Authorization providers for use with Require Authorization providers for use with Require SSLALPNPreference SSLCACertificateFile SSLCACertificatePath SSLCADNRequestFilemod_log_conf
+
+
+SSLALPNPreference Directive
+
+Description: Configure protocol preference for Application-Layer Protocol Negotiation (RFC 7301) Syntax: SSLALPNPreference protocol-id ...Context: server config, virtual host Status: Extension Module: mod_ssl Compatibility: Available if using OpenSSL 1.0.2 or later
+This directive overrides preferences by implementations of application-layer
+protocols during negotiation. Protocol IDs must be specified in terms of the
+"Identification Sequence" from IANA's Application-Layer Protocol
+Negotiation (ALPN) Protocol IDs registry. The protocol specified first gets
+precedence over later or unspecified protocols. This list is evaluated
+against client capabilities.
+
+Examples
SSLALPNPreference h2 spdy/3
+For clients which support both protocols, h2 will be selected. For
+clients which only support spdy/3, that one will be chosen. If a client
+supports only protocol X and there is support for X in httpd, the
+negotiation will select X.
+
SSLCACertificateFile Directive
diff --git a/docs/manual/mod/mod_ssl.xml b/docs/manual/mod/mod_ssl.xml
index 82d0517aca..6c5197cf85 100644
--- a/docs/manual/mod/mod_ssl.xml
+++ b/docs/manual/mod/mod_ssl.xml
@@ -2650,4 +2650,32 @@ SSLOpenSSLConfCmd SignatureAlgorithms RSA+SHA384:ECDSA+SHA256
+
+SSLALPNPreference
+Configure protocol preference for Application-Layer Protocol Negotiation (RFC 7301)
+SSLALPNPreference protocol-id ...
+server config
+virtual host Available if using OpenSSL 1.0.2 or later
+
+
+This directive overrides preferences by implementations of application-layer
+protocols during negotiation. Protocol IDs must be specified in terms of the
+"Identification Sequence" from IANA's Application-Layer Protocol
+Negotiation (ALPN) Protocol IDs registry. The protocol specified first gets
+precedence over later or unspecified protocols. This list is evaluated
+against client capabilities.
+
+Examples
+
+SSLALPNPreference h2 spdy/3
+
+For clients which support both protocols, h2 will be selected. For
+clients which only support spdy/3, that one will be chosen. If a client
+supports only protocol X and there is support for X in httpd, the
+negotiation will select X.
+
+
+
diff --git a/docs/manual/mod/quickreference.html.en b/docs/manual/mod/quickreference.html.en
index eb00d66cba..edc4907a52 100644
--- a/docs/manual/mod/quickreference.html.en
+++ b/docs/manual/mod/quickreference.html.en
@@ -977,158 +977,159 @@ server.
SSITimeFormat formatstring "%A, %d-%b-%Y %H:%M + svdh B Configures the format in which date strings are
displayed SSIUndefinedEcho string "(none)" svdh B String displayed when an unset variable is echoed SSLCACertificateFile file-path sv E File of concatenated PEM-encoded CA Certificates
+ SSLALPNPreference protocol-id ... sv E Configure protocol preference for Application-Layer Protocol Negotiation (RFC 7301) SSLCACertificateFile file-path sv E File of concatenated PEM-encoded CA Certificates
for Client Auth SSLCACertificatePath directory-path sv E Directory of PEM-encoded CA Certificates for
+ SSLCACertificatePath directory-path sv E Directory of PEM-encoded CA Certificates for
Client Auth SSLCADNRequestFile file-path sv E File of concatenated PEM-encoded CA Certificates
+ SSLCADNRequestFile file-path sv E File of concatenated PEM-encoded CA Certificates
for defining acceptable CA names SSLCADNRequestPath directory-path sv E Directory of PEM-encoded CA Certificates for
+ SSLCADNRequestPath directory-path sv E Directory of PEM-encoded CA Certificates for
defining acceptable CA names SSLCARevocationCheck chain|leaf|none none sv E Enable CRL-based revocation checking SSLCARevocationFile file-path sv E File of concatenated PEM-encoded CA CRLs for
+ SSLCARevocationCheck chain|leaf|none none sv E Enable CRL-based revocation checking SSLCARevocationFile file-path sv E File of concatenated PEM-encoded CA CRLs for
Client Auth SSLCARevocationPath directory-path sv E Directory of PEM-encoded CA CRLs for
+ SSLCARevocationPath directory-path sv E Directory of PEM-encoded CA CRLs for
Client Auth SSLCertificateChainFile file-path sv E File of PEM-encoded Server CA Certificates SSLCertificateFile file-path sv E Server PEM-encoded X.509 certificate data file SSLCertificateKeyFile file-path sv E Server PEM-encoded private key file SSLCipherSuite cipher-spec DEFAULT (depends on + svdh E Cipher Suite available for negotiation in SSL
+ SSLCertificateChainFile file-path sv E File of PEM-encoded Server CA Certificates SSLCertificateFile file-path sv E Server PEM-encoded X.509 certificate data file SSLCertificateKeyFile file-path sv E Server PEM-encoded private key file SSLCipherSuite cipher-spec DEFAULT (depends on + svdh E Cipher Suite available for negotiation in SSL
