Changeset 764fef3 in mod_gnutls for src

Timestamp:

May 31, 2020, 6:24:41 AM (8 months ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

asyncio, master

Children:

e151b6f

Parents:

7e29705

git-author:

Fiona Klute <fiona.klute@…> (05/31/20 06:17:51)

git-committer:

Fiona Klute <fiona.klute@…> (05/31/20 06:24:41)

Message:

Load cached proxy TLS sessions from cache

Location:

src

Files:

• gnutls_cache.c (modified) (3 diffs)
• gnutls_cache.h (modified) (2 diffs)
• gnutls_io.c (modified) (1 diff)
• gnutls_proxy.c (modified) (4 diffs)

src/gnutls_cache.c

@@ -3 +3 @@
  *  Copyright 2008 Nikos Mavrogiannopoulos
  *  Copyright 2011 Dash Shendy
- *  Copyright 2015-2018 Fiona Klute
+ *  Copyright 2015-2020 Fiona Klute
  *
  *  Licensed under the Apache License, Version 2.0 (the "License");
@@ -169 +169 @@
 
 
-/** 8K is the maximum size accepted when receiving OCSP responses,
- * sessions cache entries should be much smaller. The buffer is
- * reallocated to actual size after fetching, so memory waste is
- * minimal and temporary. */
-#define SOCACHE_FETCH_BUF_SIZE (8 * 1024)
-
 apr_status_t mgs_cache_fetch(mgs_cache_t cache, server_rec *server,
                              gnutls_datum_t key, gnutls_datum_t *output,
@@ -240 +234 @@
         return data;
 
-    data.data = gnutls_malloc(SOCACHE_FETCH_BUF_SIZE);
+    data.data = gnutls_malloc(MGS_SESSION_FETCH_BUF_SIZE);
     if (data.data == NULL)
         return data;
-    data.size = SOCACHE_FETCH_BUF_SIZE;
+    data.size = MGS_SESSION_FETCH_BUF_SIZE;
 
     apr_status_t rv = mgs_cache_fetch(ctxt->sc->cache, ctxt->c->base_server,

src/gnutls_cache.h

@@ -2 +2 @@
  *  Copyright 2004-2005 Paul Querna
  *  Copyright 2014 Nikos Mavrogiannopoulos
- *  Copyright 2015-2018 Fiona Klute
+ *  Copyright 2015-2020 Fiona Klute
  *
  *  Licensed under the Apache License, Version 2.0 (the "License");
@@ -33 +33 @@
  * `Mutex` directive */
 #define MGS_CACHE_MUTEX_NAME "gnutls-cache"
+
+/** 8K is the maximum size accepted when receiving OCSP responses,
+ * sessions cache entries should be much smaller. The buffer is
+ * reallocated to actual size after fetching, so memory waste is
+ * minimal and temporary. */
+#define MGS_SESSION_FETCH_BUF_SIZE (8 * 1024)
 
 /**

src/gnutls_io.c

@@ -385 +385 @@
     }
 
-    /* Enable SNI and ALPN for proxy connections */
+    /* Enable SNI and ALPN for proxy connections, and load cached
+     * session if any. */
     if (ctxt->is_proxy == GNUTLS_ENABLED_TRUE)
         mgs_set_proxy_handshake_ext(ctxt);

src/gnutls_proxy.c

@@ -16 +16 @@
 
 #include "mod_gnutls.h"
+#include "gnutls_cache.h"
 #include "gnutls_proxy.h"
 #include "gnutls_util.h"
@@ -21 +22 @@
 #include <apr_strings.h>
 #include <gnutls/gnutls.h>
+
+APLOG_USE_MODULE(gnutls);
 
 /*
@@ -396 +399 @@
 
 
+/**
+ * Check if there is a cached session for the connection, and load it
+ * if yes. The session is deleted from the cache after that, because
+ * tickets should not be reused for forward secrecy.
+ *
+ * @param ctxt the mod_gnutls connection handle
+ */
+static void proxy_conn_load_session(mgs_handle_t *ctxt)
+{
+    gnutls_datum_t data = {NULL, 0};
+    data.data = gnutls_malloc(MGS_SESSION_FETCH_BUF_SIZE);
+    if (data.data == NULL)
+        return;
+    data.size = MGS_SESSION_FETCH_BUF_SIZE;
+
+    apr_status_t rv = mgs_cache_fetch(ctxt->sc->cache, ctxt->c->base_server,
+                                      ctxt->proxy_ticket_key, &data,
+                                      ctxt->c->pool);
+    if (rv != APR_SUCCESS)
+    {
+        gnutls_free(data.data);
+        return;
+    }
+
+    // TODO: delete the cache entry
+
+    int ret = gnutls_session_set_data(ctxt->session, data.data, data.size);
+    if (ret == GNUTLS_E_SUCCESS)
+        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, ctxt->c,
+                      "%s: Cached session loaded.", __func__);
+    else
+        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_EGENERAL, ctxt->c,
+                      "%s: Loading cached session failed: %s (%d)",
+                      __func__, gnutls_strerror(ret), ret);
+    gnutls_free(data.data);
+}
+
+
+
 gnutls_datum_t mgs_proxy_ticket_id(mgs_handle_t *ctxt, apr_pool_t *pool)
 {
@@ -429 +471 @@
     proxy_conn_set_sni(ctxt);
     proxy_conn_set_alpn(ctxt);
-}
+    proxy_conn_load_session(ctxt);
+}