mod_ssl: Redesign NPN (Next Protocol Negotiation) API to avoid use of

hooks API and inter-module hard linkage:

* modules/ssl/mod_ssl.h: Remove NPN hooks, add "modssl_register_npn"
  optional function and callback function type declarations for
  ssl_npn_advertise_protos, ssl_npn_proto_negotiated.

* modules/ssl/mod_ssl.c: Drop hooks.
  (modssl_register_npn): New optional function implementation.
  (ssl_register_hooks): Register it.

* modules/ssl/ssl_private.h (SSLConnRec): Add npn_advertfns,
  npn_negofns array fields.

* modules/ssl/ssl_engine_kernel.c (ssl_callback_AdvertiseNextProtos): 
  Replace use of hook API with array iteration.

* modules/ssl/ssl_engine_io.c (ssl_io_filter_input): Likewise.

Reviewed by: Matthew Steele <mdsteele google.com>


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1487772 13f79535-47bb-0310-9956-ffa450edef68

modules/ssl/mod_ssl.c

@@ -285,18 +285,6 @@ static const command_rec ssl_config_cmds[] = {
     AP_END_CMD
 };
 
-/* Implement 'modssl_run_npn_advertise_protos_hook'. */
-APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(
-    modssl, AP, int, npn_advertise_protos_hook,
-    (conn_rec *connection, apr_array_header_t *protos),
-    (connection, protos), OK, DECLINED)
-
-/* Implement 'modssl_run_npn_proto_negotiated_hook'. */
-APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL(
-    modssl, AP, int, npn_proto_negotiated_hook,
-    (conn_rec *connection, const char *proto_name, apr_size_t proto_name_len),
-    (connection, proto_name, proto_name_len), OK, DECLINED)
-
 /*
  *  the various processing hooks
  */
@@ -444,6 +432,37 @@ int ssl_engine_disable(conn_rec *c)
     return 1;
 }
 
+static int modssl_register_npn(conn_rec *c, 
+                               ssl_npn_advertise_protos advertisefn,
+                               ssl_npn_proto_negotiated negotiatedfn)
+{
+#ifdef HAVE_TLS_NPN
+    SSLConnRec *sslconn = myConnConfig(c);
+
+    if (!sslconn) {
+        return DECLINED;
+    }
+
+    if (!sslconn->npn_advertfns) {
+        sslconn->npn_advertfns = 
+            apr_array_make(c->pool, 5, sizeof(ssl_npn_advertise_protos));
+        sslconn->npn_negofns = 
+            apr_array_make(c->pool, 5, sizeof(ssl_npn_proto_negotiated));
+    }
+
+    if (advertisefn)
+        APR_ARRAY_PUSH(sslconn->npn_advertfns, ssl_npn_advertise_protos) =
+            advertisefn;
+    if (negotiatedfn)
+        APR_ARRAY_PUSH(sslconn->npn_negofns, ssl_npn_proto_negotiated) =
+            negotiatedfn;
+
+    return OK;
+#else
+    return DECLINED;
+#endif
+}
+
 int ssl_init_ssl_connection(conn_rec *c, request_rec *r)
 {
     SSLSrvConfigRec *sc;
@@ -615,6 +634,7 @@ static void ssl_register_hooks(apr_pool_t *p)
 
     APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
     APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
+    APR_REGISTER_OPTIONAL_FN(modssl_register_npn);
 
     ap_register_auth_provider(p, AUTHZ_PROVIDER_GROUP, "ssl",
                               AUTHZ_PROVIDER_VERSION,

modules/ssl/mod_ssl.h

@@ -63,26 +63,40 @@ APR_DECLARE_OPTIONAL_FN(int, ssl_proxy_enable, (conn_rec *));
 
 APR_DECLARE_OPTIONAL_FN(int, ssl_engine_disable, (conn_rec *));
 
-/** The npn_advertise_protos optional hook allows other modules to add entries
- * to the list of protocol names advertised by the server during the Next
- * Protocol Negotiation (NPN) portion of the SSL handshake.  The hook callee is
- * given the connection and an APR array; it should push one or more char*'s
- * pointing to null-terminated strings (such as "http/1.1" or "spdy/2") onto
- * the array and return OK, or do nothing and return DECLINED. */
-APR_DECLARE_EXTERNAL_HOOK(modssl, AP, int, npn_advertise_protos_hook,
-                          (conn_rec *connection, apr_array_header_t *protos))
+/** The npn_advertise_protos callback allows another modules to add
+ * entries to the list of protocol names advertised by the server
+ * during the Next Protocol Negotiation (NPN) portion of the SSL
+ * handshake.  The callback is given the connection and an APR array;
+ * it should push one or more char*'s pointing to NUL-terminated
+ * strings (such as "http/1.1" or "spdy/2") onto the array and return
+ * OK.  To prevent further processing of (other modules') callbacks,
+ * return DONE. */
+typedef int (*ssl_npn_advertise_protos)(conn_rec *connection, 
+                                        apr_array_header_t *protos);
 
