	425
	426	static int cert_retrieve_fn(gnutls_session_t session, gnutls_retr_st* ret)
	427	{
	428	mgs_handle_t *ctxt;
	429	mgs_srvconf_rec *tsc;
	430
	431	ctxt = gnutls_transport_get_ptr(session);
	432
	433	ret->type = GNUTLS_CRT_X509;
	434	ret->ncerts = 1;
	435	ret->deinit_all = 0;
	436
	437	tsc = mgs_find_sni_server(session);
	438
	439	if (tsc != NULL) {
	440	ctxt->sc = tsc;
	441	gnutls_certificate_server_set_request(ctxt->session, ctxt->sc->client_verify_mode);
	442	}
[c301152]	443
	444	ret->cert.x509 = &ctxt->sc->cert_x509;
	445	ret->key.x509 = ctxt->sc->privkey_x509;
	446	return 0;
	447	}
	448
	449	static mgs_handle_t* create_gnutls_handle(apr_pool_t* pool, conn_rec * c)
	450	{
	451	mgs_handle_t *ctxt;
	452	mgs_srvconf_rec *sc =
	453	(mgs_srvconf_rec *) ap_get_module_config(c->base_server->
	454	module_config,
	455	&gnutls_module);
	456
	457	ctxt = apr_pcalloc(pool, sizeof(*ctxt));
	458	ctxt->c = c;
	459	ctxt->sc = sc;
	460	ctxt->status = 0;
	461
	462	ctxt->input_rc = APR_SUCCESS;
	463	ctxt->input_bb = apr_brigade_create(c->pool, c->bucket_alloc);
	464	ctxt->input_cbuf.length = 0;
	465
	466	ctxt->output_rc = APR_SUCCESS;
	467	ctxt->output_bb = apr_brigade_create(c->pool, c->bucket_alloc);
	468	ctxt->output_blen = 0;
	469	ctxt->output_length = 0;
	470
	471	gnutls_init(&ctxt->session, GNUTLS_SERVER);
	472
	473	gnutls_protocol_set_priority(ctxt->session, sc->protocol);
	474	gnutls_cipher_set_priority(ctxt->session, sc->ciphers);
	475	gnutls_compression_set_priority(ctxt->session, sc->compression);
	476	gnutls_kx_set_priority(ctxt->session, sc->key_exchange);
	477	gnutls_mac_set_priority(ctxt->session, sc->macs);
	478	gnutls_certificate_type_set_priority(ctxt->session, sc->cert_types);
	479
	480	mgs_cache_session_init(ctxt);
	481
	482	gnutls_credentials_set(ctxt->session, GNUTLS_CRD_CERTIFICATE, ctxt->sc->certs);
	483
	484	gnutls_certificate_server_set_retrieve_function(sc->certs, cert_retrieve_fn);
	485	gnutls_certificate_server_set_request(ctxt->session, ctxt->sc->client_verify_mode);
	486	return ctxt;
	487	}
	488
	489	int mgs_hook_pre_connection(conn_rec * c, void *csd)
	490	{
	491	mgs_handle_t *ctxt;
	492	mgs_srvconf_rec *sc =
	493	(mgs_srvconf_rec *) ap_get_module_config(c->base_server->
	494	module_config,
	495	&gnutls_module);
	496
	497	if (!(sc && (sc->enabled == GNUTLS_ENABLED_TRUE))) {
	498	return DECLINED;
	499	}
	500
	501	ctxt = create_gnutls_handle(c->pool, c);
	502
	503	ap_set_module_config(c->conn_config, &gnutls_module, ctxt);
	504
	505	gnutls_transport_set_pull_function(ctxt->session,
	506	mgs_transport_read);
	507	gnutls_transport_set_push_function(ctxt->session,
	508	mgs_transport_write);
	509	gnutls_transport_set_ptr(ctxt->session, ctxt);
	510
	511	ctxt->input_filter = ap_add_input_filter(GNUTLS_INPUT_FILTER_NAME, ctxt,
	512	NULL, c);
	513	ctxt->output_filter = ap_add_output_filter(GNUTLS_OUTPUT_FILTER_NAME, ctxt,
	514	NULL, c);
	515
	516	return OK;
	517	}
	518
	519	int mgs_hook_fixups(request_rec *r)
	520	{
	521	unsigned char sbuf[GNUTLS_MAX_SESSION_ID];
[7ba803b]	522	char buf[AP_IOBUFSIZE];
[c301152]	523	const char* tmp;
	524	int len;
	525	mgs_handle_t *ctxt;
[2ad3683]	526	int rv = OK;
[7ba803b]	527
[c301152]	528	apr_table_t *env = r->subprocess_env;
	529
	530	ctxt = ap_get_module_config(r->connection->conn_config, &gnutls_module);
	531
	532	if(!ctxt) {
	533	return DECLINED;
	534	}
	535
	536	apr_table_setn(env, "HTTPS", "on");
	537
	538	apr_table_setn(env, "GNUTLS_VERSION_INTERFACE", MOD_GNUTLS_VERSION);
	539	apr_table_setn(env, "GNUTLS_VERSION_LIBRARY", LIBGNUTLS_VERSION);
	540
	541	apr_table_setn(env, "SSL_PROTOCOL",
	542	gnutls_protocol_get_name(gnutls_protocol_get_version(ctxt->session)));
	543
	544	apr_table_setn(env, "SSL_CIPHER",
	545	gnutls_cipher_get_name(gnutls_cipher_get(ctxt->session)));
	546
	547	apr_table_setn(env, "SSL_CLIENT_VERIFY", "NONE");
	548
	549	tmp = apr_psprintf(r->pool, "%d",
