Adding upstream version 2.4.57.upstream/2.4.57upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 310 insertions, 0 deletions

diff --git a/modules/tls/tls_cache.c b/modules/tls/tls_cache.c
new file mode 100644
index 0000000..de4be18
--- /dev/null
+++ b/modules/tls/tls_cache.c
@@ -0,0 +1,310 @@
+/* Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+#include <assert.h>
+#include <apr_lib.h>
+#include <apr_strings.h>
+#include <apr_hash.h>
+
+#include <httpd.h>
+#include <http_connection.h>
+#include <http_log.h>
+#include <ap_socache.h>
+#include <util_mutex.h>
+
+#include <rustls.h>
+
+#include "tls_conf.h"
+#include "tls_core.h"
+#include "tls_cache.h"
+
+extern module AP_MODULE_DECLARE_DATA tls_module;
+APLOG_USE_MODULE(tls);
+
+#define TLS_CACHE_DEF_PROVIDER      "shmcb"
+#define TLS_CACHE_DEF_DIR           "tls"
+#define TLS_CACHE_DEF_FILE          "session_cache"
+#define TLS_CACHE_DEF_SIZE          512000
+
+static const char *cache_provider_unknown(const char *name, apr_pool_t *p)
+{
+    apr_array_header_t *known;
+    const char *known_names;
+
+    known = ap_list_provider_names(p, AP_SOCACHE_PROVIDER_GROUP,
+                                   AP_SOCACHE_PROVIDER_VERSION);
+    known_names = apr_array_pstrcat(p, known, ',');
+    return apr_psprintf(p, "cache type '%s' not supported "
+                        "(known names: %s). Maybe you need to load the "
+                        "appropriate socache module (mod_socache_%s?).",
+                        name, known_names, name);
+}
+
+void tls_cache_pre_config(apr_pool_t *pconf, apr_pool_t *plog, apr_pool_t *ptemp)
+{
+    (void)plog;
+    (void)ptemp;
+    /* we make this visible, in case someone wants to configure it.
+     * this does not mean that we will really use it, which is determined
+     * by configuration and cache provider capabilities. */
+    ap_mutex_register(pconf, TLS_SESSION_CACHE_MUTEX_TYPE, NULL, APR_LOCK_DEFAULT, 0);
+}
+
+static const char *cache_init(tls_conf_global_t *gconf, apr_pool_t *p, apr_pool_t *ptemp)
+{
+    const char *err = NULL;
+    const char *name, *args = NULL;
+    apr_status_t rv;
+
+    if (gconf->session_cache) {
+        goto cleanup;
+    }
+    else if (!apr_strnatcasecmp("none", gconf->session_cache_spec)) {
+        gconf->session_cache_provider = NULL;
+        gconf->session_cache = NULL;
+        ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, gconf->ap_server, APLOGNO(10346)
+                     "session cache explicitly disabled");
+        goto cleanup;
+    }
+    else if (!apr_strnatcasecmp("default", gconf->session_cache_spec)) {
+        const char *path = TLS_CACHE_DEF_DIR;
+
+#if AP_MODULE_MAGIC_AT_LEAST(20180906, 2)
+        path = ap_state_dir_relative(p, path);
+#endif
+        gconf->session_cache_spec = apr_psprintf(p, "%s:%s/%s(%ld)",
+            TLS_CACHE_DEF_PROVIDER, path, TLS_CACHE_DEF_FILE, (long)TLS_CACHE_DEF_SIZE);
+        gconf->session_cache_spec = "shmcb:mod_tls-sesss(64000)";
+    }
+
+    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, gconf->ap_server, APLOGNO(10347)
+                 "Using session cache: %s", gconf->session_cache_spec);
+    name = gconf->session_cache_spec;
+    args = ap_strchr((char*)name, ':');
+    if (args) {
+        name = apr_pstrmemdup(p, name, (apr_size_t)(args - name));
+        ++args;
+    }
+    gconf->session_cache_provider = ap_lookup_provider(AP_SOCACHE_PROVIDER_GROUP,
+                                                       name, AP_SOCACHE_PROVIDER_VERSION);
+    if (!gconf->session_cache_provider) {
+        err = cache_provider_unknown(name, p);
