From 8240f591e11b4c87c8f134515806d6cbd59bf9f2 Mon Sep 17 00:00:00 2001 From: Nokis Mavrogiannopoulos Date: Sat, 8 Dec 2007 16:07:12 +0000 Subject: Added support for sending more than one certificate. --- src/gnutls_config.c | 14 +++++--------- src/gnutls_hooks.c | 10 +++++----- 2 files changed, 10 insertions(+), 14 deletions(-) (limited to 'src') diff --git a/src/gnutls_config.c b/src/gnutls_config.c index 7b5a42b..8d6308a 100644 --- a/src/gnutls_config.c +++ b/src/gnutls_config.c @@ -151,15 +151,10 @@ const char *mgs_set_cert_file(cmd_parms * parms, void *dummy, "Certificate '%s'", file); } - ret = gnutls_x509_crt_init(&sc->cert_x509); - if (ret < 0) { - return apr_psprintf(parms->pool, "GnuTLS: Failed to initialize" - ": (%d) %s", ret, gnutls_strerror(ret)); - } - + sc->certs_x509_num = MAX_CHAIN_SIZE; ret = - gnutls_x509_crt_import(sc->cert_x509, &data, GNUTLS_X509_FMT_PEM); - if (ret != 0) { + gnutls_x509_crt_list_import(sc->certs_x509, &sc->certs_x509_num, &data, GNUTLS_X509_FMT_PEM, 0); + if (ret < 0) { return apr_psprintf(parms->pool, "GnuTLS: Failed to Import " "Certificate '%s': (%d) %s", file, ret, gnutls_strerror(ret)); @@ -440,7 +435,8 @@ void *mgs_config_server_create(apr_pool_t * p, server_rec * s) sc->srp_tpasswd_conf_file = NULL; sc->srp_tpasswd_file = NULL; sc->privkey_x509 = NULL; - sc->cert_x509 = NULL; + memset( sc->certs_x509, 0, sizeof(sc->certs_x509)); + sc->certs_x509_num = 0; sc->cache_timeout = apr_time_from_sec(300); sc->cache_type = mgs_cache_dbm; sc->cache_config = ap_server_root_relative(p, "conf/gnutls_cache"); diff --git a/src/gnutls_hooks.c b/src/gnutls_hooks.c index 4364add..025e4e1 100644 --- a/src/gnutls_hooks.c +++ b/src/gnutls_hooks.c @@ -148,10 +148,10 @@ static int cert_retrieve_fn(gnutls_session_t session, gnutls_retr_st * ret) ctxt = gnutls_transport_get_ptr(session); ret->type = GNUTLS_CRT_X509; - ret->ncerts = 1; + ret->ncerts = ctxt->sc->certs_x509_num; ret->deinit_all = 0; - ret->cert.x509 = &ctxt->sc->cert_x509; + ret->cert.x509 = ctxt->sc->certs_x509; ret->key.x509 = ctxt->sc->privkey_x509; return 0; } @@ -334,7 +334,7 @@ mgs_hook_post_config(apr_pool_t * p, apr_pool_t * plog, } } - if (sc->cert_x509 == NULL + if (sc->certs_x509[0] == NULL && sc->enabled == GNUTLS_ENABLED_TRUE) { ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, "[GnuTLS] - Host '%s:%d' is missing a " @@ -353,7 +353,7 @@ mgs_hook_post_config(apr_pool_t * p, apr_pool_t * plog, } if (sc->enabled == GNUTLS_ENABLED_TRUE) { - rv = read_crt_cn(s, p, sc->cert_x509, &sc->cert_cn); + rv = read_crt_cn(s, p, sc->certs_x509[0], &sc->cert_cn); if (rv < 0) { ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, "[GnuTLS] - Cannot find a certificate for host '%s:%d'!", @@ -686,7 +686,7 @@ int mgs_hook_fixups(request_rec * r) tmp = mgs_session_id2sz(sbuf, len, buf, sizeof(buf)); apr_table_setn(env, "SSL_SESSION_ID", apr_pstrdup(r->pool, tmp)); - mgs_add_common_cert_vars(r, ctxt->sc->cert_x509, 0, + mgs_add_common_cert_vars(r, ctxt->sc->certs_x509[0], 0, ctxt->sc->export_certificates_enabled); return rv; -- cgit From e2ba0d06fd1edd80ca76bb2279b76944b6e6a901 Mon Sep 17 00:00:00 2001 From: Nokis Mavrogiannopoulos Date: Sun, 9 Dec 2007 10:19:00 +0000 Subject: Corrected bug which did not allow the TLS session cache to be used. --- src/gnutls_hooks.