~ubuntu-branches/ubuntu/saucy/mod-gnutls/saucy : revision 1

1

/**

2

3

4

*

5

* Licensed under the Apache License, Version 2.0 (the "License");

6

* you may not use this file except in compliance with the License.

7

* You may obtain a copy of the License at

8

*

9

* http://www.apache.org/licenses/LICENSE-2.0

10

*

11

* Unless required by applicable law or agreed to in writing, software

12

* distributed under the License is distributed on an "AS IS" BASIS,

13

* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

14

* See the License for the specific language governing permissions and

15

* limitations under the License.

16

*

17

*/

18

19

#include "mod_gnutls.h"

20

#include "http_vhost.h"

21

#include "ap_mpm.h"

22

23

#if !USING_2_1_RECENT

24

extern server_rec *ap_server_conf;

25

#endif

26

27

#if APR_HAS_THREADS

28

GCRY_THREAD_OPTION_PTHREAD_IMPL;

29

#endif

30

31

#if MOD_GNUTLS_DEBUG

32

static apr_file_t *debug_log_fp;

33

#endif

34

35

static int mpm_is_threaded;

36

37

static int mgs_cert_verify(request_rec * r, mgs_handle_t * ctxt);

38

/* use side==0 for server and side==1 for client */

39

static void mgs_add_common_cert_vars(request_rec * r, gnutls_x509_crt_t cert,

40

int side,

41

int export_certificates_enabled);

42

static void mgs_add_common_pgpcert_vars(request_rec * r, gnutls_openpgp_crt_t cert,

43

int side,

44

int export_certificates_enabled);

45

46

static apr_status_t mgs_cleanup_pre_config(void *data)

47

{

48

gnutls_global_deinit();

49

return APR_SUCCESS;

50

}

51

52

#if MOD_GNUTLS_DEBUG

53

static void gnutls_debug_log_all(int level, const char *str)

54

{

55

apr_file_printf(debug_log_fp, "<%d> %s\n", level, str);

56

}

57

#endif

58

59

int

60

mgs_hook_pre_config(apr_pool_t * pconf,

61

apr_pool_t * plog, apr_pool_t * ptemp)

62

{

63

int ret;

64

65

#if APR_HAS_THREADS

66

ap_mpm_query(AP_MPMQ_IS_THREADED, &mpm_is_threaded);

67

if (mpm_is_threaded) {

68

gcry_control(GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread);

69

}

70

#else

71

mpm_is_threaded = 0;

72

#endif

73

74

if (gnutls_check_version(LIBGNUTLS_VERSION)==NULL) {

75

fprintf(stderr, "gnutls_check_version() failed. Required: gnutls-%s Found: gnutls-%s\n",

76

LIBGNUTLS_VERSION, gnutls_check_version(NULL));

77

return -3;

78

}

79

80

ret = gnutls_global_init();

81

if (ret < 0) {

82

fprintf(stderr, "gnutls_global_init: %s\n", gnutls_strerror(ret));

83

return -3;

84

}

85

86

ret = gnutls_global_init_extra();

87

if (ret < 0) {

88

fprintf(stderr, "gnutls_global_init_extra: %s\n", gnutls_strerror(ret));

89

return -3;

90

}

91

92

apr_pool_cleanup_register(pconf, NULL, mgs_cleanup_pre_config,

93

apr_pool_cleanup_null);

94

95

#if MOD_GNUTLS_DEBUG

96

apr_file_open(&debug_log_fp, "/tmp/gnutls_debug",

97

APR_APPEND | APR_WRITE | APR_CREATE, APR_OS_DEFAULT,

98

pconf);

99

100

gnutls_global_set_log_level(9);

101

gnutls_global_set_log_function(gnutls_debug_log_all);

102

apr_file_printf(debug_log_fp, "gnutls: %s\n", gnutls_check_version(NULL));

103

#endif

104

105

return OK;

106

}

107

108

static int mgs_select_virtual_server_cb(gnutls_session_t session)

109

{

110

mgs_handle_t *ctxt;

111

mgs_srvconf_rec *tsc;

112

int ret;

113

int cprio[2];

114

115

ctxt = gnutls_transport_get_ptr(session);

116

117

/* find the virtual server */

118

tsc = mgs_find_sni_server(session);

119

120

if (tsc != NULL)

121

ctxt->sc = tsc;

122

123

gnutls_certificate_server_set_request(session,

124

ctxt->sc->client_verify_mode);

125

126

/* set the new server credentials

127

*/

128

129

gnutls_credentials_set(session, GNUTLS_CRD_CERTIFICATE,

130

ctxt->sc->certs);

131

132

gnutls_credentials_set(session, GNUTLS_CRD_ANON, ctxt->sc->anon_creds);

133

134

#ifdef ENABLE_SRP

135

if (ctxt->sc->srp_tpasswd_conf_file != NULL

136

&& ctxt->sc->srp_tpasswd_file != NULL) {

137

gnutls_credentials_set(session, GNUTLS_CRD_SRP,

138

ctxt->sc->srp_creds);

139

}

140

#endif

141

142

/* update the priorities - to avoid negotiating a ciphersuite that is not

143

* enabled on this virtual server. Note that here we ignore the version

144

* negotiation.

145

*/

146

ret = gnutls_priority_set(session, ctxt->sc->priorities);

147

/* actually it shouldn't fail since we have checked at startup */

148

if (ret < 0)

149

return ret;

150

151

/* If both certificate types are not present disallow them from

152

* being negotiated.