handshake SSLCompression on|off off sv E Enable compression on the SSL level SSLCryptoDevice engine builtin s E Enable use of a cryptographic hardware accelerator SSLEngine on|off|optional off sv E SSL Engine Operation Switch SSLFIPS on|off off s E SSL FIPS mode Switch SSLHonorCipherOrder on|off off sv E Option to prefer the server's cipher preference order SSLInsecureRenegotiation on|off off sv E Option to enable support for insecure renegotiation SSLOCSDefaultResponder uri sv E Set the default responder URI for OCSP validation SSLOCSPEnable on|off off sv E Enable OCSP validation of the client certificate chain SSLOCSPOverrideResponder on|off off sv E Force use of the default responder URI for OCSP validation SSLOCSPResponderTimeout seconds 10 sv E Timeout for OCSP queries SSLOCSPResponseMaxAge seconds -1 sv E Maximum allowable age for OCSP responses SSLOCSPResponseTimeSkew seconds 300 sv E Maximum allowable time skew for OCSP response validation SSLOCSPUseRequestNonce on|off on sv E Use a nonce within OCSP queries SSLOpenSSLConfCmd command-name command-value sv E Configure OpenSSL parameters through its SSL_CONF API SSLOptions [+|-]option ... svdh E Configure various SSL engine run-time options SSLPassPhraseDialog type builtin s E Type of pass phrase dialog for encrypted private
+ SSLCompression on|off off sv E Enable compression on the SSL level SSLCryptoDevice engine builtin s E Enable use of a cryptographic hardware accelerator SSLEngine on|off|optional off sv E SSL Engine Operation Switch SSLFIPS on|off off s E SSL FIPS mode Switch SSLHonorCipherOrder on|off off sv E Option to prefer the server's cipher preference order SSLInsecureRenegotiation on|off off sv E Option to enable support for insecure renegotiation SSLOCSDefaultResponder uri sv E Set the default responder URI for OCSP validation SSLOCSPEnable on|off off sv E Enable OCSP validation of the client certificate chain SSLOCSPOverrideResponder on|off off sv E Force use of the default responder URI for OCSP validation SSLOCSPResponderTimeout seconds 10 sv E Timeout for OCSP queries SSLOCSPResponseMaxAge seconds -1 sv E Maximum allowable age for OCSP responses SSLOCSPResponseTimeSkew seconds 300 sv E Maximum allowable time skew for OCSP response validation SSLOCSPUseRequestNonce on|off on sv E Use a nonce within OCSP queries SSLOpenSSLConfCmd command-name command-value sv E Configure OpenSSL parameters through its SSL_CONF API SSLOptions [+|-]option ... svdh E Configure various SSL engine run-time options SSLPassPhraseDialog type builtin s E Type of pass phrase dialog for encrypted private
keys SSLProtocol [+|-]protocol ... all sv E Configure usable SSL/TLS protocol versions SSLProxyCACertificateFile file-path sv E File of concatenated PEM-encoded CA Certificates
+ SSLProtocol [+|-]protocol ... all sv E Configure usable SSL/TLS protocol versions SSLProxyCACertificateFile file-path sv E File of concatenated PEM-encoded CA Certificates
for Remote Server Auth SSLProxyCACertificatePath directory-path sv E Directory of PEM-encoded CA Certificates for
+ SSLProxyCACertificatePath directory-path sv E Directory of PEM-encoded CA Certificates for
Remote Server Auth SSLProxyCARevocationCheck chain|leaf|none none sv E Enable CRL-based revocation checking for Remote Server Auth SSLProxyCARevocationFile file-path sv E File of concatenated PEM-encoded CA CRLs for
+ SSLProxyCARevocationCheck chain|leaf|none none sv E Enable CRL-based revocation checking for Remote Server Auth SSLProxyCARevocationFile file-path sv E File of concatenated PEM-encoded CA CRLs for
Remote Server Auth SSLProxyCARevocationPath directory-path sv E Directory of PEM-encoded CA CRLs for
+ SSLProxyCARevocationPath directory-path sv E Directory of PEM-encoded CA CRLs for
Remote Server Auth SSLProxyCheckPeerCN on|off on sv E Whether to check the remote server certificate's CN field
+ SSLProxyCheckPeerCN on|off on sv E Whether to check the remote server certificate's CN field
SSLProxyCheckPeerExpire on|off on sv E Whether to check if remote server certificate is expired
+ SSLProxyCheckPeerExpire on|off on sv E Whether to check if remote server certificate is expired
SSLProxyCheckPeerName on|off on sv E Configure host name checking for remote server certificates
+ SSLProxyCheckPeerName on|off on sv E Configure host name checking for remote server certificates
SSLProxyCipherSuite cipher-spec ALL:!ADH:RC4+RSA:+H + svdh E Cipher Suite available for negotiation in SSL
+ SSLProxyCipherSuite cipher-spec ALL:!ADH:RC4+RSA:+H + svdh E Cipher Suite available for negotiation in SSL
