www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2025-08-07 04:02:58 +03:00
Code Activity

* Don't SEGFAULT if SSLProxyMachineCertificateChainFile is not set. Just skip the additional lookups in this case.

Browse Source 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162103 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Ruediger Pluem
2011-08-26 13:07:49 +00:00
parent 1f3ac80ec2
commit e63cd2cc79
1 changed files with 19 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
modules/ssl/ssl_engine_kernel.c
View File

@@ -1803,6 +1803,7 @@ int ssl_callback_proxy_cert(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
STACK_OF(X509_NAME) *ca_list; STACK_OF(X509_NAME) *ca_list;
STACK_OF(X509_INFO) *certs = sc->proxy->pkp->certs; STACK_OF(X509_INFO) *certs = sc->proxy->pkp->certs;
STACK_OF(X509_INFO) *ca_certs; STACK_OF(X509_INFO) *ca_certs;
STACK_OF(X509_INFO) **ca_cert_chains;
int i, j, k; int i, j, k;
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
@@ -1833,6 +1834,7 @@ int ssl_callback_proxy_cert(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
return TRUE; return TRUE;
} }
ca_cert_chains = sc->proxy->pkp->ca_certs;
for (i = 0; i < sk_X509_NAME_num(ca_list); i++) { for (i = 0; i < sk_X509_NAME_num(ca_list); i++) {
ca_name = sk_X509_NAME_value(ca_list, i); ca_name = sk_X509_NAME_value(ca_list, i);
@@ -1849,8 +1851,12 @@ int ssl_callback_proxy_cert(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
return TRUE; return TRUE;
} }
/* Failed to find direct issuer - search intermediaries (by issuer name) */ if (ca_cert_chains) {
ca_certs = sc->proxy->pkp->ca_certs[j]; /*
* Failed to find direct issuer - search intermediaries
* (by issuer name), if provided.
*/
ca_certs = ca_cert_chains[j];
for (k = 0; k < sk_X509_INFO_num(ca_certs); k++) { for (k = 0; k < sk_X509_INFO_num(ca_certs); k++) {
ca_info = sk_X509_INFO_value(ca_certs, k); ca_info = sk_X509_INFO_value(ca_certs, k);
ca_issuer = X509_get_issuer_name(ca_info->x509); ca_issuer = X509_get_issuer_name(ca_info->x509);
@@ -1863,6 +1869,7 @@ int ssl_callback_proxy_cert(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
return TRUE; return TRUE;
} }
} /* end loop through chained certs */ } /* end loop through chained certs */
}
} /* end loop through available certs */ } /* end loop through available certs */
} }