Changeset 7ff6c6c in mod_gnutls

Timestamp:

Nov 4, 2018, 4:55:35 PM (2 years ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

asyncio, debian/master, master, proxy-ticket

Children:

c0fc11e

Parents:

99eb567

Message:

Add proof-of-concept SNI parser in a pre client hello hook

The SNI parser is complete, but right now the hook only retrieves the
SNI data and logs it. The goal is to select the right virtual host and
load ALPN parameters (and possibly others) before GnuTLS processes the
ClientHello? message. That should make different "Protocols" directives
between virtual hosts work as expected.

Files:

• configure.ac (modified) (3 diffs)
• src/Makefile.am (modified) (1 diff)
• src/gnutls_hooks.c (modified) (3 diffs)
• src/gnutls_sni.c (added)
• src/gnutls_sni.h (added)

configure.ac

@@ -67 +67 @@
 AC_SEARCH_LIBS([gnutls_srp_server_get_username], [gnutls], [], [use_srp="no"])
 
-SRP_CFLAGS=""
+GNUTLS_FEAT_CFLAGS=""
 if test "$use_srp" != "no"; then
-        SRP_CFLAGS="-DENABLE_SRP=1"
+        GNUTLS_FEAT_CFLAGS="-DENABLE_SRP=1"
+fi
+
+# check if the available GnuTLS library supports raw extension parsing
+AC_SEARCH_LIBS([gnutls_ext_raw_parse], [gnutls], [early_sni="yes"],
+        [early_sni="no"])
+if test "$early_sni" != "no"; then
+        GNUTLS_FEAT_CFLAGS="${GNUTLS_FEAT_CFLAGS} -DENABLE_EARLY_SNI"
 fi
 
@@ -223 +230 @@
 AC_PATH_PROGS([HTTP_CLI], [curl wget], [no])
 
-MODULE_CFLAGS="${LIBGNUTLS_CFLAGS} ${SRP_CFLAGS} ${MSVA_CFLAGS} ${APXS_CFLAGS} ${AP_INCLUDES} ${APR_INCLUDES} ${APU_INCLUDES} ${STRICT_CFLAGS}"
+MODULE_CFLAGS="${LIBGNUTLS_CFLAGS} ${GNUTLS_FEAT_CFLAGS} ${MSVA_CFLAGS} ${APXS_CFLAGS} ${AP_INCLUDES} ${APR_INCLUDES} ${APU_INCLUDES} ${STRICT_CFLAGS}"
 MODULE_LIBS="${LIBGNUTLS_LIBS}"
 
@@ -315 +322 @@
 echo "   * SRP Authentication:  ${use_srp}"
 echo "   * MSVA Client Verification:    ${use_msva}"
+echo "   * Early SNI (experimental):    ${early_sni}"
 echo "   * Build documentation: ${build_doc}"
 echo ""

src/Makefile.am

@@ -7 +7 @@
 
 mod_gnutls_la_SOURCES = mod_gnutls.c gnutls_io.c gnutls_cache.c \
-        gnutls_config.c gnutls_hooks.c gnutls_ocsp.c gnutls_util.c \
-        gnutls_watchdog.c
+        gnutls_config.c gnutls_hooks.c gnutls_ocsp.c gnutls_sni.c \
+        gnutls_util.c gnutls_watchdog.c
 mod_gnutls_la_CFLAGS = -Wall ${MODULE_CFLAGS}
 mod_gnutls_la_LDFLAGS = -module -avoid-version ${MODULE_LIBS}
-noinst_HEADERS = gnutls_cache.h gnutls_config.h gnutls_ocsp.h gnutls_util.h \
-        gnutls_watchdog.h
+noinst_HEADERS = gnutls_cache.h gnutls_config.h gnutls_ocsp.h gnutls_sni.h \
+        gnutls_util.h gnutls_watchdog.h
 
 apmodpkglib_LTLIBRARIES = mod_gnutls.la

src/gnutls_hooks.c

@@ -23 +23 @@
 #include "gnutls_config.h"
 #include "gnutls_ocsp.h"
+#include "gnutls_sni.h"
 #include "gnutls_util.h"
 #include "gnutls_watchdog.h"
@@ -1032 +1033 @@
 }
 
+
+
+#ifdef ENABLE_EARLY_SNI
+static int early_sni_hook(gnutls_session_t session,
+                          unsigned int htype __attribute__((unused)),
+                          unsigned when __attribute__((unused)),
+                          unsigned int incoming,
+                          const gnutls_datum_t *msg)
+{
+    //assert(htype == GNUTLS_HANDSHAKE_CLIENT_HELLO);
+    //assert(when == GNUTLS_HOOK_PRE);
+    if (!incoming)
+        return 0;
+
+    mgs_handle_t *ctxt = (mgs_handle_t *) gnutls_session_get_ptr(session);
+    ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, ctxt->c,
+                  "%s: Trying early SNI.",
+                  __func__);
+
+    int ret = gnutls_ext_raw_parse(session, mgs_sni_ext_hook, msg,
+                                   GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
+    if (ret == 0 && ctxt->sni_name != NULL)
+        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, ctxt->c,
+                      "%s: Early SNI result: %s",
+                      __func__, ctxt->sni_name);
+    return ret;
+}
+#endif
+
+
+
 /**
  * This function is intended as a cleanup handler for connections
@@ -1122 +1154 @@
         ap_log_cerror(APLOG_MARK, APLOG_ERR, err, c,
                       "gnutls_priority_set failed!");
+#ifdef ENABLE_EARLY_SNI
+    /* Pre-handshake hook, EXPERIMENTAL */
+    gnutls_handshake_set_hook_function(ctxt->session,
+                                       GNUTLS_HANDSHAKE_CLIENT_HELLO,
+                                       GNUTLS_HOOK_PRE, early_sni_hook);
+#endif
     /* Set Handshake function */
     gnutls_handshake_set_post_client_hello_function(ctxt->session,