Skip to content

Commit 86661d0

Browse files
simo5simo5
committed
Allocate new keys at server startup.
This avoids a potential race condition if the first 2 request come in at the same time. It also avoids issues with forked apapche processes which may end up with different keys per fork. Signed-off-by: Simo Sorce <simo@redhat.com>
1 parent 3e4f466 commit 86661d0

File tree

4 files changed

+44
-39
lines changed

4 files changed

+44
-39
lines changed

‎src/mod_auth_gssapi.c‎

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -621,21 +621,30 @@ static bool mag_auth_basic(request_rec *req,
621621

622622
struct mag_req_cfg *mag_init_cfg(request_rec *req)
623623
{
624+
struct mag_server_config *scfg;
624625
struct mag_req_cfg *req_cfg = apr_pcalloc(req->pool,
625626
sizeof(struct mag_req_cfg));
627+
req_cfg->req = req;
626628
req_cfg->cfg = ap_get_module_config(req->per_dir_config,
627629
&auth_gssapi_module);
628630

631+
scfg = ap_get_module_config(req->server->module_config,
632+
&auth_gssapi_module);
633+
629634
if (req_cfg->cfg->allowed_mechs) {
630635
req_cfg->desired_mechs = req_cfg->cfg->allowed_mechs;
631636
} else {
632-
struct mag_server_config *scfg;
633-
/* Try to fetch the default set if not explicitly configured */
634-
scfg = ap_get_module_config(req->server->module_config,
635-
&auth_gssapi_module);
637+
/* Use the default set if not explicitly configured */
636638
req_cfg->desired_mechs = scfg->default_mechs;
637639
}
638640

641+
if (!req_cfg->cfg->mag_skey) {
642+
req_cfg->mag_skey = req_cfg->cfg->mag_skey;
643+
} else {
644+
/* Use server random key if not explicitly configured */
645+
req_cfg->mag_skey = scfg->mag_skey;
646+
}
647+
639648
if (req->proxyreq == PROXYREQ_PROXY) {
640649
req_cfg->req_proto = "Proxy-Authorization";
641650
req_cfg->rep_proto = "Proxy-Authenticate";
@@ -743,7 +752,7 @@ static int mag_auth(request_rec *req)
743752

744753
/* if available, session always supersedes connection bound data */
745754
if (req_cfg->use_sessions) {
746-
mag_check_session(req, cfg, &mc);
755+
mag_check_session(req_cfg, &mc);
747756
}
748757

749758
auth_header = apr_table_get(req->headers_in, req_cfg->req_proto);
@@ -802,7 +811,7 @@ static int mag_auth(request_rec *req)
802811
ba_pwd.length = strlen(ba_pwd.value);
803812

804813
if (mc && mc->established &&
805-
mag_basic_check(cfg, mc, ba_user, ba_pwd)) {
814+
mag_basic_check(req_cfg, mc, ba_user, ba_pwd)) {
806815
ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, req,
807816
"Already established BASIC AUTH context found!");
808817
mag_set_req_data(req, cfg, mc);
@@ -947,10 +956,10 @@ static int mag_auth(request_rec *req)
947956
mc->expiration = expiration;
948957
mc->auth_type = auth_type;
949958
if (auth_type == AUTH_TYPE_BASIC) {
950-
mag_basic_cache(cfg, mc, ba_user, ba_pwd);
959+
mag_basic_cache(req_cfg, mc, ba_user, ba_pwd);
951960
}
952961
if (req_cfg->use_sessions) {
953-
mag_attempt_session(req, cfg, mc);
962+
mag_attempt_session(req_cfg, mc);
954963
}
955964
}
956965

@@ -1265,6 +1274,7 @@ static void *mag_create_server_config(apr_pool_t *p, server_rec *s)
12651274
{
12661275
struct mag_server_config *scfg;
12671276
uint32_t maj, min;
1277+
apr_status_t rc;
12681278

12691279
scfg = apr_pcalloc(p, sizeof(struct mag_server_config));
12701280

@@ -1278,6 +1288,12 @@ static void *mag_create_server_config(apr_pool_t *p, server_rec *s)
12781288
mag_oid_set_destroy, apr_pool_cleanup_null);
12791289
}
12801290

1291+
rc = SEAL_KEY_CREATE(p, &scfg->mag_skey, NULL);
1292+
if (rc != OK) {
1293+
ap_log_error(APLOG_MARK, APLOG_ERR, 0, s,
1294+
"Failed to generate random sealing key!");
1295+
}
1296+
12811297
return scfg;
12821298
}
12831299

‎src/mod_auth_gssapi.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,15 +63,18 @@ struct mag_config {
6363

6464
struct mag_server_config {
6565
gss_OID_set default_mechs;
66+
struct seal_key *mag_skey;
6667
};
6768

6869
struct mag_req_cfg {
70+
request_rec *req;
6971
struct mag_config *cfg;
7072
gss_OID_set desired_mechs;
7173
bool use_sessions;
7274
bool send_persist;
7375
const char *req_proto;
7476
const char *rep_proto;
77+
struct seal_key *mag_skey;
7578
};
7679

