diff --git a/certbot-apache/certbot_apache/_internal/configurator.py b/certbot-apache/certbot_apache/_internal/configurator.py index 10b3c52d9..501c7cad8 100644 --- a/certbot-apache/certbot_apache/_internal/configurator.py +++ b/certbot-apache/certbot_apache/_internal/configurator.py @@ -115,6 +115,7 @@ class ApacheConfigurator(common.Installer): handle_modules=False, handle_sites=False, challenge_location="/etc/apache2", + bin=None ) def option(self, key): @@ -145,7 +146,7 @@ class ApacheConfigurator(common.Installer): """ opts = ["enmod", "dismod", "le_vhost_ext", "server_root", "vhost_root", "logs_root", "challenge_location", "handle_modules", "handle_sites", - "ctl"] + "ctl", "bin"] for o in opts: # Config options use dashes instead of underscores if self.conf(o.replace("_", "-")) is not None: @@ -194,6 +195,8 @@ class ApacheConfigurator(common.Installer): "(Only Ubuntu/Debian currently)") add("ctl", default=DEFAULTS["ctl"], help="Full path to Apache control script") + add("bin", default=DEFAULTS["bin"], + help="Full path to apache2/httpd binary") def __init__(self, *args, **kwargs): """Initialize an Apache Configurator. @@ -269,18 +272,25 @@ class ApacheConfigurator(common.Installer): """ if self._openssl_version: return self._openssl_version - # Step 1. Check for LoadModule directive + # Step 1. Determine the location of ssl_module try: ssl_module_location = self.parser.modules['ssl_module'] except KeyError: if warn_on_no_mod_ssl: logger.warning("Could not find ssl_module; not disabling session tickets.") return None - if not ssl_module_location: - logger.warning("Could not find ssl_module; not disabling session tickets.") - return None - ssl_module_location = self.parser.standard_path_from_server_root(ssl_module_location) - # Step 2. Grep in the .so for openssl version + if ssl_module_location: + # Possibility A: ssl_module is a DSO + ssl_module_location = self.parser.standard_path_from_server_root(ssl_module_location) + else: + # Possibility B: ssl_module is statically linked into Apache + if self.option("bin"): + ssl_module_location = self.option("bin") + else: + logger.warning("ssl_module is statically linked but --apache-bin is " + "missing; not disabling session tickets.") + return None + # Step 2. Grep in the binary for openssl version contents = self._open_module_file(ssl_module_location) if not contents: logger.warning("Unable to read ssl_module file; not disabling session tickets.") diff --git a/certbot-apache/certbot_apache/_internal/override_arch.py b/certbot-apache/certbot_apache/_internal/override_arch.py index 54202c087..1c3aed1dc 100644 --- a/certbot-apache/certbot_apache/_internal/override_arch.py +++ b/certbot-apache/certbot_apache/_internal/override_arch.py @@ -24,4 +24,5 @@ class ArchConfigurator(configurator.ApacheConfigurator): handle_modules=False, handle_sites=False, challenge_location="/etc/httpd/conf", + bin=None, ) diff --git a/certbot-apache/certbot_apache/_internal/override_centos.py b/certbot-apache/certbot_apache/_internal/override_centos.py index 0de882519..9b2ee54c9 100644 --- a/certbot-apache/certbot_apache/_internal/override_centos.py +++ b/certbot-apache/certbot_apache/_internal/override_centos.py @@ -35,6 +35,7 @@ class CentOSConfigurator(configurator.ApacheConfigurator): handle_modules=False, handle_sites=False, challenge_location="/etc/httpd/conf.d", + bin=None, ) def config_test(self): diff --git a/certbot-apache/certbot_apache/_internal/override_darwin.py b/certbot-apache/certbot_apache/_internal/override_darwin.py index f19823866..106f5fbab 100644 --- a/certbot-apache/certbot_apache/_internal/override_darwin.py +++ b/certbot-apache/certbot_apache/_internal/override_darwin.py @@ -24,4 +24,5 @@ class DarwinConfigurator(configurator.ApacheConfigurator): handle_modules=False, handle_sites=False, challenge_location="/etc/apache2/other", + bin=None, ) diff --git a/certbot-apache/certbot_apache/_internal/override_debian.py b/certbot-apache/certbot_apache/_internal/override_debian.py index c977fb43e..9f938046b 100644 --- a/certbot-apache/certbot_apache/_internal/override_debian.py +++ b/certbot-apache/certbot_apache/_internal/override_debian.py @@ -33,6 +33,7 @@ class DebianConfigurator(configurator.ApacheConfigurator): handle_modules=True, handle_sites=True, challenge_location="/etc/apache2", + bin=None, ) def