153

*/

154

if (ctxt->sc->certs_x509[0] != NULL && ctxt->sc->cert_pgp == NULL) {

155

cprio[0] = GNUTLS_CRT_X509;

156

cprio[1] = 0;

157

gnutls_certificate_type_set_priority( session, cprio);

158

} else if (ctxt->sc->cert_pgp != NULL && ctxt->sc->certs_x509[0]==NULL) {

159

cprio[0] = GNUTLS_CRT_OPENPGP;

160

cprio[1] = 0;

161

gnutls_certificate_type_set_priority( session, cprio);

162

}

163

164

return 0;

165

}

166

167

static int cert_retrieve_fn(gnutls_session_t session, gnutls_retr_st * ret)

168

{

169

mgs_handle_t *ctxt;

170

171

ctxt = gnutls_transport_get_ptr(session);

172

173

if (gnutls_certificate_type_get( session) == GNUTLS_CRT_X509) {

174

ret->type = GNUTLS_CRT_X509;

175

ret->ncerts = ctxt->sc->certs_x509_num;

176

ret->deinit_all = 0;

177

178

ret->cert.x509 = ctxt->sc->certs_x509;

179

ret->key.x509 = ctxt->sc->privkey_x509;

180

181

return 0;

182

} else if (gnutls_certificate_type_get( session) == GNUTLS_CRT_OPENPGP) {

183

ret->type = GNUTLS_CRT_OPENPGP;

184

ret->ncerts = 1;

185

ret->deinit_all = 0;

186

187

ret->cert.pgp = ctxt->sc->cert_pgp;

188

ret->key.pgp = ctxt->sc->privkey_pgp;

189

190

return 0;

191

192

}

193

194

return GNUTLS_E_INTERNAL_ERROR;

195

}

196

197

/* 2048-bit group parameters from SRP specification */

198

const char static_dh_params[] = "-----BEGIN DH PARAMETERS-----\n"

199

"MIIBBwKCAQCsa9tBMkqam/Fm3l4TiVgvr3K2ZRmH7gf8MZKUPbVgUKNzKcu0oJnt\n"

200

"gZPgdXdnoT3VIxKrSwMxDc1/SKnaBP1Q6Ag5ae23Z7DPYJUXmhY6s2YaBfvV+qro\n"

201

"KRipli8Lk7hV+XmT7Jde6qgNdArb9P90c1nQQdXDPqcdKB5EaxR3O8qXtDoj+4AW\n"

202

"dr0gekNsZIHx0rkHhxdGGludMuaI+HdIVEUjtSSw1X1ep3onddLs+gMs+9v1L7N4\n"

203

"YWAnkATleuavh05zA85TKZzMBBx7wwjYKlaY86jQw4JxrjX46dv7tpS1yAPYn3rk\n"

204

"Nd4jbVJfVHWbZeNy/NaO8g+nER+eSv9zAgEC\n"

205

"-----END DH PARAMETERS-----\n";

206

207

/* Read the common name or the alternative name of the certificate.

208

* We only support a single name per certificate.

209

*

210

* Returns negative on error.

211

*/

212

static int read_crt_cn(server_rec * s, apr_pool_t * p,

213

gnutls_x509_crt_t cert, char **cert_cn)

214

{

215

int rv = 0, i;

216

size_t data_len;

217

218

219

*cert_cn = NULL;

220

221

data_len = 0;

222

rv = gnutls_x509_crt_get_dn_by_oid(cert,

223

GNUTLS_OID_X520_COMMON_NAME,

224

0, 0, NULL, &data_len);

225

226

if (rv == GNUTLS_E_SHORT_MEMORY_BUFFER && data_len > 1) {

227

*cert_cn = apr_palloc(p, data_len);

228

rv = gnutls_x509_crt_get_dn_by_oid(cert,

229

GNUTLS_OID_X520_COMMON_NAME, 0,

230

0, *cert_cn, &data_len);

231

} else { /* No CN return subject alternative name */

232

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,

233

"No common name found in certificate for '%s:%d'. Looking for subject alternative name...",

234

s->server_hostname, s->port);

235

rv = 0;

236

/* read subject alternative name */

237

for (i = 0; !(rv < 0); i++) {

238

data_len = 0;

239

rv = gnutls_x509_crt_get_subject_alt_name(cert, i,

240

NULL, &data_len,

241

NULL);

242

243

if (rv == GNUTLS_E_SHORT_MEMORY_BUFFER && data_len > 1) {

244

/* FIXME: not very efficient. What if we have several alt names

245

* before DNSName?

246

*/

247

*cert_cn = apr_palloc(p, data_len + 1);

248

249

rv = gnutls_x509_crt_get_subject_alt_name(cert, i,

250

*cert_cn,

251

&data_len, NULL);

252

(*cert_cn)[data_len] = 0;

253

254

if (rv == GNUTLS_SAN_DNSNAME)

255

break;

256

}

257

}

258

}

259

260

return rv;

261

}

262

263

static int read_pgpcrt_cn(server_rec * s, apr_pool_t * p,

264

gnutls_openpgp_crt_t cert, char **cert_cn)

265

{

266

int rv = 0;

267

size_t data_len;

268

269

270

*cert_cn = NULL;

271

272

data_len = 0;

273

rv = gnutls_openpgp_crt_get_name(cert, 0, NULL, &data_len);

274

275

if (rv == GNUTLS_E_SHORT_MEMORY_BUFFER && data_len > 1) {

276

*cert_cn = apr_palloc(p, data_len);

277

rv = gnutls_openpgp_crt_get_name(cert, 0, *cert_cn, &data_len);

278

} else { /* No CN return subject alternative name */

279

ap_log_error(APLOG_MARK, APLOG_INFO, 0, s,

280

"No name found in PGP certificate for '%s:%d'.",

281

s->server_hostname, s->port);