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) (limited to 'src') diff --git a/src/gnutls_hooks.c b/src/gnutls_hooks.c index 025e4e1..15b66fa 100644 --- a/src/gnutls_hooks.c +++ b/src/gnutls_hooks.c @@ -133,10 +133,6 @@ static int mgs_select_virtual_server_cb(gnutls_session_t session) if (ret < 0) return ret; - /* allow separate caches per virtual host. Actually allowing the same is a - * bad idea, since they might have different security requirements. - */ - mgs_cache_session_init(ctxt); return 0; } @@ -591,6 +587,8 @@ static mgs_handle_t *create_gnutls_handle(apr_pool_t * pool, conn_rec * c) gnutls_handshake_set_post_client_hello_function(ctxt->session, mgs_select_virtual_server_cb); + mgs_cache_session_init(ctxt); + return ctxt; } -- cgit From ae5263c379cc43e451102e4c4e193f48fd91df88 Mon Sep 17 00:00:00 2001 From: Nokis Mavrogiannopoulos Date: Sun, 9 Dec 2007 11:12:23 +0000 Subject: Do not allow resuming sessions on different servers. --- src/gnutls_cache.c | 84 +++++++++++++++++++++++++++++++----------------------- 1 file changed, 49 insertions(+), 35 deletions(-) (limited to 'src') diff --git a/src/gnutls_cache.c b/src/gnutls_cache.c index 86b843e..b29086b 100644 --- a/src/gnutls_cache.c +++ b/src/gnutls_cache.c @@ -34,18 +34,16 @@ #define MC_TAG "mod_gnutls:" -#define MC_TAG_LEN \ - (sizeof(MC_TAG)) +#define MC_TAG_LEN sizeof(MC_TAG) #define STR_SESSION_LEN (GNUTLS_SESSION_ID_STRING_LEN + MC_TAG_LEN) -#if 0 -static char *gnutls_session_id2sz(unsigned char *id, int idlen, +char *mgs_session_id2sz(unsigned char *id, int idlen, char *str, int strsize) { char *cp; int n; - - cp = apr_cpystrn(str, MC_TAG, MC_TAG_LEN); + + cp = str; for (n = 0; n < idlen && n < GNUTLS_MAX_SESSION_ID; n++) { apr_snprintf(cp, strsize - (cp-str), "%02X", id[n]); cp += 2; @@ -53,7 +51,27 @@ static char *gnutls_session_id2sz(unsigned char *id, int idlen, *cp = '\0'; return str; } -#endif + + +/* Name the Session ID as: + * IP:port.SessionID + * to disallow resuming sessions on different servers + */ +static int mgs_session_id2dbm(conn_rec* c, unsigned char *id, int idlen, + apr_datum_t* dbmkey) +{ +char buf[STR_SESSION_LEN]; +char *sz; + + sz = mgs_session_id2sz(id, idlen, buf, sizeof(buf)); + if (sz == NULL) + return -1; + + dbmkey->dptr = apr_psprintf(c->pool, "%s:%d.%s", c->local_ip, c->base_server->port, sz); + dbmkey->dsize = strlen( dbmkey->dptr); + + return 0; +} #define CTIME "%b %d %k:%M:%S %Y %Z" char *mgs_time2sz(time_t in_time, char *str, int strsize) @@ -70,24 +88,23 @@ char *mgs_time2sz(time_t in_time, char *str, int strsize) return str; } -char *mgs_session_id2sz(unsigned char *id, int idlen, - char *str, int strsize) +#if HAVE_APR_MEMCACHE +/* Name the Session ID as: + * IP:port.SessionID + * to disallow resuming sessions on different servers + */ +static char* mgs_session_id2mc(conn_rec* c, unsigned char *id, int idlen) { - char *cp; - int n; +char buf[STR_SESSION_LEN]; +char *sz; - cp = str; - for (n = 0; n < idlen && n < GNUTLS_MAX_SESSION_ID; n++) { - apr_snprintf(cp, strsize - (cp-str), "%02X", id[n]); - cp += 2; - } - *cp = '\0'; - return str; + sz = mgs_session_id2sz(id, idlen, buf, sizeof(buf)); + if (sz == NULL) + return NULL; + + return apr_psprintf(c->pool, MC_TAG"%s:%d.