Changeset babdb29 in mod_gnutls

Timestamp:

May 16, 2018, 2:12:08 AM (5 years ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

asyncio, debian/master, main, master, proxy-ticket

Children:

92b5f4d

Parents:

d036f96

Message:

Initialize and clean up the OCSP cache, following session cache patterns

Files:

• include/mod_gnutls.h.in (modified) (1 diff)
• src/gnutls_cache.c (modified) (4 diffs)
• src/gnutls_cache.h (modified) (1 diff)
• src/gnutls_config.c (modified) (2 diffs)
• src/gnutls_hooks.c (modified) (3 diffs)
• src/gnutls_ocsp.h (modified) (1 diff)

include/mod_gnutls.h.in

@@ -182 +182 @@
     /* Mutex to prevent parallel OCSP requests */
     apr_global_mutex_t *ocsp_mutex;
+    /* Enable OCSP cache */
+    unsigned char ocsp_cache_enable : 2;
+    /* Internal OCSP cache data */
+    mgs_cache_t ocsp_cache;
     /* Cache timeout for OCSP responses. Note that the nextUpdate
      * field of the response takes precedence if shorter. */

src/gnutls_cache.c

@@ -31 +31 @@
 #include "mod_gnutls.h"
 #include "gnutls_config.h"
+#include "gnutls_ocsp.h"
 
 #include <ap_socache.h>
@@ -414 +415 @@
     mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
         ap_get_module_config(s->module_config, &gnutls_module);
-    ap_log_error(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, s,
-                 "Cleaning up socache '%s:%s'",
-                 sc->cache->prov->name, sc->cache->config);
-    sc->cache->prov->destroy(sc->cache->socache, s);
+    if (sc->cache)
+    {
+        ap_log_error(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, s,
+                     "Cleaning up session cache '%s:%s'",
+                     sc->cache->prov->name, sc->cache->config);
+        sc->cache->prov->destroy(sc->cache->socache, s);
+    }
+    if (sc->ocsp_cache)
+    {
+        ap_log_error(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, s,
+                     "Cleaning up OCSP cache '%s:%s'",
+                     sc->ocsp_cache->prov->name, sc->ocsp_cache->config);
+        sc->ocsp_cache->prov->destroy(sc->ocsp_cache->socache, s);
+    }
     return APR_SUCCESS;
 }
@@ -428 +439 @@
 {
     apr_status_t rv = APR_SUCCESS;
+
+    /* Initialize the OCSP cache first so it's not skipped if the
+     * session cache is disabled. */
+    if (sc->ocsp_cache != NULL)
+    {
+        /* TODO: Maybe initialize only if explicitly enabled OR at
+         * least one (virtual) host has OCSP enabled? */
+        rv = mgs_cache_inst_init(sc->ocsp_cache, MGS_OCSP_CACHE_NAME,
+                                 MGS_OCSP_CACHE_MUTEX_NAME, s, pconf);
+        if (rv != APR_SUCCESS)
+            return HTTP_INSUFFICIENT_STORAGE;
+    }
+
     /* GnuTLSCache was never explicitly set or is disabled: */
     if (sc->cache_enable == GNUTLS_ENABLED_UNSET
@@ -450 +474 @@
 }
 
-int mgs_cache_child_init(apr_pool_t * p,
-                         server_rec * s,
-                         mgs_srvconf_rec * sc)
+int mgs_cache_child_init(apr_pool_t *p, server_rec *server,
+                         mgs_cache_t cache, const char *mutex_name)
 {
     /* reinit cache mutex */
-    const char *lockfile = apr_global_mutex_lockfile(sc->cache->mutex);
-    apr_status_t rv = apr_global_mutex_child_init(&sc->cache->mutex,
+    const char *lockfile = apr_global_mutex_lockfile(cache->mutex);
+    apr_status_t rv = apr_global_mutex_child_init(&cache->mutex,
                                                   lockfile, p);
     if (rv != APR_SUCCESS)
-        ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s,
-                     "Failed to reinit mutex '%s'", MGS_CACHE_MUTEX_NAME);
-
-    return 0;
+        ap_log_error(APLOG_MARK, APLOG_EMERG, rv, server,
+                     "Failed to reinit mutex '%s'", mutex_name);
+
+    return rv;
 }
 

src/gnutls_cache.h

@@ -81 +81 @@
  * @param s default server of the Apache configuration, head of the
  * server list
- * @param sc mod_gnutls data associated with `s`
+ * @param cache the cache to reinit
+ * @param mutex_name name of the mutex associated with the cache for
+ * logging purposes
  */
-int mgs_cache_child_init(apr_pool_t *p, server_rec *s, mgs_srvconf_rec *sc);
+int mgs_cache_child_init(apr_pool_t *p, server_rec *server,
+                         mgs_cache_t cache, const char *mutex_name);
 
