Changeset f030883 in mod_gnutls

Timestamp:

Apr 9, 2015, 1:02:39 PM (6 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

asyncio, debian/master, debian/stretch-backports, jessie-backports, master, proxy-ticket, upstream

Children:

73f6f12

Parents:

8b472af

Message:

Set GnuTLS priorities for proxy connections separately

Until now, proxy connections were configured with the same priorities as
the server side. This commit introduces the new configuration option
"GnuTLSProxyPriorities" to set the priorities for proxy connections
separately. Note that GnuTLSProxyPriorities MUST be set when
SSLProxyEngine is enabled.

Since the parameters to GnuTLSPriorities and GnuTLSProxyPriorities need
the same processing, mgs_set_priorities has been rewritten to select the
priority cache to write to based on the option name, rather than adding
a new function to handle GnuTLSProxyPriorities.

Files:

• docs/mod_gnutls_manual.mdwn (modified) (1 diff)
• include/mod_gnutls.h.in (modified) (1 diff)
• src/gnutls_config.c (modified) (3 diffs)
• src/gnutls_hooks.c (modified) (2 diffs)
• src/mod_gnutls.c (modified) (1 diff)
• test/Makefile.am (modified) (1 diff)
• test/test-23_TLS_reverse_proxy_mismatched_priorities.bash (added)
• test/tests/19_TLS_reverse_proxy/apache.conf (modified) (1 diff)
• test/tests/20_TLS_reverse_proxy_client_auth/apache.conf (modified) (1 diff)
• test/tests/21_TLS_reverse_proxy_wrong_cert/apache.conf (modified) (1 diff)
• test/tests/22_TLS_reverse_proxy_crl_revoke/apache.conf (modified) (1 diff)
• test/tests/23_TLS_reverse_proxy_mismatched_priorities/apache.conf (added)
• test/tests/23_TLS_reverse_proxy_mismatched_priorities/backend.conf (added)
• test/tests/23_TLS_reverse_proxy_mismatched_priorities/gnutls-cli.args (added)
• test/tests/23_TLS_reverse_proxy_mismatched_priorities/input (added)
• test/tests/23_TLS_reverse_proxy_mismatched_priorities/output (added)

docs/mod_gnutls_manual.mdwn

@@ -480 +480 @@
 running as root, and does not need to be readable by the nobody or
 apache user.
+
+`GnuTLSProxyPriorities`
+------------------
+
+Set the allowed ciphers, key exchange algorithms, MACs and compression
+methods for proxy connections
+
+    GnuTLSProxyPriorities NORMAL:+CIPHER_0:+CIPHER_1:...:+CIPHER_N
+
+Default: *none*\
+Context: server config, virtual host
+
+This option is used to set the allowed ciphers, key exchange
+algorithms, MACs and compression methods for proxy connections. It
+takes the same parameters as `GnuTLSPriorities`. Required if
+`SSLProxyEngine` is `On`.
 
 * * * * *

include/mod_gnutls.h.in

@@ -114 +114 @@
     const char* proxy_x509_ca_file;
     const char* proxy_x509_crl_file;
+    /* GnuTLS priorities for proxy connections */
+    gnutls_priority_t proxy_priorities;
     /* SRP Certificate Structure*/
     gnutls_srp_server_credentials_t srp_creds;

src/gnutls_config.c

@@ -578 +578 @@
 }
 
-const char *mgs_set_priorities(cmd_parms * parms, void *dummy __attribute__((unused)), const char *arg) {
-
-        int ret;
+
+
+/*
+ * Initialize a GnuTLS priorities cache from a configuration
+ * string. Used for GnuTLSPriorities and GnuTLSProxyPriorities.
+ */
+const char *mgs_set_priorities(cmd_parms * parms,
+                               void *dummy __attribute__((unused)),
+                               const char *arg)
+{
+    int ret;
     const char *err;
 
     mgs_srvconf_rec *sc = (mgs_srvconf_rec *)
-                                                  ap_get_module_config(parms->server->module_config, &gnutls_module);
-
-    ret = gnutls_priority_init(&sc->priorities, arg, &err);
-
-    if (ret < 0) {
-        if (ret == GNUTLS_E_INVALID_REQUEST) {
+        ap_get_module_config(parms->server->module_config, &gnutls_module);
+
+    /* Setting a priority cache works the same no matter for which
+     * option. Just point the pointer at the right one. */
+    gnutls_priority_t *prio = NULL;
+    if (!strcasecmp(parms->directive->directive, "GnuTLSPriorities"))
+        prio = &sc->priorities;
+    else if (!strcasecmp(parms->directive->directive, "GnuTLSProxyPriorities"))
+        prio = &sc->proxy_priorities;
+    else
+        /* Can't happen unless there's a serious bug in mod_gnutls or Apache */
+        return apr_psprintf(parms->pool,
+                            "mod_gnutls: %s called for invalid option '%s'",
+                            __func__, parms->directive->directive);
+
+    ret = gnutls_priority_init(prio, arg, &err);
+    if (ret < 0)
+    {
+        if (ret == GNUTLS_E_INVALID_REQUEST)
             return apr_psprintf(parms->pool,
-                                                                "GnuTLS: Syntax error parsing priorities string at: %s", err);
-                }
-        return "Error setting priorities";
+                                "mod_gnutls: Syntax error parsing priorities "
+                                "string for %s at: %s",
+                                parms->directive->directive, err);
+        return  apr_psprintf(parms->pool,
+                             "Error setting priorities: %s (%d)",
+                             gnutls_strerror(ret), ret);
     }
 