%s", c->local_ip, c->base_server->port, sz); } - -#if HAVE_APR_MEMCACHE - /** * GnuTLS Session Cache using libmemcached * @@ -184,11 +201,10 @@ static int mc_cache_store(void* baton, gnutls_datum_t key, { apr_status_t rv = APR_SUCCESS; mgs_handle_t *ctxt = baton; - char buf[STR_SESSION_LEN]; char* strkey = NULL; apr_uint32_t timeout; - strkey = gnutls_session_id2sz(key.data, key.size, buf, sizeof(buf)); + strkey = mgs_session_id2mc(ctxt->c, key.data, key.size); if(!strkey) return -1; @@ -211,13 +227,12 @@ static gnutls_datum_t mc_cache_fetch(void* baton, gnutls_datum_t key) { apr_status_t rv = APR_SUCCESS; mgs_handle_t *ctxt = baton; - char buf[STR_SESSION_LEN]; char* strkey = NULL; char* value; apr_size_t value_len; gnutls_datum_t data = { NULL, 0 }; - strkey = gnutls_session_id2sz(key.data, key.size, buf, sizeof(buf)); + strkey = mgs_session_id2mc(ctxt->c, key.data, key.size); if (!strkey) { return data; } @@ -252,10 +267,9 @@ static int mc_cache_delete(void* baton, gnutls_datum_t key) { apr_status_t rv = APR_SUCCESS; mgs_handle_t *ctxt = baton; - char buf[STR_SESSION_LEN]; char* strkey = NULL; - strkey = gnutls_session_id2sz(key.data, key.size, buf, sizeof(buf)); + strkey = mgs_session_id2mc(ctxt->c, key.data, key.size); if(!strkey) return -1; @@ -366,8 +380,8 @@ static gnutls_datum_t dbm_cache_fetch(void* baton, gnutls_datum_t key) mgs_handle_t *ctxt = baton; apr_status_t rv; - dbmkey.dptr = (void*)key.data; - dbmkey.dsize = key.size; + if (mgs_session_id2dbm(ctxt->c, key.data, key.size, &dbmkey) < 0) + return data; rv = apr_dbm_open(&dbm, ctxt->sc->cache_config, APR_DBM_RWCREATE, SSL_DBM_FILE_MODE, ctxt->c->pool); @@ -413,9 +427,9 @@ static int dbm_cache_store(void* baton, gnutls_datum_t key, mgs_handle_t *ctxt = baton; apr_status_t rv; apr_time_t expiry; - - dbmkey.dptr = (char *)key.data; - dbmkey.dsize = key.size; + + if (mgs_session_id2dbm(ctxt->c, key.data, key.size, &dbmkey) < 0) + return -1; /* create DBM value */ dbmval.dsize = data.size + sizeof(apr_time_t); @@ -467,9 +481,9 @@ static int dbm_cache_delete(void* baton, gnutls_datum_t key) apr_datum_t dbmkey; mgs_handle_t *ctxt = baton; apr_status_t rv; - - dbmkey.dptr = (char *)key.data; - dbmkey.dsize = key.size; + + if (mgs_session_id2dbm(ctxt->c, key.data, key.size, &dbmkey) < 0) + return -1; rv = apr_dbm_open(&dbm, ctxt->sc->cache_config, APR_DBM_RWCREATE, SSL_DBM_FILE_MODE, ctxt->c->pool); -- cgit From 47d85e7795db6797f5186f2bf4c18aef130561f2 Mon Sep 17 00:00:00 2001 From: Nokis Mavrogiannopoulos Date: Sun, 9 Dec 2007 11:35:24 +0000 Subject: --- src/gnutls_cache.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'src') diff --git a/src/gnutls_cache.c b/src/gnutls_cache.c index b29086b..83e7bb5 100644 --- a/src/gnutls_cache.c +++ b/src/gnutls_cache.c @@ -54,7 +54,7 @@ char *mgs_session_id2sz(unsigned char *id, int idlen, /* Name the Session ID as: - * IP:port.SessionID + * server:port.SessionID * to disallow resuming sessions on different servers */ static int mgs_session_id2dbm(conn_rec* c, unsigned char *id, int idlen, @@ -67,7 +67,7 @@ char *sz; if (sz == NULL) return -1; - dbmkey->dptr = apr_psprintf(c->pool, "%s:%d.