Changeset 654805357ada928555def99685df092926437bac

Timestamp:

03/04/05 17:51:51 (3 years ago)

Author:

Rémi Denis-Courmont <rem@videolan.org>

git-committer:

Rémi Denis-Courmont <rem@videolan.org> 1109955111 +0000

git-parent:

[a8f95d102633b2f9ed471bb1e49d1f8de656e97f]

git-author:

Rémi Denis-Courmont <rem@videolan.org> 1109955111 +0000

Message:

TLS session resumption support

Files:

• AUTHORS (modified) (1 diff)
• modules/misc/gnutls.c (modified) (14 diffs)

AUTHORS

@@ -334 +334 @@
-S: France
-
+N: R� Denis-Courmont
+E: rem@videolan.org
+C: courmisch
+D: SSL/TLS support (core, HTTP server, HTTP input)
+S: France
+

modules/misc/gnutls.c

@@ -2 +2 @@
- * tls.c
- *****************************************************************************
-
+-2005
- * $Id: httpd.c 8263 2004-07-24 09:06:58Z courmisch $
- *
@@ -42 +42 @@
-#include <gnutls/gnutls.h>
-
-
-
+
+
+
-
-/*****************************************************************************
@@ -55 +56 @@
-    "Allows you to modify the Diffie-Hellman prime's number of bits " \
-    "(used for TLS or SSL-based server-side encryption)." )
+
+#define CACHE_EXPIRATION_TEXT N_("Expiration time for resumed TLS sessions")
+#define CACHE_EXPIRATION_LONGTEXT N_( \
+    "Defines the delay before resumed TLS sessions will be expired " \
+    "(in seconds)." )
+
+#define CACHE_SIZE_TEXT N_("Number of resumed TLS sessions")
+#define CACHE_SIZE_LONGTEXT N_( \
+    "Allows you to modify the maximum number of resumed TLS sessions that " \
+    "the cache will hold." )
+
-
-vlc_module_begin();
@@ -65 +77 @@
-    add_integer( "dh-bits", DH_BITS, NULL, DH_BITS_TEXT,
-                 DH_BITS_LONGTEXT, VLC_TRUE );
+    add_integer( "tls-cache-expiration", CACHE_EXPIRATION, NULL,
+                 CACHE_EXPIRATION_TEXT, CACHE_EXPIRATION_LONGTEXT, VLC_TRUE );
+    add_integer( "tls-cache-size", CACHE_SIZE, NULL, CACHE_SIZE_TEXT,
+                 CACHE_SIZE_LONGTEXT, VLC_TRUE );
-vlc_module_end();
-
-
+#define MAX_SESSION_ID    32
+#define MAX_SESSION_DATA  1024
+
+typedef struct saved_session_t
+{
+    char id[MAX_SESSION_ID];
+    char data[MAX_SESSION_DATA];
+
+    unsigned i_idlen;
+    unsigned i_datalen;
+} saved_session_t;
+
-
-typedef struct tls_server_sys_t
-{
-
-
+
+
+
+
+
+
+
-} tls_server_sys_t;
-
@@ -87 +120 @@
-    gnutls_certificate_credentials x509_cred;
-} tls_client_sys_t;
+
+
+static int
+_get_Int (vlc_object_t *p_this, const char *var)
+{
+    vlc_value_t value;
+
+    if( var_Get( p_this, var, &value ) != VLC_SUCCESS )
+    {
+        var_Create( p_this, var, VLC_VAR_INTEGER | VLC_VAR_DOINHERIT );
+        var_Get( p_this, var, &value );
+    }
+
+    return value.i_int;
+}
+
+#define get_Int( a, b ) _get_Int( (vlc_object_t *)(a), (b) )
-
-
@@ -313 +363 @@
-
-/*****************************************************************************
+ * TLS session resumption callbacks
+ *****************************************************************************/
+static int cb_store( void *p_server, gnutls_datum key, gnutls_datum data )
+{
+    tls_server_sys_t *p_sys = ((tls_server_t *)p_server)->p_sys;
+
+    if( ( p_sys->i_cache_size == 0 )
+     || ( key.size > MAX_SESSION_ID )
+     || ( data.size > MAX_SESSION_DATA ) )
+        return -1;
+
+    vlc_mutex_lock( &p_sys->cache_lock );
+
+    memcpy( p_sys->p_store->id, key.data, key.size);
+    memcpy( p_sys->p_store->data, data.data, data.size );
+    p_sys->p_store->i_idlen = key.size;
+    p_sys->p_store->i_datalen = data.size;
+
+    p_sys->p_store++;
+    if( ( p_sys->p_store - p_sys->p_cache ) == p_sys->i_cache_size )
+        p_sys->p_store = p_sys->p_cache;
+
+    vlc_mutex_unlock( &p_sys->cache_lock );
+
+    return 0;
+}
+
+
+static const gnutls_datum err_datum = { NULL, 0 };
+
+static gnutls_datum cb_fetch( void *p_server, gnutls_datum key )
+{
+    tls_server_sys_t *p_sys = ((tls_server_t *)p_server)->p_sys;
+    saved_session_t *p_session, *p_end;
+
+    p_session = p_sys->p_cache;
+    p_end = p_session + p_sys->i_cache_size;
+
+    vlc_mutex_lock( &p_sys->cache_lock );
+
+    while( p_session < p_end )
+    {
+        if( ( p_session->i_idlen == key.size )
+         && !memcmp( p_session->id, key.data, key.size ) )
+        {
+            gnutls_datum data;
+
+            data.size = p_session->i_datalen;
+
+            data.data = gnutls_malloc( data.size );
+            if( data.data == NULL )
+            {
+                vlc_mutex_unlock( &p_sys->cache_lock );
+                return err_datum;
+            }
+