@@ -636 +660 @@
     sc->proxy_x509_ca_file = NULL;
     sc->proxy_x509_crl_file = NULL;
+    sc->proxy_priorities = NULL;
     ret = gnutls_certificate_allocate_credentials(&sc->proxy_x509_creds);
     if (ret < 0)
@@ -716 +741 @@
     gnutls_srvconf_merge(proxy_x509_ca_file, NULL);
     gnutls_srvconf_merge(proxy_x509_crl_file, NULL);
+    gnutls_srvconf_merge(proxy_priorities, NULL);
 
     /* FIXME: the following items are pre-allocated, and should be

src/gnutls_hooks.c

@@ -463 +463 @@
             && sc->proxy_enabled == GNUTLS_ENABLED_TRUE)
         {
+            /* Check if the proxy priorities have been set */
+            if (sc->proxy_priorities == NULL)
+            {
+                ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,
+                             "Host '%s:%d' is missing the "
+                             "GnuTLSProxyPriorities directive!",
+                             s->server_hostname, s->port);
+                exit(-1);
+            }
+            /* Set up proxy credentials */
             load_proxy_x509_credentials(s);
         }
@@ -826 +836 @@
                                ctxt->sc->proxy_x509_creds);
         /* Load priorities from the server configuration */
-        err = gnutls_priority_set(ctxt->session, ctxt->sc->priorities);
+        err = gnutls_priority_set(ctxt->session, ctxt->sc->proxy_priorities);
         if (err != GNUTLS_E_SUCCESS)
             ap_log_cerror(APLOG_MARK, APLOG_ERR, err, c,
-                          "%s: setting priorities for proxy connection failed: %s (%d)",
+                          "%s: setting priorities for proxy connection "
+                          "failed: %s (%d)",
                           __func__, gnutls_strerror(err), err);
     }

src/mod_gnutls.c

@@ -240 +240 @@
     RSRC_CONF,
     "X509 CRL file for proxy connections"),
+    AP_INIT_RAW_ARGS("GnuTLSProxyPriorities", mgs_set_priorities,
+    NULL,
+    RSRC_CONF,
+    "The priorities to enable for proxy connections (ciphers, key exchange, "
+    "MACs, compression)."),
     { NULL },
 };

test/Makefile.am

@@ -23 +23 @@
         test-20_TLS_reverse_proxy_client_auth.bash \
         test-21_TLS_reverse_proxy_wrong_cert.bash \
-        test-22_TLS_reverse_proxy_crl_revoke.bash
+        test-22_TLS_reverse_proxy_crl_revoke.bash \
+        test-23_TLS_reverse_proxy_mismatched_priorities.bash
 
 clean-local:

test/tests/19_TLS_reverse_proxy/apache.conf

@@ -15 +15 @@
  SSLProxyEngine On
  GnuTLSProxyCAFile      authority/x509.pem
+ GnuTLSProxyPriorities          NORMAL
  ProxyPass /proxy/ https://${BACKEND_HOST}:${BACKEND_PORT}/
  ProxyPassReverse /proxy/ https://${BACKEND_HOST}:${BACKEND_PORT}/

test/tests/20_TLS_reverse_proxy_client_auth/apache.conf

@@ -17 +17 @@
  GnuTLSProxyCertificateFile     client/x509.pem
  GnuTLSProxyCAFile              authority/x509.pem
+ GnuTLSProxyPriorities          NORMAL
  ProxyPass /proxy/ https://${BACKEND_HOST}:${BACKEND_PORT}/
  ProxyPassReverse /proxy/ https://${BACKEND_HOST}:${BACKEND_PORT}/

test/tests/21_TLS_reverse_proxy_wrong_cert/apache.conf

@@ -15 +15 @@
  SSLProxyEngine On
  GnuTLSProxyCAFile      authority/x509.pem
+ GnuTLSProxyPriorities  NORMAL
  ProxyPass /proxy/ https://${BACKEND_HOST}:${BACKEND_PORT}/
  ProxyPassReverse /proxy/ https://${BACKEND_HOST}:${BACKEND_PORT}/

test/tests/22_TLS_reverse_proxy_crl_revoke/apache.conf

@@ -16 +16 @@
  GnuTLSProxyCAFile      authority/x509.pem
  GnuTLSProxyCRLFile     ${PWD}/crl.pem
+ GnuTLSProxyPriorities  NORMAL
  ProxyPass /proxy/ https://${BACKEND_HOST}:${BACKEND_PORT}/
  ProxyPassReverse /proxy/ https://${BACKEND_HOST}:${BACKEND_PORT}/