Changeset 42307a9 in mod_gnutls for src

Timestamp:

Apr 6, 2005, 12:52:25 AM (18 years ago)

Author:

Paul Querna <chip@…>

Branches:

asyncio, debian/master, debian/stretch-backports, jessie-backports, main, master, msva, proxy-ticket, upstream

Children:

6af4f74

Parents:

fcb122d

Message:

• remove anno creds
• initial attempt at Server Name Extension
• change to adding 'mod_gnutls' to the server sig instead of GnuTLS/
• fix for EOF/EOC/EOS buckets
• 'general' code cleanups

Location:

src

Files:

• gnutls_cache.c (modified) (24 diffs)
• gnutls_io.c (modified) (8 diffs)
• mod_gnutls.c (modified) (8 diffs)

src/gnutls_cache.c

@@ -33 +33 @@
 #endif
 
-#define GNUTLS_SESSION_ID_STRING_LEN \
-    ((GNUTLS_MAX_SESSION_ID + 1) * 2)
+
 #define MC_TAG "mod_gnutls:"
 #define MC_TAG_LEN \
@@ -41 +40 @@
 
 static char *gnutls_session_id2sz(unsigned char *id, int idlen,
-                        char *str, int strsize)
+                               char *str, int strsize)
 {
     char *cp;
@@ -47 +46 @@
  
     cp = apr_cpystrn(str, MC_TAG, MC_TAG_LEN);
+    for (n = 0; n < idlen && n < GNUTLS_MAX_SESSION_ID; n++) {
+        apr_snprintf(cp, strsize - (cp-str), "%02X", id[n]);
+        cp += 2;
+    }
+    *cp = '\0';
+    return str;
+}
+
+char *mod_gnutls_session_id2sz(unsigned char *id, int idlen,
+                               char *str, int strsize)
+{
+    char *cp;
+    int n;
+    
+    cp = str;
     for (n = 0; n < idlen && n < GNUTLS_MAX_SESSION_ID; n++) {
         apr_snprintf(cp, strsize - (cp-str), "%02X", id[n]);
@@ -104 +118 @@
 
         rv = apr_parse_addr_port(&host_str, &scope_id, &port, split, p);
-        if(rv != APR_SUCCESS) {
+        if (rv != APR_SUCCESS) {
             ap_log_error(APLOG_MARK, APLOG_CRIT, rv, s,
                          "[gnutls_cache] Failed to Parse Server: '%s'", split);
@@ -110 +124 @@
         }
 
-        if(host_str == NULL) {
+        if (host_str == NULL) {
             ap_log_error(APLOG_MARK, APLOG_CRIT, rv, s,
                          "[gnutls_cache] Failed to Parse Server, "
@@ -129 +143 @@
                                         600,
                                         &st);
-        if(rv != APR_SUCCESS) {
+        if (rv != APR_SUCCESS) {
             ap_log_error(APLOG_MARK, APLOG_CRIT, rv, s,
                          "[gnutls_cache] Failed to Create Server: %s:%d", 
@@ -137 +151 @@
 
         rv = apr_memcache_add_server(mc, st);
-        if(rv != APR_SUCCESS) {
+        if (rv != APR_SUCCESS) {
             ap_log_error(APLOG_MARK, APLOG_CRIT, rv, s,
                          "[gnutls_cache] Failed to Add Server: %s:%d", 
@@ -162 +176 @@
         return -1;
 
-    timeout = ctxt->sc->cache_timeout;
-
-    rv = apr_memcache_set(mc,  strkey, data.data, data.size, timeout, 0);
-
-    if(rv != APR_SUCCESS) {
+    timeout = apr_time_sec(ctxt->sc->cache_timeout);
+
+    rv = apr_memcache_set(mc, strkey, data.data, data.size, timeout, 0);
+
+    if (rv != APR_SUCCESS) {
         ap_log_error(APLOG_MARK, APLOG_CRIT, rv,
                      ctxt->c->base_server,
@@ -188 +202 @@
 
     strkey = gnutls_session_id2sz(key.data, key.size, buf, sizeof(buf));
-    if(!strkey) {
+    if (!strkey) {
         return data;
     }
@@ -195 +209 @@
                            &value, &value_len, NULL);
 
-    if(rv != APR_SUCCESS) {
+    if (rv != APR_SUCCESS) {
         ap_log_error(APLOG_MARK, APLOG_DEBUG, rv,
                      ctxt->c->base_server,
@@ -230 +244 @@
     rv = apr_memcache_delete(mc, strkey, 0);
 
