Changeset 2f10643 in mod_gnutls

Timestamp:

Apr 10, 2018, 12:48:05 PM (6 months ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

debian/master, debian/stretch-backports, master, upstream

Children:

9cee2e9

Parents:

e7cf823

Message:

Consider secondary connections (like mod_http2 streams) in hooks

Secondary connections share the TLS session of the primary connection,
so they must not be subject to mod_gnutls' filters. On the other hand,
request hooks looking up TLS parameters must access the TLS session of
the primary connection.

File:

• src/gnutls_hooks.c (modified) (5 diffs)

src/gnutls_hooks.c

@@ -1060 +1060 @@
     _gnutls_log(debug_log_fp, "%s: %d\n", __func__, __LINE__);
 
+    if (c->master)
+    {
+        ap_log_cerror(APLOG_MARK, APLOG_TRACE1, 0, c,
+                      "%s declined secondary connection", __func__);
+        return DECLINED;
+    }
+
     mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
         ap_get_module_config(c->base_server->module_config, &gnutls_module);
@@ -1065 +1072 @@
         ap_get_module_config(c->conn_config, &gnutls_module);
 
-    if ((sc && (!sc->enabled)) || (ctxt && ctxt->enabled == GNUTLS_ENABLED_FALSE))
+    if ((sc && (!sc->enabled))
+        || (ctxt && ctxt->enabled == GNUTLS_ENABLED_FALSE))
     {
         ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, "%s declined connection",
@@ -1117 +1125 @@
     apr_table_t *env = r->subprocess_env;
 
-    ctxt = ap_get_module_config(r->connection->conn_config,
-                                &gnutls_module);
+    ctxt = get_effective_gnutls_ctxt(r->connection);
 
     if (!ctxt || ctxt->enabled != GNUTLS_ENABLED_TRUE || ctxt->session == NULL)
@@ -1198 +1205 @@
 
     _gnutls_log(debug_log_fp, "%s: %d\n", __func__, __LINE__);
-    ctxt =
-            ap_get_module_config(r->connection->conn_config,
-            &gnutls_module);
+    ctxt = get_effective_gnutls_ctxt(r->connection);
 
     if (!ctxt || ctxt->session == NULL) {
@@ -1930 +1935 @@
     if (sc->enabled != GNUTLS_ENABLED_FALSE)
     {
-        mgs_handle_t* ctxt =
-            ap_get_module_config(r->connection->conn_config, &gnutls_module);
+        mgs_handle_t* ctxt = get_effective_gnutls_ctxt(r->connection);
         if (ctxt && ctxt->session != NULL)
         {