1 files changed, 202 insertions, 48 deletions

diff --git a/src/mod_gnutls.c b/src/mod_gnutls.c
index a1668f3..edf7068 100644
--- a/src/mod_gnutls.c
+++ b/src/mod_gnutls.c
@@ -1,5 +1,5 @@
-/* ====================================================================
- *  Copyright 2004 Paul Querna
+/**
+ *  Copyright 2004-2005 Paul Querna
  *
  *  Licensed under the Apache License, Version 2.0 (the "License");
  *  you may not use this file except in compliance with the License.
@@ -21,17 +21,25 @@
 GCRY_THREAD_OPTION_PTHREAD_IMPL;
 #endif
 
+static apr_file_t* debug_log_fp;
+
 static apr_status_t mod_gnutls_cleanup_pre_config(void *data)
 {
     gnutls_global_deinit();
     return APR_SUCCESS;
 }
 
+static void gnutls_debug_log_all( int level, const char* str)
+{
+    apr_file_printf(debug_log_fp, "<%d> %s\n", level, str);
+}
+
 static int mod_gnutls_hook_pre_config(apr_pool_t * pconf,
                                       apr_pool_t * plog, apr_pool_t * ptemp)
 {
 
 #if APR_HAS_THREADS
+    /* TODO: Check MPM Type here */
     gcry_control(GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread);
 #endif
 
@@ -40,25 +48,68 @@ static int mod_gnutls_hook_pre_config(apr_pool_t * pconf,
     apr_pool_cleanup_register(pconf, NULL, mod_gnutls_cleanup_pre_config,
                               apr_pool_cleanup_null);
 
+    apr_file_open(&debug_log_fp, "/tmp/gnutls_debug",
+                  APR_APPEND|APR_WRITE|APR_CREATE, APR_OS_DEFAULT, pconf);
+
+    gnutls_global_set_log_level(9);
+    gnutls_global_set_log_function(gnutls_debug_log_all);
+
     return OK;
 }
 
-#define DH_BITS 1024
-#ifdef USE_RSA
-#define RSA_BITS 512
-#endif
+
+static gnutls_datum load_params(const char* file, server_rec* s, 
+                                apr_pool_t* pool) 
+{
+    gnutls_datum ret = { NULL, 0 };
+    apr_file_t* fp;
+    apr_finfo_t finfo;
+    apr_status_t rv;
+    apr_size_t br = 0;
+
+    rv = apr_file_open(&fp, file, APR_READ|APR_BINARY, APR_OS_DEFAULT, 
+                       pool);
+    if (rv != APR_SUCCESS) {
+        ap_log_error(APLOG_MARK, APLOG_STARTUP, rv, s, 
+                     "GnuTLS failed to load params file at: %s", file);
+        return ret;
+    }
+
+    rv = apr_file_info_get(&finfo, APR_FINFO_SIZE, fp);
+
+    if (rv != APR_SUCCESS) {
+        ap_log_error(APLOG_MARK, APLOG_STARTUP, rv, s, 
+                     "GnuTLS failed to stat params file at: %s", file);
+        return ret;
+    }
+
+    ret.data = apr_palloc(pool, finfo.size+1);
+    rv = apr_file_read_full(fp, ret.data, finfo.size, &br);
+
+    if (rv != APR_SUCCESS) {
+        ap_log_error(APLOG_MARK, APLOG_STARTUP, rv, s, 
+                     "GnuTLS failed to read params file at: %s", file);
+        return ret;
+    }
+
+    ret.data[br] = '\0';
+    ret.size = br;
+
+    return ret;
+}
+
 static int mod_gnutls_hook_post_config(apr_pool_t * p, apr_pool_t * plog,
                                        apr_pool_t * ptemp,
                                        server_rec * base_server)
 {
-    mod_gnutls_srvconf_rec *sc;
-    void *data = NULL;
-    int first_run = 0;
+    int rv;
     server_rec *s;
     gnutls_dh_params_t dh_params;
-#ifdef USE_RSA
     gnutls_rsa_params_t rsa_params;
-#endif
+    mod_gnutls_srvconf_rec *sc;
+    mod_gnutls_srvconf_rec *sc_base;
+    void *data = NULL;
+    int first_run = 0;
     const char *userdata_key = "mod_gnutls_init";
          
     apr_pool_userdata_get(&data, userdata_key, base_server->process->pool);
@@ -70,35 +121,98 @@ static int mod_gnutls_hook_post_config(apr_pool_t * p, apr_pool_t * plog,
     }
 