proxy handshake SSLProxyEngine on|off off sv E SSL Proxy Engine Operation Switch SSLProxyMachineCertificateChainFile filename s E File of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate SSLProxyMachineCertificateFile filename s E File of concatenated PEM-encoded client certificates and keys to be used by the proxy SSLProxyMachineCertificatePath directory s E Directory of PEM-encoded client certificates and keys to be used by the proxy SSLProxyProtocol [+|-]protocol ... all sv E Configure usable SSL protocol flavors for proxy usage SSLProxyVerify level none sv E Type of remote server Certificate verification SSLProxyVerifyDepth number 1 sv E Maximum depth of CA Certificates in Remote Server
+ SSLProxyEngine on|off off sv E SSL Proxy Engine Operation Switch SSLProxyMachineCertificateChainFile filename s E File of concatenated PEM-encoded CA certificates to be used by the proxy for choosing a certificate SSLProxyMachineCertificateFile filename s E File of concatenated PEM-encoded client certificates and keys to be used by the proxy SSLProxyMachineCertificatePath directory s E Directory of PEM-encoded client certificates and keys to be used by the proxy SSLProxyProtocol [+|-]protocol ... all sv E Configure usable SSL protocol flavors for proxy usage SSLProxyVerify level none sv E Type of remote server Certificate verification SSLProxyVerifyDepth number 1 sv E Maximum depth of CA Certificates in Remote Server
Certificate verification SSLRandomSeed context source
-[bytes] s E Pseudo Random Number Generator (PRNG) seeding
+ SSLRandomSeed context source
+[bytes] s E Pseudo Random Number Generator (PRNG) seeding
source SSLRenegBufferSize bytes 131072 dh E Set the size for the SSL renegotiation buffer SSLRequire expression dh E Allow access only when an arbitrarily complex
+ SSLRenegBufferSize bytes 131072 dh E Set the size for the SSL renegotiation buffer SSLRequire expression dh E Allow access only when an arbitrarily complex
boolean expression is true SSLRequireSSL dh E Deny access when SSL is not used for the
+ SSLRequireSSL dh E Deny access when SSL is not used for the
HTTP request SSLSessionCache type none s E Type of the global/inter-process SSL Session
+ SSLSessionCache type none s E Type of the global/inter-process SSL Session
Cache SSLSessionCacheTimeout seconds 300 sv E Number of seconds before an SSL session expires
+ SSLSessionCacheTimeout seconds 300 sv E Number of seconds before an SSL session expires
in the Session Cache SSLSessionTicketKeyFile file-path sv E Persistent encryption/decryption key for TLS session tickets SSLSessionTickets on|off on sv E Enable or disable use of TLS session tickets SSLSRPUnknownUserSeed secret-string sv E SRP unknown user seed SSLSRPVerifierFile file-path sv E Path to SRP verifier file SSLStaplingCache type s E Configures the OCSP stapling cache SSLStaplingErrorCacheTimeout seconds 600 sv E Number of seconds before expiring invalid responses in the OCSP stapling cache SSLStaplingFakeTryLater on|off on sv E Synthesize "tryLater" responses for failed OCSP stapling queries SSLStaplingForceURL uri sv E Override the OCSP responder URI specified in the certificate's AIA extension SSLStaplingResponderTimeout seconds 10 sv E Timeout for OCSP stapling queries SSLStaplingResponseMaxAge seconds -1 sv E Maximum allowable age for OCSP stapling responses SSLStaplingResponseTimeSkew seconds 300 sv E Maximum allowable time skew for OCSP stapling response validation SSLStaplingReturnResponderErrors on|off on sv E Pass stapling related OCSP errors on to client SSLStaplingStandardCacheTimeout seconds 3600 sv E Number of seconds before expiring responses in the OCSP stapling cache SSLStrictSNIVHostCheck on|off off sv E Whether to allow non-SNI clients to access a name-based virtual
+ SSLSessionTicketKeyFile file-path sv E Persistent encryption/decryption key for TLS session tickets SSLSessionTickets on|off on sv E Enable or disable use of TLS session tickets SSLSRPUnknownUserSeed secret-string sv E SRP unknown user seed SSLSRPVerifierFile file-path sv E Path to SRP verifier file SSLStaplingCache type s E Configures the OCSP stapling cache SSLStaplingErrorCacheTimeout seconds 600 sv E Number of seconds before expiring invalid responses in the OCSP stapling cache SSLStaplingFakeTryLater on|off on sv E Synthesize "tryLater" responses for failed OCSP stapling queries SSLStaplingForceURL uri sv E Override the OCSP responder URI specified in the certificate's AIA extension SSLStaplingResponderTimeout seconds 10 sv E Timeout for OCSP stapling queries SSLStaplingResponseMaxAge seconds -1 sv E Maximum allowable age for OCSP stapling responses SSLStaplingResponseTimeSkew seconds 300 sv E Maximum allowable time skew for OCSP stapling response validation SSLStaplingReturnResponderErrors on|off on sv E Pass stapling related OCSP errors on to client SSLStaplingStandardCacheTimeout seconds 3600 sv E Number of seconds before expiring responses in the OCSP stapling cache SSLStrictSNIVHostCheck on|off off sv E Whether to allow non-SNI clients to access a name-based virtual
host.
