www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2025-08-08 15:02:10 +03:00
Code Activity

Remove NPN support and focus on ALPN (RFC 7301)

Browse Source 
* modules/ssl/mod_ssl.c, modules/ssl/mod_ssl.h: drop
  modssl_register_npn optional function and related declarations.

* modules/ssl/ssl_engine_init.c (ssl_init_ctx_callbacks):
  no longer set NPN advertisement callback.

* modules/ssl/ssl_engine_io.c (ssl_io_filter_input): remove
  NPN handling.

* modules/ssl/ssl_engine_kernel.c (ssl_callback_AdvertiseNextProtos):
  remove callback.

* modules/ssl/ssl_private.h: remove NPN prototypes, set
  HAVE_TLS_ALPN (OpenSSL 1.0.2 and later) with feature-based detection.

Rename SSLAlpnPreference to SSLALPNPreference, and add documentation.

Previous commits related to NPN and ALPN, for reference purposes:

r1332643 - Add support for TLS Next Protocol Negotiation
r1487772 - mod_ssl: Redesign NPN (Next Protocol Negotiation) API
           to avoid use of hooks API and inter-module hard linkage
r1670397 - ALPN support, based on mod_spdy/mod_h2 patch set
r1670434 - More ALPN goodness

(plus some minor tweaks: r1670578, r1670440, r1670578,
 r1670738, r1675459, and r1675549)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1676004 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Kaspar Brand
2015-04-25 09:46:09 +00:00
parent a5a2b609ab
commit 6dd2a90084
11 changed files with 192 additions and 341 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
modules/ssl/ssl_engine_io.c
View File

@@ -315,8 +315,9 @@ typedef struct {
apr_pool_t *pool;
char buffer[AP_IOBUFSIZE];
ssl_filter_ctx_t *filter_ctx;
int npn_finished; /* 1 if NPN has finished, 0 otherwise */
#ifdef HAVE_TLS_ALPN
int alpn_finished; /* 1 if ALPN has finished, 0 otherwise */
#endif
} bio_filter_in_ctx_t;
/*
@@ -1515,37 +1516,6 @@ static apr_status_t ssl_io_filter_input(ap_filter_t *f,
}
#endif
#ifdef HAVE_TLS_NPN
/* By this point, Next Protocol Negotiation (NPN) should be completed (if
* our version of OpenSSL supports it). If we haven't already, find out
* which protocol was decided upon and inform other modules by calling
* npn_proto_negotiated_hook. */
if (!inctx->npn_finished) {
SSLConnRec *sslconn = myConnConfig(f->c);
const unsigned char *next_proto = NULL;
unsigned next_proto_len = 0;
int n;
if (sslconn->npn_negofns) {
SSL_get0_next_proto_negotiated(
inctx->ssl, &next_proto, &next_proto_len);
ap_log_cerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, f->c,
APLOGNO(02306) "SSL NPN negotiated protocol: '%*s'",
next_proto_len, (const char*)next_proto);
for (n = 0; n < sslconn->npn_negofns->nelts; n++) {
ssl_npn_proto_negotiated fn =
APR_ARRAY_IDX(sslconn->npn_negofns, n, ssl_npn_proto_negotiated);
if (fn(f->c, (const char *)next_proto, next_proto_len) == DONE)
break;
}
}
inctx->npn_finished = 1;
}
#endif
return APR_SUCCESS;
}
@@ -2026,8 +1996,9 @@ static void ssl_io_input_add_filter(ssl_filter_ctx_t *filter_ctx, conn_rec *c,
inctx->block = APR_BLOCK_READ;
inctx->pool = c->pool;
inctx->filter_ctx = filter_ctx;
inctx->npn_finished = 0;
#ifdef HAVE_TLS_ALPN
inctx->alpn_finished = 0;
#endif
}
/* The request_rec pointer is passed in here only to ensure that the