282

}

283

284

return rv;

285

}

286

287

288

int

289

mgs_hook_post_config(apr_pool_t * p, apr_pool_t * plog,

290

apr_pool_t * ptemp, server_rec * base_server)

291

{

292

int rv;

293

server_rec *s;

294

gnutls_dh_params_t dh_params = NULL;

295

gnutls_rsa_params_t rsa_params = NULL;

296

mgs_srvconf_rec *sc;

297

mgs_srvconf_rec *sc_base;

298

void *data = NULL;

299

int first_run = 0;

300

const char *userdata_key = "mgs_init";

301

302

apr_pool_userdata_get(&data, userdata_key, base_server->process->pool);

303

if (data == NULL) {

304

first_run = 1;

305

apr_pool_userdata_set((const void *) 1, userdata_key,

306

apr_pool_cleanup_null,

307

base_server->process->pool);

308

}

309

310

311

{

312

s = base_server;

313

sc_base =

314

(mgs_srvconf_rec *) ap_get_module_config(s->module_config,

315

&gnutls_module);

316

317

gnutls_dh_params_init(&dh_params);

318

319

if (sc_base->dh_params == NULL) {

320

gnutls_datum pdata = { (void *) static_dh_params, sizeof(static_dh_params) };

321

/* loading defaults */

322

rv = gnutls_dh_params_import_pkcs3(dh_params, &pdata,

323

GNUTLS_X509_FMT_PEM);

324

325

if (rv < 0) {

326

ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,

327

"GnuTLS: Unable to load DH Params: (%d) %s",

328

rv, gnutls_strerror(rv));

329

exit(rv);

330

}

331

} else dh_params = sc_base->dh_params;

332

333

if (sc_base->rsa_params != NULL)

334

rsa_params = sc_base->rsa_params;

335

336

/* else not an error but RSA-EXPORT ciphersuites are not available

337

*/

338

339

rv = mgs_cache_post_config(p, s, sc_base);

340

if (rv != 0) {

341

ap_log_error(APLOG_MARK, APLOG_STARTUP, rv, s,

342

"GnuTLS: Post Config for GnuTLSCache Failed."

343

" Shutting Down.");

344

exit(-1);

345

}

346

347

for (s = base_server; s; s = s->next) {

348

void *load = NULL;

349

sc = (mgs_srvconf_rec *) ap_get_module_config(s->module_config,

350

&gnutls_module);

351

sc->cache_type = sc_base->cache_type;

352

sc->cache_config = sc_base->cache_config;

353

354

/* Check if the priorities have been set */

355

if (sc->priorities == NULL && sc->enabled == GNUTLS_ENABLED_TRUE) {

356

ap_log_error(APLOG_MARK, APLOG_STARTUP, 0, s,

357

"GnuTLS: Host '%s:%d' is missing the GnuTLSPriorities directive!",

358

s->server_hostname, s->port);

359

exit(-1);

360

}

361

362

/* Check if DH or RSA params have been set per host */

363

if (sc->rsa_params != NULL)

364

load = sc->rsa_params;

365

else if (rsa_params) load = rsa_params;

366

367

if (load != NULL)

368

gnutls_certificate_set_rsa_export_params(sc->certs, load);

369

370

371

load = NULL;

372

if (sc->dh_params != NULL)

373

load = sc->dh_params;

374

else if (dh_params) load = dh_params;

375

376

if (load != NULL) { /* not needed but anyway */

377

gnutls_certificate_set_dh_params(sc->certs, load);

378

gnutls_anon_set_server_dh_params(sc->anon_creds, load);

379

}

380

381

gnutls_certificate_server_set_retrieve_function(sc->certs,

382

cert_retrieve_fn);

383

384

#ifdef ENABLE_SRP

385

if (sc->srp_tpasswd_conf_file != NULL

386

&& sc->srp_tpasswd_file != NULL) {

387

rv = gnutls_srp_set_server_credentials_file(sc->srp_creds,

388

sc->

389

srp_tpasswd_file,

390

sc->

391

srp_tpasswd_conf_file);

392

393

if (rv < 0 && sc->enabled == GNUTLS_ENABLED_TRUE) {

394

ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,

395

"[GnuTLS] - Host '%s:%d' is missing a "

396

"SRP password or conf File!",

397

s->server_hostname, s->port);

398

exit(-1);

399

}

400

}

401

#endif

402

403

if (sc->certs_x509[0] == NULL

404

&& sc->enabled == GNUTLS_ENABLED_TRUE) {

405

ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,

406

"[GnuTLS] - Host '%s:%d' is missing a "

407

"Certificate File!", s->server_hostname,

408

s->port);

409

exit(-1);

410

}

411

412

if (sc->privkey_x509 == NULL

413

&& sc->enabled == GNUTLS_ENABLED_TRUE) {

414

ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,

415

"[GnuTLS] - Host '%s:%d' is missing a "

416

"Private Key File!",

417

s->server_hostname, s->port);

418

exit(-1);

419

}

420

421

if (sc->enabled == GNUTLS_ENABLED_TRUE) {

422

rv = read_crt_cn(s, p, sc->certs_x509[0], &sc->cert_cn);

423

if (rv < 0 && sc->cert_pgp != NULL) /* try openpgp certificate */

424

rv = read_pgpcrt_cn(s, p, sc->cert_pgp, &sc->cert_cn);

425

426

if (rv < 0) {

427

ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s,

428

"[GnuTLS] - Cannot find a certificate for host '%s:%d'!",

429

s->server_hostname, s->port);

430

sc->cert_cn = NULL;

431

continue;