SSLUserName varname sdh E Variable name to determine user name SSLUseStapling on|off off sv E Enable stapling of OCSP responses in the TLS handshake SSLVerifyClient level none svdh E Type of Client Certificate verification SSLVerifyDepth number 1 svdh E Maximum depth of CA Certificates in Client
+ SSLUserName varname sdh E Variable name to determine user name SSLUseStapling on|off off sv E Enable stapling of OCSP responses in the TLS handshake SSLVerifyClient level none svdh E Type of Client Certificate verification SSLVerifyDepth number 1 svdh E Maximum depth of CA Certificates in Client
Certificate verification StartServers number s M Number of child server processes created at startup StartThreads number s M Number of threads created on startup Substitute s/pattern/substitution/[infq] dh E Pattern to filter the response content SubstituteMaxLineLength bytes(b|B|k|K|m|M|g|G) 1m dh E Set the maximum line size Suexec On|Off s B Enable or disable the suEXEC feature SuexecUserGroup User Group sv E User and group for CGI programs to run as ThreadLimit number s M Sets the upper limit on the configurable number of threads
+ StartServers number s M Number of child server processes created at startup StartThreads number s M Number of threads created on startup Substitute s/pattern/substitution/[infq] dh E Pattern to filter the response content SubstituteMaxLineLength bytes(b|B|k|K|m|M|g|G) 1m dh E Set the maximum line size Suexec On|Off s B Enable or disable the suEXEC feature SuexecUserGroup User Group sv E User and group for CGI programs to run as ThreadLimit number s M Sets the upper limit on the configurable number of threads
per child process ThreadsPerChild number s M Number of threads created by each child process ThreadStackSize size s M The size in bytes of the stack used by threads handling
+ ThreadsPerChild number s M Number of threads created by each child process ThreadStackSize size s M The size in bytes of the stack used by threads handling
client connections TimeOut seconds 60 sv C Amount of time the server will wait for
+ TimeOut seconds 60 sv C Amount of time the server will wait for
certain events before failing a request TraceEnable [on|off|extended] on sv C Determines the behavior on TRACE requests TransferLog file|pipe sv B Specify location of a log file TypesConfig file-path conf/mime.types s B The location of the mime.types file UnDefine parameter-name sv C Undefine the existence of a variable UndefMacro name svd B Undefine a macro UnsetEnv env-variable [env-variable]
-... svdh B Removes variables from the environment Use name [value1 ... valueN]
- svd B Use a macro UseCanonicalName On|Off|DNS Off svd C Configures how the server determines its own name and
+ TraceEnable [on|off|extended] on sv C Determines the behavior on TRACE requests TransferLog file|pipe sv B Specify location of a log file TypesConfig file-path conf/mime.types s B The location of the mime.types file UnDefine parameter-name sv C Undefine the existence of a variable UndefMacro name svd B Undefine a macro UnsetEnv env-variable [env-variable]
+... svdh B Removes variables from the environment Use name [value1 ... valueN]
+ svd B Use a macro UseCanonicalName On|Off|DNS Off svd C Configures how the server determines its own name and
port UseCanonicalPhysicalPort On|Off Off svd C Configures how the server determines its own port User unix-userid #-1 s B The userid under which the server will answer
+ UseCanonicalPhysicalPort On|Off Off svd C Configures how the server determines its own port User unix-userid #-1 s B The userid under which the server will answer
requests UserDir directory-filename [directory-filename] ...
- sv B Location of the user-specific directories VHostCGIMode On|Off|Secure On v X Determines whether the virtualhost can run
+ UserDir directory-filename [directory-filename] ...
+ sv B Location of the user-specific directories VHostCGIMode On|Off|Secure On v X Determines whether the virtualhost can run
subprocesses, and the privileges available to subprocesses. VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ... v X Assign arbitrary privileges to subprocesses created
+ VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ... v X Assign arbitrary privileges to subprocesses created
by a virtual host. VHostGroup unix-groupid v X Sets the Group ID under which a virtual host runs. VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ... v X Assign arbitrary privileges to a virtual host. VHostSecure On|Off On v X Determines whether the server runs with enhanced security
+ VHostGroup unix-groupid v X Sets the Group ID under which a virtual host runs. VHostPrivs [+-]?privilege-name [[+-]?privilege-name] ... v X Assign arbitrary privileges to a virtual host. VHostSecure On|Off On v X Determines whether the server runs with enhanced security
for the virtualhost. VHostUser unix-userid v X Sets the User ID under which a virtual host runs. VirtualDocumentRoot interpolated-directory|none none sv E Dynamically configure the location of the document root
+ VHostUser unix-userid v X Sets the User ID under which a virtual host runs. VirtualDocumentRoot interpolated-directory|none none sv E Dynamically configure the location of the document root
for a given virtual host VirtualDocumentRootIP interpolated-directory|none none sv E Dynamically configure the location of the document root
+ VirtualDocumentRootIP interpolated-directory|none none sv E Dynamically configure the location of the document root
for a given virtual host <VirtualHost
+<VirtualHost
addr[:port] [addr[:port]]
- ...> ... </VirtualHost> s C Contains directives that apply only to a specific
+ ...> ... </VirtualHost> s C Contains directives that apply only to a specific
hostname or IP address VirtualScriptAlias interpolated-directory|none none sv E Dynamically configure the location of the CGI directory for
