www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2025-08-08 15:02:10 +03:00
Code Activity

On the trunk:

Browse Source 
mod_ssl: proper checks for libressl 2.07/8 and its TLSv1_3 support, see PR 62236.
     [Bernard Spil <brnrd@freebsd.org>]



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1828222 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Stefan Eissing
2018-04-03 12:19:28 +00:00
parent afba88ef3d
commit c9e9ecff20
5 changed files with 17 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGES
View File

@@ -1,6 +1,9 @@
-*- coding: utf-8 -*- -*- coding: utf-8 -*-
Changes with Apache 2.5.1 Changes with Apache 2.5.1
*) mod_ssl: proper checks for libressl 2.07/8 and its TLSv1_3 support, see PR 62236.
[Bernard Spil <brnrd@freebsd.org>]
*) mod_http2: on level trace2, log any unsuccessful HTTP/2 direct connection upgrade *) mod_http2: on level trace2, log any unsuccessful HTTP/2 direct connection upgrade
with base64 encoding to unify its appearance in possible bug reports. [Stefan Eissing] with base64 encoding to unify its appearance in possible bug reports. [Stefan Eissing]

2
modules/md/md_crypt.c
View File

@@ -471,7 +471,7 @@ apr_status_t md_pkey_gen(md_pkey_t **ppkey, apr_pool_t *p, md_pkey_spec_t *spec)
} }
} }
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) #if OPENSSL_VERSION_NUMBER < 0x10100000L || (defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x2070000f)
#ifndef NID_tlsfeature #ifndef NID_tlsfeature
#define NID_tlsfeature 1020 #define NID_tlsfeature 1020

2
modules/ssl/mod_ssl.c
View File

@@ -407,7 +407,7 @@ static int ssl_hook_pre_config(apr_pool_t *pconf,
/* We must register the library in full, to ensure our configuration /* We must register the library in full, to ensure our configuration
* code can successfully test the SSL environment. * code can successfully test the SSL environment.
*/ */
#if MODSSL_USE_OPENSSL_PRE_1_1_API #if MODSSL_USE_OPENSSL_PRE_1_1_API || defined(LIBRESSL_VERSION_NUMBER)
(void)CRYPTO_malloc_init(); (void)CRYPTO_malloc_init();
#else #else
OPENSSL_malloc_init(); OPENSSL_malloc_init();

6
modules/ssl/ssl_engine_init.c
View File

@@ -542,7 +542,8 @@ static apr_status_t ssl_init_ctx_tls_extensions(server_rec *s,
} }
#endif #endif
#if OPENSSL_VERSION_NUMBER < 0x10100000L #if OPENSSL_VERSION_NUMBER < 0x10100000L || \
(defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x20800000L)
/* /*
* Enable/disable SSLProtocol. If the mod_ssl enables protocol * Enable/disable SSLProtocol. If the mod_ssl enables protocol
* which is disabled by default by OpenSSL, show a warning. * which is disabled by default by OpenSSL, show a warning.
@@ -660,7 +661,8 @@ static apr_status_t ssl_init_ctx_protocol(server_rec *s,
SSL_CTX_set_options(ctx, SSL_OP_ALL); SSL_CTX_set_options(ctx, SSL_OP_ALL);
#if OPENSSL_VERSION_NUMBER < 0x10100000L #if OPENSSL_VERSION_NUMBER < 0x10100000L || \
(defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x20800000L)
/* always disable SSLv2, as per RFC 6176 */ /* always disable SSLv2, as per RFC 6176 */
SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2); SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2);

14
modules/ssl/ssl_private.h
View File

@@ -132,13 +132,14 @@
SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL) SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MIN_PROTO_VERSION, version, NULL)
#define SSL_CTX_set_max_proto_version(ctx, version) \ #define SSL_CTX_set_max_proto_version(ctx, version) \
SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL) SSL_CTX_ctrl(ctx, SSL_CTRL_SET_MAX_PROTO_VERSION, version, NULL)
#endif #elif LIBRESSL_VERSION_NUMBER < 0x2070000f
/* LibreSSL declares OPENSSL_VERSION_NUMBER == 2.0 but does not include most /* LibreSSL before 2.7 declares OPENSSL_VERSION_NUMBER == 2.0 but does not
* changes from OpenSSL >= 1.1 (new functions, macros, deprecations, ...), so * include most changes from OpenSSL >= 1.1 (new functions, macros,
* we have to work around this... * deprecations, ...), so we have to work around this...
*/ */
#define MODSSL_USE_OPENSSL_PRE_1_1_API (1) #define MODSSL_USE_OPENSSL_PRE_1_1_API (1)
#else #endif /* LIBRESSL_VERSION_NUMBER < 0x2060000f */
#else /* defined(LIBRESSL_VERSION_NUMBER) */
#define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L) #define MODSSL_USE_OPENSSL_PRE_1_1_API (OPENSSL_VERSION_NUMBER < 0x10100000L)
#endif #endif
@@ -238,7 +239,8 @@ void init_bio_methods(void);
void free_bio_methods(void); void free_bio_methods(void);
#endif #endif
#if OPENSSL_VERSION_NUMBER < 0x10002000L || defined(LIBRESSL_VERSION_NUMBER) #if OPENSSL_VERSION_NUMBER < 0x10002000L || \
(defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x2070000f)
#define X509_STORE_CTX_get0_store(x) (x->ctx) #define X509_STORE_CTX_get0_store(x) (x->ctx)
#endif #endif