432

}

433

}

434

}

435

}

436

437

ap_add_version_component(p, "mod_gnutls/" MOD_GNUTLS_VERSION);

438

439

return OK;

440

}

441

442

void mgs_hook_child_init(apr_pool_t * p, server_rec * s)

443

{

444

apr_status_t rv = APR_SUCCESS;

445

mgs_srvconf_rec *sc = ap_get_module_config(s->module_config,

446

&gnutls_module);

447

448

if (sc->cache_type != mgs_cache_none) {

449

rv = mgs_cache_child_init(p, s, sc);

450

if (rv != APR_SUCCESS) {

451

ap_log_error(APLOG_MARK, APLOG_EMERG, rv, s,

452

"[GnuTLS] - Failed to run Cache Init");

453

}

454

} else {

455

ap_log_error(APLOG_MARK, APLOG_CRIT, 0, s,

456

"[GnuTLS] - No Cache Configured. Hint: GnuTLSCache");

457

}

458

}

459

460

const char *mgs_hook_http_scheme(const request_rec * r)

461

{

462

mgs_srvconf_rec *sc =

463

(mgs_srvconf_rec *) ap_get_module_config(r->server->module_config,

464

&gnutls_module);

465

466

if (sc->enabled == GNUTLS_ENABLED_FALSE) {

467

return NULL;

468

}

469

470

return "https";

471

}

472

473

apr_port_t mgs_hook_default_port(const request_rec * r)

474

{

475

mgs_srvconf_rec *sc =

476

(mgs_srvconf_rec *) ap_get_module_config(r->server->module_config,

477

&gnutls_module);

478

479

if (sc->enabled == GNUTLS_ENABLED_FALSE) {

480

return 0;

481

}

482

483

return 443;

484

}

485

486

#define MAX_HOST_LEN 255

487

488

#if USING_2_1_RECENT

489

typedef struct {

490

mgs_handle_t *ctxt;

491

mgs_srvconf_rec *sc;

492

const char *sni_name;

493

} vhost_cb_rec;

494

495

static int vhost_cb(void *baton, conn_rec * conn, server_rec * s)

496

{

497

mgs_srvconf_rec *tsc;

498

vhost_cb_rec *x = baton;

499

500

tsc = (mgs_srvconf_rec *) ap_get_module_config(s->module_config,

501

&gnutls_module);

502

503

if (tsc->enabled != GNUTLS_ENABLED_TRUE || tsc->cert_cn == NULL) {

504

return 0;

505

}

506

507

/* The CN can contain a * -- this will match those too. */

508

if (ap_strcasecmp_match(x->sni_name, tsc->cert_cn) == 0) {

509

/* found a match */

510

#if MOD_GNUTLS_DEBUG

511

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,

512

x->ctxt->c->base_server,

513

"GnuTLS: Virtual Host CB: "

514

"'%s' == '%s'", tsc->cert_cn, x->sni_name);

515

#endif

516

/* Because we actually change the server used here, we need to reset

517

* things like ClientVerify.

518

*/

519

x->sc = tsc;

520

/* Shit. Crap. Dammit. We *really* should rehandshake here, as our

521

* certificate structure *should* change when the server changes.

522

* acccckkkkkk.

523

*/

524

return 1;

525

} else {

526

#if MOD_GNUTLS_DEBUG

527

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,

528

x->ctxt->c->base_server,

529

"GnuTLS: Virtual Host CB: "

530

"'%s' != '%s'", tsc->cert_cn, x->sni_name);

531

#endif

532

533

}

534

return 0;

535

}

536

#endif

537

538

mgs_srvconf_rec *mgs_find_sni_server(gnutls_session_t session)

539

{

540

int rv;

541

unsigned int sni_type;

542

size_t data_len = MAX_HOST_LEN;

543

char sni_name[MAX_HOST_LEN];

544

mgs_handle_t *ctxt;

545

#if USING_2_1_RECENT

546

vhost_cb_rec cbx;

547

#else

548

server_rec *s;

549

mgs_srvconf_rec *tsc;

550

#endif

551

552

ctxt = gnutls_transport_get_ptr(session);

553

554

rv = gnutls_server_name_get(ctxt->session, sni_name,

555

&data_len, &sni_type, 0);

556

557

if (rv != 0) {

558

return NULL;

559

}

560

561

if (sni_type != GNUTLS_NAME_DNS) {

562

ap_log_error(APLOG_MARK, APLOG_CRIT, 0,

563

ctxt->c->base_server,

564

"GnuTLS: Unknown type '%d' for SNI: "

565

"'%s'", sni_type, sni_name);

566

return NULL;

567

}

568

569

/**

570

* Code in the Core already sets up the c->base_server as the base

571

* for this IP/Port combo. Trust that the core did the 'right' thing.

572

*/

573

#if USING_2_1_RECENT

574

cbx.ctxt = ctxt;

575

cbx.sc = NULL;

576

cbx.sni_name = sni_name;

577

578

rv = ap_vhost_iterate_given_conn(ctxt->c, vhost_cb, &cbx);

579

if (rv == 1) {

580

return cbx.sc;

581

}

582

#else

583

for (s = ap_server_conf; s; s = s->next) {

584

585

tsc = (mgs_srvconf_rec *) ap_get_module_config(s->module_config,

586

&gnutls_module);

587

if (tsc->enabled != GNUTLS_ENABLED_TRUE) {

588

continue;

589

}

590

#if MOD_GNUTLS_DEBUG

591

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,

592

ctxt->c->base_server,

593

"GnuTLS: sni-x509 cn: %s/%d pk: %s s: 0x%08X s->n: 0x%08X sc: 0x%08X",

594

tsc->cert_cn, rv,

595

gnutls_pk_algorithm_get_name

596

(gnutls_x509_privkey_get_pk_algorithm

597

(ctxt->sc->privkey_x509)), (unsigned int) s,

598

(unsigned int) s->next, (unsigned int) tsc);

