7 changed files with 270 additions and 2 deletions
@ -0,0 +1,217 @@
|
||||
#include "first.h" |
||||
|
||||
#include <errno.h> |
||||
#include <string.h> |
||||
|
||||
#ifndef USE_OPENSSL_KERBEROS |
||||
#ifndef OPENSSL_NO_KRB5 |
||||
#define OPENSSL_NO_KRB5 |
||||
#endif |
||||
#endif |
||||
|
||||
#include <openssl/ssl.h> |
||||
#include <openssl/err.h> |
||||
|
||||
#include "base.h" |
||||
#include "log.h" |
||||
#include "plugin.h" |
||||
|
||||
typedef struct { |
||||
int dummy; |
||||
} plugin_config; |
||||
|
||||
typedef struct { |
||||
PLUGIN_DATA; |
||||
plugin_config **config_storage; |
||||
plugin_config conf; |
||||
} plugin_data; |
||||
|
||||
typedef struct { |
||||
SSL *ssl; |
||||
buffer *tlsext_server_name; |
||||
unsigned int renegotiations; /* count of SSL_CB_HANDSHAKE_START */ |
||||
int request_env_patched; |
||||
plugin_config conf; |
||||
} handler_ctx; |
||||
|
||||
|
||||
static handler_ctx * |
||||
handler_ctx_init (void) |
||||
{ |
||||
handler_ctx *hctx = calloc(1, sizeof(*hctx)); |
||||
force_assert(hctx); |
||||
return hctx; |
||||
} |
||||
|
||||
|
||||
static void |
||||
handler_ctx_free (handler_ctx *hctx) |
||||
{ |
||||
buffer_free(hctx->tlsext_server_name); |
||||
free(hctx); |
||||
} |
||||
|
||||
|
||||
INIT_FUNC(mod_openssl_init) |
||||
{ |
||||
return calloc(1, sizeof(plugin_data)); |
||||
} |
||||
|
||||
|
||||
FREE_FUNC(mod_openssl_free) |
||||
{ |
||||
plugin_data *p = p_d; |
||||
if (!p) return HANDLER_GO_ON; |
||||
|
||||
if (p->config_storage) { |
||||
for (size_t i = 0; i < srv->config_context->used; ++i) { |
||||
plugin_config *s = p->config_storage[i]; |
||||
if (NULL == s) continue; |
||||
|
||||
free(s); |
||||
} |
||||
free(p->config_storage); |
||||
} |
||||
|
||||
free(p); |
||||
|
||||
UNUSED(srv); |
||||
return HANDLER_GO_ON; |
||||
} |
||||
|
||||
|
||||
SETDEFAULTS_FUNC(mod_openssl_set_defaults) |
||||
{ |
||||
UNUSED(srv); |
||||
UNUSED(p_d); |
||||
return HANDLER_GO_ON; |
||||
} |
||||
|
||||
|
||||
#define PATCH(x) \ |
||||
p->conf.x = s->x; |
||||
static int |
||||
mod_openssl_patch_connection (server *srv, connection *con, handler_ctx *p) |
||||
{ |
||||
UNUSED(srv); |
||||
UNUSED(con); |
||||
UNUSED(p); |
||||
return 0; |
||||
} |
||||
#undef PATCH |
||||
|
||||
|
||||
CONNECTION_FUNC(mod_openssl_handle_con_accept) |
||||
{ |
||||
server_socket *srv_sock = con->srv_socket; |
||||
if (!srv_sock->is_ssl) return HANDLER_GO_ON; |
||||
|
||||
{ |
||||
plugin_data *p = p_d; |
||||
handler_ctx *hctx = handler_ctx_init(); |
||||
con->plugin_ctx[p->id] = hctx; |
||||
mod_openssl_patch_connection(srv, con, hctx); |
||||
} |
||||
|
||||
return HANDLER_GO_ON; |
||||
} |
||||
|
||||
|
||||
CONNECTION_FUNC(mod_openssl_handle_con_shut_wr) |
||||
{ |
||||
plugin_data *p = p_d; |
||||
handler_ctx *hctx = con->plugin_ctx[p->id]; |
||||
if (NULL == hctx) return HANDLER_GO_ON; |
||||
|
||||
UNUSED(srv); |
||||
return HANDLER_GO_ON; |
||||
} |
||||
|
||||
|
||||