-    if(rv != APR_SUCCESS) {
+    if (rv != APR_SUCCESS) {
         ap_log_error(APLOG_MARK, APLOG_DEBUG, rv,
                      ctxt->c->base_server,
@@ -249 +263 @@
     apr_status_t rv;
     apr_dbm_t *dbm;
+    apr_datum_t *keylist;
+    apr_datum_t dbmkey;
+    apr_datum_t dbmval;
+    apr_time_t ex;
+    apr_time_t dtime;
+    apr_pool_t* spool;
+    int i = 0;
+    int keyidx = 0;
+    int should_delete = 0;
+
+    apr_pool_create(&spool, ctxt->c->pool);
+    ex = apr_time_now();
+    
+    rv = apr_dbm_open(&dbm, ctxt->sc->cache_config, APR_DBM_READONLY,
+                      SSL_DBM_FILE_MODE, spool);
+    if (rv != APR_SUCCESS) {
+        ap_log_error(APLOG_MARK, APLOG_NOTICE, rv,
+                     ctxt->c->base_server,
+                     "[gnutls_cache] error opening cache searcher '%s'",
+                     ctxt->sc->cache_config);
+        return -1;
+    }
+
+#define KEYMAX 128
+
+    keylist = apr_palloc(spool, sizeof(dbmkey)*KEYMAX);
+
+    apr_dbm_firstkey(dbm, &dbmkey);
+    while (dbmkey.dptr != NULL) {
+        apr_dbm_fetch(dbm, dbmkey, &dbmval);
+        if (dbmval.dptr != NULL) {
+            if (dbmval.dsize >= sizeof(apr_time_t)) {
+                memcpy(&dtime, dbmval.dptr, sizeof(apr_time_t));
+                if (dtime < ex) {
+                    should_delete = 1;
+                }
+            }
+            else {
+                should_delete = 1;
+            }
+            
+            if (should_delete == 1) {
+                should_delete = 0;
+                keylist[keyidx].dptr = apr_palloc(spool, dbmkey.dsize) ;
+                memcpy(keylist[keyidx].dptr, dbmkey.dptr, dbmkey.dsize);
+                keylist[keyidx].dsize = dbmkey.dsize;
+                keyidx++;
+                if (keyidx == KEYMAX) {
+                    break;
+                }
+            }
+            
+        }
+        apr_dbm_nextkey(dbm, &dbmkey);
+    }
+    apr_dbm_close(dbm);
 
     rv = apr_dbm_open(&dbm, ctxt->sc->cache_config,
-                      APR_DBM_RWCREATE, SSL_DBM_FILE_MODE, ctxt->c->pool);
-    if (rv != APR_SUCCESS) {
-        ap_log_error(APLOG_MARK, APLOG_NOTICE, rv,
-                     ctxt->c->base_server,
-                     "[gnutls_cache] error opening cache '%s'",
-                     ctxt->sc->cache_config);
-        return -1;
-    }
+                  APR_DBM_RWCREATE, SSL_DBM_FILE_MODE, spool);
+    if (rv != APR_SUCCESS) {
+        ap_log_error(APLOG_MARK, APLOG_NOTICE, rv,
+                 ctxt->c->base_server,
+                 "[gnutls_cache] error opening cache writer '%s'",
+                 ctxt->sc->cache_config);
+        return -1;
+    }
+
+    for (i = 0; i < keyidx; i++) {
+        apr_dbm_delete(dbm, keylist[i]);
+    }
+
     apr_dbm_close(dbm);
-
+    apr_pool_destroy(spool);
+    
     return 0;
 }
@@ -276 +352 @@
     dbmkey.dsize = key.size;
 
+    dbm_cache_expire(ctxt);
+
     rv = apr_dbm_open(&dbm, ctxt->sc->cache_config,
                       APR_DBM_RWCREATE, SSL_DBM_FILE_MODE, ctxt->c->pool);
@@ -287 +365 @@
 
     rv = apr_dbm_fetch(dbm, dbmkey, &dbmval);
-
+    
     if (rv != APR_SUCCESS) {
         apr_dbm_close(dbm);
@@ -297 +375 @@
         return data;
     }
-
-    data.data = gnutls_malloc(dbmval.dsize - sizeof(apr_time_t));
-    if (data.data == NULL)
-        return data;
+    apr_dbm_close(dbm);
 
     data.size = dbmval.dsize - sizeof(apr_time_t);
+
+    data.data = gnutls_malloc(data.size);
+    if (data.data == NULL) {
+        return data;
+    }
+    
     memcpy(data.data, dbmval.dptr+sizeof(apr_time_t), data.size);
 