+ VirtualScriptAlias interpolated-directory|none none sv E Dynamically configure the location of the CGI directory for
a given virtual host VirtualScriptAliasIP interpolated-directory|none none sv E Dynamically configure the location of the CGI directory for
+ VirtualScriptAliasIP interpolated-directory|none none sv E Dynamically configure the location of the CGI directory for
a given virtual host Warning message svdh C Warn from configuration parsing with a custom message WatchdogInterval number-of-seconds 1 s B Watchdog interval in seconds XBitHack on|off|full off svdh B Parse SSI directives in files with the execute bit
+ Warning message svdh C Warn from configuration parsing with a custom message WatchdogInterval number-of-seconds 1 s B Watchdog interval in seconds XBitHack on|off|full off svdh B Parse SSI directives in files with the execute bit
set xml2EncAlias charset alias [alias ...] s B Recognise Aliases for encoding values xml2EncDefault name svdh B Sets a default encoding to assume when absolutely no information
+ xml2EncAlias charset alias [alias ...] s B Recognise Aliases for encoding values xml2EncDefault name svdh B Sets a default encoding to assume when absolutely no information
can be automatically detected xml2StartParse element [element ...] svdh B Advise the parser to skip leading junk. xml2StartParse element [element ...] svdh B Advise the parser to skip leading junk. Available Languages: de |
diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
index a9324830e5..2cb63669fe 100644
--- a/modules/ssl/mod_ssl.c
+++ b/modules/ssl/mod_ssl.c
@@ -283,12 +283,12 @@ static const command_rec ssl_config_cmds[] = {
"OpenSSL configuration command")
#endif
-#if defined(HAVE_TLS_ALPN) || defined(HAVE_TLS_NPN)
- SSL_CMD_SRV(AlpnPreference, ITERATE,
+#ifdef HAVE_TLS_ALPN
+ SSL_CMD_SRV(ALPNPreference, ITERATE,
"Preference in Application-Layer Protocol Negotiation (ALPN), "
- "protocols are chosed in the specified order")
+ "protocols are chosen in the specified order")
#endif
-
+
/* Deprecated directives. */
AP_INIT_RAW_ARGS("SSLLog", ap_set_deprecated, NULL, OR_ALL,
"SSLLog directive is no longer supported - use ErrorLog."),
@@ -448,37 +448,6 @@ static int ssl_engine_disable(conn_rec *c)
return 1;
}
-static int modssl_register_npn(conn_rec *c,
- ssl_npn_advertise_protos advertisefn,
- ssl_npn_proto_negotiated negotiatedfn)
-{
-#ifdef HAVE_TLS_NPN
- SSLConnRec *sslconn = myConnConfig(c);
-
- if (!sslconn) {
- return DECLINED;
- }
-
- if (!sslconn->npn_advertfns) {
- sslconn->npn_advertfns =
- apr_array_make(c->pool, 5, sizeof(ssl_npn_advertise_protos));
- sslconn->npn_negofns =
- apr_array_make(c->pool, 5, sizeof(ssl_npn_proto_negotiated));
- }
-
- if (advertisefn)
- APR_ARRAY_PUSH(sslconn->npn_advertfns, ssl_npn_advertise_protos) =
- advertisefn;
- if (negotiatedfn)
- APR_ARRAY_PUSH(sslconn->npn_negofns, ssl_npn_proto_negotiated) =
- negotiatedfn;
-
- return OK;
-#else
- return DECLINED;
-#endif
-}
-
static int modssl_register_alpn(conn_rec *c,
ssl_alpn_propose_protos advertisefn,
ssl_alpn_proto_negotiated negotiatedfn)
@@ -678,7 +647,6 @@ static void ssl_register_hooks(apr_pool_t *p)
APR_REGISTER_OPTIONAL_FN(ssl_proxy_enable);
APR_REGISTER_OPTIONAL_FN(ssl_engine_disable);
- APR_REGISTER_OPTIONAL_FN(modssl_register_npn);
APR_REGISTER_OPTIONAL_FN(modssl_register_alpn);
ap_register_auth_provider(p, AUTHZ_PROVIDER_GROUP, "ssl",
diff --git a/modules/ssl/mod_ssl.h b/modules/ssl/mod_ssl.h
index a3ea694ec3..8246d49629 100644
--- a/modules/ssl/mod_ssl.h
+++ b/modules/ssl/mod_ssl.h
@@ -93,41 +93,6 @@ APR_DECLARE_OPTIONAL_FN(int, ssl_proxy_enable, (conn_rec *));
APR_DECLARE_OPTIONAL_FN(int, ssl_engine_disable, (conn_rec *));
-/** The npn_advertise_protos callback allows another modules to add
- * entries to the list of protocol names advertised by the server
- * during the Next Protocol Negotiation (NPN) portion of the SSL
- * handshake. The callback is given the connection and an APR array;
- * it should push one or more char*'s pointing to NUL-terminated
- * strings (such as "http/1.1" or "spdy/2") onto the array and return
- * OK. To prevent further processing of (other modules') callbacks,
- * return DONE. */
-typedef int (*ssl_npn_advertise_protos)(conn_rec *connection,
- apr_array_header_t *protos);
-
-/** The npn_proto_negotiated callback allows other modules to discover
- * the name of the protocol that was chosen during the Next Protocol
- * Negotiation (NPN) portion of the SSL handshake. Note that this may
- * be the empty string (in which case modules should probably assume
- * HTTP), or it may be a protocol that was never even advertised by
- * the server. The callback is given the connection, a
- * non-NUL-terminated string containing the protocol name, and the
- * length of the string; it should do something appropriate
- * (i.e. insert or remove filters) and return OK. To prevent further
- * processing of (other modules') callbacks, return DONE. */
-typedef int (*ssl_npn_proto_negotiated)(conn_rec *connection,
- const char *proto_name,
- apr_size_t proto_name_len);
-
-/* An optional function which can be used to register a pair of
- * callbacks for NPN handling. This optional function should be
- * invoked from a pre_connection hook which runs *after* mod_ssl.c's
- * pre_connection hook. The function returns OK if the callbacks are
- * register, or DECLINED otherwise (for example if mod_ssl does not
- * support NPN). */
-APR_DECLARE_OPTIONAL_FN(int, modssl_register_npn, (conn_rec *conn,
- ssl_npn_advertise_protos advertisefn,
- ssl_npn_proto_negotiated negotiatedfn));
-
/** The alpn_propose_proto callback allows other modules to propose
* the name of the protocol that will be chosen during the
* Application-Layer Protocol Negotiation (ALPN) portion of the SSL handshake.
