www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2025-08-07 04:02:58 +03:00
Code Activity

mod_ssl: Switch to using SSL_OP_NO_RENEGOTATION (where available) to

Browse Source 
block client-initiated renegotiation with TLSv1.2 and earlier.

* modules/ssl/ssl_private.h: Define modssl_reneg_state enum,
  modssl_set_reneg_state function.

* modules/ssl/ssl_engine_io.c (bio_filter_out_write,
  bio_filter_in_read): #ifdef-out reneg protection if
  SSL_OP_NO_RENEGOTATION is defined.

* modules/ssl/ssl_engine_init.c (ssl_init_ctx_protocol):
  Enable SSL_OP_NO_RENEGOTATION.
  (ssl_init_ctx_callbacks): Only enable the "info" callback if
  debug-level logging *or* OpenSSL doesn't support SSL_OP_NO_RENEGOTATION.
  
* modules/ssl/ssl_engine_kernel.c (ssl_hook_Access_classic): Use
  modssl_set_reneg_state to set the reneg protection mode.
  (ssl_hook_Access_modern): Drop manipulation of the reneg mode which
  does nothing for TLSv1.3 already.
  (ssl_callback_Info): Only enable reneg protection if
  SSL_OP_NO_RENEGOTATION is *not* defined.

* modules/ssl/ssl_util_ssl.c (modssl_set_reneg_state): New function.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1877397 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Joe Orton
2020-05-05 12:40:38 +00:00
parent 60723ea40c
commit b8155f30da
6 changed files with 79 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
modules/ssl/ssl_engine_init.c
View File

@@ -858,6 +858,13 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
SSL_CTX_set_keylog_callback(ctx, modssl_callback_keylog);
}
#endif
#ifdef SSL_OP_NO_RENEGOTIATION
/* For server-side SSL_CTX, disable renegotiation by default.. */
if (!mctx->pkp) {
SSL_CTX_set_options(ctx, SSL_OP_NO_RENEGOTIATION);
}
#endif
return APR_SUCCESS;
}
@@ -879,6 +886,14 @@ static void ssl_init_ctx_session_cache(server_rec *s,
}
}
#ifdef SSL_OP_NO_RENEGOTIATION
/* OpenSSL-level renegotiation protection. */
#define MODSSL_BLOCKS_RENEG (0)
#else
/* mod_ssl-level renegotiation protection. */
#define MODSSL_BLOCKS_RENEG (1)
#endif
static void ssl_init_ctx_callbacks(server_rec *s,
apr_pool_t *p,
apr_pool_t *ptemp,
@@ -888,7 +903,13 @@ static void ssl_init_ctx_callbacks(server_rec *s,
SSL_CTX_set_tmp_dh_callback(ctx, ssl_callback_TmpDH);
SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
/* The info callback is used for debug-level tracing. For OpenSSL
* versions where SSL_OP_NO_RENEGOTIATION is not available, the
* callback is also used to prevent use of client-initiated
* renegotiation. Enable it in either case. */
if (APLOGdebug(s) || MODSSL_BLOCKS_RENEG) {
SSL_CTX_set_info_callback(ctx, ssl_callback_Info);
}
#ifdef HAVE_TLS_ALPN
SSL_CTX_set_alpn_select_cb(ctx, ssl_callback_alpn_select, NULL);