Changeset f450ac9 in mod_gnutls

Timestamp:

Jun 9, 2016, 2:50:43 PM (3 years ago)

Author:

Thomas Klute <thomas2.klute@…>

Branches:

debian/master, debian/stretch-backports, master, upstream

Children:

70a1e5a

Parents:

d18afb8

git-author:

Thomas Klute <thomas2.klute@…> (06/09/16 14:36:10)

git-committer:

Thomas Klute <thomas2.klute@…> (06/09/16 14:50:43)

Message:

Replace mgs_session_id2sz() with apr_(p?)escape_hex()

There's no need to carry a local bin-to-hex function if APR already
provides a converter. Using integrated pool allocation even avoids a
few string copies in gnutls_hooks.c.

The session hex buffers in gnutls_cache.c don't need room for the
memcache tag because it is added in a apr_psprintf() call if
necessary, so we can save a few bytes of stack space there.

Location:

src

Files:

• gnutls_cache.c (modified) (5 diffs)
• gnutls_cache.h (modified) (1 diff)
• gnutls_hooks.c (modified) (5 diffs)

src/gnutls_cache.c

@@ -27 +27 @@
 
 #include "apr_dbm.h"
+#include <apr_escape.h>
 
 #include "ap_mpm.h"
@@ -44 +45 @@
  */
 #define MC_TAG "mod_gnutls:"
-#define MC_TAG_LEN sizeof(MC_TAG)
-#define STR_SESSION_LEN (GNUTLS_SESSION_ID_STRING_LEN + MC_TAG_LEN)
+/* two characters per byte, plus one more for '\0' */
+#define GNUTLS_SESSION_ID_STRING_LEN ((GNUTLS_MAX_SESSION_ID_SIZE * 2) + 1)
 
 #if MODULE_MAGIC_NUMBER_MAJOR < 20081201
@@ -54 +55 @@
 APLOG_USE_MODULE(gnutls);
 #endif
-
-char *mgs_session_id2sz(unsigned char *id, int idlen,
-        char *str, int strsize) {
-    char *cp;
-    int n;
-
-    cp = str;
-    for (n = 0; n < idlen && n < GNUTLS_MAX_SESSION_ID; n++) {
-        apr_snprintf(cp, strsize - (cp - str), "%02X", id[n]);
-        cp += 2;
-    }
-    *cp = '\0';
-    return str;
-}
 
 /* Name the Session ID as:
@@ -76 +63 @@
                               gnutls_datum_t *dbmkey)
 {
-    char buf[STR_SESSION_LEN];
-    char *sz;
-
-    sz = mgs_session_id2sz(id, idlen, buf, sizeof (buf));
-    if (sz == NULL)
+    char sz[GNUTLS_SESSION_ID_STRING_LEN];
+    apr_status_t rv = apr_escape_hex(sz, id, idlen, 0, NULL);
+    if (rv != APR_SUCCESS)
         return -1;
 
@@ -113 +98 @@
  * to disallow resuming sessions on different servers
  */
-static char *mgs_session_id2mc(conn_rec * c, unsigned char *id, int idlen) {
-    char buf[STR_SESSION_LEN];
-    char *sz;
-
-    sz = mgs_session_id2sz(id, idlen, buf, sizeof (buf));
-    if (sz == NULL)
+static char *mgs_session_id2mc(conn_rec * c, unsigned char *id, int idlen)
+{
+    char sz[GNUTLS_SESSION_ID_STRING_LEN];
+    apr_status_t rv = apr_escape_hex(sz, id, idlen, 0, NULL);
+    if (rv != APR_SUCCESS)
         return NULL;
 

src/gnutls_cache.h

@@ -41 +41 @@
 int mgs_cache_session_init(mgs_handle_t *ctxt);
 
-#define GNUTLS_SESSION_ID_STRING_LEN \
-    ((GNUTLS_MAX_SESSION_ID + 1) * 2)
 
-
-
-/**
- * Convert a SSL Session ID into a Null Terminated Hex Encoded String
- * @param id raw SSL Session ID
- * @param idlen Length of the raw Session ID
- * @param str Location to store the Hex Encoded String
- * @param strsize The Maximum Length that can be stored in str
- */
-char *mgs_session_id2sz(unsigned char *id, int idlen, char *str, int strsize);
 
 /**

src/gnutls_hooks.c

@@ -27 +27 @@
 #include "mod_status.h"
 #include <util_mutex.h>
+#include <apr_escape.h>
 
 #ifdef ENABLE_MSVA
@@ -893 +894 @@
 int mgs_hook_fixups(request_rec * r) {
     unsigned char sbuf[GNUTLS_MAX_SESSION_ID];
-    char buf[AP_IOBUFSIZE];
     const char *tmp;
     size_t len;
@@ -963 +963 @@
     len = sizeof (sbuf);
     gnutls_session_get_id(ctxt->session, sbuf, &len);
-    tmp = mgs_session_id2sz(sbuf, len, buf, sizeof (buf));
-    apr_table_setn(env, "SSL_SESSION_ID", apr_pstrdup(r->pool, tmp));
+    apr_table_setn(env, "SSL_SESSION_ID",
+                   apr_pescape_hex(r->pool, sbuf, len, 0));
 
     if (gnutls_certificate_type_get(ctxt->session) == GNUTLS_CRT_X509) {
@@ -1099 +1099 @@
     len = sizeof (sbuf);
     gnutls_x509_crt_get_serial(cert, sbuf, &len);
-    tmp = mgs_session_id2sz(sbuf, len, buf, sizeof (buf));
-    apr_table_setn(env, MGS_SIDE("_M_SERIAL"), apr_pstrdup(r->pool, tmp));
+    apr_table_setn(env, MGS_SIDE("_M_SERIAL"),
+                   apr_pescape_hex(r->pool, sbuf, len, 0));
 
     ret = gnutls_x509_crt_get_version(cert);
@@ -1216 +1216 @@
     len = sizeof (sbuf);
     gnutls_openpgp_crt_get_fingerprint(cert, sbuf, &len);
-    tmp = mgs_session_id2sz(sbuf, len, buf, sizeof (buf));
-    apr_table_setn(env, MGS_SIDE("_FINGERPRINT"), apr_pstrdup(r->pool, tmp));
+    apr_table_setn(env, MGS_SIDE("_FINGERPRINT"),
+                   apr_pescape_hex(r->pool, sbuf, len, 0));
 
     ret = gnutls_openpgp_crt_get_version(cert);