From 86661d07812b010b8cf664c2dab596be15ff1e31 Mon Sep 17 00:00:00 2001 From: Simo Sorce Date: Sun, 30 Aug 2015 14:31:44 -0400 Subject: [PATCH] Allocate new keys at server startup. This avoids a potential race condition if the first 2 request come in at the same time. It also avoids issues with forked apapche processes which may end up with different keys per fork. Signed-off-by: Simo Sorce --- src/mod_auth_gssapi.c | 32 ++++++++++++++++++++++++-------- src/mod_auth_gssapi.h | 3 +++ src/sessions.c | 36 ++++++++++++------------------------ src/sessions.h | 12 +++++------- 4 files changed, 44 insertions(+), 39 deletions(-) diff --git a/src/mod_auth_gssapi.c b/src/mod_auth_gssapi.c index d4e2682..6f185f9 100644 --- a/src/mod_auth_gssapi.c +++ b/src/mod_auth_gssapi.c @@ -621,21 +621,30 @@ done: struct mag_req_cfg *mag_init_cfg(request_rec *req) { + struct mag_server_config *scfg; struct mag_req_cfg *req_cfg = apr_pcalloc(req->pool, sizeof(struct mag_req_cfg)); + req_cfg->req = req; req_cfg->cfg = ap_get_module_config(req->per_dir_config, &auth_gssapi_module); + scfg = ap_get_module_config(req->server->module_config, + &auth_gssapi_module); + if (req_cfg->cfg->allowed_mechs) { req_cfg->desired_mechs = req_cfg->cfg->allowed_mechs; } else { - struct mag_server_config *scfg; - /* Try to fetch the default set if not explicitly configured */ - scfg = ap_get_module_config(req->server->module_config, - &auth_gssapi_module); + /* Use the default set if not explicitly configured */ req_cfg->desired_mechs = scfg->default_mechs; } + if (!req_cfg->cfg->mag_skey) { + req_cfg->mag_skey = req_cfg->cfg->mag_skey; + } else { + /* Use server random key if not explicitly configured */ + req_cfg->mag_skey = scfg->mag_skey; + } + if (req->proxyreq == PROXYREQ_PROXY) { req_cfg->req_proto = "Proxy-Authorization"; req_cfg->rep_proto = "Proxy-Authenticate"; @@ -743,7 +752,7 @@ static int mag_auth(request_rec *req) /* if available, session always supersedes connection bound data */ if (req_cfg->use_sessions) { - mag_check_session(req, cfg, &mc); + mag_check_session(req_cfg, &mc); } auth_header = apr_table_get(req->headers_in, req_cfg->req_proto); @@ -802,7 +811,7 @@ static int mag_auth(request_rec *req) ba_pwd.length = strlen(ba_pwd.value); if (mc && mc->established && - mag_basic_check(cfg, mc, ba_user, ba_pwd)) { + mag_basic_check(req_cfg, mc, ba_user, ba_pwd)) { ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, req, "Already established BASIC AUTH context found!"); mag_set_req_data(req, cfg, mc); @@ -947,10 +956,10 @@ complete: mc->expiration = expiration; mc->auth_type = auth_type; if (auth_type == AUTH_TYPE_BASIC) { - mag_basic_cache(cfg, mc, ba_user, ba_pwd); + mag_basic_cache(req_cfg, mc, ba_user, ba_pwd); } if (req_cfg->use_sessions) { - mag_attempt_session(req, cfg, mc); + mag_attempt_session(req_cfg, mc); } } @@ -1265,6 +1274,7 @@ static void *mag_create_server_config(apr_pool_t *p, server_rec *s) { struct mag_server_config *scfg; uint32_t maj, min; + apr_status_t rc; scfg = apr_pcalloc(p, sizeof(struct mag_server_config)); @@ -1278,6 +1288,12 @@ static void *mag_create_server_config(apr_pool_t *p, server_rec *s) mag_oid_set_destroy, apr_pool_cleanup_null); } + rc = SEAL_KEY_CREATE(p, &scfg->mag_skey, NULL); + if (rc != OK) { + ap_log_error(APLOG_MARK, APLOG_ERR, 0, s, + "Failed to generate random sealing key!"); + } + return scfg; } diff --git a/src/mod_auth_gssapi.h b/src/mod_auth_gssapi.h index 46e5c6a..b08c38a 100644 --- a/src/mod_auth_gssapi.h +++ b/src/mod_auth_gssapi.h @@ -63,15 +63,18 @@ struct mag_config { struct mag_server_config { gss_OID_set default_mechs; + struct seal_key *mag_skey; }; struct mag_req_cfg { + request_rec *req; struct mag_config *cfg; gss_OID_set desired_mechs; bool