diff --git a/modules/ssl/ssl_engine_config.c b/modules/ssl/ssl_engine_config.c
index 7af7b907c4..b19103cf6b 100644
--- a/modules/ssl/ssl_engine_config.c
+++ b/modules/ssl/ssl_engine_config.c
@@ -160,7 +160,7 @@ static void modssl_ctx_init(modssl_ctx_t *mctx, apr_pool_t *p)
SSL_CONF_CTX_set_flags(mctx->ssl_ctx_config, SSL_CONF_FLAG_CERTIFICATE);
mctx->ssl_ctx_param = apr_array_make(p, 5, sizeof(ssl_ctx_param_t));
#endif
-#if defined(HAVE_TLS_ALPN) || defined(HAVE_TLS_NPN)
+#ifdef HAVE_TLS_ALPN
mctx->ssl_alpn_pref = apr_array_make(p, 5, sizeof(const char *));
#endif
}
@@ -307,7 +307,7 @@ static void modssl_ctx_cfg_merge(apr_pool_t *p,
#ifdef HAVE_SSL_CONF_CMD
cfgMergeArray(ssl_ctx_param);
#endif
-#if defined(HAVE_TLS_ALPN) || defined(HAVE_TLS_NPN)
+#ifdef HAVE_TLS_ALPN
cfgMergeArray(ssl_alpn_pref);
#endif
}
@@ -1868,8 +1868,8 @@ const char *ssl_cmd_SSLOpenSSLConfCmd(cmd_parms *cmd, void *dcfg,
}
#endif
-#if defined(HAVE_TLS_ALPN) || defined(HAVE_TLS_NPN)
-const char *ssl_cmd_SSLAlpnPreference(cmd_parms *cmd, void *dcfg,
+#ifdef HAVE_TLS_ALPN
+const char *ssl_cmd_SSLALPNPreference(cmd_parms *cmd, void *dcfg,
const char *protocol)
{
SSLSrvConfigRec *sc = mySrvConfig(cmd->server);
diff --git a/modules/ssl/ssl_engine_init.c b/modules/ssl/ssl_engine_init.c
index aa5cc7b964..28753a6f1a 100644
--- a/modules/ssl/ssl_engine_init.c
+++ b/modules/ssl/ssl_engine_init.c
@@ -651,11 +651,6 @@ static void ssl_init_ctx_callbacks(server_rec *s,
SSL_CTX_set_alpn_select_cb(
ctx, ssl_callback_alpn_select, NULL);
#endif
-
-#ifdef HAVE_TLS_NPN
- SSL_CTX_set_next_protos_advertised_cb(
- ctx, ssl_callback_AdvertiseNextProtos, NULL);
-#endif
}
static apr_status_t ssl_init_ctx_verify(server_rec *s,
diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c
index 53d7b10671..ed09b92e22 100644
--- a/modules/ssl/ssl_engine_io.c
+++ b/modules/ssl/ssl_engine_io.c
@@ -315,8 +315,9 @@ typedef struct {
apr_pool_t *pool;
char buffer[AP_IOBUFSIZE];
ssl_filter_ctx_t *filter_ctx;
- int npn_finished; /* 1 if NPN has finished, 0 otherwise */
+#ifdef HAVE_TLS_ALPN
int alpn_finished; /* 1 if ALPN has finished, 0 otherwise */
+#endif
} bio_filter_in_ctx_t;
/*
@@ -1515,37 +1516,6 @@ static apr_status_t ssl_io_filter_input(ap_filter_t *f,
}
#endif
-#ifdef HAVE_TLS_NPN
- /* By this point, Next Protocol Negotiation (NPN) should be completed (if
- * our version of OpenSSL supports it). If we haven't already, find out
- * which protocol was decided upon and inform other modules by calling
- * npn_proto_negotiated_hook. */
- if (!inctx->npn_finished) {
- SSLConnRec *sslconn = myConnConfig(f->c);
- const unsigned char *next_proto = NULL;
- unsigned next_proto_len = 0;
- int n;
-
- if (sslconn->npn_negofns) {
- SSL_get0_next_proto_negotiated(
- inctx->ssl, &next_proto, &next_proto_len);
- ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, f->c,
- APLOGNO(02306) "SSL NPN negotiated protocol: '%*s'",
- next_proto_len, (const char*)next_proto);
