Changeset 3e94bd3 in mod_gnutls for src/gnutls_io.c

Timestamp:

Jan 11, 2013, 12:54:56 AM (9 years ago)

Author:

Daniel Kahn Gillmor <dkg@…>

Branches:

debian/master, debian/stretch-backports, jessie-backports, upstream

Children:

1c87791, 70c2d86

Parents:

8eb6ccd

Message:

Imported Upstream version 0.2.0

File:

• src/gnutls_io.c (modified) (13 diffs)

src/gnutls_io.c

@@ -36 +36 @@
                                            apr_status_t status)
 {
-    mod_gnutls_handle_t *ctxt = (mod_gnutls_handle_t *) f->ctx;
+    mgs_handle_t *ctxt = (mgs_handle_t *) f->ctx;
     apr_bucket *bucket;
 
@@ -64 +64 @@
 }
 
-static int char_buffer_read(mod_gnutls_char_buffer_t * buffer, char *in,
+static int char_buffer_read(mgs_char_buffer_t * buffer, char *in,
                             int inl)
 {
@@ -88 +88 @@
 }
 
-static int char_buffer_write(mod_gnutls_char_buffer_t * buffer, char *in,
+static int char_buffer_write(mgs_char_buffer_t * buffer, char *in,
                              int inl)
 {
@@ -182 +182 @@
 
 
-static apr_status_t gnutls_io_input_read(mod_gnutls_handle_t * ctxt,
+static apr_status_t gnutls_io_input_read(mgs_handle_t * ctxt,
                                          char *buf, apr_size_t * len)
 {
@@ -311 +311 @@
 }
 
-static apr_status_t gnutls_io_input_getline(mod_gnutls_handle_t * ctxt,
+static apr_status_t gnutls_io_input_getline(mgs_handle_t * ctxt,
                                             char *buf, apr_size_t * len)
 {
@@ -354 +354 @@
 }
 
-
-static void gnutls_do_handshake(mod_gnutls_handle_t * ctxt)
+static int gnutls_do_handshake(mgs_handle_t * ctxt)
 {
     int ret;
     int errcode;
     if (ctxt->status != 0) {
-        return;
+        return -1;
     }
 
 tryagain:
-
-    ret = gnutls_handshake(ctxt->session);
+    do {
+        ret = gnutls_handshake(ctxt->session);
+    } while (ret == GNUTLS_E_AGAIN);
+    
     if (ret < 0) {
         if (ret == GNUTLS_E_WARNING_ALERT_RECEIVED
@@ -381 +382 @@
             goto tryagain;
         }
-
+#if USING_2_1_RECENT
+        ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, ctxt->c,
+                     "GnuTLS: Handshake Failed (%d) '%s'", ret,
+                      gnutls_strerror(ret));
+#else
         ap_log_error(APLOG_MARK, APLOG_ERR, 0, ctxt->c->base_server,
                      "GnuTLS: Handshake Failed (%d) '%s'", ret,
-                      gnutls_strerror(ret));
+                     gnutls_strerror(ret));
+#endif
         ctxt->status = -1;
         gnutls_alert_send(ctxt->session, GNUTLS_AL_FATAL, 
                           gnutls_error_to_alert(ret, NULL));
         gnutls_deinit(ctxt->session);
-        return;
+        return ret;
     }
     else {
+        /* all done with the handshake */
         ctxt->status = 1;
-        return;             /* all done with the handshake */
-    }
-}
-
-
-apr_status_t mod_gnutls_filter_input(ap_filter_t* f,
+        /* If the session was resumed, we did not set the correct 
+         * server_rec in ctxt->sc.  Go Find it. (ick!)
+         */
+        if (gnutls_session_is_resumed(ctxt->session)) {
+            mgs_srvconf_rec* sc;
+            sc = mgs_find_sni_server(ctxt->session);
+            if (sc) {
+                ctxt->sc = sc;
+            }
+        }
+        return 0;
+    }
+}
+
+int mgs_rehandshake(mgs_handle_t * ctxt)
+{
+    int rv;
+
+    rv = gnutls_rehandshake(ctxt->session);
+    
+    if (rv != 0) {
+        /* the client did not want to rehandshake. goodbye */
+        ap_log_error(APLOG_MARK, APLOG_ERR, 0, ctxt->c->base_server,
+                     "GnuTLS: Client Refused Rehandshake request.");
+        return -1;
+    }
+    
+    ctxt->status = 0;
+
+    rv = gnutls_do_handshake(ctxt);
+
+    return rv;
+}
+
+
+apr_status_t mgs_filter_input(ap_filter_t* f,
                                      apr_bucket_brigade * bb,
                                      ap_input_mode_t mode,
@@ -405 +442 @@
 {
     apr_status_t status = APR_SUCCESS;
-    mod_gnutls_handle_t *ctxt = (mod_gnutls_handle_t *) f->ctx;
+    mgs_handle_t *ctxt = (mgs_handle_t *) f->ctx;
     apr_size_t len = sizeof(ctxt->input_buffer);
 
@@ -415 +452 @@
 
     if (ctxt->status == 0) {
-        char* server_name;
-        int server_type;
-        int data_len = 256;
-        
         gnutls_do_handshake(ctxt);
-        
-        /**
-         * Due to issues inside the GnuTLS API, we cannot currently do TLS 1.1
-         * Server Name Indication.
-         */
-        server_name = apr_palloc(ctxt->c->pool, data_len);
-        if (gnutls_server_name_get(ctxt->session, server_name, &data_len, &server_type, 0) == 0) {
-            if (server_type == GNUTLS_NAME_DNS) {
-                ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,
-                             ctxt->c->base_server,
-                             "GnuTLS: TLS 1.1 Server Name: "
-                             "%s", server_name);
-                
-            }
-        }
     }
 
@@ -481 +499 @@
 }
 
-apr_status_t mod_gnutls_filter_output(ap_filter_t * f,
+apr_status_t mgs_filter_output(ap_filter_t * f,
                                       apr_bucket_brigade * bb)
 {
     apr_size_t ret;
     apr_bucket* e;
-    mod_gnutls_handle_t *ctxt = (mod_gnutls_handle_t *) f->ctx;
+    mgs_handle_t *ctxt = (mgs_handle_t *) f->ctx;
     apr_status_t status = APR_SUCCESS;
     apr_read_type_e rblock = APR_NONBLOCK_READ;
@@ -585 +603 @@
 }
 
-ssize_t mod_gnutls_transport_read(gnutls_transport_ptr_t ptr,
+ssize_t mgs_transport_read(gnutls_transport_ptr_t ptr,
                                   void *buffer, size_t len)
 {
-    mod_gnutls_handle_t *ctxt = ptr;
+    mgs_handle_t *ctxt = ptr;
     apr_status_t rc;
     apr_size_t in = len;
@@ -652 +670 @@
 
 
-static ssize_t write_flush(mod_gnutls_handle_t * ctxt)
+static ssize_t write_flush(mgs_handle_t * ctxt)
 {
     apr_bucket *e;
@@ -684 +702 @@
 }
 
-ssize_t mod_gnutls_transport_write(gnutls_transport_ptr_t ptr,
+ssize_t mgs_transport_write(gnutls_transport_ptr_t ptr,
                                    const void *buffer, size_t len)
 {
-    mod_gnutls_handle_t *ctxt = ptr;
+    mgs_handle_t *ctxt = ptr;
 
     /* pass along the encrypted data