Changeset 07d548d in mod_gnutls

Timestamp:

Jan 26, 2015, 11:41:05 AM (8 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

asyncio, debian/master, debian/stretch-backports, jessie-backports, main, master, proxy-ticket, upstream

Children:

5342265

Parents:

accbb83

Message:

Properly use SSLProxyEngine option

ssl_proxy_enable now checks if SSLProxyEngine is enabled, and fails with
an error log entry if not. If it is, TLS is enabled in the mod_gnutls
connection structure.

The pre connection hook (mgs_hook_pre_connection) is changed such that
it does not decline any connection whatsoever if TLS proxy is enabled.

Not that actually using TLS in a proxy backend is still unsupported and
will NOT work.

Location:

src

Files:

• gnutls_hooks.c (modified) (1 diff)
• mod_gnutls.c (modified) (1 diff)

src/gnutls_hooks.c

@@ -753 +753 @@
         ap_get_module_config(c->conn_config, &gnutls_module);
 
-    if ((sc && (!sc->enabled || sc->proxy_enabled == GNUTLS_ENABLED_TRUE))
-        || (ctxt && ctxt->enabled == GNUTLS_ENABLED_FALSE))
+    if ((sc && (!sc->enabled)) || (ctxt && ctxt->enabled == GNUTLS_ENABLED_FALSE))
     {
         ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, "%s declined connection",

src/mod_gnutls.c

@@ -112 +112 @@
 int ssl_proxy_enable(conn_rec *c)
 {
+    /* check if TLS proxy support is enabled */
     mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
         ap_get_module_config(c->base_server->module_config, &gnutls_module);
-    sc->proxy_enabled = GNUTLS_ENABLED_TRUE;
-    sc->enabled = GNUTLS_ENABLED_FALSE;
+    if (sc->proxy_enabled != GNUTLS_ENABLED_TRUE)
+    {
+        ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c,
+                      "%s: mod_proxy requested TLS proxy, but not enabled "
+                      "for %s", __func__, sc->cert_cn);
+        return 0;
+    }
+
+    /* enable TLS for this connection */
+    mgs_handle_t *ctxt = (mgs_handle_t *)
+        ap_get_module_config(c->conn_config, &gnutls_module);
+    if (ctxt == NULL)
+    {
+        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c,
+                      "%s: allocating connection memory", __func__);
+        ctxt = apr_pcalloc(c->pool, sizeof (*ctxt));
+        ap_set_module_config(c->conn_config, &gnutls_module, ctxt);
+    }
+    ctxt->enabled = GNUTLS_ENABLED_TRUE;
     return 1;
 }