-
- for (n = 0; n < sslconn->npn_negofns->nelts; n++) {
- ssl_npn_proto_negotiated fn =
- APR_ARRAY_IDX(sslconn->npn_negofns, n, ssl_npn_proto_negotiated);
-
- if (fn(f->c, (const char *)next_proto, next_proto_len) == DONE)
- break;
- }
- }
-
- inctx->npn_finished = 1;
- }
-#endif
-
return APR_SUCCESS;
}
@@ -2026,8 +1996,9 @@ static void ssl_io_input_add_filter(ssl_filter_ctx_t *filter_ctx, conn_rec *c,
inctx->block = APR_BLOCK_READ;
inctx->pool = c->pool;
inctx->filter_ctx = filter_ctx;
- inctx->npn_finished = 0;
+#ifdef HAVE_TLS_ALPN
inctx->alpn_finished = 0;
+#endif
}
/* The request_rec pointer is passed in here only to ensure that the
diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
index 59c3591877..ffc2c99813 100644
--- a/modules/ssl/ssl_engine_kernel.c
+++ b/modules/ssl/ssl_engine_kernel.c
@@ -2226,6 +2226,7 @@ int ssl_callback_alpn_select(SSL *ssl,
apr_array_header_t *client_protos;
apr_array_header_t *proposed_protos;
int i;
+ size_t len;
/* If the connection object is not available,
* then there's nothing for us to do. */
@@ -2236,7 +2237,7 @@ int ssl_callback_alpn_select(SSL *ssl,
if (inlen == 0) {
// someone tries to trick us?
ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02837)
- "alpn client protocol list empty");
+ "ALPN client protocol list empty");
return SSL_TLSEXT_ERR_ALERT_FATAL;
}
@@ -2246,7 +2247,7 @@ int ssl_callback_alpn_select(SSL *ssl,
if (plen + i > inlen) {
// someone tries to trick us?
ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02838)
- "alpn protocol identier too long");
+ "ALPN protocol identier too long");
return SSL_TLSEXT_ERR_ALERT_FATAL;
}
APR_ARRAY_PUSH(client_protos, char*) =
@@ -2278,7 +2279,7 @@ int ssl_callback_alpn_select(SSL *ssl,
* supported by us. Choose it if none other matches. */
if (ssl_array_index(client_protos, alpn_http1) < 0) {
ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02839)
- "none of the client alpn protocols are supported");
+ "none of the client ALPN protocols are supported");
return SSL_TLSEXT_ERR_ALERT_FATAL;
}
*out = (const unsigned char*)alpn_http1;
@@ -2296,10 +2297,10 @@ int ssl_callback_alpn_select(SSL *ssl,
}
}
- size_t len = strlen((const char*)*out);
+ len = strlen((const char*)*out);
if (len > 255) {
ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02840)
- "alpn negotiated protocol name too long");
+ "ALPN negotiated protocol name too long");
return SSL_TLSEXT_ERR_ALERT_FATAL;
}
*outlen = (unsigned char)len;
@@ -2307,96 +2308,6 @@ int ssl_callback_alpn_select(SSL *ssl,
return SSL_TLSEXT_ERR_OK;
}
#endif
-#if defined(HAVE_TLS_NPN)
-/*
- * This callback function is executed when SSL needs to decide what protocols
- * to advertise during Next Protocol Negotiation (NPN). It must produce a
- * string in wire format -- a sequence of length-prefixed strings -- indicating
- * the advertised protocols. Refer to SSL_CTX_set_next_protos_advertised_cb
- * in OpenSSL for reference.