 
-//    if(first_run) {
-        /* TODO: Should we regenerate these after X requests / X time ? */
+    if (!first_run) {
+        gnutls_datum pdata;
+        apr_pool_t* tpool;
+        s = base_server;
+        sc_base = (mod_gnutls_srvconf_rec *) ap_get_module_config(s->module_config,
+                                                             &gnutls_module);
+
+        apr_pool_create(&tpool, p);
+
         gnutls_dh_params_init(&dh_params);
-        gnutls_dh_params_generate2(dh_params, DH_BITS);
-#ifdef USE_RSA
+
+        pdata = load_params(sc_base->dh_params_file, s, tpool);
+
+        if (pdata.size != 0) {
+            rv = gnutls_dh_params_import_pkcs3(dh_params, &pdata, 
+                                               GNUTLS_X509_FMT_PEM);
+            if (rv != 0) {
+                ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s, 
+                             "GnuTLS: Unable to load DH Params: (%d) %s",
+                             rv, gnutls_strerror(rv));
+                exit(rv);
+            }
+        }
+        else {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s, 
+                         "GnuTLS: Unable to load DH Params."
+                         " Shutting Down.");
+            exit(-1);
+        }
+        apr_pool_clear(tpool);
+
         gnutls_rsa_params_init(&rsa_params);
-        gnutls_rsa_params_generate2(rsa_params, RSA_BITS);
-#endif
-//    }
 
-    for (s = base_server; s; s = s->next) {
-        sc = (mod_gnutls_srvconf_rec *) ap_get_module_config(s->module_config,
-                                                             &gnutls_module);
-        if (sc->cert_file != NULL && sc->key_file != NULL) {
-            gnutls_certificate_set_x509_key_file(sc->certs, sc->cert_file,
+        pdata = load_params(sc_base->rsa_params_file, s, tpool);
+
+        if (pdata.size != 0) {
+            rv = gnutls_rsa_params_import_pkcs1(rsa_params, &pdata, 
+                                                GNUTLS_X509_FMT_PEM);
+            if (rv != 0) {
+                ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s, 
+                             "GnuTLS: Unable to load RSA Params: (%d) %s",
+                             rv, gnutls_strerror(rv));
+                exit(rv);
+            }
+        }
+        else {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s, 
+                         "GnuTLS: Unable to load RSA Params."
+                         " Shutting Down.");
+            exit(-1);
+        }
+
+        apr_pool_destroy(tpool);
+        rv = mod_gnutls_cache_post_config(p, s, sc_base);
+        if (rv != 0) {
+            ap_log_error(APLOG_MARK, APLOG_STARTUP, rv, s, 
+                         "GnuTLS: Post Config for GnuTLSCache Failed."
+                         " Shutting Down.");
+            exit(-1);
+        }
+         
+        for (s = base_server; s; s = s->next) {
+            sc = (mod_gnutls_srvconf_rec *) ap_get_module_config(s->module_config,
+                                                                 &gnutls_module);
+            sc->cache_type = sc_base->cache_type;
+            sc->cache_config = sc_base->cache_config;
+
+            if (sc->cert_file != NULL && sc->key_file != NULL) {
+                rv = gnutls_certificate_set_x509_key_file(sc->certs, sc->cert_file,
                                                  sc->key_file,
                                                  GNUTLS_X509_FMT_PEM);
-#ifdef USE_RSA
-          gnutls_certificate_set_rsa_export_params(sc->certs, rsa_params);
-#endif
-          gnutls_certificate_set_dh_params(sc->certs, dh_params);
-        }
-        else if (sc->enabled == GNUTLS_ENABLED_TRUE) {
-            ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,
-                         "[GnuTLS] - Host '%s:%d' is missing a Cert and Key File!",
+                if (rv != 0) {
+                    ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,
+                         "[GnuTLS] - Host '%s:%d' has an invalid key or certificate:"
+                         "(%s,%s) (%d) %s",
+                         s->server_hostname, s->port, sc->cert_file, sc->key_file,
+                         rv, gnutls_strerror(rv));
+                }
+                else {
+                    gnutls_certificate_set_rsa_export_params(sc->certs, 
+                                                     rsa_params);
+                    gnutls_certificate_set_dh_params(sc->certs, dh_params);
+                }
+            }
+            else if (sc->enabled == GNUTLS_ENABLED_TRUE) {
+                ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,
+                             "[GnuTLS] - Host '%s:%d' is missing a "
+                             "Cert and Key File!",
                          s->server_hostname, s->port);
+            }
         }
-    }
-
+    } /* first_run */
 
     ap_add_version_component(p, "GnuTLS/" LIBGNUTLS_VERSION);
 