	550	8 * gnutls_cipher_get_key_size(gnutls_cipher_get(ctxt->session)));
	551
	552	apr_table_setn(env, "SSL_CIPHER_USEKEYSIZE", tmp);
	553
	554	apr_table_setn(env, "SSL_CIPHER_ALGKEYSIZE", tmp);
	555
	556	len = sizeof(sbuf);
	557	gnutls_session_get_id(ctxt->session, sbuf, &len);
	558	tmp = mgs_session_id2sz(sbuf, len, buf, sizeof(buf));
[38435cc]	559	apr_table_setn(env, "SSL_SESSION_ID", apr_pstrdup(r->pool, tmp));
[7ba803b]	560
	561	/* TODO: There are many other env vars that we need to add */
	562	{
[2ad3683]	563	len = sizeof(buf);
	564	gnutls_x509_crt_get_dn(ctxt->sc->cert_x509, buf, &len);
[38435cc]	565	apr_table_setn(env, "SSL_SERVER_S_DN", apr_pstrmemdup(r->pool, buf, len));
[2ad3683]	566
	567	len = sizeof(buf);
	568	gnutls_x509_crt_get_issuer_dn(ctxt->sc->cert_x509, buf, &len);
[38435cc]	569	apr_table_setn(env, "SSL_SERVER_I_DN", apr_pstrmemdup(r->pool, buf, len));
[7ba803b]	570	}
[c301152]	571
[2ad3683]	572	return rv;
[c301152]	573	}
	574
	575	int mgs_hook_authz(request_rec *r)
	576	{
	577	int rv;
	578	int status;
	579	mgs_handle_t *ctxt;
	580	mgs_dirconf_rec *dc = ap_get_module_config(r->per_dir_config,
	581	&gnutls_module);
	582
	583	ctxt = ap_get_module_config(r->connection->conn_config, &gnutls_module);
	584
	585	if (!ctxt) {
	586	return DECLINED;
	587	}
	588
	589	if (!dc) {
	590	dc = mgs_config_dir_create(r->pool, NULL);
	591	}
	592
	593	if (dc->client_verify_mode == GNUTLS_CERT_IGNORE) {
	594	ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
	595	"GnuTLS: Directory set to Ignore Client Certificate!");
	596	return DECLINED;
	597	}
	598
	599	if (ctxt->sc->client_verify_mode < dc->client_verify_mode) {
	600	ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
	601	"GnuTLS: Attempting to rehandshake with peer. %d %d",
	602	ctxt->sc->client_verify_mode, dc->client_verify_mode);
	603
	604	gnutls_certificate_server_set_request(ctxt->session,
	605	dc->client_verify_mode);
	606
	607	if (mgs_rehandshake(ctxt) != 0) {
	608	return HTTP_FORBIDDEN;
	609	}
	610	}
	611	else if (ctxt->sc->client_verify_mode == GNUTLS_CERT_IGNORE) {
	612	#if MOD_GNUTLS_DEBUG
	613	ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
	614	"GnuTLS: Peer is set to IGNORE");
	615	#endif
	616	return DECLINED;
	617	}
	618
	619	rv = gnutls_certificate_verify_peers2(ctxt->session, &status);
	620
	621	if (rv < 0) {
	622	ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
	623	"GnuTLS: Failed to Verify Peer: (%d) %s",
	624	rv, gnutls_strerror(rv));
	625	return HTTP_FORBIDDEN;
	626	}
	627
	628	if (status < 0) {
	629	ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
	630	"GnuTLS: Peer Status is invalid.");
	631	return HTTP_FORBIDDEN;
	632	}
	633
	634	if (status & GNUTLS_CERT_SIGNER_NOT_FOUND) {
	635	ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
	636	"GnuTLS: Could not find Signer for Peer Certificate");
	637	}
	638
	639	if (status & GNUTLS_CERT_SIGNER_NOT_CA) {
	640	ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
	641	"GnuTLS: Could not find CA for Peer Certificate");
	642	}
	643
	644	if (status & GNUTLS_CERT_INVALID) {
	645	ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
	646	"GnuTLS: Peer Certificate is invalid.");
	647	return HTTP_FORBIDDEN;
	648	}
	649	else if (status & GNUTLS_CERT_REVOKED) {
	650	ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
	651	"GnuTLS: Peer Certificate is revoked.");
	652	return HTTP_FORBIDDEN;
	653	}
	654
	655	/* TODO: OpenPGP Certificates */
	656	if (gnutls_certificate_type_get(ctxt->session) != GNUTLS_CRT_X509) {
	657	ap_log_rerror(APLOG_MARK, APLOG_CRIT, 0, r,
	658	"GnuTLS: Only x509 is supported for client certificates");
	659	return HTTP_FORBIDDEN;
	660	}
	661	/* TODO: Further Verification. */
	662	ap_log_rerror(APLOG_MARK, APLOG_CRIT, 0, r,
	663	"GnuTLS: Verified Peer.");
	664	return OK;
	665	}
	666

Note: See TracBrowser for help on using the repository browser.

Download in other formats: