www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2026-10-23 22:49:01 +03:00
Code Activity
29,900 Commits 62 Branches 313 Tags
httpdunit
Commit Graph

1451 Commits

Author SHA1 Message Date
Jacob Champion
f90daed529 Merge fix branch for PR60947. 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1791849 13f79535-47bb-0310-9956-ffa450edef68
 2017-04-19 02:42:43 +00:00
Jacob Champion
b05388b5e5 ssl_util.c: add APLOGNOs 
Start from 10027 to match the current trunk (r1791845), which will be
merged into shortly.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/trunk-openssl-threadid@1791848 13f79535-47bb-0310-9956-ffa450edef68
 2017-04-19 02:38:20 +00:00
Jacob Champion
bac77f2026 ssl_util.c: log which threadid callback is in use 
This should help during testing and debugging. Use APLOG_NOTICE for now,
until we fix PR60999, so that people can actually see the log message.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/trunk-openssl-threadid@1791847 13f79535-47bb-0310-9956-ffa450edef68
 2017-04-19 02:23:48 +00:00
Jacob Champion
6f10517a08 mod_ssl_ct: fix return values for custom extension callback 
This is most likely a follow-up to r1628833.

At some point during the OpenSSL 1.0.2 beta, the contract for custom
extension callbacks changed from "returning -1 skips the extension" to
"returning -1 will issue a TLS fatal alert". This caused mod_ssl_ct to
abort TLS connections that it intended to ignore. Zero is the correct
return value for "do nothing" in 1.0.2.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1791845 13f79535-47bb-0310-9956-ffa450edef68
 2017-04-19 01:32:58 +00:00
Jacob Champion
e8c348af4a PR60947: try to warn affected users... 
...but at the moment, this won't actually get logged unless you're
running in debug mode, due to an unrelated bug (PR60999).

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/trunk-openssl-threadid@1791733 13f79535-47bb-0310-9956-ffa450edef68
 2017-04-18 00:19:34 +00:00
Jacob Champion
7b2bdcea91 PR60947: avoid CRYPTO_THREADID_set_callback() if possible 
CRYPTO_THREADID_set_callback() is write-once, so if mod_ssl is unloaded
and reloaded into a different address, we'll crash if OpenSSL wasn't
also unloaded and reloaded at the same time. This can happen if another
module or library is using OpenSSL as well.

- OpenSSL 1.1.0 isn't affected.
- Certain platforms (Windows, BeOS, and POSIX-compliant systems) can
  make use of the default THREADID callback in OpenSSL 1.0.x.
- If the deprecated CRYPTO_set_id_callback() is available, we can use it
  instead of CRYPTO_THREADID_set_callback().

Otherwise, we have to fall back to CRYPTO_THREADID_set_callback(), but
hopefully that applies to a small percentage of users at this point.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/trunk-openssl-threadid@1791732 13f79535-47bb-0310-9956-ffa450edef68
 2017-04-18 00:19:32 +00:00
Jacob Champion
d06424f116 ssl_util.c: add a couple explanatory comments 
Mark the things that are busted.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/trunk-openssl-threadid@1791731 13f79535-47bb-0310-9956-ffa450edef68
 2017-04-18 00:19:30 +00:00
Jacob Champion
7f59369309 ssl_util.c: pull up duplicated code in ssl_util_thr_id() 
Should make it easier to see what's going on in the next few changes.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/trunk-openssl-threadid@1791730 13f79535-47bb-0310-9956-ffa450edef68
 2017-04-18 00:19:27 +00:00
Yann Ylavic
cee2df66f0 mod_ssl: follow up to r1781575 
Fix SSLOCSPNoVerify merging, and while at it capitalize Verify as suggested
by wrowe.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1788430 13f79535-47bb-0310-9956-ffa450edef68
 2017-03-24 12:40:27 +00:00
Stefan Eissing
dadde98190 On the trunk: 
mod_ssl: treat SSLConnRecs as const during var lookups.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1787605 13f79535-47bb-0310-9956-ffa450edef68
 2017-03-19 10:32:53 +00:00
William A. Rowe Jr
84d078e64c Thanks to Rüdiger, Yann and Jacob for catches and verification 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1783438 13f79535-47bb-0310-9956-ffa450edef68
 2017-02-17 17:39:59 +00:00
William A. Rowe Jr
08e986a8aa Revert it part r1783317, 'avoid _free()ing NULL references.' 
OpenSSL team is committed to preserving safe _free(NULL) behaviors, and the
overhead of these calls in the context setup path is inconsequential. 



