Changeset c4a015b in mod_gnutls for src

Timestamp:

Apr 4, 2015, 5:03:43 PM (5 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, jessie-backports, master, upstream

Children:

01b5d85

Parents:

259e835 (diff), 9a06bbd (diff)
Note: this is a merge changeset, the changes displayed below correspond to the merge itself.
Use the (diff) links above to see all the changes relative to each parent.

Message:

Merge branch 'split-testsuite' into new-gnutls-api

OpenPGP support is still broken, but this will make testing a lot
easier.

Location:

src

Files:

• gnutls_hooks.c (modified) (5 diffs)
• mod_gnutls.c (modified) (3 diffs)

src/gnutls_hooks.c

@@ -632 +632 @@
 }
 
-static void create_gnutls_handle(conn_rec * c) {
-    mgs_handle_t *ctxt;
-    /* Get mod_gnutls Configuration Record */
-    mgs_srvconf_rec *sc =(mgs_srvconf_rec *)
-            ap_get_module_config(c->base_server->module_config,&gnutls_module);
-
-    _gnutls_log(debug_log_fp, "%s: %d\n", __func__, __LINE__);
-    ctxt = apr_pcalloc(c->pool, sizeof (*ctxt));
+static void create_gnutls_handle(conn_rec * c)
+{
+    /* Get mod_gnutls server configuration */
+    mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
+            ap_get_module_config(c->base_server->module_config, &gnutls_module);
+
+    _gnutls_log(debug_log_fp, "%s: %d\n", __func__, __LINE__);
+
+    /* Get connection specific configuration */
+    mgs_handle_t *ctxt = (mgs_handle_t *) ap_get_module_config(c->conn_config, &gnutls_module);
+    if (ctxt == NULL)
+    {
+        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, "%s: allocating connection memory", __func__);
+        ctxt = apr_pcalloc(c->pool, sizeof (*ctxt));
+        ap_set_module_config(c->conn_config, &gnutls_module, ctxt);
+    }
+    ctxt->enabled = GNUTLS_ENABLED_TRUE;
     ctxt->c = c;
     ctxt->sc = sc;
@@ -650 +659 @@
     ctxt->output_blen = 0;
     ctxt->output_length = 0;
+
     /* Initialize GnuTLS Library */
-    gnutls_init(&ctxt->session, GNUTLS_SERVER);
+    int err = gnutls_init(&ctxt->session, GNUTLS_SERVER);
+    if (err != GNUTLS_E_SUCCESS)
+        ap_log_cerror(APLOG_MARK, APLOG_ERR, err, c, "gnutls_init failed!");
     /* Initialize Session Tickets */
     if (session_ticket_key.data != NULL && ctxt->sc->tickets != 0) {
-        gnutls_session_ticket_enable_server(ctxt->session,&session_ticket_key);
+        err = gnutls_session_ticket_enable_server(ctxt->session, &session_ticket_key);
+        if (err != GNUTLS_E_SUCCESS)
+            ap_log_cerror(APLOG_MARK, APLOG_ERR, err, c, "gnutls_session_ticket_enable_server failed!");
     }
 
     /* Set Default Priority */
-        gnutls_priority_set_direct (ctxt->session, "NORMAL", NULL);
+        err = gnutls_priority_set_direct(ctxt->session, "NORMAL", NULL);
+    if (err != GNUTLS_E_SUCCESS)
+        ap_log_cerror(APLOG_MARK, APLOG_ERR, err, c, "gnutls_priority_set_direct failed!");
     /* Set Handshake function */
     gnutls_handshake_set_post_client_hello_function(ctxt->session,
@@ -665 +681 @@
     mgs_cache_session_init(ctxt);
 
-    /* Set this config for this connection */
-    ap_set_module_config(c->conn_config, &gnutls_module, ctxt);
     /* Set pull, push & ptr functions */
     gnutls_transport_set_pull_function(ctxt->session,
@@ -680 +694 @@
 }
 
