Changeset 6fa6095 in mod_gnutls for src/gnutls_io.c

Timestamp:

Jan 21, 2020, 2:29:27 AM (9 months ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

master, proxy-ticket

Children:

1c76ea7

Parents:

e24e3bf9

Message:

Partial post-handshake auth support

Needs proper error handling, especially for
GNUTLS_E_GOT_APPLICATION_DATA, which can randomly happen with requests
containing a body.

File:

• src/gnutls_io.c (modified) (2 diffs)

src/gnutls_io.c

@@ -3 +3 @@
  *  Copyright 2008 Nikos Mavrogiannopoulos
  *  Copyright 2011 Dash Shendy
- *  Copyright 2015-2019 Fiona Klute
+ *  Copyright 2015-2020 Fiona Klute
  *
  *  Licensed under the Apache License, Version 2.0 (the "License");
@@ -449 +449 @@
 }
 
-int mgs_rehandshake(mgs_handle_t * ctxt) {
-    int rv;
-
+
+
+int mgs_reauth(mgs_handle_t * ctxt)
+{
     if (ctxt->session == NULL)
-        return -1;
-
-    rv = gnutls_rehandshake(ctxt->session);
-
-    if (rv != 0) {
-        /* the client did not want to rehandshake. goodbye */
+        return GNUTLS_E_INVALID_REQUEST;
+
+    int rv = gnutls_reauth(ctxt->session, 0);
+    // TODO: Handle non-fatal errors: GNUTLS_E_INTERRUPTED,
+    // GNUTLS_E_AGAIN, GNUTLS_E_GOT_APPLICATION_DATA
+
+    /* GNUTLS_E_GOT_APPLICATION_DATA can (randomly, depending on
+     * timing) happen with a request containing a body. According to
+     * https://tools.ietf.org/html/rfc8446#appendix-E.1.2
+     * post-handshake authentication proves that the authenticated
+     * party is the one that did the handshake, so caching the data
+     * is appropriate. */
+    /* Allocate cache to content-length (if available), with an upper
+     * limit to prevent resource exhaustion attacks. Do we have to
+     * prevent creating multiple caches for one connection? */
+    /* ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r, */
+    /*               "Request content: %s bytes", */
+    /*               apr_table_get(r->headers_in, "Content-Length")); */
+    /* If the cache is too small,
+     * a) return HTTP_REQUEST_ENTITY_TOO_LARGE to the client
+     * b) IF reauth was successful set Retry-After to immediately: */
+    /* apr_table_setn(r->err_headers_out, "Retry-After", "0"); */
+
+    if (rv != GNUTLS_E_SUCCESS)
+    {
         ap_log_cerror(APLOG_MARK, APLOG_WARNING, 0, ctxt->c,
-                      "GnuTLS: Client Refused Rehandshake request.");
-        return -1;
-    }
-
-    ctxt->status = 0;
-
-    rv = gnutls_do_handshake(ctxt);
-
-    return rv;
+                      "Reauthentication failed: %s (%d)",
+                      gnutls_strerror(rv), rv);
+        return rv;
+    }
+
+    return GNUTLS_E_SUCCESS;
 }