+            memcpy( data.data, p_session->data, data.size );
+            vlc_mutex_unlock( &p_sys->cache_lock );
+            return data;
+        }
+        p_session++;
+    }
+
+    vlc_mutex_unlock( &p_sys->cache_lock );
+
+    return err_datum;
+}
+
+
+static int cb_delete( void *p_server, gnutls_datum key )
+{
+    tls_server_sys_t *p_sys = ((tls_server_t *)p_server)->p_sys;
+    saved_session_t *p_session, *p_end;
+
+    p_session = p_sys->p_cache;
+    p_end = p_session + p_sys->i_cache_size;
+
+    vlc_mutex_lock( &p_sys->cache_lock );
+
+    while( p_session < p_end )
+    {
+        if( ( p_session->i_idlen == key.size )
+         && !memcmp( p_session->id, key.data, key.size ) )
+        {
+            p_session->i_datalen = p_session->i_idlen = 0;
+            vlc_mutex_unlock( &p_sys->cache_lock );
+            return 0;
+        }
+        p_session++;
+    }
+
+    vlc_mutex_unlock( &p_sys->cache_lock );
+
+    return -1;
+}
+
+
+/*****************************************************************************
- * tls_ServerSessionPrepare:
- *****************************************************************************
@@ -321 +469 @@
-{
-    tls_session_t *p_session;
-tls_session_sys_t *p_sys
+gnutls_session session
-    int i_val;
-
-
-
-
-
-
-
+
+
-    if( i_val != 0 )
-    {
-        msg_Err( p_server->p_tls, "Cannot initialize TLS session : %s",
-                 gnutls_strerror( i_val ) );
-        free( p_sys );
-        return NULL;
-    }
-   
-p_sys->
+
-    if( i_val < 0 )
-    {
-        msg_Err( p_server->p_tls, "Cannot set ciphers priorities : %s",
-                 gnutls_strerror( i_val ) );
-
-
-
-
-
-
+
+
+
+
+
-                                    ((tls_server_sys_t *)(p_server->p_sys))
-                                    ->x509_cred );
@@ -355 +496 @@
-        msg_Err( p_server->p_tls, "Cannot set TLS session credentials : %s",
-                 gnutls_strerror( i_val ) );
-
-
+
-        return NULL;
-    }
@@ -364 +504 @@
-                                           GNUTLS_CERT_REQUEST ); */
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
-
-    p_session = malloc( sizeof (struct tls_session_t) );
-    if( p_session == NULL )
-    {
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-    p_session->p_tls = p_server->p_tls;
-    p_session->p_server = p_server;
-    p_session->p_sys = p_sys;
-    p_session->sock.p_sys = p_session;
-    p_session->sock.pf_send = gnutls_Send;
@@ -403 +552 @@
-gnutls_ServerDelete( tls_server_t *p_server )
-{
-
-
-
-
+
+
+
+
+
+
+
+
-    free( p_server );
-}
@@ -489 +642 @@
-        return NULL;
-
+    p_server_sys->i_cache_size = get_Int( p_this, "tls-cache-size" );
+    p_server_sys->p_cache = (struct saved_session_t *)
+                            calloc( p_server_sys->i_cache_size,
+                                    sizeof( struct saved_session_t ) );
+    if( p_server_sys->p_cache == NULL )
+    {
+        free( p_server_sys );
+        return NULL;
+    }
+    p_server_sys->p_store = p_server_sys->p_cache;
+    /* FIXME: check for errors */
+    vlc_mutex_init( p_this, &p_server_sys->cache_lock );
+
-    /* Sets server's credentials */
-    val = gnutls_certificate_allocate_credentials( &p_server_sys->x509_cred );
@@ -511 +677 @@
-    }
-
-
+
+
+
+
-    val = gnutls_dh_params_init( &p_server_sys->dh_params );
-    if( val >= 0 )
-    {
-        vlc_value_t bits;
-
-        if( var_Get( p_this, "dh-bits", &bits ) != VLC_SUCCESS )
-        {
-            var_Create( p_this, "dh-bits",
-                        VLC_VAR_INTEGER | VLC_VAR_DOINHERIT );
-            var_Get( p_this, "dh-bits", &bits );
-        }
-
-        msg_Dbg( p_this, "Computing Diffie Hellman ciphers parameters" );
-        val = gnutls_dh_params_generate2( p_server_sys->dh_params,
-bits.i_int
+get_Int( p_this, "dh-bits" )
-    }
-    if( val < 0 )
@@ -564 +724 @@
-vlc_object_t *__p_gcry_data;
-
- (void **p_sys
+( void **p_sys 
-{
-    int i_val;
- (sizeof (vlc_mutex_t)
+( sizeof( vlc_mutex_t ) 
-
-    if( p_lock == NULL)
-        return ENOMEM;
-
-
- (i_val
- (p_lock
+ 
+( i_val 
+( p_lock 
-    else
-        *p_sys = p_lock;
@@ -580 +740 @@
-}
-
- (void **p_sys
+( void **p_sys 
-{
-    int i_val;
-    vlc_mutex_t *p_lock = (vlc_mutex_t *)*p_sys;
-
- (p_lock
- (p_lock
+( p_lock 
+( p_lock 
-    return i_val;
-}
-
- (void **p_sys
-
- ((vlc_mutex_t *)*p_sys
-
-
- (void **lock
-
- ((vlc_mutex_t *)*lock
+( void **p_sys 
+
+( (vlc_mutex_t *)*p_sys 
+
+
+( void **lock 
+
+( (vlc_mutex_t *)*lock 
-}
-