Changeset e809fb3 in mod_gnutls for src

Timestamp:

Jun 9, 2016, 7:52:23 PM (3 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, master, upstream

Children:

aa68232

Parents:

3e22b82

Message:

Use generic cache functions for OCSP response caching

With this, OCSP stapling works with all supported cache types.

Location:

src

Files:

• gnutls_cache.c (modified) (5 diffs)
• gnutls_cache.h (modified) (1 diff)
• gnutls_config.c (modified) (1 diff)
• gnutls_hooks.c (modified) (1 diff)
• gnutls_ocsp.c (modified) (5 diffs)

src/gnutls_cache.c

@@ -240 +240 @@
 }
 
-int mc_cache_store_generic(server_rec *s, gnutls_datum_t key,
-                           gnutls_datum_t data, apr_time_t expiry)
+static int mc_cache_store_generic(server_rec *s, gnutls_datum_t key,
+                                  gnutls_datum_t data, apr_time_t expiry)
 {
     apr_uint32_t timeout = apr_time_sec(expiry - apr_time_now());
@@ -307 +307 @@
 }
 
-gnutls_datum_t mc_cache_fetch_generic(mgs_handle_t *ctxt, gnutls_datum_t key)
+static gnutls_datum_t mc_cache_fetch_generic(mgs_handle_t *ctxt,
+                                             gnutls_datum_t key)
 {
     gnutls_datum_t data = {NULL, 0};
@@ -434 +435 @@
 }
 
-gnutls_datum_t dbm_cache_fetch(mgs_handle_t *ctxt, gnutls_datum_t key)
+static gnutls_datum_t dbm_cache_fetch(mgs_handle_t *ctxt, gnutls_datum_t key)
 {
     gnutls_datum_t data = {NULL, 0};
@@ -512 +513 @@
 }
 
-int dbm_cache_store(server_rec *s, gnutls_datum_t key,
-                    gnutls_datum_t data, apr_time_t expiry)
+static int dbm_cache_store(server_rec *s, gnutls_datum_t key,
+                           gnutls_datum_t data, apr_time_t expiry)
 {
     mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
@@ -696 +697 @@
     }
 
-    if (sc->cache_type == mgs_cache_dbm
-            || sc->cache_type == mgs_cache_gdbm) {
+    sc->cache = apr_palloc(p, sizeof(struct mgs_cache));
+    if (sc->cache_type == mgs_cache_dbm || sc->cache_type == mgs_cache_gdbm)
+    {
+        sc->cache->store = dbm_cache_store;
+        sc->cache->fetch = dbm_cache_fetch;
         return dbm_cache_post_config(p, s, sc);
     }
+#if HAVE_APR_MEMCACHE
+    else if (sc->cache_type == mgs_cache_memcache)
+    {
+        sc->cache->store = mc_cache_store_generic;
+        sc->cache->fetch = mc_cache_fetch_generic;
+    }
+#endif
 
     return APR_SUCCESS;

src/gnutls_cache.h

@@ -52 +52 @@
 
 /*
- * EXPERIMENTAL: Make DBM cache available for OCSP caching. To be
- * replaced with properly configurable caching that can also use
- * memcached later.
+ * Generic object cache functions, used for OCSP caching
  */
-#include <apr_dbm.h>
-int dbm_cache_store(server_rec *s, gnutls_datum_t key,
-                    gnutls_datum_t data, apr_time_t expiry);
-gnutls_datum_t dbm_cache_fetch(mgs_handle_t *ctxt, gnutls_datum_t key);
-int mc_cache_store_generic(server_rec *s, gnutls_datum_t key,
-                           gnutls_datum_t data, apr_time_t expiry);
-gnutls_datum_t mc_cache_fetch_generic(mgs_handle_t *ctxt, gnutls_datum_t key);
+typedef int (*cache_store_func)(server_rec *s, gnutls_datum_t key,
+                                gnutls_datum_t data, apr_time_t expiry);
+typedef gnutls_datum_t (*cache_fetch_func)(mgs_handle_t *ctxt,
+                                           gnutls_datum_t key);
+struct mgs_cache {
+    cache_store_func store;
+    cache_fetch_func fetch;
+};
 
 #endif /** __MOD_GNUTLS_CACHE_H__ */

src/gnutls_config.c

@@ -965 +965 @@
     sc->cache_config = NULL;
     sc->cache_mutex = NULL;
+    sc->cache = NULL;
     sc->tickets = GNUTLS_ENABLED_UNSET;
     sc->priorities = NULL;

src/gnutls_hooks.c

@@ -376 +376 @@
         sc->cache_timeout = sc_base->cache_timeout;
         sc->cache_mutex = sc_base->cache_mutex;
+        sc->cache = sc_base->cache;
 
         rv = mgs_load_files(pconf, s);

src/gnutls_ocsp.c

@@ -325 +325 @@
         ap_get_module_config(s->module_config, &gnutls_module);
 
-    if (sc->cache_type != mgs_cache_dbm && sc->cache_type != mgs_cache_gdbm)
-    {
-        /* experimental OCSP cache requires DBM cache */
+    if (sc->cache == NULL)
+    {
+        /* OCSP caching requires a cache. */
         return APR_ENOTIMPL;
     }
@@ -400 +400 @@
         expiry -= sc->ocsp_grace_time;
 
-    int r = dbm_cache_store(s, fingerprint, resp, expiry);
+    int r = sc->cache->store(s, fingerprint, resp, expiry);
     /* destroy pool, and original copy of the OCSP response with it */
     apr_pool_destroy(tmp);
@@ -419 +419 @@
 {
     mgs_handle_t *ctxt = (mgs_handle_t *) ptr;
+    if (ctxt->sc->cache == NULL)
+    {
+        /* OCSP caching requires a cache. */
+        return GNUTLS_E_NO_CERTIFICATE_STATUS;
+    }
 
     gnutls_datum_t fingerprint =
@@ -426 +431 @@
         return GNUTLS_E_NO_CERTIFICATE_STATUS;
 
-    *ocsp_response = dbm_cache_fetch(ctxt, fingerprint);
+    *ocsp_response = ctxt->sc->cache->fetch(ctxt, fingerprint);
     if (ocsp_response->size == 0)
     {
@@ -454 +459 @@
 
     /* retry reading from cache */
-    *ocsp_response = dbm_cache_fetch(ctxt, fingerprint);
+    *ocsp_response = ctxt->sc->cache->fetch(ctxt, fingerprint);
     if (ocsp_response->size == 0)
     {