aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGravatar Nokis Mavrogiannopoulos 2008-01-24 06:39:20 +0000
commitGravatar Nokis Mavrogiannopoulos 2008-01-24 06:39:20 +0000
commit32f573a968f55113224bee3f41e15d7487880f42 (patch)
treec06f0865fb45343cc5cd042785add1ddbd94e42c
parent36a617804bdd905e2da3ae3bb36e6c60c933cc8c (diff)
prepare for an alpha release
-rw-r--r--NEWS5
-rw-r--r--README24
-rw-r--r--configure.ac4
-rw-r--r--src/gnutls_hooks.c2
4 files changed, 28 insertions, 7 deletions
diff --git a/NEWS b/NEWS
index f8b524e..a9fe9fd 100644
--- a/NEWS
+++ b/NEWS
@@ -1,6 +1,7 @@
1** Version 0.5.0 1** Version 0.5.0-alpha (2008-01-24)
2 2
3- Added support for OpenPGP keys. 3- Added support for OpenPGP keys. The new directives are:
4 GnuTLSPGPKeyringFile, GnuTLSPGPCertificateFile, GnuTLSPGPKeyFile
4 5
5** Version 0.4.2 (2007-12-10) 6** Version 0.4.2 (2007-12-10)
6 7
diff --git a/README b/README
index 4660ac7..5198ed7 100644
--- a/README
+++ b/README
@@ -60,7 +60,6 @@ GnuTLSCache dbm conf/gnutls_cache
60 GnuTLSX509CertificateFile conf/server.cert 60 GnuTLSX509CertificateFile conf/server.cert
61</VirtualHost> 61</VirtualHost>
62 62
63
64# a more advanced configuration 63# a more advanced configuration
65GnuTLSCache dbm "/var/cache/www-tls-cache/cache" 64GnuTLSCache dbm "/var/cache/www-tls-cache/cache"
66GnuTLSCacheTimeout 600 65GnuTLSCacheTimeout 600
@@ -87,3 +86,26 @@ NameVirtualHost 1.2.3.4:443
87 GnuTLSX509CAFile ca.pem 86 GnuTLSX509CAFile ca.pem
88 ... 87 ...
89</VirtualHost> 88</VirtualHost>
89
90# A setup for OpenPGP and X.509 authentication
91<VirtualHost 1.2.3.4:443>
92 Servername crystal.lan:443
93 GnuTLSEnable on
94 GnuTLSPriorities NORMAL:+COMP-NULL
95
96# setup the openpgp keys
97 GnuTLSPGPCertificateFile /etc/apache2/test.pub.asc
98 GnuTLSPGPKeyFile /etc/apache2/test.sec.asc
99
100# and the X.509 keys
101 GnuTLSCertificateFile /etc/apache2/server-cert.pem
102 GnuTLSKeyFile /etc/apache2/server-key.pem
103 GnuTLSClientVerify ignore
104
105# To avoid using the default DH params
106 GnuTLSDHFile /etc/apache2/dh.pem
107
108# these are only needed if GnuTLSClientVerify != ignore
109 GnuTLSClientCAFile ca.pem
110 GnuTLSPGPKeyringFile /etc/apache2/ring.asc
111</VirtualHost>
diff --git a/configure.ac b/configure.ac
index 5f3a8a6..cf7cd87 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,5 +1,5 @@
1dnl 1dnl
2AC_INIT(mod_gnutls, 0.5.0) 2AC_INIT(mod_gnutls, 0.5.0-alpha)
3OOO_CONFIG_NICE(config.nice) 3OOO_CONFIG_NICE(config.nice)
4MOD_GNUTLS_VERSION=AC_PACKAGE_VERSION 4MOD_GNUTLS_VERSION=AC_PACKAGE_VERSION
5AC_PREREQ(2.53) 5AC_PREREQ(2.53)
@@ -28,7 +28,7 @@ CHECK_APACHE(,$AP_VERSION,
28dnl LIBTOOL="`${APR_CONFIG} --apr-libtool`" 28dnl LIBTOOL="`${APR_CONFIG} --apr-libtool`"
29dnl AC_SUBST(LIBTOOL) 29dnl AC_SUBST(LIBTOOL)
30 30