-    apr_dbm_close(dbm);
     return data;
 }
@@ -317 +397 @@
     mod_gnutls_handle_t *ctxt = baton;
     apr_status_t rv;
-    apr_time_t timeout;
+    apr_time_t expiry;
     
     dbmkey.dptr  = (char *)key.data;
@@ -323 +403 @@
 
     /* create DBM value */
-    dbmval.dsize = data.size;
-    dbmval.dptr  = (char *)malloc(dbmval.dsize+sizeof(apr_time_t));
-
+    dbmval.dsize = data.size + sizeof(apr_time_t);
+    dbmval.dptr  = (char *)malloc(dbmval.dsize);
+
+    expiry = apr_time_now() + ctxt->sc->cache_timeout;
+
+    memcpy((char *)dbmval.dptr, &expiry, sizeof(apr_time_t));
     memcpy((char *)dbmval.dptr+sizeof(apr_time_t),
            data.data, data.size);
+
+    dbm_cache_expire(ctxt);
 
     rv = apr_dbm_open(&dbm, ctxt->sc->cache_config,
@@ -341 +426 @@
 
     rv = apr_dbm_store(dbm, dbmkey, dbmval);
-
+    
     if (rv != APR_SUCCESS) {
         ap_log_error(APLOG_MARK, APLOG_NOTICE, rv,
@@ -369 +454 @@
     dbmkey.dsize = key.size;
 
+    dbm_cache_expire(ctxt);
+    
     rv = apr_dbm_open(&dbm, ctxt->sc->cache_config,
                       APR_DBM_RWCREATE, SSL_DBM_FILE_MODE, ctxt->c->pool);
@@ -384 +471 @@
         ap_log_error(APLOG_MARK, APLOG_NOTICE, rv,
                      ctxt->c->base_server,
-                     "[gnutls_cache] error storing in cache '%s'",
+                     "[gnutls_cache] error deleting from cache '%s'",
                      ctxt->sc->cache_config);
         apr_dbm_close(dbm);
@@ -395 +482 @@
 }
 
-static int dbm_cache_child_init(apr_pool_t *p, server_rec *s, 
+static int dbm_cache_post_config(apr_pool_t *p, server_rec *s, 
                                 mod_gnutls_srvconf_rec *sc)
 {
@@ -435 +522 @@
 {
     if (sc->cache_type == mod_gnutls_cache_dbm) {
-        return dbm_cache_child_init(p, s, sc);
+        return dbm_cache_post_config(p, s, sc);
     }
     return 0;
@@ -458 +545 @@
 int mod_gnutls_cache_session_init(mod_gnutls_handle_t *ctxt)
 {
-    printf("Type: %d Params: %s\n",ctxt->sc->cache_type, ctxt->sc->cache_config);
     if (ctxt->sc->cache_type == mod_gnutls_cache_dbm) {
         gnutls_db_set_retrieve_function(ctxt->session, dbm_cache_fetch);
@@ -473 +559 @@
     }
 #endif
-    else {
-        assert(1);
-        /* No Session Cache is Available. Opps. */
-    }
-    return 0;
-}
+
+    return 0;
+}

src/gnutls_io.c

@@ -272 +272 @@
                              " (%d) '%s'", rc, gnutls_strerror(rc));
             }
+            else if (rc == GNUTLS_E_WARNING_ALERT_RECEIVED) {
+                rc = gnutls_alert_get(ctxt->session);
+                ap_log_error(APLOG_MARK, APLOG_INFO, ctxt->input_rc,
+                             ctxt->c->base_server,
+                             "GnuTLS: Warning Alert From Client: "
+                             " (%d) '%s'", rc, gnutls_alert_get_name(rc)); 
+            }
+            else if (rc == GNUTLS_E_FATAL_ALERT_RECEIVED) {
+                rc = gnutls_alert_get(ctxt->session);
+                ap_log_error(APLOG_MARK, APLOG_INFO, ctxt->input_rc,
+                             ctxt->c->base_server,
+                             "GnuTLS: Fatal Alert From Client: "
+                             "(%d) '%s'", rc, gnutls_alert_get_name(rc));
+                ctxt->input_rc = APR_EGENERAL;
+                break;
+            }
             else {
                 /* Some Other Error. Report it. Die. */
@@ -342 +358 @@
 {
     int ret;
-
+    int errcode;
     if (ctxt->status != 0) {
         return;
@@ -353 +369 @@
         if (ret == GNUTLS_E_WARNING_ALERT_RECEIVED
             || ret == GNUTLS_E_FATAL_ALERT_RECEIVED) {
-            ret = gnutls_alert_get(ctxt->session);
+            errcode = gnutls_alert_get(ctxt->session);
             ap_log_error(APLOG_MARK, APLOG_ERR, 0, ctxt->c->base_server,
-                         "GnuTLS: Hanshake Alert (%d) '%s'.\n", ret,
-                         gnutls_alert_get_name(ret));
+                         "GnuTLS: Hanshake Alert (%d) '%s'.", errcode,
+                         gnutls_alert_get_name(errcode));
         }
     
