Changeset c39ae1a in mod_gnutls

Timestamp:

Oct 30, 2016, 5:43:03 PM (3 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, master, upstream

Children:

3475e62

Parents:

0cd8f3d

Message:

Initialize OCSP timeouts with an "unset" value

The configuration merge function used the default timeout to check if
an OCSP related timeout has been set in a virtual host
configuration. This would work most of the time, but break in the
corner case of the global configuration setting a non-default timeout
and a virtual host configuration restoring the default. In this
situation the merge would handle the value from the virtual host
configuration as unset and copy the global timeout.

The problem is solved by initializing the timeouts using the new macro
MGS_TIMEOUT_UNSET. Timeouts as used in the mod_gnutls configuration
cannot be negative, so there is ample room for explicitly unset
values. MGS_TIMEOUT_UNSET is also used for the session cache timeout
instead of hard coded -1.

Location:

src

Files:

• Makefile.am (modified) (1 diff)
• gnutls_cache.c (modified) (2 diffs)
• gnutls_config.c (modified) (5 diffs)
• gnutls_config.h (added)
• gnutls_ocsp.c (modified) (2 diffs)

src/Makefile.am

@@ -10 +10 @@
 mod_gnutls_la_CFLAGS = -Wall ${MODULE_CFLAGS}
 mod_gnutls_la_LDFLAGS = -module -avoid-version ${MODULE_LIBS}
-noinst_HEADERS = gnutls_cache.h gnutls_ocsp.h gnutls_util.h
+noinst_HEADERS = gnutls_cache.h gnutls_config.h gnutls_ocsp.h gnutls_util.h
 
 apmodpkglib_LTLIBRARIES = mod_gnutls.la

src/gnutls_cache.c

@@ -45 +45 @@
 #include "gnutls_cache.h"
 #include "mod_gnutls.h"
+#include "gnutls_config.h"
 
 #if HAVE_APR_MEMCACHE
@@ -695 +696 @@
         sc->cache_type = mgs_cache_none;
     /* if GnuTLSCacheTimeout was never explicitly set: */
-    if (sc->cache_timeout == -1)
+    if (sc->cache_timeout == MGS_TIMEOUT_UNSET)
         sc->cache_timeout = apr_time_from_sec(MGS_DEFAULT_CACHE_TIMEOUT);
 

src/gnutls_config.c

@@ -19 +19 @@
  */
 
+#include "gnutls_config.h"
 #include "mod_gnutls.h"
 #include "gnutls_ocsp.h"
@@ -852 +853 @@
 {
     apr_int64_t argint = apr_atoi64(arg);
+    /* timeouts cannot be negative */
     if (argint < 0)
         return apr_psprintf(parms->pool, "%s: Invalid argument",
@@ -1101 +1103 @@
 
     sc->priorities_str = NULL;
-    sc->cache_timeout = -1;     /* -1 means "unset" */
+    sc->cache_timeout = MGS_TIMEOUT_UNSET;
     sc->cache_type = mgs_cache_unset;
     sc->cache_config = NULL;
@@ -1127 +1129 @@
     sc->ocsp_response_file = NULL;
     sc->ocsp_mutex = NULL;
-    sc->ocsp_grace_time = apr_time_from_sec(MGS_OCSP_GRACE_TIME);
-    sc->ocsp_failure_timeout = apr_time_from_sec(MGS_OCSP_FAILURE_TIMEOUT);
-    sc->ocsp_socket_timeout = apr_time_from_sec(MGS_OCSP_SOCKET_TIMEOUT);
+    sc->ocsp_grace_time = MGS_TIMEOUT_UNSET;
+    sc->ocsp_failure_timeout = MGS_TIMEOUT_UNSET;
+    sc->ocsp_socket_timeout = MGS_TIMEOUT_UNSET;
 
 /* this relies on GnuTLS never changing the gnutls_certificate_request_t enum to define -1 */
@@ -1189 +1191 @@
     gnutls_srvconf_merge(ocsp_staple, GNUTLS_ENABLED_UNSET);
     gnutls_srvconf_assign(ocsp_response_file);
-    gnutls_srvconf_merge(ocsp_grace_time,
-                         apr_time_from_sec(MGS_OCSP_GRACE_TIME));
-    gnutls_srvconf_merge(ocsp_failure_timeout,
-                         apr_time_from_sec(MGS_OCSP_FAILURE_TIMEOUT));
-    gnutls_srvconf_merge(ocsp_socket_timeout,
-                         apr_time_from_sec(MGS_OCSP_SOCKET_TIMEOUT));
+    gnutls_srvconf_merge(ocsp_grace_time, MGS_TIMEOUT_UNSET);
+    gnutls_srvconf_merge(ocsp_failure_timeout, MGS_TIMEOUT_UNSET);
+    gnutls_srvconf_merge(ocsp_socket_timeout, MGS_TIMEOUT_UNSET);
 
     gnutls_srvconf_assign(ca_list);

src/gnutls_ocsp.c

@@ -18 +18 @@
 #include "mod_gnutls.h"
 #include "gnutls_cache.h"
+#include "gnutls_config.h"
 #include "gnutls_util.h"
 
@@ -904 +905 @@
     }
 
+    /* set default values for unset timeouts */
+    if (sc->ocsp_grace_time == MGS_TIMEOUT_UNSET)
+        sc->ocsp_grace_time = apr_time_from_sec(MGS_OCSP_GRACE_TIME);
+    if (sc->ocsp_failure_timeout == MGS_TIMEOUT_UNSET)
+        sc->ocsp_failure_timeout = apr_time_from_sec(MGS_OCSP_FAILURE_TIMEOUT);
+    if (sc->ocsp_socket_timeout == MGS_TIMEOUT_UNSET)
+        sc->ocsp_socket_timeout = apr_time_from_sec(MGS_OCSP_SOCKET_TIMEOUT);
+
     sc->ocsp = apr_palloc(pconf, sizeof(struct mgs_ocsp_data));