-/** The npn_proto_negotiated optional hook allows other modules to discover the
- * name of the protocol that was chosen during the Next Protocol Negotiation
- * (NPN) portion of the SSL handshake.  Note that this may be the empty string
- * (in which case modules should probably assume HTTP), or it may be a protocol
- * that was never even advertised by the server.  The hook callee is given the
- * connection, a non-null-terminated string containing the protocol name, and
- * the length of the string; it should do something appropriate (i.e. insert or
- * remove filters) and return OK, or do nothing and return DECLINED. */
-APR_DECLARE_EXTERNAL_HOOK(modssl, AP, int, npn_proto_negotiated_hook,
-                          (conn_rec *connection, const char *proto_name,
-                           apr_size_t proto_name_len))
+/** The npn_proto_negotiated callback allows other modules to discover
+ * the name of the protocol that was chosen during the Next Protocol
+ * Negotiation (NPN) portion of the SSL handshake.  Note that this may
+ * be the empty string (in which case modules should probably assume
+ * HTTP), or it may be a protocol that was never even advertised by
+ * the server.  The callback is given the connection, a
+ * non-NUL-terminated string containing the protocol name, and the
+ * length of the string; it should do something appropriate
+ * (i.e. insert or remove filters) and return OK.  To prevent further
+ * processing of (other modules') callbacks, return DONE. */
+typedef int (*ssl_npn_proto_negotiated)(conn_rec *connection, 
+                                        const char *proto_name,
+                                        apr_size_t proto_name_len);
+
+/* An optional function which can be used to register a pair of
+ * callbacks for NPN handling.  This optional function should be
+ * invoked from a pre_connection hook which runs *after* mod_ssl.c's
+ * pre_connection hook.  The function returns OK if the callbacks are
+ * register, or DECLINED otherwise (for example if mod_ssl does not
+l * support NPN).  */
+APR_DECLARE_OPTIONAL_FN(int, modssl_register_npn, (conn_rec *conn, 
+                                                   ssl_npn_advertise_protos advertisefn,
+                                                   ssl_npn_proto_negotiated negotiatedfn));
 
 #endif /* __MOD_SSL_H__ */
 /** @} */

modules/ssl/ssl_engine_io.c

@@ -1422,16 +1422,27 @@ static apr_status_t ssl_io_filter_input(ap_filter_t *f,
      * which protocol was decided upon and inform other modules by calling
      * npn_proto_negotiated_hook. */
     if (!inctx->npn_finished) {
+        SSLConnRec *sslconn = myConnConfig(f->c);
         const unsigned char *next_proto = NULL;
         unsigned next_proto_len = 0;
-
-        SSL_get0_next_proto_negotiated(
-            inctx->ssl, &next_proto, &next_proto_len);
-        ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, f->c,
-                      APLOGNO(02306) "SSL NPN negotiated protocol: '%*s'",
-                      next_proto_len, (const char*)next_proto);
-        modssl_run_npn_proto_negotiated_hook(
-            f->c, (const char*)next_proto, next_proto_len);
+        int n;
+
+        if (sslconn->npn_negofns) {
+            SSL_get0_next_proto_negotiated(
+                inctx->ssl, &next_proto, &next_proto_len);
+            ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, f->c,
+                          APLOGNO(02306) "SSL NPN negotiated protocol: '%*s'",
+                          next_proto_len, (const char*)next_proto);
+
+            for (n = 0; n < sslconn->npn_negofns->nelts; n++) {
+                ssl_npn_proto_negotiated fn = 
+                    APR_ARRAY_IDX(sslconn->npn_negofns, n, ssl_npn_proto_negotiated);
+
+                if (fn(f->c, (const char *)next_proto, next_proto_len) == DONE)
+                    break;
+            }
+        }
+
         inctx->npn_finished = 1;
     }
 #endif

modules/ssl/ssl_engine_kernel.c

@@ -2186,6 +2186,7 @@ int ssl_callback_AdvertiseNextProtos(SSL *ssl, const unsigned char **data_out,
                                      unsigned int *size_out, void *arg)
 {
     conn_rec *c = (conn_rec*)SSL_get_app_data(ssl);
+    SSLConnRec *sslconn = myConnConfig(c);
     apr_array_header_t *protos;
     int num_protos;
     unsigned int size;
@@ -2196,16 +2197,22 @@ int ssl_callback_AdvertiseNextProtos(SSL *ssl, const unsigned char **data_out,
     *data_out = NULL;
     *size_out = 0;
 
-    /* If the connection object is not available, then there's nothing for us
-     * to do. */
-    if (c == NULL) {
+    /* If the connection object is not available, or there are no NPN
+     * hooks registered, then there's nothing for us to do. */
+    if (c == NULL || sslconn->npn_advertfns == NULL) {
         return SSL_TLSEXT_ERR_OK;
     }
 
     /* Invoke our npn_advertise_protos hook, giving other modules a chance to
      * add alternate protocol names to advertise. */
-    protos = apr_array_make(c->pool, 0, sizeof(char*));
-    modssl_run_npn_advertise_protos_hook(c, protos);
+    protos = apr_array_make(c->pool, 0, sizeof(char *));
+    for (i = 0; i < sslconn->npn_advertfns->nelts; i++) {
+        ssl_npn_advertise_protos fn = 
+            APR_ARRAY_IDX(sslconn->npn_advertfns, i, ssl_npn_advertise_protos);
+
+        if (fn(c, protos) == DONE)
+            break;
+    }
     num_protos = protos->nelts;
 
     /* We now have a list of null-terminated strings; we need to concatenate

modules/ssl/ssl_private.h

@@ -496,6 +496,12 @@ typedef struct {
                      * connection */
     } reneg_state;
 
+#ifdef HAVE_TLS_NPN
+    /* Poor man's inter-module optional hooks for NPN. */
+    apr_array_header_t *npn_advertfns; /* list of ssl_npn_advertise_protos callbacks */
+    apr_array_header_t *npn_negofns; /* list of ssl_npn_proto_negotiated callbacks. */
+#endif
+
     server_rec *server;
 } SSLConnRec;