599

#endif

600

/* The CN can contain a * -- this will match those too. */

601

if (ap_strcasecmp_match(sni_name, tsc->cert_cn) == 0) {

602

#if MOD_GNUTLS_DEBUG

603

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,

604

ctxt->c->base_server,

605

"GnuTLS: Virtual Host: "

606

"'%s' == '%s'", tsc->cert_cn, sni_name);

607

#endif

608

return tsc;

609

}

610

}

611

#endif

612

return NULL;

613

}

614

615

616

static const int protocol_priority[] = {

617

GNUTLS_TLS1_1, GNUTLS_TLS1_0, GNUTLS_SSL3, 0

618

};

619

620

621

static mgs_handle_t *create_gnutls_handle(apr_pool_t * pool, conn_rec * c)

622

{

623

mgs_handle_t *ctxt;

624

mgs_srvconf_rec *sc =

625

(mgs_srvconf_rec *) ap_get_module_config(c->base_server->

626

module_config,

627

&gnutls_module);

628

629

ctxt = apr_pcalloc(pool, sizeof(*ctxt));

630

ctxt->c = c;

631

ctxt->sc = sc;

632

ctxt->status = 0;

633

634

ctxt->input_rc = APR_SUCCESS;

635

ctxt->input_bb = apr_brigade_create(c->pool, c->bucket_alloc);

636

ctxt->input_cbuf.length = 0;

637

638

ctxt->output_rc = APR_SUCCESS;

639

ctxt->output_bb = apr_brigade_create(c->pool, c->bucket_alloc);

640

ctxt->output_blen = 0;

641

ctxt->output_length = 0;

642

643

gnutls_init(&ctxt->session, GNUTLS_SERVER);

644

645

/* because we don't set any default priorities here (we set later at

646

* the user hello callback) we need to at least set this in order for

647

* gnutls to be able to read packets.

648

*/

649

gnutls_protocol_set_priority(ctxt->session, protocol_priority);

650

651

gnutls_handshake_set_post_client_hello_function(ctxt->session,

652

mgs_select_virtual_server_cb);

653

654

mgs_cache_session_init(ctxt);

655

656

return ctxt;

657

}

658

659

int mgs_hook_pre_connection(conn_rec * c, void *csd)

660

{

661

mgs_handle_t *ctxt;

662

mgs_srvconf_rec *sc =

663

(mgs_srvconf_rec *) ap_get_module_config(c->base_server->

664

module_config,

665

&gnutls_module);

666

667

if (!(sc && (sc->enabled == GNUTLS_ENABLED_TRUE))) {

668

return DECLINED;

669

}

670

671

ctxt = create_gnutls_handle(c->pool, c);

672

673

ap_set_module_config(c->conn_config, &gnutls_module, ctxt);

674

675

gnutls_transport_set_pull_function(ctxt->session, mgs_transport_read);

676

gnutls_transport_set_push_function(ctxt->session, mgs_transport_write);

677

gnutls_transport_set_ptr(ctxt->session, ctxt);

678

679

ctxt->input_filter =

680

ap_add_input_filter(GNUTLS_INPUT_FILTER_NAME, ctxt, NULL, c);

681

ctxt->output_filter =

682

ap_add_output_filter(GNUTLS_OUTPUT_FILTER_NAME, ctxt, NULL, c);

683

684

return OK;

685

}

686

687

int mgs_hook_fixups(request_rec * r)

688

{

689

unsigned char sbuf[GNUTLS_MAX_SESSION_ID];

690

char buf[AP_IOBUFSIZE];

691

const char *tmp;

692

size_t len;

693

mgs_handle_t *ctxt;

694

int rv = OK;

695

696

apr_table_t *env = r->subprocess_env;

697

698

ctxt =

699

ap_get_module_config(r->connection->conn_config, &gnutls_module);

700

701

if (!ctxt) {

702

return DECLINED;

703

}

704

705

apr_table_setn(env, "HTTPS", "on");

706

707

apr_table_setn(env, "SSL_VERSION_LIBRARY",

708

"GnuTLS/" LIBGNUTLS_VERSION);

709

apr_table_setn(env, "SSL_VERSION_INTERFACE",

710

"mod_gnutls/" MOD_GNUTLS_VERSION);

711

712

apr_table_setn(env, "SSL_PROTOCOL",

713

gnutls_protocol_get_name(gnutls_protocol_get_version

714

(ctxt->session)));

715

716

/* should have been called SSL_CIPHERSUITE instead */

717

apr_table_setn(env, "SSL_CIPHER",

718

gnutls_cipher_suite_get_name(gnutls_kx_get

719

(ctxt->session),

720

gnutls_cipher_get(ctxt->

721

session),

722

gnutls_mac_get(ctxt->

723

session)));

724

725

apr_table_setn(env, "SSL_COMPRESS_METHOD",

726

gnutls_compression_get_name(gnutls_compression_get

727

(ctxt->session)));

728

729

#ifdef ENABLE_SRP

730

apr_table_setn(env, "SSL_SRP_USER",

731

gnutls_srp_server_get_username(ctxt->session));

732

#endif

733

734

if (apr_table_get(env, "SSL_CLIENT_VERIFY") == NULL)

735

apr_table_setn(env, "SSL_CLIENT_VERIFY", "NONE");

736

737

unsigned int key_size =

738

8 * gnutls_cipher_get_key_size(gnutls_cipher_get(ctxt->session));