use_sessions; bool send_persist; const char *req_proto; const char *rep_proto; + struct seal_key *mag_skey; }; struct mag_conn { diff --git a/src/sessions.c b/src/sessions.c index 73d600c..70f39a2 100644 --- a/src/sessions.c +++ b/src/sessions.c @@ -86,9 +86,9 @@ static GSSSessionData_t *decode_GSSSessionData(void *buf, size_t len) #define MAG_BEARER_KEY "MagBearerToken" -void mag_check_session(request_rec *req, - struct mag_config *cfg, struct mag_conn **conn) +void mag_check_session(struct mag_req_cfg *cfg, struct mag_conn **conn) { + request_rec *req = cfg->req; struct mag_conn *mc; apr_status_t rc; session_rec *sess = NULL; @@ -184,9 +184,9 @@ done: ASN_STRUCT_FREE(asn_DEF_GSSSessionData, gsessdata); } -void mag_attempt_session(request_rec *req, - struct mag_config *cfg, struct mag_conn *mc) +void mag_attempt_session(struct mag_req_cfg *cfg, struct mag_conn *mc) { + request_rec *req = cfg->req; session_rec *sess = NULL; struct databuf plainbuf = { 0 }; struct databuf cipherbuf = { 0 }; @@ -207,13 +207,8 @@ void mag_attempt_session(request_rec *req, if (!cfg->mag_skey) { ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, req, - "Session key not available, generating new one."); - rc = SEAL_KEY_CREATE(cfg->pool, &cfg->mag_skey, NULL); - if (rc != OK) { - ap_log_rerror(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, req, - "Failed to create sealing key!"); - return; - } + "Session key not available, aborting."); + return; } gsessdata.established = mc->established?1:0; @@ -275,25 +270,18 @@ static int mag_basic_hmac(struct seal_key *key, unsigned char *mac, return HMAC_BUFFER(key, &databuf, &hmacbuf); } -static int mag_get_mac_size(struct mag_config *cfg) +static int mag_get_mac_size(struct mag_req_cfg *cfg) { - apr_status_t rc; - if (!cfg->mag_skey) { - ap_log_perror(APLOG_MARK, APLOG_INFO, 0, cfg->pool, - "Session key not available, generating new one."); - rc = SEAL_KEY_CREATE(cfg->pool, &cfg->mag_skey, NULL); - if (rc != OK) { - ap_log_perror(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, cfg->pool, - "Failed to create sealing key!"); - return 0; - } + ap_log_perror(APLOG_MARK, APLOG_INFO, 0, cfg->cfg->pool, + "Session key not available, aborting!"); + return 0; } return get_mac_size(cfg->mag_skey); } -bool mag_basic_check(struct mag_config *cfg, struct mag_conn *mc, +bool mag_basic_check(struct mag_req_cfg *cfg, struct mag_conn *mc, gss_buffer_desc user, gss_buffer_desc pwd) { int mac_size = mag_get_mac_size(cfg); @@ -320,7 +308,7 @@ done: return res; } -void mag_basic_cache(struct mag_config *cfg, struct mag_conn *mc, +void mag_basic_cache(struct mag_req_cfg *cfg, struct mag_conn *mc, gss_buffer_desc user, gss_buffer_desc pwd) { int mac_size = mag_get_mac_size(cfg); diff --git a/src/sessions.h b/src/sessions.h index 840dbe9..be6ff16 100644 --- a/src/sessions.h +++ b/src/sessions.h @@ -1,14 +1,12 @@ /* Copyright (C) 2014 mod_auth_gssapi authors - See COPYING for (C) terms */ -struct mag_config; +struct mag_req_cfg; struct mag_conn; void mag_post_config_session(void); -void mag_check_session(request_rec *req, - struct mag_config *cfg, struct mag_conn **conn); -void mag_attempt_session(request_rec *req, - struct mag_config *cfg, struct mag_conn *mc); -bool mag_basic_check(struct mag_config *cfg, struct mag_conn *mc, +void mag_check_session(struct mag_req_cfg *cfg, struct mag_conn **conn); +void mag_attempt_session(struct mag_req_cfg *cfg, struct mag_conn *mc); +bool mag_basic_check(struct mag_req_cfg *cfg, struct mag_conn *mc, gss_buffer_desc user, gss_buffer_desc pwd); -void mag_basic_cache(struct mag_config *cfg, struct mag_conn *mc, +void mag_basic_cache(struct mag_req_cfg *cfg, struct mag_conn *mc, gss_buffer_desc user, gss_buffer_desc pwd); -- 2.1.4