1 files changed, 52 insertions, 203 deletions

diff --git a/src/gnutls_hooks.c b/src/gnutls_hooks.c
index 26917b8..55a1120 100644
--- a/src/gnutls_hooks.c
+++ b/src/gnutls_hooks.c
@@ -36,10 +36,7 @@ static int mpm_is_threaded;
 
 static int mgs_cert_verify(request_rec * r, mgs_handle_t * ctxt);
 /* use side==0 for server and side==1 for client */
-static void mgs_add_common_cert_vars(request_rec * r, gnutls_x509_crt_t cert,
-                                     int side,
-                                     int export_certificates_enabled);
-static void mgs_add_common_pgpcert_vars(request_rec * r, gnutls_openpgp_crt_t cert,
+static void mgs_add_common_cert_vars(request_rec * r, gnutls_x509_crt cert,
                                      int side,
                                      int export_certificates_enabled);
 
@@ -71,23 +68,9 @@ int ret;
     mpm_is_threaded = 0;
 #endif
 
-    if (gnutls_check_version(LIBGNUTLS_VERSION)==NULL) {
-        fprintf(stderr, "gnutls_check_version() failed. Required: gnutls-%s Found: gnutls-%s\n", 
-          LIBGNUTLS_VERSION, gnutls_check_version(NULL));
-        return -3;
-    }
-
     ret = gnutls_global_init();
-    if (ret < 0) {
-        fprintf(stderr, "gnutls_global_init: %s\n", gnutls_strerror(ret));
-        return -3;
-    }
-
-    ret = gnutls_global_init_extra();
-    if (ret < 0) {
-        fprintf(stderr, "gnutls_global_init_extra: %s\n", gnutls_strerror(ret));
-        return -3;
-    }
+    if (ret < 0) /* FIXME: can we print here? */
+        exit(ret);
                                             
     apr_pool_cleanup_register(pconf, NULL, mgs_cleanup_pre_config,
                               apr_pool_cleanup_null);
@@ -99,18 +82,19 @@ int ret;
 
     gnutls_global_set_log_level(9);
     gnutls_global_set_log_function(gnutls_debug_log_all);
-    apr_file_printf(debug_log_fp, "gnutls: %s\n", gnutls_check_version(NULL));
 #endif
 
     return OK;
 }
 
+/* We don't support openpgp certificates, yet */
+const static int cert_type_prio[2] = { GNUTLS_CRT_X509, 0 };
+
 static int mgs_select_virtual_server_cb(gnutls_session_t session)
 {
     mgs_handle_t *ctxt;
     mgs_srvconf_rec *tsc;
     int ret;
-    int cprio[2];
 
     ctxt = gnutls_transport_get_ptr(session);
 
@@ -142,22 +126,13 @@ static int mgs_select_virtual_server_cb(gnutls_session_t session)
      * negotiation.
      */
     ret = gnutls_priority_set(session, ctxt->sc->priorities);
+    gnutls_certificate_type_set_priority(session, cert_type_prio);
+
+
     /* actually it shouldn't fail since we have checked at startup */
     if (ret < 0)
         return ret;
 
-    /* If both certificate types are not present disallow them from
-     * being negotiated.
-     */
-    if (ctxt->sc->certs_x509[0] != NULL && ctxt->sc->cert_pgp == NULL) {
-        cprio[0] = GNUTLS_CRT_X509;
-        cprio[1] = 0;
-        gnutls_certificate_type_set_priority( session, cprio);
-    } else if (ctxt->sc->cert_pgp != NULL && ctxt->sc->certs_x509[0]==NULL) {
-        cprio[0] = GNUTLS_CRT_OPENPGP;
-        cprio[1] = 0;
-        gnutls_certificate_type_set_priority( session, cprio);
-    }
 
     return 0;
 }
@@ -168,31 +143,15 @@ static int cert_retrieve_fn(gnutls_session_t session, gnutls_retr_st * ret)
 
     ctxt = gnutls_transport_get_ptr(session);
 
-    if (gnutls_certificate_type_get( session) == GNUTLS_CRT_X509) {
-        ret->type = GNUTLS_CRT_X509;
-        ret->ncerts = ctxt->sc->certs_x509_num;
-        ret->deinit_all = 0;
-
-        ret->cert.x509 = ctxt->sc->certs_x509;
-        ret->key.x509 = ctxt->sc->privkey_x509;
-        
-        return 0;
-    } else if (gnutls_certificate_type_get( session) == GNUTLS_CRT_OPENPGP) {
-        ret->type = GNUTLS_CRT_OPENPGP;
-        ret->ncerts = 1;
-        ret->deinit_all = 0;
-
-        ret->cert.pgp = ctxt->sc->cert_pgp;
-        ret->key.pgp = ctxt->sc->privkey_pgp;
-
-        return 0;
-    
-    }
+    ret->type = GNUTLS_CRT_X509;
+    ret->ncerts = ctxt->sc->certs_x509_num;
+    ret->deinit_all = 0;
 
