Changeset 84cb5b2 in mod_gnutls for src/gnutls_hooks.c

Timestamp:

May 17, 2005, 5:00:53 PM (15 years ago)

Author:

Paul Querna <chip@…>

Branches:

debian/master, debian/stretch-backports, jessie-backports, master, msva, proxy-ticket, upstream

Children:

836c2f9

Parents:

836417f

Message:

• add lua to do client verification
• only use gcrypt locking when required to

File:

• src/gnutls_hooks.c (modified) (6 diffs)

src/gnutls_hooks.c

@@ -18 +18 @@
 #include "mod_gnutls.h"
 #include "http_vhost.h"
+#include "ap_mpm.h"
 
 #if !USING_2_1_RECENT
@@ -31 +32 @@
 #endif
 
+static int mpm_is_threaded;
+
 static apr_status_t mgs_cleanup_pre_config(void *data)
 {
@@ -49 +52 @@
 
 #if APR_HAS_THREADS
-    /* TODO: Check MPM Type here */
-    gcry_control(GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread);
+    ap_mpm_query(AP_MPMQ_IS_THREADED, &mpm_is_threaded);
+    if (mpm_is_threaded) {
+        gcry_control(GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread);
+    }
+#else
+    mpm_is_threaded = 0;
 #endif
 
@@ -235 +242 @@
                                                GNUTLS_OID_X520_COMMON_NAME, 0, 0,
                                                sc->cert_cn, &data_len);
-            ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,
-                         s,
-                         "GnuTLS: sni-x509 cn: %s/%d pk: %s s: 0x%08X sc: 0x%08X", sc->cert_cn, rv,
-                         gnutls_pk_algorithm_get_name(gnutls_x509_privkey_get_pk_algorithm(sc->privkey_x509)),
-                         (unsigned int)s, (unsigned int)sc);
         }
     }
@@ -569 +571 @@
         apr_table_setn(env, "SSL_SERVER_I_DN", apr_pstrmemdup(r->pool, buf, len));
     }
-    
     return rv;
 }
@@ -586 +587 @@
         return DECLINED;
     }
-    
-    if (!dc) {
-        dc = mgs_config_dir_create(r->pool, NULL);
-    }
-
+    ap_add_common_vars(r);
+    mgs_hook_fixups(r);
+    status = mgs_authz_lua(r);
+    if (status != 0) {
+        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, 
+                      "GnuTLS: FAILED Lua Authorization Test");
+        return HTTP_FORBIDDEN;
+    }
     if (dc->client_verify_mode == GNUTLS_CERT_IGNORE) {
         ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,