- */
-int ssl_callback_AdvertiseNextProtos(SSL *ssl, const unsigned char **data_out,
- unsigned int *size_out, void *arg)
-{
- conn_rec *c = (conn_rec*)SSL_get_app_data(ssl);
- SSLConnRec *sslconn = myConnConfig(c);
- apr_array_header_t *protos;
- int num_protos;
- unsigned int size;
- int i;
- unsigned char *data;
- unsigned char *start;
-
- *data_out = NULL;
- *size_out = 0;
-
- /* If the connection object is not available, or there are no NPN
- * hooks registered, then there's nothing for us to do. */
- if (c == NULL || sslconn->npn_advertfns == NULL) {
- return SSL_TLSEXT_ERR_OK;
- }
-
- /* Invoke our npn_advertise_protos hook, giving other modules a chance to
- * add alternate protocol names to advertise. */
- protos = apr_array_make(c->pool, 0, sizeof(char *));
- for (i = 0; i < sslconn->npn_advertfns->nelts; i++) {
- ssl_npn_advertise_protos fn =
- APR_ARRAY_IDX(sslconn->npn_advertfns, i, ssl_npn_advertise_protos);
-
- if (fn(c, protos) == DONE)
- break;
- }
- num_protos = protos->nelts;
-
- /* We now have a list of null-terminated strings; we need to concatenate
- * them together into a single string, where each protocol name is prefixed
- * by its length. First, calculate how long that string will be. */
- size = 0;
- for (i = 0; i < num_protos; ++i) {
- const char *string = APR_ARRAY_IDX(protos, i, const char*);
- unsigned int length = strlen(string);
- /* If the protocol name is too long (the length must fit in one byte),
- * then log an error and skip it. */
- if (length > 255) {
- ap_log_cerror(APLOG_MARK, APLOG_ERR, 0, c, APLOGNO(02307)
- "SSL NPN protocol name too long (length=%u): %s",
- length, string);
- continue;
- }
- /* Leave room for the length prefix (one byte) plus the protocol name
- * itself. */
- size += 1 + length;
- }
-
- /* If there is nothing to advertise (either because no modules added
- * anything to the protos array, or because all strings added to the array
- * were skipped), then we're done. */
- if (size == 0) {
- return SSL_TLSEXT_ERR_OK;
- }
-
- /* Now we can build the string. Copy each protocol name string into the
- * larger string, prefixed by its length. */
- data = apr_palloc(c->pool, size * sizeof(unsigned char));
- start = data;
- for (i = 0; i < num_protos; ++i) {
- const char *string = APR_ARRAY_IDX(protos, i, const char*);
- apr_size_t length = strlen(string);
- if (length > 255)
- continue;
- *start = (unsigned char)length;
- ++start;
- memcpy(start, string, length * sizeof(unsigned char));
- start += length;
- }
-
- /* Success. */
- *data_out = data;
- *size_out = size;
- return SSL_TLSEXT_ERR_OK;
-}
-
-#endif /* HAVE_TLS_NPN */
#ifdef HAVE_SRP
diff --git a/modules/ssl/ssl_private.h b/modules/ssl/ssl_private.h
index bbf8b42715..91d5068410 100644
--- a/modules/ssl/ssl_private.h
+++ b/modules/ssl/ssl_private.h
@@ -176,22 +176,17 @@
#endif
#endif
-/* ALPN Protocol Negotiation */
-#if OPENSSL_VERSION_NUMBER >= 0x10002000L
-#define HAVE_TLS_ALPN
-#endif
-
-/* Next Protocol Negotiation */
-#if !defined(OPENSSL_NO_NEXTPROTONEG) && defined(OPENSSL_NPN_NEGOTIATED)
-#define HAVE_TLS_NPN
-#endif
-
/* Secure Remote Password */
#if !defined(OPENSSL_NO_SRP) && defined(SSL_CTRL_SET_TLS_EXT_SRP_USERNAME_CB)
#define HAVE_SRP
#include
#endif
+/* ALPN Protocol Negotiation */
+#if defined(TLSEXT_TYPE_application_layer_protocol_negotiation)
+#define HAVE_TLS_ALPN
+#endif
+
#endif /* !defined(OPENSSL_NO_TLSEXT) && defined(SSL_set_tlsext_host_name) */
/* mod_ssl headers */
@@ -443,12 +438,6 @@ typedef struct {
* connection */
} reneg_state;
-#ifdef HAVE_TLS_NPN
- /* Poor man's inter-module optional hooks for NPN. */
- apr_array_header_t *npn_advertfns; /* list of ssl_npn_advertise_protos callbacks */
- apr_array_header_t *npn_negofns; /* list of ssl_npn_proto_negotiated callbacks. */
-#endif
-
#ifdef HAVE_TLS_ALPN
/* Poor man's inter-module optional hooks for ALPN. */
apr_array_header_t *alpn_proposefns; /* list of ssl_alpn_propose_protos callbacks */
@@ -636,7 +625,7 @@ typedef struct {
apr_array_header_t *ssl_ctx_param; /* parameters to pass to SSL_CTX */
#endif
-#if defined(HAVE_TLS_ALPN) || defined(HAVE_TLS_NPN)
+#ifdef HAVE_TLS_ALPN
apr_array_header_t *ssl_alpn_pref; /* protocol names in order of preference */
#endif
} modssl_ctx_t;
@@ -765,8 +754,8 @@ const char *ssl_cmd_SSLOCSPEnable(cmd_parms *cmd, void *dcfg, int flag);
const char *ssl_cmd_SSLOpenSSLConfCmd(cmd_parms *cmd, void *dcfg, const char *arg1, const char *arg2);
#endif
-#if defined(HAVE_TLS_ALPN) || defined(HAVE_TLS_NPN)
-const char *ssl_cmd_SSLAlpnPreference(cmd_parms *cmd, void *dcfg, const char *protocol);
+#ifdef HAVE_TLS_ALPN
+const char *ssl_cmd_SSLALPNPreference(cmd_parms *cmd, void *dcfg, const char *protocol);
#endif
#ifdef HAVE_SRP
@@ -822,9 +811,6 @@ int ssl_callback_alpn_select(SSL *ssl, const unsigned char **out,
unsigned char *outlen, const unsigned char *in,
unsigned int inlen, void *arg);
#endif
-#ifdef HAVE_TLS_NPN
-int ssl_callback_AdvertiseNextProtos(SSL *ssl, const unsigned char **data, unsigned int *len, void *arg);
-#endif
/** Session Cache Support */
apr_status_t ssl_scache_init(server_rec *, apr_pool_t *);