diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c index 5dbc26761e6..fdb90a120cc 100644 --- a/modules/ssl/mod_ssl.c +++ b/modules/ssl/mod_ssl.c @@ -285,18 +285,6 @@ static const command_rec ssl_config_cmds[] = { AP_END_CMD }; -/* Implement 'modssl_run_npn_advertise_protos_hook'. */ -APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL( - modssl, AP, int, npn_advertise_protos_hook, - (conn_rec *connection, apr_array_header_t *protos), - (connection, protos), OK, DECLINED) - -/* Implement 'modssl_run_npn_proto_negotiated_hook'. */ -APR_IMPLEMENT_OPTIONAL_HOOK_RUN_ALL( - modssl, AP, int, npn_proto_negotiated_hook, - (conn_rec *connection, const char *proto_name, apr_size_t proto_name_len), - (connection, proto_name, proto_name_len), OK, DECLINED) - /* * the various processing hooks */ @@ -444,6 +432,37 @@ int ssl_engine_disable(conn_rec *c) return 1; } +static int modssl_register_npn(conn_rec *c, + ssl_npn_advertise_protos advertisefn, + ssl_npn_proto_negotiated negotiatedfn) +{ +#ifdef HAVE_TLS_NPN + SSLConnRec *sslconn = myConnConfig(c); + + if (!sslconn) { + return DECLINED; + } + + if (!sslconn->npn_advertfns) { + sslconn->npn_advertfns = + apr_array_make(c->pool, 5, sizeof(ssl_npn_advertise_protos)); + sslconn->npn_negofns = + apr_array_make(c->pool, 5, sizeof(ssl_npn_proto_negotiated)); + } + + if (advertisefn) + APR_ARRAY_PUSH(sslconn->npn_advertfns, ssl_npn_advertise_protos) = + advertisefn; + if (negotiatedfn) + APR_ARRAY_PUSH(sslconn->npn_negofns, ssl_npn_proto_negotiated) = + negotiatedfn; + + return OK; +#else + return DECLINED; +#endif +} + int ssl_init_ssl_connection(conn_rec *c, request_rec *r) { SSLSrvConfigRec *sc; @@ -615,6 +634,7 @@ static void ssl_register_hooks(apr_pool_t *p) APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable); APR_REGISTER_OPTIONAL_FN(ssl_engine_disable); + APR_REGISTER_OPTIONAL_FN(modssl_register_npn); ap_register_auth_provider(p, AUTHZ_PROVIDER_GROUP, "ssl", AUTHZ_PROVIDER_VERSION, diff --git a/modules/ssl/mod_ssl.h b/modules/ssl/mod_ssl.h index 96de7627de0..5213ec024a8 100644 --- a/modules/ssl/mod_ssl.h +++ b/modules/ssl/mod_ssl.h @@ -63,26 +63,40 @@ APR_DECLARE_OPTIONAL_FN(int, ssl_proxy_enable, (conn_rec *)); APR_DECLARE_OPTIONAL_FN(int, ssl_engine_disable, (conn_rec *)); -/** The npn_advertise_protos optional hook allows other modules to add entries - * to the list of protocol names advertised by the server during the Next - * Protocol Negotiation (NPN) portion of the SSL handshake. The hook callee is - * given the connection and an APR array; it should push one or more char*'s - * pointing to null-terminated strings (such as "http/1.1" or "spdy/2") onto - * the array and return OK, or do nothing and return DECLINED. */ -APR_DECLARE_EXTERNAL_HOOK(modssl, AP, int, npn_advertise_protos_hook, - (conn_rec *connection, apr_array_header_t *protos)) +/** The npn_advertise_protos callback allows another modules to add + * entries to the list of protocol names advertised by the server + * during the Next Protocol Negotiation (NPN) portion of the SSL + * handshake. The callback is given the connection and an APR array; + * it should push one or more char*'s pointing to NUL-terminated + * strings (such as "http/1.1" or "spdy/2") onto the array and return + * OK. To prevent further processing of (other modules') callbacks, + * return DONE. */ +typedef int (*ssl_npn_advertise_protos)(conn_rec *connection, + apr_array_header_t *protos); -/** The npn_proto_negotiated optional hook allows other modules to discover the - * name of the protocol that was chosen during the Next Protocol Negotiation - * (NPN) portion of the SSL handshake. Note that this may be the empty string - * (in which case modules should probably assume HTTP), or it may be a protocol - * that was never even advertised by the server. The hook callee is given the - * connection, a non-null-terminated string containing the protocol name, and - * the length of the string; it should do something appropriate (i.e. insert or - * remove filters) and return OK, or do nothing and return DECLINED. */ -APR_DECLARE_EXTERNAL_HOOK(modssl, AP, int, npn_proto_negotiated_hook, - (conn_rec *connection, const char *proto_name, - apr_size_t proto_name_len)) +/** The npn_proto_negotiated callback allows other modules to discover + * the name of the protocol that was chosen during the Next Protocol + * Negotiation (NPN) portion of the SSL handshake. Note that this may + * be the empty string (in which case