1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
|
/*
* Copyright (C) 2000 Nikos Mavroyanopoulos
*
* This file is part of GNUTLS.
*
* GNUTLS is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* GNUTLS is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
*/
/* This file contains functions that manipulate a database
* for resumed sessions.
*/
#include "gnutls_int.h"
#include "gnutls_errors.h"
#include "gnutls_session.h"
#include "debug.h"
#ifdef HAVE_LIBGDBM
# define GNUTLS_DBF state->gnutls_internals.db_reader
# define GNUTLS_DBNAME state->gnutls_internals.db_name
# define GNUTLS_REOPEN_DB() if (GNUTLS_DBF!=NULL) \
gdbm_close( GNUTLS_DBF); \
GNUTLS_DBF = gdbm_open(GNUTLS_DBNAME, 0, GDBM_READER, 0600, NULL);
#endif
/**
* gnutls_set_cache_expiration - Sets the expiration time for resumed sessions.
* @state: is a &GNUTLS_STATE structure.
* @seconds: is the number of seconds.
*
* Sets the expiration time for resumed sessions. The default is 3600 (one hour)
* at the time writing this.
**/
int gnutls_set_cache_expiration( GNUTLS_STATE state, int seconds) {
state->gnutls_internals.expire_time = seconds;
return 0;
}
/**
* gnutls_set_db_name - Sets the name of the database that holds TLS sessions.
* @state: is a &GNUTLS_STATE structure.
* @filename: is the filename for the database
*
* Sets the name of the (gdbm) database to be used to keep
* the sessions to be resumed. This function also creates the database
* - if it does not exist - and opens it for reading.
**/
int gnutls_set_db_name( GNUTLS_STATE state, char* filename) {
#ifdef HAVE_LIBGDBM
GDBM_FILE dbf;
if (filename==NULL) return 0;
/* deallocate previous name */
if (GNUTLS_DBNAME!=NULL)
gnutls_free(GNUTLS_DBNAME);
/* set name */
GNUTLS_DBNAME = gnutls_strdup(filename);
if (GNUTLS_DBNAME==NULL) return GNUTLS_E_MEMORY_ERROR;
/* open for reader */
GNUTLS_DBF = gdbm_open(GNUTLS_DBNAME, 0, GDBM_READER, 0600, NULL);
if (GNUTLS_DBF==NULL) {
/* maybe it does not exist - so try to
* create it.
*/
dbf = gdbm_open( filename, 0, GDBM_WRCREAT, 0600, NULL);
if (dbf==NULL) return GNUTLS_E_DB_ERROR;
gdbm_close(dbf);
/* try to open again */
GNUTLS_DBF = gdbm_open(GNUTLS_DBNAME, 0, GDBM_READER, 0600, NULL);
}
if (GNUTLS_DBF==NULL)
return GNUTLS_E_DB_ERROR;
return 0;
#else
return GNUTLS_E_UNIMPLEMENTED_FEATURE;
#endif
}
/**
* gnutls_clean_db - removes expired and invalid sessions from the database
* @state: is a &GNUTLS_STATE structure.
*
* This function Deletes all expired records in the resumed sessions' database.
* This database may become huge if this function is not called.