-    return GNUTLS_E_INTERNAL_ERROR;
+    ret->cert.x509 = ctxt->sc->certs_x509;
+    ret->key.x509 = ctxt->sc->privkey_x509;
+    return 0;
 }
 
-/* 2048-bit group parameters from SRP specification */
 const char static_dh_params[] = "-----BEGIN DH PARAMETERS-----\n"
     "MIIBBwKCAQCsa9tBMkqam/Fm3l4TiVgvr3K2ZRmH7gf8MZKUPbVgUKNzKcu0oJnt\n"
     "gZPgdXdnoT3VIxKrSwMxDc1/SKnaBP1Q6Ag5ae23Z7DPYJUXmhY6s2YaBfvV+qro\n"
@@ -208,7 +167,7 @@ const char static_dh_params[] = "-----BEGIN DH PARAMETERS-----\n"
  * Returns negative on error.
  */
 static int read_crt_cn(server_rec * s, apr_pool_t * p,
-                       gnutls_x509_crt_t cert, char **cert_cn)
+                       gnutls_x509_crt cert, char **cert_cn)
 {
     int rv = 0, i;
     size_t data_len;
@@ -216,7 +175,6 @@ static int read_crt_cn(server_rec * s, apr_pool_t * p,
 
     *cert_cn = NULL;
 
-    data_len = 0;
     rv = gnutls_x509_crt_get_dn_by_oid(cert,
                                        GNUTLS_OID_X520_COMMON_NAME,
                                        0, 0, NULL, &data_len);
@@ -227,8 +185,8 @@ static int read_crt_cn(server_rec * s, apr_pool_t * p,
                                            GNUTLS_OID_X520_COMMON_NAME, 0,
                                            0, *cert_cn, &data_len);
     } else {                    /* No CN return subject alternative name */
-        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
-                     "No common name found in certificate for '%s:%d'. Looking for subject alternative name...",
+        ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
+                     "No common name found in certificate for '%s:%d'. Looking for subject alternative name.",
                      s->server_hostname, s->port);
         rv = 0;
         /* read subject alternative name */
@@ -256,33 +214,9 @@ static int read_crt_cn(server_rec * s, apr_pool_t * p,
     }
 
     return rv;
-}
-
-static int read_pgpcrt_cn(server_rec * s, apr_pool_t * p,
-                       gnutls_openpgp_crt_t cert, char **cert_cn)
-{
-    int rv = 0;
-    size_t data_len;
-
 
-    *cert_cn = NULL;
-
-    data_len = 0;
-    rv = gnutls_openpgp_crt_get_name(cert, 0, NULL, &data_len);
-
-    if (rv == GNUTLS_E_SHORT_MEMORY_BUFFER && data_len > 1) {
-        *cert_cn = apr_palloc(p, data_len);
-        rv = gnutls_openpgp_crt_get_name(cert, 0, *cert_cn, &data_len);
-    } else {                    /* No CN return subject alternative name */
-        ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,
-                     "No name found in PGP certificate for '%s:%d'.",
-                     s->server_hostname, s->port);
-    }
-
-    return rv;
 }
 
-
 int
 mgs_hook_post_config(apr_pool_t * p, apr_pool_t * plog,
                      apr_pool_t * ptemp, server_rec * base_server)
@@ -416,9 +350,6 @@ mgs_hook_post_config(apr_pool_t * p, apr_pool_t * plog,
 
             if (sc->enabled == GNUTLS_ENABLED_TRUE) {
                 rv = read_crt_cn(s, p, sc->certs_x509[0], &sc->cert_cn);
-                if (rv < 0 && sc->cert_pgp != NULL)  /* try openpgp certificate */
-                    rv = read_pgpcrt_cn(s, p, sc->cert_pgp, &sc->cert_cn);
-
                 if (rv < 0) {
                     ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,
                                  "[GnuTLS] - Cannot find a certificate for host '%s:%d'!",
@@ -547,6 +478,15 @@ mgs_srvconf_rec *mgs_find_sni_server(gnutls_session_t session)
 
     ctxt = gnutls_transport_get_ptr(session);
 
+    sni_type = gnutls_certificate_type_get(session);
+    if (sni_type != GNUTLS_CRT_X509) {
+        /* In theory, we could support OpenPGP Certificates. Theory != code. */
+        ap_log_error(APLOG_MARK, APLOG_CRIT, 0,
+                     ctxt->c->base_server,
+                     "GnuTLS: Only x509 Certificates are currently supported.");
+        return NULL;
+    }
+
     rv = gnutls_server_name_get(ctxt->session, sni_name,
                                 &data_len, &sni_type, 0);
 