@@ -111,7 +225,7 @@ static void mod_gnutls_hook_child_init(apr_pool_t *p, server_rec *s)
     mod_gnutls_srvconf_rec *sc = ap_get_module_config(s->module_config,
                                                       &gnutls_module);
 
-    if(sc->cache_config != NULL) {
+    if (sc->cache_type != mod_gnutls_cache_none) {
         rv = mod_gnutls_cache_child_init(p, s, sc);
         if(rv != APR_SUCCESS) {
             ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s,
@@ -119,8 +233,8 @@ static void mod_gnutls_hook_child_init(apr_pool_t *p, server_rec *s)
         }
     }
     else {
-            ap_log_error(APLOG_MARK, APLOG_CRIT, 0, s,
-                             "[GnuTLS] - No Cache Configured. Hint: GnuTLSCache");
+        ap_log_error(APLOG_MARK, APLOG_CRIT, 0, s,
+                     "[GnuTLS] - No Cache Configured. Hint: GnuTLSCache");
     }
 }
 
@@ -176,21 +290,21 @@ static mod_gnutls_handle_t* create_gnutls_handle(apr_pool_t* pool, conn_rec * c)
 
     gnutls_init(&ctxt->session, GNUTLS_SERVER);
 
+    gnutls_protocol_set_priority(ctxt->session, sc->protocol);
     gnutls_cipher_set_priority(ctxt->session, sc->ciphers);
     gnutls_compression_set_priority(ctxt->session, sc->compression);
     gnutls_kx_set_priority(ctxt->session, sc->key_exchange);
-    gnutls_protocol_set_priority(ctxt->session, sc->protocol);
     gnutls_mac_set_priority(ctxt->session, sc->macs);
+    gnutls_certificate_type_set_priority(ctxt->session, sc->cert_types);
 
     gnutls_credentials_set(ctxt->session, GNUTLS_CRD_CERTIFICATE, sc->certs);
+
 //  if(anon) {
 //    gnutls_credentials_set(ctxt->session, GNUTLS_CRD_ANON, sc->anoncred);
 //  }
 
     gnutls_certificate_server_set_request(ctxt->session, GNUTLS_CERT_IGNORE);
 
-    gnutls_dh_set_prime_bits(ctxt->session, DH_BITS);
-
     mod_gnutls_cache_session_init(ctxt);
     return ctxt;
 }
@@ -216,8 +330,11 @@ static int mod_gnutls_hook_pre_connection(conn_rec * c, void *csd)
     gnutls_transport_set_push_function(ctxt->session,
                                        mod_gnutls_transport_write);
     gnutls_transport_set_ptr(ctxt->session, ctxt);
-    ctxt->input_filter = ap_add_input_filter(GNUTLS_INPUT_FILTER_NAME, ctxt, NULL, c);
-    ctxt->output_filter = ap_add_output_filter(GNUTLS_OUTPUT_FILTER_NAME, ctxt, NULL, c);
+    
+    ctxt->input_filter = ap_add_input_filter(GNUTLS_INPUT_FILTER_NAME, ctxt, 
+                                             NULL, c);
+    ctxt->output_filter = ap_add_output_filter(GNUTLS_OUTPUT_FILTER_NAME, ctxt,
+                                               NULL, c);
 
     return OK;
 }
@@ -233,6 +350,7 @@ static int mod_gnutls_hook_fixups(request_rec *r)
     if(!ctxt) {
         return DECLINED;
     }
+
     apr_table_setn(env, "HTTPS", "on");
     apr_table_setn(env, "SSL_PROTOCOL",
                    gnutls_protocol_get_name(gnutls_protocol_get_version(ctxt->session)));
@@ -271,7 +389,7 @@ static const char *gnutls_set_key_file(cmd_parms * parms, void *dummy,
 }
 
 static const char *gnutls_set_cache(cmd_parms * parms, void *dummy,
-                                       const char *arg)
+                                       const char *type, const char* arg)
 {
     const char* err;
     mod_gnutls_srvconf_rec *sc = ap_get_module_config(parms->server->
@@ -281,7 +399,28 @@ static const char *gnutls_set_cache(cmd_parms * parms, void *dummy,
         return err;
     }
 