31MIN_TLS_VERSION=2.1.7 31MIN_TLS_VERSION=2.2.1
32AM_PATH_LIBGNUTLS_EXTRA($MIN_TLS_VERSION,, 32AM_PATH_LIBGNUTLS_EXTRA($MIN_TLS_VERSION,,
33 AC_MSG_ERROR([[ 33 AC_MSG_ERROR([[
34*** 34***
diff --git a/src/gnutls_hooks.c b/src/gnutls_hooks.c
index 6f4fead..26917b8 100644
--- a/src/gnutls_hooks.c
+++ b/src/gnutls_hooks.c
@@ -159,8 +159,6 @@ static int mgs_select_virtual_server_cb(gnutls_session_t session)
159 gnutls_certificate_type_set_priority( session, cprio); 159 gnutls_certificate_type_set_priority( session, cprio);
160 } 160 }
161 161
162
163
164 return 0; 162 return 0;
165} 163}
166 164
no'> 129 ap_log_error(APLOG_MARK, APLOG_ERR, 0, f->c->base_server, 130 "GnuTLS: Hanshake Alert (%d) '%s'.\n", ret, gnutls_alert_get_name(ret)); 131 } 132 133 if (gnutls_error_is_fatal(ret) != 0) { 134 gnutls_deinit(ctxt->session); 135 ap_log_error(APLOG_MARK, APLOG_ERR, 0, f->c->base_server, 136 "GnuTLS: Handshake Failed (%d) '%s'",ret, gnutls_strerror(ret)); 137 ctxt->status = -1; 138 break; 139 } 140 } 141 else { 142 ctxt->status = 1; 143 break; /* all done with the handshake */ 144 } 145 } 102 } 146 } 103 147 104 for (b = APR_BRIGADE_FIRST(bb); 148 if (ctxt->status < 0) { 105 b != APR_BRIGADE_SENTINEL(bb); b = APR_BUCKET_NEXT(b)) { 149 return ap_pass_brigade(f->next, bb); 106 if (APR_BUCKET_IS_EOS(b)) { 150 } 107 /* end of connection */ 151 152 while (!APR_BRIGADE_EMPTY(bb)) { 153 apr_bucket *bucket = APR_BRIGADE_FIRST(bb); 154 if (APR_BUCKET_IS_EOS(bucket) || APR_BUCKET_IS_FLUSH(bucket)) { 155 /** TODO: GnuTLS doesn't have a special flush method? **/ 156 if ((status = ap_pass_brigade(f->next, bb)) != APR_SUCCESS) { 157 return status; 158 } 159 break; 108 } 160 } 109 else if (apr_bucket_read(b, &buf, &bytes, APR_BLOCK_READ) 161 else if(AP_BUCKET_IS_EOC(bucket)) { 110 == APR_SUCCESS) { 162 gnutls_bye(ctxt->session, GNUTLS_SHUT_WR); 111 /* more data */ 163 164 if ((status = ap_pass_brigade(f->next, bb)) != APR_SUCCESS) { 165 return status; 166 } 167 break; 168 } 169 else { 170 /* filter output */ 171 const char *data; 172 apr_size_t len; 173 174 status = apr_bucket_read(bucket, &data, &len, rblock); 175 176 if (APR_STATUS_IS_EAGAIN(status)) { 177 rblock = APR_BLOCK_READ; 178 continue; /* and try again with a blocking read. */ 179 } 180 181 rblock = APR_NONBLOCK_READ; 182 183 if (!APR_STATUS_IS_EOF(status) && (status != APR_SUCCESS)) { 184 break; 185 } 186 187 ret = gnutls_record_send(ctxt->session, data, len); 188 status = ssl_filter_write(f, data, len); 189 if(ret < 0) { 190 /* error sending output */ 191 } 192 else if ((apr_size_t)res != len) { 193 /* not all of the data was sent. */ 194 /* mod_ssl basicly errors out here.. this doesn't seem right? */ 195 } 196 else { 197 /* send complete */ 198 199 } 200 201 apr_bucket_delete(bucket); 202 203 if (status != APR_SUCCESS) { 204 break; 205 } 206 112 } 207 } 113 } 208 } 114 209 115 return status; 210 return status; 116} 211} 117 212 118#endif /* GNUTLS_AS_FILTER */ 119 120static apr_status_t gnutls_cleanup_pre_config(void *data) 213static apr_status_t gnutls_cleanup_pre_config(void *data) 121{ 214{ 122 gnutls_global_deinit(); 215 gnutls_global_deinit();@@ -206,7 +299,6 @@ static apr_port_t gnutls_hook_default_port(const request_rec * r) 206 return 443; 299 return 443; 207} 300} 208 301 209#ifdef GNUTLS_AS_FILTER 210/** 302/** 211 * From mod_ssl / ssl_engine_io.c 303 * From mod_ssl / ssl_engine_io.c 212 * This function will read from a brigade and discard the read buckets as it 304 * This function will read from a brigade and discard the read buckets as it@@ -345,14 +437,9 @@ static ssize_t gnutls_transport_write(gnutls_transport_ptr_t ptr, 345 //APR_BRIGADE_INSERT_TAIL(outctx->bb, bucket); 437 //APR_BRIGADE_INSERT_TAIL(outctx->bb, bucket); 346 return 0; 438 return 0; 347} 439} 348#endif /* GNUTLS_AS_FILTER */ 349 440 350static int gnutls_hook_pre_connection(conn_rec * c, void *csd) 441static int gnutls_hook_pre_connection(conn_rec * c, void *csd) 351{ 442{ 352#ifndef GNUTLS_AS_FILTER 353 int cfd; 354 int ret; 355#endif 356 gnutls_handle_t *ctxt; 443 gnutls_handle_t *ctxt; 357 gnutls_srvconf_rec *sc = 444 gnutls_srvconf_rec *sc = 358 (gnutls_srvconf_rec *) ap_get_module_config(c->base_server-> 445 (gnutls_srvconf_rec *) ap_get_module_config(c->base_server->@@ -366,6 +453,7 @@ static int gnutls_hook_pre_connection(conn_rec * c, void *csd) 366 ctxt = apr_pcalloc(c->pool, sizeof(*ctxt)); 453 ctxt = apr_pcalloc(c->pool, sizeof(*ctxt)); 367 454 368 ctxt->sc = sc; 455 ctxt->sc = sc; 456 ctxt->status = 0; 369 gnutls_init(&ctxt->session, GNUTLS_SERVER); 457 gnutls_init(&ctxt->session, GNUTLS_SERVER); 370 458 371 gnutls_cipher_set_priority(ctxt->session, sc->ciphers); 459 gnutls_cipher_set_priority(ctxt->session, sc->ciphers);@@ -375,6 +463,10 @@ static int gnutls_hook_pre_connection(conn_rec * c, void *csd) 375 gnutls_mac_set_priority(ctxt->session, sc->macs); 463 gnutls_mac_set_priority(ctxt->session, sc->macs); 376 464 377 gnutls_credentials_set(ctxt->session, GNUTLS_CRD_CERTIFICATE, sc->certs); 465 gnutls_credentials_set(ctxt->session, GNUTLS_CRD_CERTIFICATE, sc->certs); 466// if(anon) { 467// gnutls_credentials_set(ctxt->session, GNUTLS_CRD_ANON, sc->anoncred); 468// } 469 378 gnutls_certificate_server_set_request(ctxt->session, GNUTLS_CERT_IGNORE); 470 gnutls_certificate_server_set_request(ctxt->session, GNUTLS_CERT_IGNORE); 379 471 380// gnutls_dh_set_prime_bits(ctxt->session, DH_BITS); 472// gnutls_dh_set_prime_bits(ctxt->session, DH_BITS);@@ -382,43 +474,12 @@ static int gnutls_hook_pre_connection(conn_rec * c, void *csd) 382 474 383 