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1783434 13f79535-47bb-0310-9956-ffa450edef68
 2017-02-17 17:32:26 +00:00
William A. Rowe Jr
fee7329281 Revert r1783310 'Preserve OpenSSL 1.0.2 compatibility, following up on r1783305' 
This was our first compatibility pattern but we are not preserving it, it seems
irrelevant since the death of 16 bit Windows object files.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1783432 13f79535-47bb-0310-9956-ffa450edef68
 2017-02-17 17:29:51 +00:00
William A. Rowe Jr
5004e381b2 Fix #cpp bug in prior commit, follow up to r1783317. 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1783318 13f79535-47bb-0310-9956-ffa450edef68
 2017-02-16 22:30:50 +00:00
William A. Rowe Jr
915c1b7087 Avoid unnecessary code (the deprecation macro wrapper itself emits unused args 
warnings) in OpenSSL 1.1.0 and avoid _free()ing NULL references.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1783317 13f79535-47bb-0310-9956-ffa450edef68
 2017-02-16 22:27:24 +00:00
William A. Rowe Jr
342bc8e512 Preserve OpenSSL 1.0.2 compatibility, following up on r1783305 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1783310 13f79535-47bb-0310-9956-ffa450edef68
 2017-02-16 21:41:55 +00:00
William A. Rowe Jr
561b273ca8 Fix OpenSSL 1.1.0 breakage in r1781575; BIO_s_file_internal() is gone. 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1783305 13f79535-47bb-0310-9956-ffa450edef68
 2017-02-16 21:26:34 +00:00
Daniel Ruggeri
873119e7d8 Remove unused variable 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1781687 13f79535-47bb-0310-9956-ffa450edef68
 2017-02-04 16:51:59 +00:00
Yann Ylavic
43a1396988 mod_ssl: don't depend on the next output filters to cleanup the passed out 
brigades.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1781582 13f79535-47bb-0310-9956-ffa450edef68
 2017-02-03 17:32:32 +00:00
Jean-Frederic Clere
f6146b725c Add Configuration for trusted OCSP responder certificates 
Fix for PR 46037


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1781575 13f79535-47bb-0310-9956-ffa450edef68
 2017-02-03 16:19:17 +00:00
Yann Ylavic
5054dfbb96 mod_ssl: follow up to r1740928: fix memory leaks from merged proxy_ctx. 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1781313 13f79535-47bb-0310-9956-ffa450edef68
 2017-02-01 21:25:26 +00:00
Yann Ylavic
c98a1699b0 mod_ssl: follow up to r1781187. 
Address SSL_CTX leak in (merged) proxy_ctx.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1781312 13f79535-47bb-0310-9956-ffa450edef68
 2017-02-01 21:23:17 +00:00
Yann Ylavic
7e95870837 mod_ssl: revert r1781299 r1781188. 
Need to separate follow up related to r1740928 and co from the one related to
r1781187.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1781311 13f79535-47bb-0310-9956-ffa450edef68
 2017-02-01 21:17:20 +00:00
Ruediger Pluem
16e22e46ef * We only need this in case HAVE_SSL_CONF_CMD is defined 
[Reverted by r1781311]

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1781299 13f79535-47bb-0310-9956-ffa450edef68
 2017-02-01 19:31:06 +00:00
Yann Ylavic
f82a8bdc2b mod_ssl: follow up to r1781187. 
The ssl_util_thread_*() functions are not necessary with openssl-1.1+



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1781190 13f79535-47bb-0310-9956-ffa450edef68
 2017-02-01 00:32:59 +00:00
Yann Ylavic
ad6088c88d mod_ssl: follow up to r1740928: fix memory leaks. 
[Reverted by r1781311]


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1781188 13f79535-47bb-0310-9956-ffa450edef68
 2017-01-31 23:39:58 +00:00
Yann Ylavic
120f9ee886 mod_ssl: work around leaks on (graceful) restart. 
Tested with valgrind and --with-ssl shared/static.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1781187 13f79535-47bb-0310-9956-ffa450edef68
 2017-01-31 23:37:41 +00:00
Rainer Jung
67b777389b Silence compiler warning: 
"686: warning: 'ok' may be used uninitialized in
this function"
This is a false positive, because the value of "ok"
will only be used if stapling_get_cached_response()
sets "rsp" to non-NULL in which case it will always
have set "ok".


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1775173 13f79535-47bb-0310-9956-ffa450edef68
 2016-12-19 20:36:58 +00:00
Joe Orton
6020903e0c * modules/ssl/ssl_engine_vars.c (ssl_var_lookup_ssl_cert): Use const 
ASN1_OBJECT for X509_ALGOR_get0() for OpenSSL >= 1.1.0 per
  ac4e257747


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1769592 13f79535-47bb-0310-9956-ffa450edef68
 2016-11-14 10:57:46 +00:00
Jacob Champion
2d74fe1ab1 ssl: clear the error queue before SSL_read/write/accept() 
If other modules or libraries do not clear the OpenSSL error queue after
a failed operation, other code that relies on SSL_get_error() -- in
particular, code that deals with SSL_ERROR_WANT_READ/WRITE logic -- will
malfunction later on. To prevent this, explicitly clear the error queue
before calls like SSL_read/write/accept().

PR: 60223
Submitted by: Paul Spangler <paul.spangler ni.com>

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1769332 13f79535-47bb-0310-9956-ffa450edef68
 2016-11-11 19:38:28 +00:00
Joe Orton
b70d7ae5b5 * modules/ssl/ssl_engine_kernel.c (ssl_callback_SessionTicket): Fail 
if RAND_bytes() fails; possible per API, although not in practice
  with the OpenSSL implementation.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1757147 13f79535-47bb-0310-9956-ffa450edef68
 2016-08-22 11:10:58 +00:00
Yann Ylavic
c52a928f5a mod_ssl: follow up to r1740928. 
Quiet (not so )clever compilers about (im)possible use of uninitialized 'mode'.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1756976 13f79535-47bb-0310-9956-ffa450edef68
 2016-08-19 23:08:58 +00:00
Yann Ylavic
a0cddc57d4 mod_ssl: Fix quick renegotiation (OptRenegotiaton) with no intermediate 
in the client certificate chain.  PR 55786.

This is done by handling an empty cert chain as no/NULL chain.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1756542 13f79535-47bb-0310-9956-ffa450edef68
 2016-08-16 18:24:56 +00:00
Rainer Jung
145ff1c92a Clarify some z/OS mysteries via code comments. 
Followup to r1421305.
PR 56210


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1756163 13f79535-47bb-0310-9956-ffa450edef68
 2016-08-12 11:50:38 +00:00
Rainer Jung
d79b514c4b Fix spelling in comments and text files. 
No functional change.
PR 59990


