Changeset e7cf823 in mod_gnutls

Timestamp:

Apr 10, 2018, 12:18:26 PM (5 years ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

asyncio, debian/master, debian/stretch-backports, main, master, proxy-ticket, upstream

Children:

2f10643

Parents:

4cdd4fd

Message:

Add process_connection hook, adjust hook order for mod_http2 compatibility

The TLS handshake must have happened before the mod_http2
process_connection hook runs, which means we have to trigger it
explicitly before any reads happen. Some other hooks must have a
certain order relative to mod_http2 as well.

Files:

• include/mod_gnutls.h.in (modified) (1 diff)
• src/gnutls_hooks.c (modified) (1 diff)
• src/mod_gnutls.c (modified) (2 diffs)

include/mod_gnutls.h.in

@@ -470 +470 @@
 int mgs_hook_pre_connection(conn_rec * c, void *csd);
 
+int mgs_hook_process_connection(conn_rec* c);
+
 int mgs_hook_fixups(request_rec *r);
 

src/gnutls_hooks.c

@@ -1076 +1076 @@
 }
 
+
+
+/**
+ * process_connection hook: Do a zero byte read to trigger the
+ * handshake. Doesn't change anything for traditional protocols that
+ * just do reads, but HTTP/2 needs the TLS handshake and ALPN to
+ * happen before its process_connection hook runs.
+ */
+int mgs_hook_process_connection(conn_rec* c)
+{
+    mgs_handle_t *ctxt = (mgs_handle_t *)
+        ap_get_module_config(c->conn_config, &gnutls_module);
+
+    if ((ctxt != NULL) && (ctxt->enabled == GNUTLS_ENABLED_TRUE))
+    {
+        /* This connection is supposed to use TLS. Give the filters a
+         * kick with a zero byte read to trigger the handshake. */
+        apr_bucket_brigade* temp =
+            apr_brigade_create(c->pool, c->bucket_alloc);
+        ap_get_brigade(c->input_filters, temp,
+                       AP_MODE_INIT, APR_BLOCK_READ, 0);
+        apr_brigade_destroy(temp);
+    }
+    return DECLINED;
+}
+
+
+
 int mgs_hook_fixups(request_rec * r) {
     unsigned char sbuf[GNUTLS_MAX_SESSION_ID];

src/mod_gnutls.c

@@ -30 +30 @@
                    int proxy, int enable);
 
+static const char * const mod_proxy[] = { "mod_proxy.c", NULL };
+static const char * const mod_http2[] = { "mod_http2.c", NULL };
+
 static void gnutls_hooks(apr_pool_t * p __attribute__((unused)))
 {
     /* Try Run Post-Config Hook After mod_proxy */
-    static const char * const aszPre[] = { "mod_proxy.c", NULL };
-    ap_hook_post_config(mgs_hook_post_config, aszPre, NULL,
-                        APR_HOOK_REALLY_LAST);
+    ap_hook_post_config(mgs_hook_post_config, mod_proxy, mod_http2,
+                        APR_HOOK_MIDDLE);
     /* HTTP Scheme Hook */
     ap_hook_http_scheme(mgs_hook_http_scheme, NULL, NULL, APR_HOOK_MIDDLE);
@@ -41 +43 @@
     ap_hook_default_port(mgs_hook_default_port, NULL, NULL, APR_HOOK_MIDDLE);
     /* Pre-Connect Hook */
-    ap_hook_pre_connection(mgs_hook_pre_connection, NULL, NULL,
+    ap_hook_pre_connection(mgs_hook_pre_connection, mod_http2, NULL,
                            APR_HOOK_MIDDLE);
+    ap_hook_process_connection(mgs_hook_process_connection,
+                               NULL, mod_http2, APR_HOOK_MIDDLE);
     /* Pre-Config Hook */
     ap_hook_pre_config(mgs_hook_pre_config, NULL, NULL,