Changeset 2b3a248b in mod_gnutls for src

Timestamp:

Dec 16, 2007, 4:04:11 AM (15 years ago)

Author:

Nokis Mavrogiannopoulos <nmav@…>

Branches:

asyncio, debian/master, debian/stretch-backports, jessie-backports, main, master, msva, proxy-ticket, upstream

Children:

e6f648a

Parents:

8bd529f

git-author:

Nikos Mavrogiannopoulos <nmav@…> (12/16/07 04:04:11)

git-committer:

Nokis Mavrogiannopoulos <nmav@…> (12/16/07 04:04:11)

Message:

more changes for openpgp support. Seems to be at a workable state.

Location:

src

Files:

• gnutls_config.c (modified) (3 diffs)
• gnutls_hooks.c (modified) (11 diffs)
• mod_gnutls.c (modified) (2 diffs)

src/gnutls_config.c

@@ -1 +1 @@
 /**
  *  Copyright 2004-2005 Paul Querna
+ *  Copyright 2007 Nikos Mavrogiannopoulos
  *
  *  Licensed under the Apache License, Version 2.0 (the "License");
@@ -230 +231 @@
     }
       
-
     ret =
         gnutls_openpgp_crt_import(sc->cert_pgp, &data, GNUTLS_OPENPGP_FMT_BASE64);
@@ -451 +451 @@
     }
 
+    rv = gnutls_openpgp_keyring_init(&sc->pgp_list);
+    if (rv < 0) {
+        return apr_psprintf(parms->pool, "GnuTLS: Failed to initialize"
+                            "keyring: (%d) %s", rv, gnutls_strerror(rv));
+    }
+
     rv = gnutls_openpgp_keyring_import(sc->pgp_list, &data, GNUTLS_OPENPGP_FMT_BASE64);
     if (rv < 0) {

src/gnutls_hooks.c

@@ -72 +72 @@
 #endif
 
+    if (gnutls_check_version(LIBGNUTLS_VERSION)==NULL) {
+        fprintf(stderr, "gnutls_check_version() failed. Required: gnutls-%s Found: gnutls-%s\n", 
+          LIBGNUTLS_VERSION, gnutls_check_version(NULL));
+        return -3;
+    }
+
     ret = gnutls_global_init();
-    if (ret < 0) /* FIXME: can we print here? */ {
+    if (ret < 0) {
         fprintf(stderr, "gnutls_global_init: %s\n", gnutls_strerror(ret));
         return -3;
@@ -79 +85 @@
 
     ret = gnutls_global_init_extra();
-    if (ret < 0) { /* FIXME: can we print here? */
+    if (ret < 0) {
         fprintf(stderr, "gnutls_global_init_extra: %s\n", gnutls_strerror(ret));
         return -3;
@@ -94 +100 @@
     gnutls_global_set_log_level(9);
     gnutls_global_set_log_function(gnutls_debug_log_all);
+    apr_file_printf(debug_log_fp, "gnutls: %s\n", gnutls_check_version(NULL));
 #endif
 
@@ -104 +111 @@
     mgs_srvconf_rec *tsc;
     int ret;
-    int cprio[3] = { GNUTLS_CRT_X509, GNUTLS_CRT_OPENPGP, 0 };
+    int cprio[2];
 
     ctxt = gnutls_transport_get_ptr(session);
@@ -136 +143 @@
      */
     ret = gnutls_priority_set(session, ctxt->sc->priorities);
-
-    /* Do not allow the user to override certificate priorities. We know
-     * better if the certificate of certain type is enabled. */
-    if (ctxt->sc->cert_pgp != NULL && ctxt->sc->certs_x509[0] != NULL) {
-        gnutls_certificate_type_set_priority( session, cprio);
-    } else if (ctxt->sc->certs_x509[0] != NULL) {
+    /* actually it shouldn't fail since we have checked at startup */
+    if (ret < 0)
+        return ret;
+
+    /* If both certificate types are not present disallow them from
+     * being negotiated.
+     */
+    if (ctxt->sc->certs_x509[0] != NULL && ctxt->sc->cert_pgp == NULL) {
         cprio[0] = GNUTLS_CRT_X509;
         cprio[1] = 0;
         gnutls_certificate_type_set_priority( session, cprio);
-    } else if (ctxt->sc->cert_pgp != NULL) {
+    } else if (ctxt->sc->cert_pgp != NULL && ctxt->sc->certs_x509[0]==NULL) {
         cprio[0] = GNUTLS_CRT_OPENPGP;
         cprio[1] = 0;
@@ -151 +160 @@
     }
 