ap_set_module_config(c->conn_config, &gnutls_module, ctxt); 475 ap_set_module_config(c->conn_config, &gnutls_module, ctxt); 384 476 385#ifdef GNUTLS_AS_FILTER 386 gnutls_transport_set_pull_function(ctxt->session, gnutls_transport_read); 477 gnutls_transport_set_pull_function(ctxt->session, gnutls_transport_read); 387 gnutls_transport_set_push_function(ctxt->session, gnutls_transport_write); 478 gnutls_transport_set_push_function(ctxt->session, gnutls_transport_write); 388 gnutls_transport_set_ptr(ctxt->session, ctxt); 479 gnutls_transport_set_ptr(ctxt->session, ctxt); 389 390 ap_add_input_filter(GNUTLS_INPUT_FILTER_NAME, ctxt, NULL, c); 480 ap_add_input_filter(GNUTLS_INPUT_FILTER_NAME, ctxt, NULL, c); 391 ap_add_output_filter(GNUTLS_OUTPUT_FILTER_NAME, ctxt, NULL, c); 481 ap_add_output_filter(GNUTLS_OUTPUT_FILTER_NAME, ctxt, NULL, c); 392#else 393 apr_os_sock_get(&cfd, csd); 394 gnutls_transport_set_ptr(ctxt->session, (gnutls_transport_ptr)cfd); 395 gnutls_credentials_set(ctxt->session, GNUTLS_CRD_ANON, sc->anoncred); 396 482 397 do{ 398 ret = gnutls_handshake(ctxt->session); 399 400 if(ret == GNUTLS_E_INTERRUPTED || ret == GNUTLS_E_AGAIN){ 401 continue; 402 } 403 404 if (ret < 0) { 405 if (ret == GNUTLS_E_WARNING_ALERT_RECEIVED || ret == GNUTLS_E_FATAL_ALERT_RECEIVED) { 406 ret = gnutls_alert_get(ctxt->session); 407 ap_log_error(APLOG_MARK, APLOG_ERR, 0, c->base_server, 408 "GnuTLS: Hanshake Alert (%d) '%s'.\n", ret, gnutls_alert_get_name(ret)); 409 } 410 411 if (gnutls_error_is_fatal(ret) != 0) { 412 gnutls_deinit(ctxt->session); 413 ap_log_error(APLOG_MARK, APLOG_ERR, 0, c->base_server, 414 "GnuTLS: Handshake Failed (%d) '%s'",ret, gnutls_strerror(ret)); 415 sc->non_https = 1; 416 break; 417 } 418 } 419 break; /* all done with the handshake */ 420 } while(1); 421#endif 422 return OK; 483 return OK; 423} 484} 424 485@@ -501,12 +562,10 @@ static void gnutls_hooks(apr_pool_t * p) 501 /* ap_register_output_filter ("UPGRADE_FILTER", 562 /* ap_register_output_filter ("UPGRADE_FILTER", 502 * ssl_io_filter_Upgrade, NULL, AP_FTYPE_PROTOCOL + 5); 563 * ssl_io_filter_Upgrade, NULL, AP_FTYPE_PROTOCOL + 5); 503 */ 564 */ 504#ifdef GNUTLS_AS_FILTER 505 ap_register_input_filter(GNUTLS_INPUT_FILTER_NAME, gnutls_filter_input, 565 ap_register_input_filter(GNUTLS_INPUT_FILTER_NAME, gnutls_filter_input, 506 NULL, AP_FTYPE_CONNECTION + 5); 566 NULL, AP_FTYPE_CONNECTION + 5); 507 ap_register_output_filter(GNUTLS_OUTPUT_FILTER_NAME, gnutls_filter_output, 567 ap_register_output_filter(GNUTLS_OUTPUT_FILTER_NAME, gnutls_filter_output, 508 NULL, AP_FTYPE_CONNECTION + 5); 568 NULL, AP_FTYPE_CONNECTION + 5); 509#endif 510} 569} 511 570 512static void *gnutls_config_server_create(apr_pool_t * p, server_rec * s) 571static void *gnutls_config_server_create(apr_pool_t * p, server_rec * s)