 /**

src/gnutls_config.c

@@ -625 +625 @@
     else if (!strcasecmp(parms->directive->directive, "GnuTLSOCSPCache"))
     {
-        // TODO
-        return NULL;
+        if (enable == GNUTLS_ENABLED_FALSE)
+        {
+            /* TODO: Should this return an error like "use
+             * GnuTLSOCSPStapling off if you want to disable OCSP
+             * stapling"? */
+            sc->ocsp_cache_enable = GNUTLS_ENABLED_FALSE;
+            return NULL;
+        }
+        sc->ocsp_cache_enable = GNUTLS_ENABLED_TRUE;
+        cache = &sc->ocsp_cache;
     }
     else
@@ -899 +907 @@
     sc->ocsp_response_file = NULL;
     sc->ocsp_mutex = NULL;
+    sc->ocsp_cache_enable = GNUTLS_ENABLED_UNSET;
+    sc->ocsp_cache = NULL;
     sc->ocsp_cache_time = MGS_TIMEOUT_UNSET;
     sc->ocsp_failure_timeout = MGS_TIMEOUT_UNSET;

src/gnutls_hooks.c

@@ -130 +130 @@
     ap_mutex_register(pconf, MGS_CACHE_MUTEX_NAME, NULL, APR_LOCK_DEFAULT, 0);
     ap_mutex_register(pconf, MGS_OCSP_MUTEX_NAME, NULL, APR_LOCK_DEFAULT, 0);
+    ap_mutex_register(pconf, MGS_OCSP_CACHE_MUTEX_NAME, NULL,
+                      APR_LOCK_DEFAULT, 0);
 
     /* Register a pool clean-up function */
@@ -633 +635 @@
         if (sc->cache_timeout == MGS_TIMEOUT_UNSET)
             sc->cache_timeout = sc_base->cache_timeout;
+        sc->ocsp_cache_enable = sc_base->ocsp_cache_enable;
+        sc->ocsp_cache = sc_base->ocsp_cache;
 
         sc->singleton_wd = sc_base->singleton_wd;
@@ -775 +779 @@
     }
 
-    if (sc->cache_enable) {
-        rv = mgs_cache_child_init(p, s, sc);
-        if (rv != APR_SUCCESS) {
+    if (sc->cache_enable == GNUTLS_ENABLED_TRUE)
+    {
+        rv = mgs_cache_child_init(p, s, sc->cache, MGS_CACHE_MUTEX_NAME);
+        if (rv != APR_SUCCESS)
             ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s,
-                    "GnuTLS: Failed to run Cache Init");
-        }
-    }
-
-    /* reinit OCSP mutex */
+                    "Child init for session cache failed!");
+    }
+
+    if (sc->ocsp_cache_enable == GNUTLS_ENABLED_TRUE)
+    {
+        rv = mgs_cache_child_init(p, s, sc->ocsp_cache,
+                                  MGS_OCSP_CACHE_MUTEX_NAME);
+        if (rv != APR_SUCCESS)
+            ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s,
+                    "Child init for OCSP cache failed!");
+    }
+
+    /* reinit OCSP request mutex */
     const char *lockfile = apr_global_mutex_lockfile(sc->ocsp_mutex);
     rv = apr_global_mutex_child_init(&sc->ocsp_mutex, lockfile, p);

src/gnutls_ocsp.h

@@ -24 +24 @@
 
 #define MGS_OCSP_MUTEX_NAME "gnutls-ocsp"
+#define MGS_OCSP_CACHE_MUTEX_NAME "gnutls-ocsp-cache"
+#define MGS_OCSP_CACHE_NAME "gnutls_ocsp"
 
 /** Default OCSP response cache timeout in seconds */