Changeset de3fad3 in mod_gnutls

Timestamp:

Oct 24, 2018, 12:56:08 PM (14 months ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

debian/master, master

Children:

20c3f7b

Parents:

15368a4

Message:

Require handshake and request to use the same server

The new check prevents clients from establishing a TLS connection to
one virtual host and then requesting data from another. This is
particularly important for servers using TLS client authentication as
the only means of access control, because the server context for
certificate validation is selected based on the TLS connection.

Files:

• include/mod_gnutls.h.in (modified) (1 diff)
• src/gnutls_hooks.c (modified) (1 diff)
• src/mod_gnutls.c (modified) (1 diff)

include/mod_gnutls.h.in

@@ -431 +431 @@
 int mgs_hook_fixups(request_rec *r);
 
+/** Post request hook, checks if TLS connection and vhost match */
+int mgs_req_vhost_check(request_rec *r);
+
 int mgs_hook_authz(request_rec *r);
 

src/gnutls_hooks.c

@@ -1221 +1221 @@
 
 
+/* Post request hook, checks if TLS connection and vhost match */
+int mgs_req_vhost_check(request_rec *r)
+{
+    /* mod_gnutls server record for the request vhost */
+    mgs_srvconf_rec *r_sc = (mgs_srvconf_rec *)
+        ap_get_module_config(r->server->module_config, &gnutls_module);
+    mgs_handle_t *ctxt = get_effective_gnutls_ctxt(r->connection);
+
+    /* Nothing to check for non-TLS and outgoing proxy connections */
+    if (ctxt == NULL || !ctxt->enabled || ctxt->is_proxy)
+        return DECLINED;
+
+    if (ctxt->sc != r_sc)
+    {
+        ap_log_cerror(APLOG_MARK, APLOG_ERR, APR_SUCCESS, ctxt->c,
+                      "%s: Mismatch between handshake and request servers!",
+                      __func__);
+        return HTTP_MISDIRECTED_REQUEST;
+    }
+
+    return DECLINED;
+}
+
+
+
 int mgs_hook_fixups(request_rec * r) {
     unsigned char sbuf[GNUTLS_MAX_SESSION_ID];

src/mod_gnutls.c

@@ -68 +68 @@
     /* Fixups Hook */
     ap_hook_fixups(mgs_hook_fixups, NULL, NULL, APR_HOOK_REALLY_FIRST);
+
+    /* Request hook: Check if TLS connection and request host match */
+    ap_hook_post_read_request(mgs_req_vhost_check, NULL, NULL, APR_HOOK_MIDDLE);
 
     /* TODO: HTTP Upgrade Filter */