CONNECTION_FUNC(mod_openssl_handle_con_close) |
||||
{ |
||||
plugin_data *p = p_d; |
||||
handler_ctx *hctx = con->plugin_ctx[p->id]; |
||||
if (NULL == hctx) return HANDLER_GO_ON; |
||||
|
||||
handler_ctx_free(hctx); |
||||
|
||||
UNUSED(srv); |
||||
return HANDLER_GO_ON; |
||||
} |
||||
|
||||
|
||||
CONNECTION_FUNC(mod_openssl_handle_request_env) |
||||
{ |
||||
plugin_data *p = p_d; |
||||
handler_ctx *hctx = con->plugin_ctx[p->id]; |
||||
if (NULL == hctx) return HANDLER_GO_ON; |
||||
if (hctx->request_env_patched) return HANDLER_GO_ON; |
||||
hctx->request_env_patched = 1; |
||||
|
||||
UNUSED(srv); |
||||
return HANDLER_GO_ON; |
||||
} |
||||
|
||||
|
||||
CONNECTION_FUNC(mod_openssl_handle_uri_raw) |
||||
{ |
||||
/* mod_openssl must be loaded prior to mod_auth
|
||||
* if mod_openssl is configured to set REMOTE_USER based on client cert */ |
||||
/* mod_openssl must be loaded after mod_extforward
|
||||
* if mod_openssl config is based on lighttpd.conf remote IP conditional |
||||
* using remote IP address set by mod_extforward */ |
||||
plugin_data *p = p_d; |
||||
handler_ctx *hctx = con->plugin_ctx[p->id]; |
||||
if (NULL == hctx) return HANDLER_GO_ON; |
||||
|
||||
if (con->conf.ssl_verifyclient) { |
||||
mod_openssl_handle_request_env(srv, con, p); |
||||
} |
||||
|
||||
return HANDLER_GO_ON; |
||||
} |
||||
|
||||
|
||||
CONNECTION_FUNC(mod_openssl_handle_request_reset) |
||||
{ |
||||
plugin_data *p = p_d; |
||||
handler_ctx *hctx = con->plugin_ctx[p->id]; |
||||
if (NULL == hctx) return HANDLER_GO_ON; |
||||
|
||||
/*
|
||||
* XXX: preserve (for now) lighttpd historical behavior which resets |
||||
* tlsext_server_name after each request, meaning SNI is valid only for |
||||
* initial request, prior to reading request headers. Probably should |
||||
* instead validate that Host header (or authority in request line) |
||||
* matches SNI server name for all requests on the connection on which |
||||
* SNI extension has been provided. |
||||
*/ |
||||
buffer_reset(hctx->tlsext_server_name); |
||||
hctx->request_env_patched = 0; |
||||
|
||||
UNUSED(srv); |
||||
return HANDLER_GO_ON; |
||||
} |
||||
|
||||
|
||||
int mod_openssl_plugin_init (plugin *p); |
||||
int mod_openssl_plugin_init (plugin *p) |
||||
{ |
||||
p->version = LIGHTTPD_VERSION_ID; |
||||
p->name = buffer_init_string("openssl"); |
||||
p->init = mod_openssl_init; |
||||
p->cleanup = mod_openssl_free; |
||||
p->set_defaults = mod_openssl_set_defaults; |
||||
|
||||
p->handle_connection_accept = mod_openssl_handle_con_accept; |
||||
p->handle_connection_shut_wr = mod_openssl_handle_con_shut_wr; |
||||
p->handle_connection_close = mod_openssl_handle_con_close; |
||||
p->handle_uri_raw = mod_openssl_handle_uri_raw; |
||||
p->handle_request_env = mod_openssl_handle_request_env; |
||||
p->connection_reset = mod_openssl_handle_request_reset; |
||||
|
||||
p->data = NULL; |
||||
|
||||
return 0; |
||||
} |
||||
Loading…
Reference in new issue