Changeset 87f1ed2 in mod_gnutls for src

Timestamp:

May 8, 2015, 8:40:02 PM (4 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, jessie-backports, master, upstream

Children:

8f90bf4

Parents:

39bd695

git-author:

Thomas Klute <thomas2.klute@…> (04/26/15 14:48:27)

git-committer:

Thomas Klute <thomas2.klute@…> (05/08/15 20:40:02)

Message:

Allow loading of an additional PKCS #11 provider library

When using PKCS #11, it may not be desirable to add the PKCS #11 module
to be used by mod_gnutls to the system wide config, and we definitely
cannot demand it for tests.

To work around such problems, add the new configuration parameter
"GnuTLSP11Module", which may contain the path of a library to load. Note
that the value is only used if present in the base server configuration
(not a virtual host), and that the library is used in addition to
system defaults (if any).

Location:

src

Files:

• gnutls_config.c (modified) (3 diffs)
• gnutls_hooks.c (modified) (1 diff)
• mod_gnutls.c (modified) (1 diff)

src/gnutls_config.c

@@ -948 +948 @@
     sc->privkey_pgp = NULL;
     sc->certs_x509_chain_num = 0;
+    sc->p11_module = NULL;
     sc->pin = NULL;
     sc->priorities_str = NULL;
@@ -1008 +1009 @@
     gnutls_srvconf_merge(x509_key_file, NULL);
     gnutls_srvconf_merge(x509_ca_file, NULL);
+    gnutls_srvconf_merge(p11_module, NULL);
     gnutls_srvconf_merge(pin, NULL);
     gnutls_srvconf_merge(pgp_cert_file, NULL);
@@ -1100 +1102 @@
     return NULL;
 }
+
+
+
+/*
+ * Record additional PKCS #11 module to load. Note that the value is
+ * only used in the base config, settings in virtual hosts are
+ * ignored.
+ */
+const char *mgs_set_p11_module(cmd_parms * parms,
+                               void *dummy __attribute__((unused)),
+                               const char *arg)
+{
+    mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
+        ap_get_module_config(parms->server->module_config, &gnutls_module);
+    sc->p11_module = apr_pstrdup(parms->pool, arg);
+    return NULL;
+}

src/gnutls_hooks.c

@@ -320 +320 @@
                 " Shutting Down.");
         exit(-1);
+    }
+
+    /* Load additional PKCS #11 module, if requested */
+    if (sc_base->p11_module != NULL)
+    {
+        rv = gnutls_pkcs11_add_provider(sc_base->p11_module, NULL);
+        if (rv != GNUTLS_E_SUCCESS)
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                         "GnuTLS: Loading PKCS #11 provider module %s "
+                         "failed: %s (%d).",
+                         sc_base->p11_module, gnutls_strerror(rv), rv);
     }
 

src/mod_gnutls.c

@@ -140 +140 @@
     RSRC_CONF | OR_AUTHCFG,
     "Enable SSL Proxy Engine"),
+    AP_INIT_TAKE1("GnuTLSP11Module", mgs_set_p11_module,
+    NULL,
+    RSRC_CONF,
+    "Load this additional PKCS #11 provider library"),
     AP_INIT_RAW_ARGS("GnuTLSPIN", mgs_set_pin,
     NULL,