www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2025-08-07 04:02:58 +03:00
Code Activity

New releases of OpenSSL will only allow secure renegotiation by

Browse Source 
default.  Add an "SSLInsecureRenegotiation" directive to enable
renegotiation against unpatched clients, to ease transition:

* modules/ssl/ssl_private.h (struct SSLSrvConfigRec): Add
  insecure_reneg field.

* modules/ssl/ssl_engine_config.c (ssl_config_server_new,
  ssl_config_server_merge): Handle the insecure_reneg flag.
  (ssl_cmd_SSLInsecureRenegotiation): New function.

* modules/ssl/ssl_engine_init.c (ssl_init_ctx_protocol): Set the
  SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION option if insecure_reneg is
  enabled.

* modules/ssl/ssl_engine_kernel.c (ssl_hook_Access): Log level of
  support for secure reneg.

* modules/ssl/mod_ssl.c: Add the directive definition.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@906039 13f79535-47bb-0310-9956-ffa450edef68
This commit is contained in:
Joe Orton
2010-02-03 13:38:09 +00:00
parent 262c4164d2
commit f1e767fd68
5 changed files with 37 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
modules/ssl/ssl_engine_kernel.c
View File

@@ -764,10 +764,17 @@ int ssl_hook_Access(request_rec *r)
r->connection->keepalive = AP_CONN_CLOSE;
}
/* do a full renegotiation */
/* Perform a full renegotiation. */
ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
"Performing full renegotiation: "
"complete handshake protocol");
"Performing full renegotiation: complete handshake "
"protocol (%s support secure renegotiation)",
#if defined(SSL_get_secure_renegotiation_support)
SSL_get_secure_renegotiation_support(ssl) ?
"client does" : "client does not"
#else
"server does not"
#endif
);
SSL_set_session_id_context(ssl,
(unsigned char *)&id,