modules should probably assume + * HTTP), or it may be a protocol that was never even advertised by + * the server. The callback is given the connection, a + * non-NUL-terminated string containing the protocol name, and the + * length of the string; it should do something appropriate + * (i.e. insert or remove filters) and return OK. To prevent further + * processing of (other modules') callbacks, return DONE. */ +typedef int (*ssl_npn_proto_negotiated)(conn_rec *connection, + const char *proto_name, + apr_size_t proto_name_len); + +/* An optional function which can be used to register a pair of + * callbacks for NPN handling. This optional function should be + * invoked from a pre_connection hook which runs *after* mod_ssl.c's + * pre_connection hook. The function returns OK if the callbacks are + * register, or DECLINED otherwise (for example if mod_ssl does not +l * support NPN). */ +APR_DECLARE_OPTIONAL_FN(int, modssl_register_npn, (conn_rec *conn, + ssl_npn_advertise_protos advertisefn, + ssl_npn_proto_negotiated negotiatedfn)); #endif /* __MOD_SSL_H__ */ /** @} */ diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c index 006c84d4f6d..18bc48503a2 100644 --- a/modules/ssl/ssl_engine_io.c +++ b/modules/ssl/ssl_engine_io.c @@ -1422,16 +1422,27 @@ static apr_status_t ssl_io_filter_input(ap_filter_t *f, * which protocol was decided upon and inform other modules by calling * npn_proto_negotiated_hook. */ if (!inctx->npn_finished) { + SSLConnRec *sslconn = myConnConfig(f->c); const unsigned char *next_proto = NULL; unsigned next_proto_len = 0; - - SSL_get0_next_proto_negotiated( - inctx->ssl, &next_proto, &next_proto_len); - ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, f->c, - APLOGNO(02306) "SSL NPN negotiated protocol: '%*s'", - next_proto_len, (const char*)next_proto); - modssl_run_npn_proto_negotiated_hook( - f->c, (const char*)next_proto, next_proto_len); + int n; + + if (sslconn->npn_negofns) { + SSL_get0_next_proto_negotiated( + inctx->ssl, &next_proto, &next_proto_len); + ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, f->c, + APLOGNO(02306) "SSL NPN negotiated protocol: '%*s'", + next_proto_len, (const char*)next_proto); + + for (n = 0; n < sslconn->npn_negofns->nelts; n++) { + ssl_npn_proto_negotiated fn = + APR_ARRAY_IDX(sslconn->npn_negofns, n, ssl_npn_proto_negotiated); + + if (fn(f->c, (const char *)next_proto, next_proto_len) == DONE) + break; + } + } + inctx->npn_finished = 1; } #endif diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c index 7d26038bbdc..27902a22283 100644 --- a/modules/ssl/ssl_engine_kernel.c +++ b/modules/ssl/ssl_engine_kernel.c @@ -2186,6 +2186,7 @@ int ssl_callback_AdvertiseNextProtos(SSL *ssl, const unsigned char **data_out, unsigned int *size_out, void *arg) { conn_rec *c = (conn_rec*)SSL_get_app_data(ssl); + SSLConnRec *sslconn = myConnConfig(c); apr_array_header_t *protos; int num_protos; unsigned int size; @@ -2196,16 +2197,22 @@ int ssl_callback_AdvertiseNextProtos(SSL *ssl, const unsigned char **data_out, *data_out = NULL; *size_out = 0; - /* If the connection object is not available, then there's nothing for us - * to do. */ - if (c == NULL) { + /* If the connection object is not available, or there are no NPN + * hooks registered, then there's nothing for us to do. */ + if (c == NULL || sslconn->npn_advertfns == NULL) { return SSL_TLSEXT_ERR_OK; } /* Invoke our npn_advertise_protos hook, giving other modules a chance to * add alternate protocol names to advertise. */ - protos = apr_array_make(c->pool, 0, sizeof(char*)); - modssl_run_npn_advertise_protos_hook(c, protos); + protos = apr_array_make(c->pool, 0, sizeof(char *)); + for (i = 0; i < sslconn->npn_advertfns->nelts; i++) { + ssl_npn_advertise_protos fn = + APR_ARRAY_IDX(sslconn->npn_advertfns, i, ssl_npn_advertise_protos); + + if (fn(c, protos) == DONE) + break; + } num_protos = protos->nelts; /* We now have a list of null-terminated strings; we need to concatenate diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h index 740fba0e841..2158e00f365 100644 --- a/modules/ssl/ssl_private.h +++ b/modules/ssl/ssl_private.h @@ -496,6 +496,12 @@ typedef struct { * connection */ } reneg_state; +#ifdef HAVE_TLS_NPN + /* Poor man's inter-module optional hooks for NPN. */ + apr_array_header_t *npn_advertfns; /* list of ssl_npn_advertise_protos callbacks */ + apr_array_header_t *npn_negofns; /* list of ssl_npn_proto_negotiated callbacks. */ +#endif + server_rec *server; } SSLConnRec;