@@ -744,11 +684,7 @@ int mgs_hook_fixups(request_rec * r)
     tmp = mgs_session_id2sz(sbuf, len, buf, sizeof(buf));
     apr_table_setn(env, "SSL_SESSION_ID", apr_pstrdup(r->pool, tmp));
 
-    if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509)
-        mgs_add_common_cert_vars(r, ctxt->sc->certs_x509[0], 0,
-                             ctxt->sc->export_certificates_enabled);
-    else if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_OPENPGP)
-        mgs_add_common_pgpcert_vars(r, ctxt->sc->cert_pgp, 0,
+    mgs_add_common_cert_vars(r, ctxt->sc->certs_x509[0], 0,
                              ctxt->sc->export_certificates_enabled);
 
     return rv;
@@ -810,7 +746,7 @@ int mgs_hook_authz(request_rec * r)
  */
 #define MGS_SIDE ((side==0)?"SSL_SERVER":"SSL_CLIENT")
 static void
-mgs_add_common_cert_vars(request_rec * r, gnutls_x509_crt_t cert, int side,
+mgs_add_common_cert_vars(request_rec * r, gnutls_x509_crt cert, int side,
                          int export_certificates_enabled)
 {
     unsigned char sbuf[64];     /* buffer to hold serials */
@@ -916,82 +852,17 @@ mgs_add_common_cert_vars(request_rec * r, gnutls_x509_crt_t cert, int side,
             }
         }
     }
-}
-
-static void
-mgs_add_common_pgpcert_vars(request_rec * r, gnutls_openpgp_crt_t cert, int side,
-                         int export_certificates_enabled)
-{
-    unsigned char sbuf[64];     /* buffer to hold serials */
-    char buf[AP_IOBUFSIZE];
-    const char *tmp;
-    size_t len;
-    int ret;
-
-    apr_table_t *env = r->subprocess_env;
-
-    if (export_certificates_enabled != 0) {
-        char cert_buf[10 * 1024];
-        len = sizeof(cert_buf);
-
-        if (gnutls_openpgp_crt_export
-            (cert, GNUTLS_OPENPGP_FMT_BASE64, cert_buf, &len) >= 0)
-            apr_table_setn(env,
-                           apr_pstrcat(r->pool, MGS_SIDE, "_CERT", NULL),
-                           apr_pstrmemdup(r->pool, cert_buf, len));
-
-    }
-
-    len = sizeof(buf);
-    gnutls_openpgp_crt_get_name(cert, 0, buf, &len);
-    apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_NAME", NULL),
-                   apr_pstrmemdup(r->pool, buf, len));
 
-    len = sizeof(sbuf);
-    gnutls_openpgp_crt_get_fingerprint(cert, sbuf, &len);
-    tmp = mgs_session_id2sz(sbuf, len, buf, sizeof(buf));
-    apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_FINGERPRINT", NULL),
-                   apr_pstrdup(r->pool, tmp));
-
-    ret = gnutls_openpgp_crt_get_version(cert);
-    if (ret > 0)
-        apr_table_setn(env,
-                       apr_pstrcat(r->pool, MGS_SIDE, "_M_VERSION", NULL),
-                       apr_psprintf(r->pool, "%u", ret));
-
-    apr_table_setn(env,
-       apr_pstrcat(r->pool, MGS_SIDE, "_CERT_TYPE", NULL), "OPENPGP");
-
-    tmp =
-        mgs_time2sz(gnutls_openpgp_crt_get_expiration_time
-                    (cert), buf, sizeof(buf));
-    apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_V_END", NULL),
-                   apr_pstrdup(r->pool, tmp));
-
-    tmp =
-        mgs_time2sz(gnutls_openpgp_crt_get_creation_time
-                    (cert), buf, sizeof(buf));
-    apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_V_START", NULL),
-                   apr_pstrdup(r->pool, tmp));
-
-    ret = gnutls_openpgp_crt_get_pk_algorithm(cert, NULL);
-    if (ret >= 0) {
-        apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_A_KEY", NULL),
-                       gnutls_pk_algorithm_get_name(ret));
-    }
 
 }
 
-/* TODO: Allow client sending a X.509 certificate chain */
+
 static int mgs_cert_verify(request_rec * r, mgs_handle_t * ctxt)
 {
     const gnutls_datum_t *cert_list;
     unsigned int cert_list_size, status, expired;
     int rv, ret;
-    union {
-      gnutls_x509_crt_t x509;
-      gnutls_openpgp_crt_t pgp;
-    } cert;
+    gnutls_x509_crt_t cert;
     apr_time_t activation_time, expiration_time, cur_time;
 
     cert_list =
@@ -1017,56 +888,32 @@ static int mgs_cert_verify(request_rec * r, mgs_handle_t * ctxt)
         return HTTP_FORBIDDEN;
     }
 