-    /* actually it shouldn't fail since we have checked at startup */
-    if (ret < 0)
-        return ret;
 
 
@@ -189 +195 @@
 }
 
+/* 2048-bit group parameters from SRP specification */
 const char static_dh_params[] = "-----BEGIN DH PARAMETERS-----\n"
     "MIIBBwKCAQCsa9tBMkqam/Fm3l4TiVgvr3K2ZRmH7gf8MZKUPbVgUKNzKcu0oJnt\n"
@@ -412 +419 @@
             if (sc->enabled == GNUTLS_ENABLED_TRUE) {
                 rv = read_crt_cn(s, p, sc->certs_x509[0], &sc->cert_cn);
-                if (rv < 0)  /* try openpgp certificate */
+                if (rv < 0 && sc->cert_pgp != NULL)  /* try openpgp certificate */
                     rv = read_pgpcrt_cn(s, p, sc->cert_pgp, &sc->cert_cn);
 
@@ -978 +985 @@
 }
 
-/* FIXME: Allow client sending a certificate chain */
+/* TODO: Allow client sending a X.509 certificate chain */
 static int mgs_cert_verify(request_rec * r, mgs_handle_t * ctxt)
 {
@@ -1047 +1054 @@
     }
 
-
     if (rv < 0) {
         ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
                       "GnuTLS: Failed to Verify Peer certificate: (%d) %s",
                       rv, gnutls_strerror(rv));
+        if (rv == GNUTLS_E_NO_CERTIFICATE_FOUND)
+            ap_log_rerror(APLOG_MARK, APLOG_EMERG, 0, r,
+                      "GnuTLS: No certificate was found for verification. Did you set the GnuTLSX509CAFile or GnuTLSPGPKeyringFile directives?");
         ret = HTTP_FORBIDDEN;
         goto exit;
     }
+
+    /* TODO: X509 CRL Verification. */
+    /* May add later if anyone needs it.
+     */
+    /* ret = gnutls_x509_crt_check_revocation(crt, crl_list, crl_list_size); */
 
     expired = 0;
@@ -1089 +1103 @@
                       "GnuTLS: Peer Certificate is revoked.");
     }
-
-    /* TODO: Further Verification. */
-    /* Revocation is X.509 non workable paradigm, I really doubt implementation
-     * is worth doing --nmav
-     */
-/// ret = gnutls_x509_crt_check_revocation(crt, crl_list, crl_list_size);
-
-//    mgs_hook_fixups(r);
-//    rv = mgs_authz_lua(r);
 
     if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509)

src/mod_gnutls.c

@@ -65 +65 @@
                   RSRC_CONF,
                   "Set the CA File to verify Client Certificates"),
+    AP_INIT_TAKE1("GnuTLSX509CAFile", mgs_set_client_ca_file,
+                  NULL,
+                  RSRC_CONF,
+                  "Set the CA File to verify Client Certificates"),
     AP_INIT_TAKE1("GnuTLSPGPKeyringFile", mgs_set_keyring_file,
                   NULL,
@@ -80 +84 @@
                   NULL,
                   RSRC_CONF,
-                  "SSL Server Certificate file"),
+                  "SSL Server X509 Certificate file"),
     AP_INIT_TAKE1("GnuTLSKeyFile", mgs_set_key_file,
                   NULL,
                   RSRC_CONF,
-                  "SSL Server Private Key file"),
+                  "SSL Server X509 Private Key file"),
+    AP_INIT_TAKE1("GnuTLSX509CertificateFile", mgs_set_cert_file,
+                  NULL,
+                  RSRC_CONF,
+                  "SSL Server X509 Certificate file"),
+    AP_INIT_TAKE1("GnuTLSX509KeyFile", mgs_set_key_file,
+                  NULL,
+                  RSRC_CONF,
+                  "SSL Server X509 Private Key file"),
     AP_INIT_TAKE1("GnuTLSPGPCertificateFile", mgs_set_pgpcert_file,
                   NULL,