Changeset 70f9c00 in mod_gnutls


Ignore:
Timestamp:
Sep 28, 2020, 8:56:23 AM (7 months ago)
Author:
Fiona Klute <fiona.klute@…>
Branches:
asyncio
Children:
c9e720f
Parents:
ae4325e
Message:

Clean up TLS error handling

The HTTP_BAD_REQUEST case was never actually called, because nothing
in the mod_gnutls filter functions returns such an error code. I'm
completely removing it to avoid any issues with the injected request,
instead the client should just get an alert.

On the other hand, a lot of places in gnutls_io.c can use a generic
"insert EOS bucket" function. :-)

File:
1 edited

Legend:

Unmodified
Added
Removed
  • src/gnutls_io.c

    rae4325e r70f9c00  
    3737 */
    3838
    39 #define HTTP_ON_HTTPS_PORT \
    40     "GET /" CRLF
    41 
    42 #define HTTP_ON_HTTPS_PORT_BUCKET(alloc) \
    43     apr_bucket_immortal_create(HTTP_ON_HTTPS_PORT, \
    44                                sizeof(HTTP_ON_HTTPS_PORT) - 1, \
    45                                alloc)
    46 
    4739#define IS_PROXY_STR(c) \
    4840    ((c->is_proxy == GNUTLS_ENABLED_TRUE) ? "proxy " : "")
     
    5648
    5749
    58 static apr_status_t gnutls_io_filter_error(ap_filter_t * f,
    59         apr_bucket_brigade * bb,
    60         apr_status_t status) {
    61     mgs_handle_t *ctxt = (mgs_handle_t *) f->ctx;
    62     apr_bucket *bucket;
    63 
    64     switch (status) {
    65     case HTTP_BAD_REQUEST:
    66         /* log the situation */
    67         ap_log_cerror(APLOG_MARK, APLOG_INFO, 0, f->c,
    68                       "GnuTLS handshake failed: HTTP spoken on HTTPS port; "
    69                       "trying to send HTML error page");
    70         ctxt->status = -1;
    71 
    72         /* fake the request line */
    73         bucket = HTTP_ON_HTTPS_PORT_BUCKET(f->c->bucket_alloc);
    74         break;
    75 
    76     default:
    77         return status;
    78     }
    79 
     50/**
     51 * Helper function, used mostly for error conditions: Insert an EOS (end
     52 * of stream) bucket into the bucket brigade.
     53 */
     54static inline void gnutls_io_filter_eos(ap_filter_t *f,
     55                                        apr_bucket_brigade *bb)
     56{
     57    apr_bucket *bucket = apr_bucket_eos_create(f->c->bucket_alloc);
    8058    APR_BRIGADE_INSERT_TAIL(bb, bucket);
    81     bucket = apr_bucket_eos_create(f->c->bucket_alloc);
    82     APR_BRIGADE_INSERT_TAIL(bb, bucket);
    83 
    84     return APR_SUCCESS;
    85 }
     59}
     60
     61
    8662
    8763static int char_buffer_read(mgs_char_buffer_t * buffer, char *in, int inl) {
     
    560536
    561537    if (f->c->aborted) {
    562         apr_bucket *bucket =
    563                 apr_bucket_eos_create(f->c->bucket_alloc);
    564         APR_BRIGADE_INSERT_TAIL(bb, bucket);
     538        gnutls_io_filter_eos(f, bb);
    565539        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, ctxt->c,
    566540                      "%s: %sconnection aborted",
     
    582556                      "%s: %sconnection failed, cannot provide data!",
    583557                      __func__, IS_PROXY_STR(ctxt));
    584         apr_bucket *bucket =
    585                 apr_bucket_eos_create(f->c->bucket_alloc);
    586         APR_BRIGADE_INSERT_TAIL(bb, bucket);
     558        gnutls_io_filter_eos(f, bb);
    587559        return APR_ECONNABORTED;
    588560    }
     
    649621
    650622        /* Close TLS session and free resources on EOF,
    651          * gnutls_io_filter_error will add an EOS bucket */
     623         * gnutls_io_filter_eos will add an EOS bucket */
    652624        if (APR_STATUS_IS_EOF(status))
    653625            mgs_bye(ctxt);
    654626
    655         return gnutls_io_filter_error(f, bb, status);
     627        gnutls_io_filter_eos(f, bb);
     628        return status;
    656629    }
    657630
     
    730703             * mod_proxy continues its processing and sends a proper
    731704             * "proxy error" message when there's no response to read. */
    732             apr_bucket *bucket = apr_bucket_eos_create(f->c->bucket_alloc);
    733             APR_BRIGADE_INSERT_TAIL(bb, bucket);
     705            gnutls_io_filter_eos(f, bb);
    734706            return APR_SUCCESS;
    735707        }
Note: See TracChangeset for help on using the changeset viewer.