@@ -399 +415 @@
 
     if (ctxt->status == 0) {
+        char* server_name;
+        int server_type;
+        int data_len = 256;
+        
         gnutls_do_handshake(ctxt);
+        
+        /**
+         * Due to issues inside the GnuTLS API, we cannot currently do TLS 1.1
+         * Server Name Indication.
+         */
+        server_name = apr_palloc(ctxt->c->pool, data_len);
+        if (gnutls_server_name_get(ctxt->session, server_name, &data_len, &server_type, 0) == 0) {
+            if (server_type == GNUTLS_NAME_DNS) {
+                ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,
+                             ctxt->c->base_server,
+                             "GnuTLS: TLS 1.1 Server Name: "
+                             "%s", server_name);
+                
+            }
+        }
     }
 
@@ -450 +485 @@
 {
     apr_size_t ret;
+    apr_bucket* e;
     mod_gnutls_handle_t *ctxt = (mod_gnutls_handle_t *) f->ctx;
     apr_status_t status = APR_SUCCESS;
@@ -470 +506 @@
         apr_bucket *bucket = APR_BRIGADE_FIRST(bb);
         if (AP_BUCKET_IS_EOC(bucket)) {
-
+            do {
+                ret = gnutls_alert_send(ctxt->session, GNUTLS_AL_FATAL,
+                                        GNUTLS_A_CLOSE_NOTIFY);
+            } while(ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN);
+
+            apr_bucket_copy(bucket, &e);
+            APR_BRIGADE_INSERT_TAIL(ctxt->output_bb, e);
+            
+            if ((status = ap_pass_brigade(f->next, ctxt->output_bb)) != APR_SUCCESS) {
+                apr_brigade_cleanup(ctxt->output_bb);
+                return status;
+            }
+
+            apr_brigade_cleanup(ctxt->output_bb);
             gnutls_bye(ctxt->session, GNUTLS_SHUT_WR);
             gnutls_deinit(ctxt->session);
-
+            continue;
+
+        } else if (APR_BUCKET_IS_FLUSH(bucket) || APR_BUCKET_IS_EOS(bucket)) {
+
+            apr_bucket_copy(bucket, &e);
+            APR_BRIGADE_INSERT_TAIL(ctxt->output_bb, e);
             if ((status = ap_pass_brigade(f->next, bb)) != APR_SUCCESS) {
+                apr_brigade_cleanup(ctxt->output_bb);
                 return status;
             }
-            break;
-
-        } else if (APR_BUCKET_IS_FLUSH(bucket) || APR_BUCKET_IS_EOS(bucket)) {
-
-            if ((status = ap_pass_brigade(f->next, bb)) != APR_SUCCESS) {
-                return status;
-            }
-            break;
+            apr_brigade_cleanup(ctxt->output_bb);
+            continue;
         }
         else {
@@ -629 +678 @@
     ctxt->output_rc = ap_pass_brigade(ctxt->output_filter->next,
                                       ctxt->output_bb);
-    /* create new brigade ready for next time through */
-    ctxt->output_bb =
-        apr_brigade_create(ctxt->c->pool, ctxt->c->bucket_alloc);
+    /* clear the brigade to be ready for next time */
+    apr_brigade_cleanup(ctxt->output_bb);
+
     return (ctxt->output_rc == APR_SUCCESS) ? 1 : -1;
 }
@@ -640 +689 @@
     mod_gnutls_handle_t *ctxt = ptr;
 
-        /* pass along the encrypted data
-         * need to flush since we're using SSL's malloc-ed buffer
-         * which will be overwritten once we leave here
-         */
-        apr_bucket *bucket = apr_bucket_transient_create(buffer, len,
-                                                         ctxt->output_bb->
-                                                         bucket_alloc);
-
-        ctxt->output_length += len;
-        APR_BRIGADE_INSERT_TAIL(ctxt->output_bb, bucket);
-
-        if (write_flush(ctxt) < 0) {
-            return -1;
-        }
+    /* pass along the encrypted data
+     * need to flush since we're using SSL's malloc-ed buffer
+     * which will be overwritten once we leave here
+     */
+    apr_bucket *bucket = apr_bucket_transient_create(buffer, len,
+                                                    ctxt->output_bb->bucket_alloc);
+    ctxt->output_length += len;
+    APR_BRIGADE_INSERT_TAIL(ctxt->output_bb, bucket);
+
+    if (write_flush(ctxt) < 0) {
+        return -1;
+    }
     return len;
 }

src/mod_gnutls.c

@@ -190 +190 @@
 
             if (sc->cert_file != NULL && sc->key_file != NULL) {
+
                 rv = gnutls_certificate_set_x509_key_file(sc->certs, sc->cert_file,
                                                  sc->key_file,
@@ -215 +216 @@
     } /* first_run */
 
