Changeset beb14d9 in mod_gnutls for src/gnutls_hooks.c

Timestamp:

Jan 27, 2015, 7:20:27 AM (5 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, jessie-backports, master, upstream

Children:

4fefa39

Parents:

c1ef069

Message:

Proof of concept: Support for proxy back end connections using TLS

This commit enables TLS on proxy back end connections if requested from
mod_proxy. Since mod_gnutls acts as client instead of server on proxy
back end connections, TLS session setup is quite different.

Note that this implementation is not finished, in particular the proxy
back end connection is hard coded to use the same X.509 credentials as
the server side, which severely restricts usable certificate
combinations.

Some typos in comments and an error message related to TLS handshake are
fixed as well.

File:

• src/gnutls_hooks.c (modified) (3 diffs)

src/gnutls_hooks.c

@@ -147 +147 @@
     gnutls_certificate_server_set_request(session, ctxt->sc->client_verify_mode);
 
+    /* Set x509 credentials */
+    gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, ctxt->sc->certs);
     /* Set Anon credentials */
-    gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE, ctxt->sc->certs);
-        /* Set x509 credentials */
     gnutls_credentials_set(session, GNUTLS_CRD_ANON, ctxt->sc->anon_creds);
 
@@ -714 +714 @@
 
     /* Initialize GnuTLS Library */
-    int err = gnutls_init(&ctxt->session, GNUTLS_SERVER);
-    if (err != GNUTLS_E_SUCCESS)
-        ap_log_cerror(APLOG_MARK, APLOG_ERR, err, c, "gnutls_init failed!");
-    /* Initialize Session Tickets */
-    if (session_ticket_key.data != NULL && ctxt->sc->tickets != 0) {
-        err = gnutls_session_ticket_enable_server(ctxt->session, &session_ticket_key);
+    int err = 0;
+    if (ctxt->is_proxy == GNUTLS_ENABLED_TRUE)
+    {
+        /* this is an outgoing proxy connection, client mode */
+        err = gnutls_init(&ctxt->session, GNUTLS_CLIENT);
         if (err != GNUTLS_E_SUCCESS)
-            ap_log_cerror(APLOG_MARK, APLOG_ERR, err, c, "gnutls_session_ticket_enable_server failed!");
+            ap_log_cerror(APLOG_MARK, APLOG_ERR, err, c,
+                          "gnutls_init for proxy connection failed: %s (%d)",
+                          gnutls_strerror(err), err);
+        err = gnutls_session_ticket_enable_client(ctxt->session);
+        if (err != GNUTLS_E_SUCCESS)
+            ap_log_cerror(APLOG_MARK, APLOG_ERR, err, c,
+                          "gnutls_session_ticket_enable_client failed: %s (%d)",
+                          gnutls_strerror(err), err);
+    }
+    else
+    {
+        /* incoming connection, server mode */
+        err = gnutls_init(&ctxt->session, GNUTLS_SERVER);
+        if (err != GNUTLS_E_SUCCESS)
+            ap_log_cerror(APLOG_MARK, APLOG_ERR, err, c,
+                          "gnutls_init for server side failed: %s (%d)",
+                          gnutls_strerror(err), err);
+        /* Initialize Session Tickets */
+        if (session_ticket_key.data != NULL && ctxt->sc->tickets != 0)
+        {
+            err = gnutls_session_ticket_enable_server(ctxt->session, &session_ticket_key);
+            if (err != GNUTLS_E_SUCCESS)
+                ap_log_cerror(APLOG_MARK, APLOG_ERR, err, c,
+                              "gnutls_session_ticket_enable_server failed: %s (%d)",
+                              gnutls_strerror(err), err);
+        }
     }
 
@@ -731 +755 @@
     gnutls_handshake_set_post_client_hello_function(ctxt->session,
             mgs_select_virtual_server_cb);
+
+    /* If mod_gnutls is the TLS server, mgs_select_virtual_server_cb
+     * will load appropriate credentials during handshake. However,
+     * when handling a proxy backend connection, mod_gnutls acts as
+     * TLS client and credentials must be loaded here. */
+    if (ctxt->is_proxy == GNUTLS_ENABLED_TRUE)
+    {
+        /* Set anonymous client credentials for proxy connections */
+        gnutls_credentials_set(ctxt->session, GNUTLS_CRD_ANON,
+                               ctxt->sc->anon_client_creds);
+        /* Set x509 credentials */
+        gnutls_credentials_set(ctxt->session, GNUTLS_CRD_CERTIFICATE,
+                               ctxt->sc->certs);
+        /* Load priorities from the server configuration */
+        err = gnutls_priority_set(ctxt->session, ctxt->sc->priorities);
+        if (err != GNUTLS_E_SUCCESS)
+            ap_log_cerror(APLOG_MARK, APLOG_ERR, err, c,
+                          "%s: setting priorities for proxy connection failed: %s (%d)",
+                          __func__, gnutls_strerror(err), err);
+    }
+
     /* Initialize Session Cache */
     mgs_cache_session_init(ctxt);