Changeset 7ff6c6c in mod_gnutls for src

Timestamp:

Nov 4, 2018, 4:55:35 PM (2 years ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

asyncio, debian/master, master, proxy-ticket

Children:

c0fc11e

Parents:

99eb567

Message:

Add proof-of-concept SNI parser in a pre client hello hook

The SNI parser is complete, but right now the hook only retrieves the
SNI data and logs it. The goal is to select the right virtual host and
load ALPN parameters (and possibly others) before GnuTLS processes the
ClientHello? message. That should make different "Protocols" directives
between virtual hosts work as expected.

Location:

src

Files:

• Makefile.am (modified) (1 diff)
• gnutls_hooks.c (modified) (3 diffs)
• gnutls_sni.c (added)
• gnutls_sni.h (added)

src/Makefile.am

@@ -7 +7 @@
 
 mod_gnutls_la_SOURCES = mod_gnutls.c gnutls_io.c gnutls_cache.c \
-        gnutls_config.c gnutls_hooks.c gnutls_ocsp.c gnutls_util.c \
-        gnutls_watchdog.c
+        gnutls_config.c gnutls_hooks.c gnutls_ocsp.c gnutls_sni.c \
+        gnutls_util.c gnutls_watchdog.c
 mod_gnutls_la_CFLAGS = -Wall ${MODULE_CFLAGS}
 mod_gnutls_la_LDFLAGS = -module -avoid-version ${MODULE_LIBS}
-noinst_HEADERS = gnutls_cache.h gnutls_config.h gnutls_ocsp.h gnutls_util.h \
-        gnutls_watchdog.h
+noinst_HEADERS = gnutls_cache.h gnutls_config.h gnutls_ocsp.h gnutls_sni.h \
+        gnutls_util.h gnutls_watchdog.h
 
 apmodpkglib_LTLIBRARIES = mod_gnutls.la

src/gnutls_hooks.c

@@ -23 +23 @@
 #include "gnutls_config.h"
 #include "gnutls_ocsp.h"
+#include "gnutls_sni.h"
 #include "gnutls_util.h"
 #include "gnutls_watchdog.h"
@@ -1032 +1033 @@
 }
 
+
+
+#ifdef ENABLE_EARLY_SNI
+static int early_sni_hook(gnutls_session_t session,
+                          unsigned int htype __attribute__((unused)),
+                          unsigned when __attribute__((unused)),
+                          unsigned int incoming,
+                          const gnutls_datum_t *msg)
+{
+    //assert(htype == GNUTLS_HANDSHAKE_CLIENT_HELLO);
+    //assert(when == GNUTLS_HOOK_PRE);
+    if (!incoming)
+        return 0;
+
+    mgs_handle_t *ctxt = (mgs_handle_t *) gnutls_session_get_ptr(session);
+    ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, ctxt->c,
+                  "%s: Trying early SNI.",
+                  __func__);
+
+    int ret = gnutls_ext_raw_parse(session, mgs_sni_ext_hook, msg,
+                                   GNUTLS_EXT_RAW_FLAG_TLS_CLIENT_HELLO);
+    if (ret == 0 && ctxt->sni_name != NULL)
+        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, ctxt->c,
+                      "%s: Early SNI result: %s",
+                      __func__, ctxt->sni_name);
+    return ret;
+}
+#endif
+
+
+
 /**
  * This function is intended as a cleanup handler for connections
@@ -1122 +1154 @@
         ap_log_cerror(APLOG_MARK, APLOG_ERR, err, c,
                       "gnutls_priority_set failed!");
+#ifdef ENABLE_EARLY_SNI
+    /* Pre-handshake hook, EXPERIMENTAL */
+    gnutls_handshake_set_hook_function(ctxt->session,
+                                       GNUTLS_HANDSHAKE_CLIENT_HELLO,
+                                       GNUTLS_HOOK_PRE, early_sni_hook);
+#endif
     /* Set Handshake function */
     gnutls_handshake_set_post_client_hello_function(ctxt->session,