739

tmp = apr_psprintf(r->pool, "%u", key_size);

740

741

apr_table_setn(env, "SSL_CIPHER_USEKEYSIZE", tmp);

742

743

apr_table_setn(env, "SSL_CIPHER_ALGKEYSIZE", tmp);

744

745

apr_table_setn(env, "SSL_CIPHER_EXPORT",

746

(key_size <= 40) ? "true" : "false");

747

748

len = sizeof(sbuf);

749

gnutls_session_get_id(ctxt->session, sbuf, &len);

750

tmp = mgs_session_id2sz(sbuf, len, buf, sizeof(buf));

751

apr_table_setn(env, "SSL_SESSION_ID", apr_pstrdup(r->pool, tmp));

752

753

if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509)

754

mgs_add_common_cert_vars(r, ctxt->sc->certs_x509[0], 0,

755

ctxt->sc->export_certificates_enabled);

756

else if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_OPENPGP)

757

mgs_add_common_pgpcert_vars(r, ctxt->sc->cert_pgp, 0,

758

ctxt->sc->export_certificates_enabled);

759

760

return rv;

761

}

762

763

int mgs_hook_authz(request_rec * r)

764

{

765

int rv;

766

mgs_handle_t *ctxt;

767

mgs_dirconf_rec *dc = ap_get_module_config(r->per_dir_config,

768

&gnutls_module);

769

770

ctxt =

771

ap_get_module_config(r->connection->conn_config, &gnutls_module);

772

773

if (!ctxt) {

774

return DECLINED;

775

}

776

777

if (dc->client_verify_mode == GNUTLS_CERT_IGNORE) {

778

ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

779

"GnuTLS: Directory set to Ignore Client Certificate!");

780

} else {

781

if (ctxt->sc->client_verify_mode < dc->client_verify_mode) {

782

ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

783

"GnuTLS: Attempting to rehandshake with peer. %d %d",

784

ctxt->sc->client_verify_mode,

785

dc->client_verify_mode);

786

787

gnutls_certificate_server_set_request(ctxt->session,

788

dc->client_verify_mode);

789

790

if (mgs_rehandshake(ctxt) != 0) {

791

return HTTP_FORBIDDEN;

792

}

793

} else if (ctxt->sc->client_verify_mode == GNUTLS_CERT_IGNORE) {

794

#if MOD_GNUTLS_DEBUG

795

ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,

796

"GnuTLS: Peer is set to IGNORE");

797

#endif

798

} else {

799

rv = mgs_cert_verify(r, ctxt);

800

if (rv != DECLINED) {

801

return rv;

802

}

803

}

804

}

805

806

return DECLINED;

807

}

808

809

/* variables that are not sent by default:

810

*

811

* SSL_CLIENT_CERT string PEM-encoded client certificate

812

* SSL_SERVER_CERT string PEM-encoded client certificate

813

*/

814

815

/* side is either 0 for SERVER or 1 for CLIENT

816

*/

817

#define MGS_SIDE ((side==0)?"SSL_SERVER":"SSL_CLIENT")

818

static void

819

mgs_add_common_cert_vars(request_rec * r, gnutls_x509_crt_t cert, int side,

820

int export_certificates_enabled)

821

{

822

unsigned char sbuf[64]; /* buffer to hold serials */

823

char buf[AP_IOBUFSIZE];

824

const char *tmp;

825

char *tmp2;

826

size_t len;

827

int ret, i;

828

829

apr_table_t *env = r->subprocess_env;

830

831

if (export_certificates_enabled != 0) {

832

char cert_buf[10 * 1024];

833

len = sizeof(cert_buf);

834

835

if (gnutls_x509_crt_export

836

(cert, GNUTLS_X509_FMT_PEM, cert_buf, &len) >= 0)

837

apr_table_setn(env,

838

apr_pstrcat(r->pool, MGS_SIDE, "_CERT", NULL),

839

apr_pstrmemdup(r->pool, cert_buf, len));

840

841

}

842

843

len = sizeof(buf);

844

gnutls_x509_crt_get_dn(cert, buf, &len);

845

apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_S_DN", NULL),

846

apr_pstrmemdup(r->pool, buf, len));

847

848

len = sizeof(buf);

849

gnutls_x509_crt_get_issuer_dn(cert, buf, &len);

850

apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_I_DN", NULL),

851

apr_pstrmemdup(r->pool, buf, len));

852

853

len = sizeof(sbuf);

854

gnutls_x509_crt_get_serial(cert, sbuf, &len);

855

tmp = mgs_session_id2sz(sbuf, len, buf, sizeof(buf));

856

apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_M_SERIAL", NULL),

857

apr_pstrdup(r->pool, tmp));

858

859

ret = gnutls_x509_crt_get_version(cert);

860

if (ret > 0)

861

apr_table_setn(env,

862

apr_pstrcat(r->pool, MGS_SIDE, "_M_VERSION", NULL),

863

apr_psprintf(r->pool, "%u", ret));

864

865

apr_table_setn(env,

866

apr_pstrcat(r->pool, MGS_SIDE, "_CERT_TYPE", NULL), "X.509");

867

868

tmp =

869

mgs_time2sz(gnutls_x509_crt_get_expiration_time

870

(cert), buf, sizeof(buf));

871

apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_V_END", NULL),

872

apr_pstrdup(r->pool, tmp));

873

874

tmp =

875

mgs_time2sz(gnutls_x509_crt_get_activation_time

876

(cert), buf, sizeof(buf));

877

apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_V_START", NULL),

878

apr_pstrdup(r->pool, tmp));

879

880

ret = gnutls_x509_crt_get_signature_algorithm(cert);