-    sc->cache_config = apr_pstrdup(parms->pool, arg);
+    if (strcasecmp("none", type) == 0) {
+        sc->cache_type = mod_gnutls_cache_none;
+    }
+    else if (strcasecmp("dbm", type) == 0) {
+        sc->cache_type = mod_gnutls_cache_dbm;
+    }
+#if HAVE_APR_MEMCACHE
+    else if (strcasecmp("memcache", type) == 0) {
+        sc->cache_type = mod_gnutls_cache_memcache;
+    }
+#endif
+    else {
+        return "Invalid Type for GnuTLSCache!";
+    }
+
+    if (sc->cache_type == mod_gnutls_cache_dbm) {
+        sc->cache_config = ap_server_root_relative(parms->pool, arg);
+    }
+    else {
+        sc->cache_config = apr_pstrdup(parms->pool, arg);
+    }
+
     return NULL;
 }
 
@@ -314,10 +453,10 @@ static const command_rec gnutls_cmds[] = {
                   NULL,
                   RSRC_CONF,
                   "SSL Server Certificate file"),
-    AP_INIT_TAKE1("GnuTLSCache", gnutls_set_cache,
+    AP_INIT_TAKE2("GnuTLSCache", gnutls_set_cache,
                   NULL,
                   RSRC_CONF,
-                  "SSL Server Certificate file"),
+                  "Cache Configuration"),
     AP_INIT_TAKE1("GnuTLSEnable", gnutls_set_enabled,
                   NULL, RSRC_CONF,
                   "Whether this server has GnuTLS Enabled. Default: Off"),
@@ -372,8 +511,16 @@ static void *gnutls_config_server_create(apr_pool_t * p, server_rec * s)
     gnutls_anon_allocate_server_credentials(&sc->anoncred);
     sc->key_file = NULL;
     sc->cert_file = NULL;
-    sc->cache_config = NULL;
+    sc->cache_timeout = apr_time_from_sec(3600);
+    sc->cache_type = mod_gnutls_cache_dbm;
+    sc->cache_config = ap_server_root_relative(p, "conf/gnutls_cache");
+
+    /* TODO: Make this Configurable ! */
+    sc->dh_params_file = ap_server_root_relative(p, "conf/dhfile");
+    sc->rsa_params_file = ap_server_root_relative(p, "conf/rsafile");
 
+    /* TODO: Make this Configurable ! */
+    /* meh. mod_ssl uses a flex based parser for this part.. sigh */
     i = 0;
     sc->ciphers[i++] = GNUTLS_CIPHER_AES_256_CBC;
     sc->ciphers[i++] = GNUTLS_CIPHER_AES_128_CBC;
@@ -383,11 +530,14 @@ static void *gnutls_config_server_create(apr_pool_t * p, server_rec * s)
     sc->ciphers[i] = 0;
 
     i = 0;
-    sc->key_exchange[i++] = GNUTLS_KX_DHE_DSS;
     sc->key_exchange[i++] = GNUTLS_KX_RSA;
-    sc->key_exchange[i++] = GNUTLS_KX_DHE_RSA;
     sc->key_exchange[i++] = GNUTLS_KX_RSA_EXPORT;
     sc->key_exchange[i++] = GNUTLS_KX_DHE_DSS;
+    sc->key_exchange[i++] = GNUTLS_KX_DHE_RSA;
+    sc->key_exchange[i++] = GNUTLS_KX_ANON_DH;
+    sc->key_exchange[i++] = GNUTLS_KX_SRP;
+    sc->key_exchange[i++] = GNUTLS_KX_SRP_RSA;
+    sc->key_exchange[i++] = GNUTLS_KX_SRP_DSS;
     sc->key_exchange[i] = 0;
 
     i = 0;
@@ -408,6 +558,10 @@ static void *gnutls_config_server_create(apr_pool_t * p, server_rec * s)
     sc->compression[i++] = GNUTLS_COMP_LZO;
     sc->compression[i] = 0;
 
+    i = 0;
+    sc->cert_types[i++] = GNUTLS_CRT_X509;
+    sc->cert_types[i] = 0;
+ 
     return sc;
 }