* (this function is also quite expensive)
**/
int gnutls_clean_db( GNUTLS_STATE state) {
#ifdef HAVE_LIBGDBM
GDBM_FILE dbf;
int ret;
datum key;
time_t timestamp;
if (GNUTLS_DBF==NULL) return GNUTLS_E_DB_ERROR;
if (GNUTLS_DBNAME==NULL) return GNUTLS_E_DB_ERROR;
dbf = gdbm_open(GNUTLS_DBNAME, 0, GDBM_WRITER, 0600, NULL);
if (dbf==NULL) return GNUTLS_E_AGAIN;
key = gdbm_firstkey(dbf);
timestamp = time(0);
while( key.dptr != NULL) {
if ( timestamp - ((SecurityParameters*)(key.dptr))->timestamp <= state->gnutls_internals.expire_time || ((SecurityParameters*)(key.dptr))->timestamp > timestamp|| ((SecurityParameters*)(key.dptr))->timestamp == 0) {
/* delete expired entry */
gdbm_delete( dbf, key);
}
free(key.dptr);
key = gdbm_nextkey(dbf, key);
}
ret = gdbm_reorganize(dbf);
gdbm_close(dbf);
GNUTLS_REOPEN_DB();
if (ret!=0) return GNUTLS_E_DB_ERROR;
return 0;
#else
return GNUTLS_E_UNIMPLEMENTED_FEATURE;
#endif
}
int _gnutls_server_register_current_session( GNUTLS_STATE state)
{
#ifdef HAVE_LIBGDBM
GDBM_FILE dbf;
datum key = { state->security_parameters.session_id, state->security_parameters.session_id_size };
datum content;
int ret = 0;
if (state->gnutls_internals.resumable==RESUME_FALSE)
return GNUTLS_E_INVALID_SESSION;
if (GNUTLS_DBNAME==NULL)
return GNUTLS_E_DB_ERROR;
if (state->security_parameters.session_id==NULL || state->security_parameters.session_id_size==0)
return GNUTLS_E_INVALID_SESSION;
/* if we can't read why bother writing? */
if (GNUTLS_DBF==NULL)
return GNUTLS_E_DB_ERROR;
/* allocate space for data */
content.dsize = sizeof(SecurityParameters) + state->gnutls_key->auth_info_size;
content.dptr = gnutls_malloc( content.dsize);
if (content.dptr==NULL) return GNUTLS_E_MEMORY_ERROR;
/* copy data */
memcpy( content.dptr, (void*)&state->security_parameters, sizeof(SecurityParameters));
memcpy( &content.dptr[sizeof(SecurityParameters)], state->gnutls_key->auth_info, state->gnutls_key->auth_info_size);
dbf = gdbm_open(GNUTLS_DBNAME, 0, GDBM_WRITER, 0600, NULL);
if (dbf==NULL) {
gnutls_free(content.dptr);
/* cannot open db for writing. This may happen if multiple
* instances try to write.
*/
return GNUTLS_E_AGAIN;
}
ret = gdbm_store( dbf, key, content, GDBM_INSERT);
gnutls_free( content.dptr);
gdbm_close(dbf);
return (ret == 0 ? ret : GNUTLS_E_UNKNOWN_ERROR);
#else
return GNUTLS_E_UNIMPLEMENTED_FEATURE;
#endif
}
int _gnutls_server_restore_session( GNUTLS_STATE state, uint8* session_id, int session_id_size)
{
#ifdef HAVE_LIBGDBM
datum content;
datum key = { session_id, session_id_size};
int ret;
if (GNUTLS_DBNAME==NULL) return GNUTLS_E_DB_ERROR;
if (GNUTLS_DBF==NULL) return GNUTLS_E_DB_ERROR;
content = gdbm_fetch( GNUTLS_DBF, key);
if (content.dptr==NULL) {
return GNUTLS_E_INVALID_SESSION;
}
/* expiration check is performed inside */
ret = gnutls_set_current_session( state, content.dptr, content.dsize);
free(content.dptr);
return ret;
#else
return GNUTLS_E_UNIMPLEMENTED_FEATURE;
#endif
}
int _gnutls_db_remove_session( GNUTLS_STATE state, uint8* session_id, int session_id_size)
{
#ifdef HAVE_LIBGDBM
GDBM_FILE dbf;
datum key = { session_id, session_id_size};
int ret;
if (GNUTLS_DBNAME==NULL) return GNUTLS_E_DB_ERROR;
dbf = gdbm_open(GNUTLS_DBNAME, 0, GDBM_READER, 0600, NULL);
if (dbf==NULL) return GNUTLS_E_AGAIN;
ret = gdbm_delete( dbf, key);
gdbm_close(dbf);
return (ret==0 ? ret : GNUTLS_E_DB_ERROR);
#else
return GNUTLS_E_UNIMPLEMENTED_FEATURE;
#endif
}
|
