mod_session_crypto.c revision 34d8caec1aea41e79366ccbb464675c049e310f7
/* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
#include "mod_session.h"
#include "apu_version.h"
#include "apr_base64.h" /* for apr_base64_decode et al */
#include "apr_lib.h"
#include "apr_strings.h"
#include "http_log.h"
#include "http_core.h"
#elif APU_HAVE_CRYPTO == 0
#else
#include "apr_crypto.h" /* for apr_*_crypt et al */
#define CRYPTO_KEY "session_crypto_context"
/**
* Structure to carry the per-dir session config.
*/
typedef struct {
int passphrases_set;
const char *cipher;
int cipher_set;
/**
* Structure to carry the server wide session config.
*/
typedef struct {
const char *library;
const char *params;
int library_set;
/**
* Initialise the encryption as per the current config.
*
* Returns APR_SUCCESS if successful.
*/
{
if (APR_SUCCESS != res) {
"no ciphers returned by APR. "
"session encryption not possible");
return res;
}
if (!(*cipher)) {
const void *key;
int sum = 0;
int offset = 0;
}
if (!options) {
}
else {
}
}
"cipher '%s' not recognised by crypto driver. "
return APR_EGENERAL;
}
return APR_SUCCESS;
}
/**
* Encrypt the string given as per the current config.
*
* Returns APR_SUCCESS if successful.
*/
{
apr_size_t ivSize = 0;
char *base64;
apr_size_t blockSize = 0;
const char *passphrase;
/* by default, return an empty string */
*out = "";
/* don't attempt to encrypt an empty string, trying to do so causes a segfault */
return APR_SUCCESS;
}
/* use a uuid as a salt value, and prepend it to our result */
apr_uuid_get(&salt);
if (res != APR_SUCCESS) {
return res;
}
/* encrypt using the first passphrase in the list */
(unsigned char *) (&salt), sizeof(apr_uuid_t),
if (APR_STATUS_IS_ENOKEY(res)) {
"the passphrase '%s' was empty", passphrase);
}
if (APR_STATUS_IS_EPADDING(res)) {
"padding is not supported for cipher");
}
if (APR_STATUS_IS_EKEYTYPE(res)) {
"the key type is not known");
}
if (APR_SUCCESS != res) {
"encryption could not be configured.");
return res;
}
if (APR_SUCCESS != res) {
"apr_crypto_block_encrypt_init failed");
return res;
}
/* encrypt the given string */
if (APR_SUCCESS != res) {
"apr_crypto_block_encrypt failed");
return res;
}
if (APR_SUCCESS != res) {
"apr_crypto_block_encrypt_finish failed");
return res;
}
encryptlen += tlen;
/* prepend the salt and the iv to the result */
/* base64 encode the result */
sizeof(apr_uuid_t) + 1)
* sizeof(char));
return res;
}
/**
* Decrypt the string given as per the current config.
*
* Returns APR_SUCCESS if successful.
*/
{
apr_size_t ivSize = 0;
char *decoded;
apr_size_t blockSize = 0;
int i = 0;
/* strip base64 from the string */
if (res != APR_SUCCESS) {
return res;
}
/* try each passphrase in turn */
/* encrypt using the first passphrase in the list */
(unsigned char *)decoded, sizeof(apr_uuid_t),
if (APR_STATUS_IS_ENOKEY(res)) {
"the passphrase '%s' was empty", passphrase);
continue;
}
else if (APR_STATUS_IS_EPADDING(res)) {
"padding is not supported for cipher");
continue;
}
else if (APR_STATUS_IS_EKEYTYPE(res)) {
"the key type is not known");
continue;
}
else if (APR_SUCCESS != res) {
"encryption could not be configured.");
continue;
}
/* sanity check - decoded too short? */
"too short to decrypt, skipping");
res = APR_ECRYPT;
continue;
}
/* bypass the salt at the start of the decoded block */
slider += sizeof(apr_uuid_t);
len -= sizeof(apr_uuid_t);
r->pool);
if (APR_SUCCESS != res) {
"apr_crypto_block_decrypt_init failed");
continue;
}
/* bypass the iv at the start of the decoded block */
/* decrypt the given string */
if (res) {
"apr_crypto_block_decrypt failed");
continue;
}
if (APR_SUCCESS != res) {
"apr_crypto_block_decrypt_finish failed");
continue;
}
decryptedlen += tlen;
decrypted[decryptedlen] = 0;
break;
}
if (APR_SUCCESS != res) {
"decryption failed");
}
return res;
}
/**
* Crypto encoding for the session.