7780
struct mag_conn {

‎src/sessions.c‎

Lines changed: 12 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -86,9 +86,9 @@ static GSSSessionData_t *decode_GSSSessionData(void *buf, size_t len)
8686

8787
#define MAG_BEARER_KEY "MagBearerToken"
8888

89-
void mag_check_session(request_rec *req,
90-
struct mag_config *cfg, struct mag_conn **conn)
89+
void mag_check_session(struct mag_req_cfg *cfg, struct mag_conn **conn)
9190
{
91+
request_rec *req = cfg->req;
9292
struct mag_conn *mc;
9393
apr_status_t rc;
9494
session_rec *sess = NULL;
@@ -184,9 +184,9 @@ void mag_check_session(request_rec *req,
184184
ASN_STRUCT_FREE(asn_DEF_GSSSessionData, gsessdata);
185185
}
186186

187-
void mag_attempt_session(request_rec *req,
188-
struct mag_config *cfg, struct mag_conn *mc)
187+
void mag_attempt_session(struct mag_req_cfg *cfg, struct mag_conn *mc)
189188
{
189+
request_rec *req = cfg->req;
190190
session_rec *sess = NULL;
191191
struct databuf plainbuf = { 0 };
192192
struct databuf cipherbuf = { 0 };
@@ -207,13 +207,8 @@ void mag_attempt_session(request_rec *req,
207207

208208
if (!cfg->mag_skey) {
209209
ap_log_rerror(APLOG_MARK, APLOG_INFO, 0, req,
210-
"Session key not available, generating new one.");
211-
rc = SEAL_KEY_CREATE(cfg->pool, &cfg->mag_skey, NULL);
212-
if (rc != OK) {
213-
ap_log_rerror(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, req,
214-
"Failed to create sealing key!");
215-
return;
216-
}
210+
"Session key not available, aborting.");
211+
return;
217212
}
218213

219214
gsessdata.established = mc->established?1:0;
@@ -275,25 +270,18 @@ static int mag_basic_hmac(struct seal_key *key, unsigned char *mac,
275270
return HMAC_BUFFER(key, &databuf, &hmacbuf);
276271
}
277272

278-
static int mag_get_mac_size(struct mag_config *cfg)
273+
static int mag_get_mac_size(struct mag_req_cfg *cfg)
279274
{
280-
apr_status_t rc;
281-
282275
if (!cfg->mag_skey) {
283-
ap_log_perror(APLOG_MARK, APLOG_INFO, 0, cfg->pool,
284-
"Session key not available, generating new one.");
285-
rc = SEAL_KEY_CREATE(cfg->pool, &cfg->mag_skey, NULL);
286-
if (rc != OK) {
287-
ap_log_perror(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, cfg->pool,
288-
"Failed to create sealing key!");
289-
return 0;
290-
}
276+
ap_log_perror(APLOG_MARK, APLOG_INFO, 0, cfg->cfg->pool,
277+
"Session key not available, aborting!");
278+
return 0;
291279
}
292280

293281
return get_mac_size(cfg->mag_skey);
294282
}
295283

296-
bool mag_basic_check(struct mag_config *cfg, struct mag_conn *mc,
284+
bool mag_basic_check(struct mag_req_cfg *cfg, struct mag_conn *mc,
297285
gss_buffer_desc user, gss_buffer_desc pwd)
298286
{
299287
int mac_size = mag_get_mac_size(cfg);
@@ -320,7 +308,7 @@ bool mag_basic_check(struct mag_config *cfg, struct mag_conn *mc,
320308
return res;
321309
}
322310

323-
void mag_basic_cache(struct mag_config *cfg, struct mag_conn *mc,
311+
void mag_basic_cache(struct mag_req_cfg *cfg, struct mag_conn *mc,
324312
gss_buffer_desc user, gss_buffer_desc pwd)
325313
{
326314
int mac_size = mag_get_mac_size(cfg);

‎src/sessions.h‎

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,12 @@
11
/* Copyright (C) 2014 mod_auth_gssapi authors - See COPYING for (C) terms */
22

3-
struct mag_config;
3+
struct mag_req_cfg;
44
struct mag_conn;
55

66
void mag_post_config_session(void);
7-
void mag_check_session(request_rec *req,
8-
struct mag_config *cfg, struct mag_conn **conn);
9-
void mag_attempt_session(request_rec *req,
10-
struct mag_config *cfg, struct mag_conn *mc);
11-
bool mag_basic_check(struct mag_config *cfg, struct mag_conn *mc,
7+
void mag_check_session(struct mag_req_cfg *cfg, struct mag_conn **conn);
8+
void mag_attempt_session(struct mag_req_cfg *cfg, struct mag_conn *mc);
9+
bool mag_basic_check(struct mag_req_cfg *cfg, struct mag_conn *mc,
1210
gss_buffer_desc user, gss_buffer_desc pwd);
13-
void mag_basic_cache(struct mag_config *cfg, struct mag_conn *mc,
11+
void mag_basic_cache(struct mag_req_cfg *cfg, struct mag_conn *mc,
1412
gss_buffer_desc user, gss_buffer_desc pwd);

0 commit comments

Comments
 (0)