Changeset 9ca1f21 in mod_gnutls

Timestamp:

Sep 18, 2015, 7:12:16 PM (6 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

asyncio, debian/master, debian/stretch-backports, jessie-backports, master, proxy-ticket, upstream

Children:

dff03fa

Parents:

88df24d

Message:

Allow loading more than one PKCS #11 module using GnuTLSP11Module

This commit allows multiple modules to be loaded using the
GnuTLSP11Module directive. Each occurrence of GnuTLSP11Module causes the
given module to be added to a list, and all modules on that list are
loaded.

Commit f21d2a6dba6378b18d015dde88193fcad70d8728 disabled modules
configured through the system wide p11-kit configuration if
GnuTLSP11Module is set. With that change, using multiple PKCS #11
modules required using the system configuration, since only one module
could be loaded using GnuTLSP11Module.

Files:

• doc/mod_gnutls_manual.mdwn (modified) (1 diff)
• include/mod_gnutls.h.in (modified) (1 diff)
• src/gnutls_config.c (modified) (3 diffs)
• src/gnutls_hooks.c (modified) (2 diffs)

doc/mod_gnutls_manual.mdwn

@@ -382 +382 @@
 Context: server config
 
-Load this PKCS #11 provider module, instead of the system defaults.
+Load this PKCS #11 provider module, instead of the system
+defaults. May occur multiple times to load multiple modules.
 
 `GnuTLSPIN`

include/mod_gnutls.h.in

@@ -115 +115 @@
     int non_ssl_request;
 
-    /* Additional PKCS #11 provider module to load, only valid in the
+    /* List of PKCS #11 provider modules to load, only valid in the
      * base config, ignored in virtual hosts */
-    char *p11_module;
+    apr_array_header_t *p11_modules;
 
     /* PIN used for PKCS #11 operations */

src/gnutls_config.c

@@ -952 +952 @@
     sc->privkey_pgp = NULL;
     sc->certs_x509_chain_num = 0;
-    sc->p11_module = NULL;
+    sc->p11_modules = NULL;
     sc->pin = NULL;
     sc->priorities_str = NULL;
@@ -1013 +1013 @@
     gnutls_srvconf_merge(x509_key_file, NULL);
     gnutls_srvconf_merge(x509_ca_file, NULL);
-    gnutls_srvconf_merge(p11_module, NULL);
+    gnutls_srvconf_merge(p11_modules, NULL);
     gnutls_srvconf_merge(pin, NULL);
     gnutls_srvconf_merge(pgp_cert_file, NULL);
@@ -1119 +1119 @@
     mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
         ap_get_module_config(parms->server->module_config, &gnutls_module);
-    sc->p11_module = apr_pstrdup(parms->pool, arg);
-    return NULL;
-}
+    /* initialize PKCS #11 module list if necessary */
+    if (sc->p11_modules == NULL)
+        sc->p11_modules = apr_array_make(parms->pool, 2, sizeof(char*));
+
+    *(char **) apr_array_push(sc->p11_modules) = apr_pstrdup(parms->pool, arg);
+
+    return NULL;
+}

src/gnutls_hooks.c

@@ -323 +323 @@
     }
 
-    /* If GnuTLSP11Module is set, load that PKCS #11 module. Otherwise
-     * system defaults will be used. */
-    if (sc_base->p11_module != NULL)
+    /* If GnuTLSP11Module is set, load the listed PKCS #11
+     * modules. Otherwise system defaults will be used. */
+    if (sc_base->p11_modules != NULL)
     {
         rv = gnutls_pkcs11_init(GNUTLS_PKCS11_FLAG_MANUAL, NULL);
@@ -337 +337 @@
         else
         {
-            rv = gnutls_pkcs11_add_provider(sc_base->p11_module, NULL);
-            if (rv != GNUTLS_E_SUCCESS)
-                ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
-                             "GnuTLS: Loading PKCS #11 provider module %s "
-                             "failed: %s (%d).",
-                             sc_base->p11_module, gnutls_strerror(rv), rv);
+            int i;
+            for (i = 0; i < sc_base->p11_modules->nelts; i++)
+            {
+                char *p11_module =
+                    APR_ARRAY_IDX(sc_base->p11_modules, i, char *);
+                rv = gnutls_pkcs11_add_provider(p11_module, NULL);
+                if (rv != GNUTLS_E_SUCCESS)
+                    ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                                 "GnuTLS: Loading PKCS #11 provider module %s "
+                                 "failed: %s (%d).",
+                                 p11_module, gnutls_strerror(rv), rv);
+            }
         }
     }