881

if (ret >= 0) {

882

apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_A_SIG", NULL),

883

gnutls_sign_algorithm_get_name(ret));

884

}

885

886

ret = gnutls_x509_crt_get_pk_algorithm(cert, NULL);

887

if (ret >= 0) {

888

apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_A_KEY", NULL),

889

gnutls_pk_algorithm_get_name(ret));

890

}

891

892

/* export all the alternative names (DNS, RFC822 and URI) */

893

for (i = 0; !(ret < 0); i++) {

894

len = 0;

895

ret = gnutls_x509_crt_get_subject_alt_name(cert, i,

896

NULL, &len, NULL);

897

898

if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER && len > 1) {

899

tmp2 = apr_palloc(r->pool, len + 1);

900

901

ret =

902

gnutls_x509_crt_get_subject_alt_name(cert, i, tmp2, &len,

903

NULL);

904

tmp2[len] = 0;

905

906

if (ret == GNUTLS_SAN_DNSNAME) {

907

apr_table_setn(env,

908

apr_psprintf(r->pool, "%s_S_AN%u", MGS_SIDE, i),

909

apr_psprintf(r->pool, "DNSNAME:%s", tmp2));

910

} else if (ret == GNUTLS_SAN_RFC822NAME) {

911

apr_table_setn(env,

912

apr_psprintf(r->pool, "%s_S_AN%u", MGS_SIDE, i),

913

apr_psprintf(r->pool, "RFC822NAME:%s", tmp2));

914

} else if (ret == GNUTLS_SAN_URI) {

915

apr_table_setn(env,

916

apr_psprintf(r->pool, "%s_S_AN%u", MGS_SIDE, i),

917

apr_psprintf(r->pool, "URI:%s", tmp2));

918

} else {

919

apr_table_setn(env,

920

apr_psprintf(r->pool, "%s_S_AN%u", MGS_SIDE, i),

921

"UNSUPPORTED");

922

}

923

}

924

}

925

}

926

927

static void

928

mgs_add_common_pgpcert_vars(request_rec * r, gnutls_openpgp_crt_t cert, int side,

929

int export_certificates_enabled)

930

{

931

unsigned char sbuf[64]; /* buffer to hold serials */

932

char buf[AP_IOBUFSIZE];

933

const char *tmp;

934

size_t len;

935

int ret;

936

937

apr_table_t *env = r->subprocess_env;

938

939

if (export_certificates_enabled != 0) {

940

char cert_buf[10 * 1024];

941

len = sizeof(cert_buf);

942

943

if (gnutls_openpgp_crt_export

944

(cert, GNUTLS_OPENPGP_FMT_BASE64, cert_buf, &len) >= 0)

945

apr_table_setn(env,

946

apr_pstrcat(r->pool, MGS_SIDE, "_CERT", NULL),

947

apr_pstrmemdup(r->pool, cert_buf, len));

948

949

}

950

951

len = sizeof(buf);

952

gnutls_openpgp_crt_get_name(cert, 0, buf, &len);

953

apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_NAME", NULL),

954

apr_pstrmemdup(r->pool, buf, len));

955

956

len = sizeof(sbuf);

957

gnutls_openpgp_crt_get_fingerprint(cert, sbuf, &len);

958

tmp = mgs_session_id2sz(sbuf, len, buf, sizeof(buf));

959

apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_FINGERPRINT", NULL),

960

apr_pstrdup(r->pool, tmp));

961

962

ret = gnutls_openpgp_crt_get_version(cert);

963

if (ret > 0)

964

apr_table_setn(env,

965

apr_pstrcat(r->pool, MGS_SIDE, "_M_VERSION", NULL),

966

apr_psprintf(r->pool, "%u", ret));

967

968

apr_table_setn(env,

969

apr_pstrcat(r->pool, MGS_SIDE, "_CERT_TYPE", NULL), "OPENPGP");

970

971

tmp =

972

mgs_time2sz(gnutls_openpgp_crt_get_expiration_time

973

(cert), buf, sizeof(buf));

974

apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_V_END", NULL),

975

apr_pstrdup(r->pool, tmp));

976

977

tmp =

978

mgs_time2sz(gnutls_openpgp_crt_get_creation_time

979

(cert), buf, sizeof(buf));

980

apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_V_START", NULL),

981

apr_pstrdup(r->pool, tmp));

982

983

ret = gnutls_openpgp_crt_get_pk_algorithm(cert, NULL);

984

if (ret >= 0) {

985

apr_table_setn(env, apr_pstrcat(r->pool, MGS_SIDE, "_A_KEY", NULL),

986

gnutls_pk_algorithm_get_name(ret));

987

}

988

989

}

990

991

/* TODO: Allow client sending a X.509 certificate chain */

992

static int mgs_cert_verify(request_rec * r, mgs_handle_t * ctxt)

993

{

994

const gnutls_datum_t *cert_list;

995

unsigned int cert_list_size, status, expired;

996

int rv, ret;

997

union {

998

gnutls_x509_crt_t x509;

999

gnutls_openpgp_crt_t pgp;

1000

} cert;

1001

apr_time_t activation_time, expiration_time, cur_time;

1002

1003

cert_list =

1004

gnutls_certificate_get_peers(ctxt->session, &cert_list_size);

1005

1006

if (cert_list == NULL || cert_list_size == 0) {

1007

/* It is perfectly OK for a client not to send a certificate if on REQUEST mode

1008

*/

1009

if (ctxt->sc->client_verify_mode == GNUTLS_CERT_REQUEST)

1010

return OK;