%s", c->local_ip, c->base_server->port, sz); + dbmkey->dptr = apr_psprintf(c->pool, "%s:%d.%s", c->base_server->server_hostname, c->base_server->port, sz); dbmkey->dsize = strlen( dbmkey->dptr); return 0; @@ -90,7 +90,7 @@ char *mgs_time2sz(time_t in_time, char *str, int strsize) #if HAVE_APR_MEMCACHE /* Name the Session ID as: - * IP:port.SessionID + * server:port.SessionID * to disallow resuming sessions on different servers */ static char* mgs_session_id2mc(conn_rec* c, unsigned char *id, int idlen) @@ -102,7 +102,7 @@ char *sz; if (sz == NULL) return NULL; - return apr_psprintf(c->pool, MC_TAG"%s:%d.%s", c->local_ip, c->base_server->port, sz); + return apr_psprintf(c->pool, MC_TAG"%s:%d.%s", c->base_server->server_hostname, c->base_server->port, sz); } /** -- cgit From a592fc96a77530e8c5e04e30389f90074b01d77b Mon Sep 17 00:00:00 2001 From: Nokis Mavrogiannopoulos Date: Mon, 10 Dec 2007 22:49:20 +0000 Subject: --- src/gnutls_hooks.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to 'src') diff --git a/src/gnutls_hooks.c b/src/gnutls_hooks.c index 15b66fa..44b2bc1 100644 --- a/src/gnutls_hooks.c +++ b/src/gnutls_hooks.c @@ -792,8 +792,12 @@ mgs_add_common_cert_vars(request_rec * r, gnutls_x509_crt cert, int side, apr_pstrcat(r->pool, MGS_SIDE, "_M_VERSION", NULL), apr_psprintf(r->pool, "%u", ret)); + apr_table_setn(env, + apr_pstrcat(r->pool, MGS_SIDE, "_CERT_TYPE", NULL), "X.509"); +#ifdef COMPAT apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_S_TYPE", NULL), "X.509"); +#endif tmp = mgs_time2sz(gnutls_x509_crt_get_expiration_time @@ -835,19 +839,19 @@ mgs_add_common_cert_vars(request_rec * r, gnutls_x509_crt cert, int side, if (ret == GNUTLS_SAN_DNSNAME) { apr_table_setn(env, - apr_psprintf(r->pool, "%s_S_SAN%u", MGS_SIDE, i), + apr_psprintf(r->pool, "%s_S_AN%u", MGS_SIDE, i), apr_psprintf(r->pool, "DNSNAME:%s", tmp2)); } else if (ret == GNUTLS_SAN_RFC822NAME) { apr_table_setn(env, - apr_psprintf(r->pool, "%s_S_SAN%u", MGS_SIDE, i), + apr_psprintf(r->pool, "%s_S_AN%u", MGS_SIDE, i), apr_psprintf(r->pool, "RFC822NAME:%s", tmp2)); } else if (ret == GNUTLS_SAN_URI) { apr_table_setn(env, - apr_psprintf(r->pool, "%s_S_SAN%u", MGS_SIDE, i), + apr_psprintf(r->pool, "%s_S_AN%u", MGS_SIDE, i), apr_psprintf(r->pool, "URI:%s", tmp2)); } else { apr_table_setn(env, - apr_psprintf(r->pool, "%s_S_SAN%u", MGS_SIDE, i), + apr_psprintf(r->pool, "%s_S_AN%u", MGS_SIDE, i), "UNSUPPORTED"); } } -- cgit From 9120fdbd1f33e4ed465ee181ec237a68fa27bf2c Mon Sep 17 00:00:00 2001 From: Nokis Mavrogiannopoulos Date: Mon, 10 Dec 2007 22:53:22 +0000 Subject: --- src/gnutls_hooks.c | 4 ---- 1 file changed, 4 deletions(-) (limited to 'src') diff --git a/src/gnutls_hooks.c b/src/gnutls_hooks.c index 44b2bc1..55a1120 100644 --- a/src/gnutls_hooks.c +++ b/src/gnutls_hooks.c @@ -794,10 +794,6 @@ mgs_add_common_cert_vars(request_rec * r, gnutls_x509_crt cert, int side, apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_CERT_TYPE", NULL), "X.509"); -#ifdef COMPAT - apr_table_setn(env, - apr_pstrcat(r->pool, MGS_SIDE, "_S_TYPE", NULL), "X.509"); -#endif tmp = mgs_time2sz(gnutls_x509_crt_get_expiration_time -- cgit