*
* @param r The request pointer.
* @param z A pointer to where the session will be written.
*/
{
const apr_crypto_t *f = NULL;
"encrypt session failed");
return res;
}
}
return OK;
}
/**
* Crypto decoding for the session.
*
* @param r The request pointer.
* @param z A pointer to where the session will be written.
*/
session_rec * z)
{
const apr_crypto_t *f = NULL;
apr_pool_userdata_get((void **)&f, CRYPTO_KEY,
if (res != APR_SUCCESS) {
"decrypt session failed, wrong passphrase?");
return res;
}
}
return OK;
}
/**
* Initialise the SSL in the post_config hook.
*/
{
apr_crypto_t *f = NULL;
/* session_crypto_init() will be called twice. Don't bother
* going through all of the initialization on the first call
* because it will just be thrown away.*/
return OK;
}
rv = apr_crypto_init(p);
if (APR_SUCCESS != rv) {
"APR crypto could not be initialised");
return rv;
}
if (APR_EREINIT == rv) {
"warning: crypto for '%s' was already initialised, "
rv = APR_SUCCESS;
}
"The crypto library '%s' could not be loaded: %s (%s: %d)", conf->library, err->msg, err->reason, err->rc);
return rv;
}
if (APR_ENOTIMPL == rv) {
"The crypto library '%s' could not be found",
return rv;
}
"The crypto library '%s' could not be loaded",
return rv;
}
if (APR_SUCCESS != rv) {
"The crypto library '%s' could not be initialised",
return rv;
}
"The crypto library '%s' was loaded successfully",
apr_pool_userdata_set((const void *)f, CRYPTO_KEY,
}
return OK;
}
{
/* if no library has been configured, set the recommended library
* as a sensible default.
*/
#endif
return (void *) new;
}
{
/* default cipher AES256-SHA */
return (void *) new;
}
{
session_crypto_dir_conf *new = (session_crypto_dir_conf *) apr_pcalloc(p, sizeof(session_crypto_dir_conf));
return new;
}
{
return err;
}
return NULL;
}
{
const char **passphrase;
*passphrase = arg;
return NULL;
}
const char *filename)
{
char buffer[MAX_STRING_LEN];
char *arg;
const char *args;
if (rv != APR_SUCCESS) {
}
break;
}
}
}
return NULL;
}
{
return NULL;
}
static const command_rec session_crypto_cmds[] =
{
"The passphrase(s) used to encrypt the session. First will be used for encryption, all phrases will be accepted for decryption"),
AP_INIT_TAKE1("SessionCryptoPassphraseFile", set_crypto_passphrase_file, NULL, RSRC_CONF|ACCESS_CONF,
"File containing passphrase(s) used to encrypt the session, one per line. First will be used for encryption, all phrases will be accepted for decryption"),
"The underlying crypto cipher to use"),
"The underlying crypto library driver to use"),
{ NULL }
};
static void register_hooks(apr_pool_t * p)
{
}
{
create_session_crypto_dir_config, /* dir config creater */
merge_session_crypto_dir_config, /* dir merger --- default is to override */
create_session_crypto_config, /* server config */
NULL, /* merge server config */
session_crypto_cmds, /* command apr_table_t */
register_hooks /* register hooks */
};
#endif