-    if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509) {
-        gnutls_x509_crt_init(&cert.x509);
-        rv = gnutls_x509_crt_import(cert.x509, &cert_list[0], GNUTLS_X509_FMT_DER);
-    } else if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_OPENPGP) {
-        gnutls_openpgp_crt_init(&cert.pgp);
-        rv = gnutls_openpgp_crt_import(cert.pgp, &cert_list[0], GNUTLS_OPENPGP_FMT_RAW);
-    } else return HTTP_FORBIDDEN;
- 
+    gnutls_x509_crt_init(&cert);
+    rv = gnutls_x509_crt_import(cert, &cert_list[0], GNUTLS_X509_FMT_DER);
     if (rv < 0) {
-       ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
+        ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
                       "GnuTLS: Failed to Verify Peer: "
                       "Failed to import peer certificates.");
-       ret = HTTP_FORBIDDEN;
-       goto exit;
+        ret = HTTP_FORBIDDEN;
+        goto exit;
     }
 
-    if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509) {
-        apr_time_ansi_put(&expiration_time,
-                      gnutls_x509_crt_get_expiration_time(cert.x509));
-        apr_time_ansi_put(&activation_time,
-                      gnutls_x509_crt_get_activation_time(cert.x509));
+    apr_time_ansi_put(&expiration_time,
+                      gnutls_x509_crt_get_expiration_time(cert));
+    apr_time_ansi_put(&activation_time,
+                      gnutls_x509_crt_get_activation_time(cert));
 
-        rv = gnutls_x509_crt_verify(cert.x509, ctxt->sc->ca_list,
+    rv = gnutls_x509_crt_verify(cert, ctxt->sc->ca_list,
                                 ctxt->sc->ca_list_size, 0, &status);
-    } else {
-        apr_time_ansi_put(&expiration_time,
-                      gnutls_openpgp_crt_get_expiration_time(cert.pgp));
-        apr_time_ansi_put(&activation_time,
-                      gnutls_openpgp_crt_get_creation_time(cert.pgp));
-
-        rv = gnutls_openpgp_crt_verify_ring(cert.pgp, ctxt->sc->pgp_list,
-                      0, &status);
-    }
 
     if (rv < 0) {
         ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,
                       "GnuTLS: Failed to Verify Peer certificate: (%d) %s",
                       rv, gnutls_strerror(rv));
-        if (rv == GNUTLS_E_NO_CERTIFICATE_FOUND)
-            ap_log_rerror(APLOG_MARK, APLOG_EMERG, 0, r,
-                      "GnuTLS: No certificate was found for verification. Did you set the GnuTLSX509CAFile or GnuTLSPGPKeyringFile directives?");
         ret = HTTP_FORBIDDEN;
         goto exit;
     }
 
-    /* TODO: X509 CRL Verification. */
-    /* May add later if anyone needs it.
-     */
-    /* ret = gnutls_x509_crt_check_revocation(crt, crl_list, crl_list_size); */
-
     expired = 0;
     cur_time = apr_time_now();
     if (activation_time > cur_time) {
@@ -1101,11 +948,16 @@ static int mgs_cert_verify(request_rec * r, mgs_handle_t * ctxt)
                       "GnuTLS: Peer Certificate is revoked.");
     }
 
-    if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509)
-        mgs_add_common_cert_vars(r, cert.x509, 1,
-                             ctxt->sc->export_certificates_enabled);
-    else if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_OPENPGP)
-        mgs_add_common_pgpcert_vars(r, cert.pgp, 1,
+    /* TODO: Further Verification. */
+    /* Revocation is X.509 non workable paradigm, I really doubt implementation
+     * is worth doing --nmav
+     */
+/// ret = gnutls_x509_crt_check_revocation(crt, crl_list, crl_list_size);
+
+//    mgs_hook_fixups(r);
+//    rv = mgs_authz_lua(r);
+
+    mgs_add_common_cert_vars(r, cert, 1,
                              ctxt->sc->export_certificates_enabled);
 
     {
@@ -1129,10 +981,7 @@ static int mgs_cert_verify(request_rec * r, mgs_handle_t * ctxt)
     }
 
   exit:
-    if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509)
-        gnutls_x509_crt_deinit(cert.x509);
-    else if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_OPENPGP)
-        gnutls_openpgp_crt_deinit(cert.pgp);
+    gnutls_x509_crt_deinit(cert);
     return ret;