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1756038 13f79535-47bb-0310-9956-ffa450edef68
 2016-08-11 19:50:02 +00:00
Rainer Jung
a6517fdf5e Silence more "defined but not used" compiler 
warnings when building against OpenSSL 0.9.8a.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1755881 13f79535-47bb-0310-9956-ffa450edef68
 2016-08-10 21:57:14 +00:00
Rainer Jung
83ed3dff9f Silence "defined but not used" compiler warnings 
when building against OpenSSL 0.9.8a.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1755874 13f79535-47bb-0310-9956-ffa450edef68
 2016-08-10 21:34:21 +00:00
Rainer Jung
bd14694a65 OpenSSL 1.1.0 compat: 
- move IDCONST macro outside of addition #if check.
  Otherwise we break compatibility with old
  OpenSSL 0.9.8 releases.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1755856 13f79535-47bb-0310-9956-ffa450edef68
 2016-08-10 20:58:22 +00:00
Rainer Jung
7871d235f1 Remove calling ERR_remove_thread_state when 
using OpenSSL 1.1.0.

This API is now a no-op in OpenSSL 1.1.0 and
deprecated.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1755725 13f79535-47bb-0310-9956-ffa450edef68
 2016-08-10 11:20:00 +00:00
Rainer Jung
92153fcc1d Compatibility with OpenSSL 1.1.0 pre6. 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1755657 13f79535-47bb-0310-9956-ffa450edef68
 2016-08-09 23:09:46 +00:00
Stefan Eissing
22204edc7a modssl: reset client-verify state when renegotiation is aborted 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1750779 13f79535-47bb-0310-9956-ffa450edef68
 2016-06-30 12:08:42 +00:00
Yann Ylavic
039212b23e mod_ssl: follow up to r1734561. 
Don't enable CRL checks/flags by default.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1748368 13f79535-47bb-0310-9956-ffa450edef68
 2016-06-14 09:35:13 +00:00
William A. Rowe Jr
f4cc76ee71 Rename ap_casecmpstr[n]() to ap_cstr_casecmp[n](), update with APR doxygen 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1747469 13f79535-47bb-0310-9956-ffa450edef68
 2016-06-09 00:06:42 +00:00
William A. Rowe Jr
40581f8465 Correct the behavior and interaction between SSLProxyCheckPeer[CN|Name], 
such that disabling either disables both, and that enabling either will
trigger the more comprehensive SSLProxyCheckPeerName behavior.

Only a single configuration remains to enable the legacy behavior, which
is to explicitly disable SSLProxyCheckPeerName and enable SSLProxyCheckPeerCN.

Changes to the proxy config directives leads us to a different 2.4 fix...
https://github.com/wrowe/patches/blob/master/fix_proxy_check_peer-2.4.x.patch


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1746647 13f79535-47bb-0310-9956-ffa450edef68
 2016-06-02 22:31:35 +00:00
Yann Ylavic
cf62937eb1 Follow up to r1740928: mod_ssl.h now needs http_config.h 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1742697 13f79535-47bb-0310-9956-ffa450edef68
 2016-05-07 09:51:37 +00:00
Yann Ylavic
0c7d2c0b1d Follow up to r1740928: updates for Netware build. 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1741112 13f79535-47bb-0310-9956-ffa450edef68
 2016-04-26 22:31:19 +00:00
Yann Ylavic
f9ad2754f7 mod_proxy, mod_ssl: Handle SSLProxy* directives in <Proxy> sections, 
allowing per backend TLS configuration.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1740928 13f79535-47bb-0310-9956-ffa450edef68
 2016-04-26 00:04:57 +00:00
Rainer Jung
e387d3e9c7 Support for OpenSSL 1.1.0: 
- X509_STORE_CTX is now opaque.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1740653 13f79535-47bb-0310-9956-ffa450edef68
 2016-04-23 13:17:52 +00:00
Rainer Jung
6ba30d2c2b Support for OpenSSL 1.1.0: 
- symbols get_rfc..._prime_... have been
  renamed to BN_get_rfc..._prime_...


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1740652 13f79535-47bb-0310-9956-ffa450edef68
 2016-04-23 12:36:43 +00:00
Stefan Fritsch
57230dc7f0 fix compiler warning about missing prototype 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1738461 13f79535-47bb-0310-9956-ffa450edef68
 2016-04-10 20:26:12 +00:00