+        goto cleanup;
+    }
+    err = gconf->session_cache_provider->create(&gconf->session_cache, args, ptemp, p);
+    if (err != NULL) goto cleanup;
+
+    if (gconf->session_cache_provider->flags & AP_SOCACHE_FLAG_NOTMPSAFE
+        && !gconf->session_cache_mutex) {
+        /* we need a global lock to access the cache */
+        rv = ap_global_mutex_create(&gconf->session_cache_mutex, NULL,
+            TLS_SESSION_CACHE_MUTEX_TYPE, NULL, gconf->ap_server, p, 0);
+        if (APR_SUCCESS != rv) {
+            err = apr_psprintf(p, "error setting up global %s mutex: %d",
+                TLS_SESSION_CACHE_MUTEX_TYPE, rv);
+            gconf->session_cache_mutex = NULL;
+            goto cleanup;
+        }
+    }
+
+cleanup:
+    if (NULL != err) {
+        gconf->session_cache_provider = NULL;
+        gconf->session_cache = NULL;
+    }
+    return err;
+}
+
+const char *tls_cache_set_specification(
+    const char *spec, tls_conf_global_t *gconf, apr_pool_t *p, apr_pool_t *ptemp)
+{
+    gconf->session_cache_spec = spec;
+    return cache_init(gconf, p, ptemp);
+}
+
+apr_status_t tls_cache_post_config(apr_pool_t *p, apr_pool_t *ptemp, server_rec *s)
+{
+    tls_conf_server_t *sc = tls_conf_server_get(s);
+    const char *err;
+    apr_status_t rv = APR_SUCCESS;
+
+    err = cache_init(sc->global, p, ptemp);
+    if (err) {
+        ap_log_error(APLOG_MARK, APLOG_WARNING, 0, s, APLOGNO(10348)
+                     "session cache [%s] could not be initialized, will continue "
+                     "without session one. Since this will impact performance, "
+                     "consider making use of the 'TLSSessionCache' directive. The "
+                     "error was: %s", sc->global->session_cache_spec, err);
+    }
+
+    if (sc->global->session_cache) {
+        struct ap_socache_hints hints;
+
+        ap_log_error(APLOG_MARK, APLOG_TRACE1, 0, s, "provider init session cache [%s]",
+                     sc->global->session_cache_spec);
+        memset(&hints, 0, sizeof(hints));
+        hints.avg_obj_size = 100;
+        hints.avg_id_len = 33;
+        hints.expiry_interval = 30;
+
+        rv = sc->global->session_cache_provider->init(
+            sc->global->session_cache, "mod_tls-sess", &hints, s, p);
+        if (APR_SUCCESS != rv) {
+            ap_log_error(APLOG_MARK, APLOG_EMERG, 0, s, APLOGNO(10349)
+                         "error initializing session cache.");
+        }
+    }
+    return rv;
+}
+
+void tls_cache_init_child(apr_pool_t *p, server_rec *s)
+{
+    tls_conf_server_t *sc = tls_conf_server_get(s);
+    const char *lockfile;
+    apr_status_t rv;
+
+    if (sc->global->session_cache_mutex) {
+        lockfile = apr_global_mutex_lockfile(sc->global->session_cache_mutex);
+        rv = apr_global_mutex_child_init(&sc->global->session_cache_mutex, lockfile, p);
+        if (APR_SUCCESS != rv) {
+            ap_log_error(APLOG_MARK, APLOG_ERR, rv, s, APLOGNO(10350)
+                         "Cannot reinit %s mutex (file `%s`)",
+                         TLS_SESSION_CACHE_MUTEX_TYPE, lockfile? lockfile : "-");
+        }
+    }
+}
+
+void tls_cache_free(server_rec *s)
+{
+    tls_conf_server_t *sc = tls_conf_server_get(s);
+    if (sc->global->session_cache_provider) {
+        sc->global->session_cache_provider->destroy(sc->global->session_cache, s);
+    }
+}
+
+static void tls_cache_lock(tls_conf_global_t *gconf)
+{
+    if (gconf->session_cache_mutex) {
+        apr_status_t rv = apr_global_mutex_lock(gconf->session_cache_mutex);
+        if (APR_SUCCESS != rv) {
+            ap_log_error(APLOG_MARK, APLOG_WARNING, rv, gconf->ap_server, APLOGNO(10351)