-    ap_add_version_component(p, "GnuTLS/" LIBGNUTLS_VERSION);
+    ap_add_version_component(p, "mod_gnutls/" MOD_GNUTLS_VERSION);
 
     return OK;
@@ -265 +266 @@
 
     return 443;
+}
+
+/* TODO: Complete support for Server Name Indication */
+static int cert_retrieve_fn(gnutls_session_t session, gnutls_retr_st* ret) 
+{
+    char* server_name;
+    int server_type;
+    int data_len = 256;
+    mod_gnutls_handle_t *ctxt;    
+    ctxt = gnutls_transport_get_ptr(session);
+
+    ret->type = GNUTLS_CRT_X509;
+    ret->ncerts = 1;
+    server_name = apr_palloc(ctxt->c->pool, data_len);
+    if (gnutls_server_name_get(ctxt->session, server_name, &data_len, &server_type, 0) == 0) {
+        if (server_type == GNUTLS_NAME_DNS) {
+            ap_log_error(APLOG_MARK, APLOG_INFO, 0,
+                         ctxt->c->base_server,
+                         "GnuTLS: Virtual Host: "
+                         "%s", server_name);
+        }
+    }
+
+    return 0;
 }
 
@@ -300 +325 @@
     gnutls_credentials_set(ctxt->session, GNUTLS_CRD_CERTIFICATE, sc->certs);
 
-//  if(anon) {
-//    gnutls_credentials_set(ctxt->session, GNUTLS_CRD_ANON, sc->anoncred);
-//  }
-
     gnutls_certificate_server_set_request(ctxt->session, GNUTLS_CERT_IGNORE);
 
     mod_gnutls_cache_session_init(ctxt);
+
+    /* TODO: Finish Support for Server Name Indication */
+    /* gnutls_certificate_server_set_retrieve_function(sc->certs, cert_retrieve_fn); */
     return ctxt;
 }
@@ -342 +366 @@
 static int mod_gnutls_hook_fixups(request_rec *r)
 {
+    unsigned char sbuf[GNUTLS_MAX_SESSION_ID];
+    char buf[GNUTLS_SESSION_ID_STRING_LEN];
     const char* tmp;
+    int len;
     mod_gnutls_handle_t *ctxt;
     apr_table_t *env = r->subprocess_env;
@@ -353 +380 @@
 
     apr_table_setn(env, "HTTPS", "on");
+
+    apr_table_setn(env, "GNUTLS_VERSION_INTERFACE", MOD_GNUTLS_VERSION);
+    apr_table_setn(env, "GNUTLS_VERSION_LIBRARY", LIBGNUTLS_VERSION);
+
     apr_table_setn(env, "SSL_PROTOCOL",
                    gnutls_protocol_get_name(gnutls_protocol_get_version(ctxt->session)));
+
     apr_table_setn(env, "SSL_CIPHER",
                    gnutls_cipher_get_name(gnutls_cipher_get(ctxt->session)));
 
+    apr_table_setn(env, "SSL_CLIENT_VERIFY", "NONE");
+
     tmp = apr_psprintf(r->pool, "%d",
               8 * gnutls_cipher_get_key_size(gnutls_cipher_get(ctxt->session)));
 
     apr_table_setn(env, "SSL_CIPHER_USEKEYSIZE", tmp);
+
     apr_table_setn(env, "SSL_CIPHER_ALGKEYSIZE", tmp);
 
+    len = sizeof(sbuf);
+    gnutls_session_get_id(ctxt->session, sbuf, &len);
+    tmp = mod_gnutls_session_id2sz(sbuf, len, buf, sizeof(buf));
+    apr_table_setn(env, "SSL_SESSION_ID", tmp);
+    
     return OK;
 }
@@ -385 +425 @@
                                                         module_config,
                                                         &gnutls_module);
+    
     sc->key_file = ap_server_root_relative(parms->pool, arg);
     return NULL;
@@ -509 +550 @@
 
     gnutls_certificate_allocate_credentials(&sc->certs);
-    gnutls_anon_allocate_server_credentials(&sc->anoncred);
     sc->key_file = NULL;
     sc->cert_file = NULL;