-int mgs_hook_pre_connection(conn_rec * c, void *csd __attribute__((unused))) {
-    mgs_srvconf_rec *sc;
-
-    _gnutls_log(debug_log_fp, "%s: %d\n", __func__, __LINE__);
-
-    sc = (mgs_srvconf_rec *) ap_get_module_config(c->base_server->module_config,
-            &gnutls_module);
-
-    if (sc && (!sc->enabled || sc->proxy_enabled == GNUTLS_ENABLED_TRUE)) {
+int mgs_hook_pre_connection(conn_rec * c, void *csd __attribute__((unused)))
+{
+    _gnutls_log(debug_log_fp, "%s: %d\n", __func__, __LINE__);
+
+    mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
+        ap_get_module_config(c->base_server->module_config, &gnutls_module);
+    mgs_handle_t *ctxt = (mgs_handle_t *)
+        ap_get_module_config(c->conn_config, &gnutls_module);
+
+    if ((sc && (!sc->enabled || sc->proxy_enabled == GNUTLS_ENABLED_TRUE))
+        || (ctxt && ctxt->enabled == GNUTLS_ENABLED_FALSE))
+    {
+        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, "%s declined connection",
+                      __func__);
         return DECLINED;
     }
@@ -710 +729 @@
     apr_table_t *env = r->subprocess_env;
 
-    ctxt =
-            ap_get_module_config(r->connection->conn_config,
-            &gnutls_module);
-
-    if (!ctxt || ctxt->session == NULL) {
+    ctxt = ap_get_module_config(r->connection->conn_config,
+                                &gnutls_module);
+
+    if (!ctxt || ctxt->enabled != GNUTLS_ENABLED_TRUE || ctxt->session == NULL)
+    {
+        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, "request declined in %s", __func__);
         return DECLINED;
     }

src/mod_gnutls.c

@@ -20 +20 @@
 #include "mod_gnutls.h"
 
-static void gnutls_hooks(apr_pool_t * p __attribute__((unused))) {
-
+#ifdef APLOG_USE_MODULE
+APLOG_USE_MODULE(gnutls);
+#endif
+
+static void gnutls_hooks(apr_pool_t * p __attribute__((unused)))
+{
     /* Try Run Post-Config Hook After mod_proxy */
     static const char * const aszPre[] = { "mod_proxy.c", NULL };
@@ -75 +79 @@
 }
 
-int ssl_engine_disable(conn_rec *c) {
+int ssl_engine_disable(conn_rec *c)
+{
     mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
-            ap_get_module_config(c->base_server->module_config, &gnutls_module);
+        ap_get_module_config(c->base_server->module_config, &gnutls_module);
     if(sc->enabled == GNUTLS_ENABLED_FALSE) {
         return 1;
     }
-    ap_remove_input_filter(c->input_filters);
-    ap_remove_input_filter(c->output_filters);
-    mgs_cleanup_pre_config(c->pool);
-    sc->enabled = 0;
+
+    /* disable TLS for this connection */
+    mgs_handle_t *ctxt = (mgs_handle_t *) ap_get_module_config(c->conn_config, &gnutls_module);
+    if (ctxt == NULL)
+    {
+        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, 0, c, "%s: allocating connection memory", __func__);
+        ctxt = apr_pcalloc(c->pool, sizeof (*ctxt));
+        ap_set_module_config(c->conn_config, &gnutls_module, ctxt);
+    }
+    ctxt->enabled = GNUTLS_ENABLED_FALSE;
+
+    if (c->input_filters)
+        ap_remove_input_filter(c->input_filters);
+    if (c->output_filters)
+        ap_remove_output_filter(c->output_filters);
+
     return 1;
 }
@@ -91 +108 @@
     mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
             ap_get_module_config(c->base_server->module_config, &gnutls_module);
-    sc->proxy_enabled = 1;
-    sc->enabled = 0;
+    sc->proxy_enabled = GNUTLS_ENABLED_TRUE;
+    sc->enabled = GNUTLS_ENABLED_FALSE;
     return 1;
 }