enable_site(self, vhost): diff --git a/certbot-apache/certbot_apache/_internal/override_fedora.py b/certbot-apache/certbot_apache/_internal/override_fedora.py index 2436c76cc..9b521846c 100644 --- a/certbot-apache/certbot_apache/_internal/override_fedora.py +++ b/certbot-apache/certbot_apache/_internal/override_fedora.py @@ -29,6 +29,7 @@ class FedoraConfigurator(configurator.ApacheConfigurator): handle_modules=False, handle_sites=False, challenge_location="/etc/httpd/conf.d", + bin=None, ) def config_test(self): diff --git a/certbot-apache/certbot_apache/_internal/override_gentoo.py b/certbot-apache/certbot_apache/_internal/override_gentoo.py index 6b7416c0d..59a3d981f 100644 --- a/certbot-apache/certbot_apache/_internal/override_gentoo.py +++ b/certbot-apache/certbot_apache/_internal/override_gentoo.py @@ -27,6 +27,7 @@ class GentooConfigurator(configurator.ApacheConfigurator): handle_modules=False, handle_sites=False, challenge_location="/etc/apache2/vhosts.d", + bin=None, ) def _prepare_options(self): diff --git a/certbot-apache/certbot_apache/_internal/override_suse.py b/certbot-apache/certbot_apache/_internal/override_suse.py index 895e0cb05..eee9b0b64 100644 --- a/certbot-apache/certbot_apache/_internal/override_suse.py +++ b/certbot-apache/certbot_apache/_internal/override_suse.py @@ -24,4 +24,5 @@ class OpenSUSEConfigurator(configurator.ApacheConfigurator): handle_modules=False, handle_sites=False, challenge_location="/etc/apache2/vhosts.d", + bin=None, ) diff --git a/certbot-apache/tests/configurator_test.py b/certbot-apache/tests/configurator_test.py index b5dcc464d..091a6a828 100644 --- a/certbot-apache/tests/configurator_test.py +++ b/certbot-apache/tests/configurator_test.py @@ -1772,12 +1772,22 @@ class InstallSslOptionsConfTest(util.ApacheTest): AH02556: "SSLOpenSSLConfCmd %s %s" applied to %s OpenSSL 1.0.2g 1 Mar 2016 """ + # ssl_module as a DSO self.config.parser.modules['ssl_module'] = '/fake/path' with mock.patch("certbot_apache._internal.configurator." "ApacheConfigurator._open_module_file") as mock_omf: mock_omf.return_value = some_string_contents self.assertEqual(self.config.openssl_version(), "1.0.2g") + # ssl_module statically linked + self.config._openssl_version = None + self.config.parser.modules['ssl_module'] = None + self.config.options['bin'] = '/fake/path/to/httpd' + with mock.patch("certbot_apache._internal.configurator." + "ApacheConfigurator._open_module_file") as mock_omf: + mock_omf.return_value = some_string_contents + self.assertEqual(self.config.openssl_version(), "1.0.2g") + def test_current_version(self): self.config.version = (2, 4, 10) self.config._openssl_version = '1.0.2m' @@ -1799,12 +1809,21 @@ class InstallSslOptionsConfTest(util.ApacheTest): self.assertEqual(self.config.openssl_version(), None) self.assertTrue("Could not find ssl_module" in mock_log.call_args[0][0]) + # When no ssl_module is present at all self.config._openssl_version = None - self.config.parser.modules['ssl_module'] = None + self.assertTrue("ssl_module" not in self.config.parser.modules) with mock.patch("certbot_apache._internal.configurator.logger.warning") as mock_log: self.assertEqual(self.config.openssl_version(), None) self.assertTrue("Could not find ssl_module" in mock_log.call_args[0][0]) + # When ssl_module is statically linked but --apache-bin not provided + self.config._openssl_version = None + self.config.options['bin'] = None + self.config.parser.modules['ssl_module'] = None + with mock.patch("certbot_apache._internal.configurator.logger.warning") as mock_log: + self.assertEqual(self.config.openssl_version(), None) + self.assertTrue("ssl_module is statically linked but" in mock_log.call_args[0][0]) + self.config.parser.modules['ssl_module'] = "/fake/path" with mock.patch("certbot_apache._internal.configurator.logger.warning") as mock_log: # Check that correct logger.warning was printed diff --git a/certbot/CHANGELOG.md b/certbot/CHANGELOG.md index a6f3c485d..b7a71ff9f 100644 --- a/certbot/CHANGELOG.md +++ b/certbot/CHANGELOG.md @@ -10,7 +10,7 @@ Certbot adheres to [Semantic Versioning](https://semver.org/). ### Changed -* +* Allow session tickets to be disabled in Apache when mod_ssl is statically linked. ### Fixed