Changeset 836417f in mod_gnutls for src/gnutls_hooks.c

Timestamp:

Apr 24, 2005, 8:34:34 PM (15 years ago)

Author:

Paul Querna <chip@…>

Branches:

debian/master, debian/stretch-backports, jessie-backports, master, msva, proxy-ticket, upstream

Children:

84cb5b2

Parents:

38435cc

Message:

Refactor finding the correct server record to fix resumed sessions.

File:

• src/gnutls_hooks.c (modified) (9 diffs)

src/gnutls_hooks.c

@@ -301 +301 @@
 {
     mgs_handle_t *ctxt;
-    gnutls_retr_st* ret;
+    mgs_srvconf_rec *sc;
     const char* sni_name;
 } vhost_cb_rec;
@@ -320 +320 @@
     if (ap_strcasecmp_match(x->sni_name, tsc->cert_cn) == 0) {
         /* found a match */
-        x->ret->cert.x509 = &tsc->cert_x509;
-        x->ret->key.x509 = tsc->privkey_x509;
 #if MOD_GNUTLS_DEBUG
         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,
@@ -331 +329 @@
          * things like ClientVerify.
          */
-        x->ctxt->sc = tsc;
+        x->sc = tsc;
         /* Shit. Crap. Dammit. We *really* should rehandshake here, as our
          * certificate structure *should* change when the server changes. 
          * acccckkkkkk. 
          */
-        gnutls_certificate_server_set_request(x->ctxt->session, x->ctxt->sc->client_verify_mode);
         return 1;
     }
@@ -343 +340 @@
 #endif
 
-static int cert_retrieve_fn(gnutls_session_t session, gnutls_retr_st* ret) 
+mgs_srvconf_rec* mgs_find_sni_server(gnutls_session_t session) 
 {
     int rv;
@@ -365 +362 @@
                      ctxt->c->base_server,
                      "GnuTLS: Only x509 Certificates are currently supported.");
-        return -1;
-    }
-
-    ret->type = GNUTLS_CRT_X509;
-    ret->ncerts = 1;
-    ret->deinit_all = 0;
+        return NULL;
+    }
     
     rv = gnutls_server_name_get(ctxt->session, sni_name, 
                                 &data_len, &sni_type, 0);
-
+    
     if (rv != 0) {
-        goto use_default_crt;
-    }
-
+        return NULL;
+    }
+    
     if (sni_type != GNUTLS_NAME_DNS) {
         ap_log_error(APLOG_MARK, APLOG_CRIT, 0,
                      ctxt->c->base_server,
                      "GnuTLS: Unknown type '%d' for SNI: "
-                     "'%s'", sni_type, sni_name);        
-        goto use_default_crt;
+                     "'%s'", sni_type, sni_name);
+        return NULL;
     }
     
@@ -393 +386 @@
 #if USING_2_1_RECENT
     cbx.ctxt = ctxt;
-    cbx.ret = ret;
+    cbx.sc = NULL;
     cbx.sni_name = sni_name;
-
+    
     rv = ap_vhost_iterate_given_conn(ctxt->c, vhost_cb, &cbx);
     if (rv == 1) {
-        return 0;
+        return cbx.sc;
     }
 #else
@@ -404 +397 @@
         
         tsc = (mgs_srvconf_rec *) ap_get_module_config(s->module_config,
-                                                             &gnutls_module);
+                                                       &gnutls_module);
         if (tsc->enabled != GNUTLS_ENABLED_TRUE) {
             continue;
@@ -417 +410 @@
         /* The CN can contain a * -- this will match those too. */
         if (ap_strcasecmp_match(sni_name, tsc->cert_cn) == 0) {
-            /* found a match */
-            ret->cert.x509 = &tsc->cert_x509;
-            ret->key.x509 = tsc->privkey_x509;
 #if MOD_GNUTLS_DEBUG
             ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,
@@ -426 +416 @@
                          "'%s' == '%s'", tsc->cert_cn, sni_name);
 #endif
-            ctxt->sc = tsc;
-            gnutls_certificate_server_set_request(ctxt->session, ctxt->sc->client_verify_mode);
-            return 0;
-        }
-    }
-#endif
-    
-    /**
-     * If the client does not support the Server Name Indication, give the default 
-     * certificate for this server. 
-     */
-use_default_crt:
+            return tsc;
+        }
+    }
+#endif
+    return NULL;
+}
+
+
+static int cert_retrieve_fn(gnutls_session_t session, gnutls_retr_st* ret) 
+{
+    mgs_handle_t *ctxt;
+    mgs_srvconf_rec *tsc;
+    
+    ctxt = gnutls_transport_get_ptr(session);
+
+    ret->type = GNUTLS_CRT_X509;
+    ret->ncerts = 1;
+    ret->deinit_all = 0;
+
+    tsc = mgs_find_sni_server(session);
+    
+    if (tsc != NULL) {
+        ctxt->sc = tsc;
+        gnutls_certificate_server_set_request(ctxt->session, ctxt->sc->client_verify_mode);
+    }
+    
     ret->cert.x509 = &ctxt->sc->cert_x509;
     ret->key.x509 = ctxt->sc->privkey_x509;
-#if MOD_GNUTLS_DEBUG
-    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,
-                 ctxt->c->base_server,
-                 "GnuTLS: Using Default Certificate.");
-#endif
     return 0;
 }