1011

1012

/* no certificate provided by the client, but one was required. */

1013

ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,

1014

"GnuTLS: Failed to Verify Peer: "

1015

"Client did not submit a certificate");

1016

return HTTP_FORBIDDEN;

1017

}

1018

1019

if (cert_list_size > 1) {

1020

ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,

1021

"GnuTLS: Failed to Verify Peer: "

1022

"Chained Client Certificates are not supported.");

1023

return HTTP_FORBIDDEN;

1024

}

1025

1026

if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509) {

1027

gnutls_x509_crt_init(&cert.x509);

1028

rv = gnutls_x509_crt_import(cert.x509, &cert_list[0], GNUTLS_X509_FMT_DER);

1029

} else if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_OPENPGP) {

1030

gnutls_openpgp_crt_init(&cert.pgp);

1031

rv = gnutls_openpgp_crt_import(cert.pgp, &cert_list[0], GNUTLS_OPENPGP_FMT_RAW);

1032

} else return HTTP_FORBIDDEN;

1033

1034

if (rv < 0) {

1035

ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,

1036

"GnuTLS: Failed to Verify Peer: "

1037

"Failed to import peer certificates.");

1038

ret = HTTP_FORBIDDEN;

1039

goto exit;

1040

}

1041

1042

if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509) {

1043

apr_time_ansi_put(&expiration_time,

1044

gnutls_x509_crt_get_expiration_time(cert.x509));

1045

apr_time_ansi_put(&activation_time,

1046

gnutls_x509_crt_get_activation_time(cert.x509));

1047

1048

rv = gnutls_x509_crt_verify(cert.x509, ctxt->sc->ca_list,

1049

ctxt->sc->ca_list_size, 0, &status);

1050

} else {

1051

apr_time_ansi_put(&expiration_time,

1052

gnutls_openpgp_crt_get_expiration_time(cert.pgp));

1053

apr_time_ansi_put(&activation_time,

1054

gnutls_openpgp_crt_get_creation_time(cert.pgp));

1055

1056

rv = gnutls_openpgp_crt_verify_ring(cert.pgp, ctxt->sc->pgp_list,

1057

0, &status);

1058

}

1059

1060

if (rv < 0) {

1061

ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,

1062

"GnuTLS: Failed to Verify Peer certificate: (%d) %s",

1063

rv, gnutls_strerror(rv));

1064

if (rv == GNUTLS_E_NO_CERTIFICATE_FOUND)

1065

ap_log_rerror(APLOG_MARK, APLOG_EMERG, 0, r,

1066

"GnuTLS: No certificate was found for verification. Did you set the GnuTLSX509CAFile or GnuTLSPGPKeyringFile directives?");

1067

ret = HTTP_FORBIDDEN;

1068

goto exit;

1069

}

1070

1071

/* TODO: X509 CRL Verification. */

1072

/* May add later if anyone needs it.

1073

*/

1074

/* ret = gnutls_x509_crt_check_revocation(crt, crl_list, crl_list_size); */

1075

1076

expired = 0;

1077

cur_time = apr_time_now();

1078

if (activation_time > cur_time) {

1079

ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,

1080

"GnuTLS: Failed to Verify Peer: "

1081

"Peer Certificate is not yet activated.");

1082

expired = 1;

1083

}

1084

1085

if (expiration_time < cur_time) {

1086

ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,

1087

"GnuTLS: Failed to Verify Peer: "

1088

"Peer Certificate is expired.");

1089

expired = 1;

1090

}

1091

1092

if (status & GNUTLS_CERT_SIGNER_NOT_FOUND) {

1093

ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,

1094

"GnuTLS: Could not find Signer for Peer Certificate");

1095

}

1096

1097

if (status & GNUTLS_CERT_SIGNER_NOT_CA) {

1098

ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,

1099

"GnuTLS: Peer's Certificate signer is not a CA");

1100

}

1101

1102

if (status & GNUTLS_CERT_INVALID) {

1103

ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,

1104

"GnuTLS: Peer Certificate is invalid.");

1105

} else if (status & GNUTLS_CERT_REVOKED) {

1106

ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, r,

1107

"GnuTLS: Peer Certificate is revoked.");

1108

}

1109

1110

if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509)

1111

mgs_add_common_cert_vars(r, cert.x509, 1,

1112

ctxt->sc->export_certificates_enabled);

1113

else if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_OPENPGP)

1114

mgs_add_common_pgpcert_vars(r, cert.pgp, 1,

1115

ctxt->sc->export_certificates_enabled);

1116

1117

{

1118

/* days remaining */

1119

unsigned long remain =

1120

(apr_time_sec(expiration_time) -

1121

apr_time_sec(cur_time)) / 86400;

1122

apr_table_setn(r->subprocess_env, "SSL_CLIENT_V_REMAIN",

1123

apr_psprintf(r->pool, "%lu", remain));

1124

}

1125

1126

if (status == 0 && expired == 0) {

1127

apr_table_setn(r->subprocess_env, "SSL_CLIENT_VERIFY", "SUCCESS");

1128

ret = OK;

1129

} else {

1130

apr_table_setn(r->subprocess_env, "SSL_CLIENT_VERIFY", "FAILED");

1131

if (ctxt->sc->client_verify_mode == GNUTLS_CERT_REQUEST)

1132

ret = OK;

1133

else

1134

ret = HTTP_FORBIDDEN;

1135

}

1136

1137

exit:

1138

if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_X509)

1139

gnutls_x509_crt_deinit(cert.x509);

1140

else if (gnutls_certificate_type_get( ctxt->session) == GNUTLS_CRT_OPENPGP)

1141

gnutls_openpgp_crt_deinit(cert.pgp);

1142

return ret;

1143

1144

1145

}