www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2025-08-07 04:02:58 +03:00
Code Activity

* Don't SEGFAULT if SSLProxyMachineCertificateChainFile is not set. Just skip the additional lookups in this case.

Browse Source 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162103 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Ruediger Pluem
2011-08-26 13:07:49 +00:00
parent 1f3ac80ec2
commit e63cd2cc79
1 changed files with 19 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
modules/ssl/ssl_engine_kernel.c
View File

@@ -1803,6 +1803,7 @@ int ssl_callback_proxy_cert(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
STACK_OF(X509_NAME) *ca_list; STACK_OF(X509_NAME) *ca_list;
STACK_OF(X509_INFO) *certs = sc->proxy->pkp->certs; STACK_OF(X509_INFO) *certs = sc->proxy->pkp->certs;
STACK_OF(X509_INFO) *ca_certs; STACK_OF(X509_INFO) *ca_certs;
STACK_OF(X509_INFO) **ca_cert_chains;
int i, j, k; int i, j, k;
ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s, ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, s,
@@ -1833,6 +1834,7 @@ int ssl_callback_proxy_cert(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
return TRUE; return TRUE;
} }
ca_cert_chains = sc->proxy->pkp->ca_certs;
for (i = 0; i < sk_X509_NAME_num(ca_list); i++) { for (i = 0; i < sk_X509_NAME_num(ca_list); i++) {
ca_name = sk_X509_NAME_value(ca_list, i); ca_name = sk_X509_NAME_value(ca_list, i);
@@ -1849,20 +1851,25 @@ int ssl_callback_proxy_cert(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
return TRUE; return TRUE;
} }
/* Failed to find direct issuer - search intermediaries (by issuer name) */ if (ca_cert_chains) {
ca_certs = sc->proxy->pkp->ca_certs[j]; /*
for (k = 0; k < sk_X509_INFO_num(ca_certs); k++) { * Failed to find direct issuer - search intermediaries
ca_info = sk_X509_INFO_value(ca_certs, k); * (by issuer name), if provided.
ca_issuer = X509_get_issuer_name(ca_info->x509); */
ca_certs = ca_cert_chains[j];
for (k = 0; k < sk_X509_INFO_num(ca_certs); k++) {
ca_info = sk_X509_INFO_value(ca_certs, k);
ca_issuer = X509_get_issuer_name(ca_info->x509);
if(X509_NAME_cmp(ca_issuer, ca_name) == 0 ) { if(X509_NAME_cmp(ca_issuer, ca_name) == 0 ) {
modssl_proxy_info_log(s, info, "found acceptable cert by intermediary"); modssl_proxy_info_log(s, info, "found acceptable cert by intermediary");
modssl_set_cert_info(info, x509, pkey); modssl_set_cert_info(info, x509, pkey);
return TRUE; return TRUE;
} }
} /* end loop through chained certs */ } /* end loop through chained certs */
}
} /* end loop through available certs */ } /* end loop through available certs */
} }