www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2025-08-08 15:02:10 +03:00
Code Activity

* modules/ssl/ssl_engine_init.c (ssl_init_ctx_protocol):

Browse Source 
Disable AUTO_RETRY mode for OpenSSL 1.1.1, which fixes
  post-handshake authentication.
  (ssl_init_proxy_certs): Fix proxy client cert support with
  TLSv1.3, which is now crippled by default.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1840710 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Joe Orton
2018-09-12 15:54:24 +00:00
parent 8167ffff20
commit 4a720bb901
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
modules/ssl/ssl_engine_init.c
View File

@@ -786,6 +786,13 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
SSL_CTX_set_mode(ctx, SSL_MODE_RELEASE_BUFFERS); SSL_CTX_set_mode(ctx, SSL_MODE_RELEASE_BUFFERS);
#endif #endif
#if OPENSSL_VERSION_NUMBER >= 0x1010100fL
/* For OpenSSL >=1.1.1, disable auto-retry mode so it's possible
* to consume handshake records without blocking for app-data.
* https://github.com/openssl/openssl/issues/7178 */
SSL_CTX_clear_mode(ctx, SSL_MODE_AUTO_RETRY);
#endif
return APR_SUCCESS; return APR_SUCCESS;
} }
@@ -1551,6 +1558,13 @@ static apr_status_t ssl_init_proxy_certs(server_rec *s,
X509_STORE_CTX *sctx; X509_STORE_CTX *sctx;
X509_STORE *store = SSL_CTX_get_cert_store(mctx->ssl_ctx); X509_STORE *store = SSL_CTX_get_cert_store(mctx->ssl_ctx);
#if OPENSSL_VERSION_NUMBER >= 0x1010100fL
/* For OpenSSL >=1.1.1, turn on client cert support which is
* otherwise turned off by default (by design).
* https://github.com/openssl/openssl/issues/6933 */
SSL_CTX_set_post_handshake_auth(mctx->ssl_ctx, 1);
#endif
SSL_CTX_set_client_cert_cb(mctx->ssl_ctx, SSL_CTX_set_client_cert_cb(mctx->ssl_ctx,
ssl_callback_proxy_cert); ssl_callback_proxy_cert);