+                         "Failed to acquire TLS session cache lock");
+        }
+    }
+}
+
+static void tls_cache_unlock(tls_conf_global_t *gconf)
+{
+    if (gconf->session_cache_mutex) {
+        apr_status_t rv = apr_global_mutex_unlock(gconf->session_cache_mutex);
+        if (APR_SUCCESS != rv) {
+            ap_log_error(APLOG_MARK, APLOG_WARNING, rv, gconf->ap_server, APLOGNO(10352)
+                         "Failed to release TLS session cache lock");
+        }
+    }
+}
+
+static rustls_result tls_cache_get(
+    void *userdata,
+    const rustls_slice_bytes *key,
+    int remove_after,
+    unsigned char *buf,
+    size_t count,
+    size_t *out_n)
+{
+    conn_rec *c = userdata;
+    tls_conf_conn_t *cc = tls_conf_conn_get(c);
+    tls_conf_server_t *sc = tls_conf_server_get(cc->server);
+    apr_status_t rv = APR_ENOENT;
+    unsigned int vlen, klen;
+    const unsigned char *kdata;
+
+    if (!sc->global->session_cache) goto not_found;
+    tls_cache_lock(sc->global);
+
+    kdata = key->data;
+    klen = (unsigned int)key->len;
+    vlen = (unsigned int)count;
+    rv = sc->global->session_cache_provider->retrieve(
+        sc->global->session_cache, cc->server, kdata, klen, buf, &vlen, c->pool);
+
+    if (APLOGctrace4(c)) {
+        apr_ssize_t n = klen;
+        ap_log_cerror(APLOG_MARK, APLOG_TRACE4, rv, c, "retrieve key %d[%8x], found %d val",
+            klen, apr_hashfunc_default((const char*)kdata, &n), vlen);
+    }
+    if (remove_after || (APR_SUCCESS != rv && !APR_STATUS_IS_NOTFOUND(rv))) {
+        sc->global->session_cache_provider->remove(
+            sc->global->session_cache, cc->server, key->data, klen, c->pool);
+    }
+
+    tls_cache_unlock(sc->global);
+    if (APR_SUCCESS != rv) goto not_found;
+    cc->session_id_cache_hit = 1;
+    *out_n = count;
+    return RUSTLS_RESULT_OK;
+
+not_found:
+    *out_n = 0;
+    return RUSTLS_RESULT_NOT_FOUND;
+}
+
+static rustls_result tls_cache_put(
+    void *userdata,
+    const rustls_slice_bytes *key,
+    const rustls_slice_bytes *val)
+{
+    conn_rec *c = userdata;
+    tls_conf_conn_t *cc = tls_conf_conn_get(c);
+    tls_conf_server_t *sc = tls_conf_server_get(cc->server);
+    apr_status_t rv = APR_ENOENT;
+    apr_time_t expires_at;
+    unsigned int klen, vlen;
+    const unsigned char *kdata;
+
+    if (!sc->global->session_cache) goto not_stored;
+    tls_cache_lock(sc->global);
+
+    expires_at = apr_time_now() + apr_time_from_sec(300);
+    kdata = key->data;
+    klen = (unsigned int)key->len;
+    vlen = (unsigned int)val->len;
+    rv = sc->global->session_cache_provider->store(sc->global->session_cache, cc->server,
+                                                   kdata, klen, expires_at,
+                                                   (unsigned char*)val->data, vlen, c->pool);
+    if (APLOGctrace4(c)) {
+        ap_log_cerror(APLOG_MARK, APLOG_TRACE4, rv, c,
+            "stored %d key bytes, with %d val bytes", klen, vlen);
+    }
+    tls_cache_unlock(sc->global);
+    if (APR_SUCCESS != rv) goto not_stored;
+    return RUSTLS_RESULT_OK;
+
+not_stored:
+    return RUSTLS_RESULT_NOT_FOUND;
+}
+
+apr_status_t tls_cache_init_server(
+    rustls_server_config_builder *builder, server_rec *s)
+{
+    tls_conf_server_t *sc = tls_conf_server_get(s);
+
+    if (sc && sc->global->session_cache) {
+        ap_log_error(APLOG_MARK, APLOG_TRACE3, 0, s, "adding session persistence to rustls");
+        rustls_server_config_builder_set_persistence(
+            builder, tls_cache_get, tls_cache_put);
+    }
+    return APR_SUCCESS;
+}