www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2026-10-23 22:49:01 +03:00
Code Activity
22,315 Commits 62 Branches 313 Tags
input-filter-dev
Commit Graph

1064 Commits

Author SHA1 Message Date
Paul Querna
548f0febab Remove AP_MODE_INIT, it is a no-op, everywhere 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/input-filter-dev@1200612 13f79535-47bb-0310-9956-ffa450edef68
 2011-11-10 22:55:06 +00:00
Joe Orton
de5161b3d9 * modules/ssl/ssl_private.h, modules/ssl/ssl_engine_kernel.c 
(ssl_callback_tlsext_tickets): Use unsigned char * to fix gcc
  -Wpointer-sign warnings.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1200482 13f79535-47bb-0310-9956-ffa450edef68
 2011-11-10 19:17:52 +00:00
Paul Querna
a195310515 Remove unneeded memcpy. 
Spotted by: Rüdiger Plüm


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1200374 13f79535-47bb-0310-9956-ffa450edef68
 2011-11-10 15:19:15 +00:00
Paul Querna
c44e61902f Apply ap_server_root_relative to the path used for the ticket secrets file. 
Suggested by: Rüdiger Plüm


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1200372 13f79535-47bb-0310-9956-ffa450edef68
 2011-11-10 15:17:18 +00:00
Paul Querna
4935d31e45 Whitespace fixes for r1200040 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1200045 13f79535-47bb-0310-9956-ffa450edef68
 2011-11-09 23:44:53 +00:00
Paul Querna
8b2e0e56c2 Add support for RFC 5077 TLS Session tickets. This adds two new directives: 
* SSLTicketKeyFile: To store the private information for the encryption of the ticket.
* SSLTicketKeyDefault To set the default, otherwise the first listed token is used.  This enables key rotation across servers.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1200040 13f79535-47bb-0310-9956-ffa450edef68
 2011-11-09 23:37:37 +00:00
Stefan Fritsch
a3ffb7e3df Remove some ap_add_version_component() calls that don't provide any information 
because the modules don't have separate version numbers anymore


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1199532 13f79535-47bb-0310-9956-ffa450edef68
 2011-11-08 23:37:13 +00:00
Stefan Fritsch
0ddfb3e6cc Add -D DUMP_RUN_CFG option to dump some configuration items 
from the parsed (or default) config. This is useful for init scripts that
need to setup temporary directories and permissions, for example if those
temporary directories are located on a ram disk.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1180681 13f79535-47bb-0310-9956-ffa450edef68
 2011-10-09 18:35:23 +00:00
Stefan Fritsch
cd17cd2c10 Consistenly use apr_file_* API instead of libc when dumping config because 
mixing the two can give strange results due to buffering.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1180671 13f79535-47bb-0310-9956-ffa450edef68
 2011-10-09 17:55:06 +00:00
Stefan Fritsch
0886568494 Add another AP_DEBUG_ASSERT to document some assumptions in the code, 
for the benefit of code analyzers.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1180330 13f79535-47bb-0310-9956-ffa450edef68
 2011-10-08 07:44:10 +00:00
Stefan Fritsch
5c005263d5 Fix a potential NULL pointer dereference found by clang. 
Add a AP_DEBUG_ASSERT to quiet a clang false positive.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1180329 13f79535-47bb-0310-9956-ffa450edef68
 2011-10-08 07:41:50 +00:00
Kaspar Brand
1d7e1125f0 fix indentation 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1178694 13f79535-47bb-0310-9956-ffa450edef68
 2011-10-04 06:02:42 +00:00
Stefan Fritsch
fb5cf8f74f If MaxMemFree is set, set SSL_MODE_RELEASE_BUFFERS in mod_ssl. 
Always set SSL_MODE_RELEASE_BUFFERS in ab.

PR: 51618
Submitted by: Cristian Rodríguez <crrodriguez opensuse org>, Stefan Fritsch


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1178079 13f79535-47bb-0310-9956-ffa450edef68
 2011-10-01 19:48:14 +00:00
Kaspar Brand
2160d8594c In ssl_check_public_cert(), also take dNSNames in the subjectAltName 
extension into account when checking the cert against the configured
ServerName. PR 32652, PR 47051.

Replace SSL_X509_getCN() by SSL_X509_getIDs(), which returns an array
of a cert's DNS-IDs and CN-IDs (terms as coined by RFC 6125).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1176752 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-28 06:52:39 +00:00
Guenter Knauf
9b5b43cc2b Some NetWare ssl module build tweaks. 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1176670 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-28 00:22:19 +00:00
Daniel Ruggeri
c4736a5326 Final update to SSLProxyMachineCertificateChainFile 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1175946 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-26 16:39:00 +00:00
Kaspar Brand
8a52dc2610 replace another occurence of X509_NAME_oneline by SSL_X509_NAME_to_string 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1175905 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-26 15:24:23 +00:00
Kaspar Brand
9567e5f16c enable the SNI extension for proxy connections 
to TLS backends (but avoid for pure SSLv2/SSLv3)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1175416 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-25 15:55:13 +00:00
Stefan Fritsch
1951a037bf More cleanup: Expand tabs and some more indentation fixes 
No functional change


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1174929 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-23 18:08:42 +00:00
Jim Jagielski
427c85bd23 Cleanup effort in prep for GA push: 
Trim trailing whitespace... no func change



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1174751 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-23 13:39:32 +00:00
Jim Jagielski
103f776c25 Cleanup effort in prep for GA push: 
Trim trailing whitespace... no func change



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1174748 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-23 13:38:09 +00:00
Kaspar Brand
6411f1dc04 Bring error messages for TLS stapling related options in sync 
with their directive names.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1173772 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-21 17:32:20 +00:00
Kaspar Brand
693aab21f0 Add ssl_log_xerror() and ssl_log_rxerror(), modeled after ssl_log_cxerror(). 
Add SSL_X509_NAME_to_string(), which converts an X509 distinguished name
to an RFC 2253 formatted string.
Adapt ssl_log_*error() to make use of SSL_X509_NAME_to_string().


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1172797 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-19 20:23:27 +00:00
Stefan Fritsch
01ed21af9d Add wrappers for malloc, calloc, realloc that check for out of memory 
situations.  Use them in most places where malloc, and friends are used.
This results in clean error messages in an out of memory situation instead of
segfaulting or silently malfunctioning. In some places, it just allows to
remove some logging code.

PR 51568, PR 51569, PR 51571.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1172686 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-19 16:25:42 +00:00
Daniel Ruggeri
f1937c9534 Style cleanup 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1172562 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-19 10:48:45 +00:00
Daniel Ruggeri
362f424e78 Log better information and prevent leak of an X509 structure for SSLProxyMachineCertificateChainFile 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1172010 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-17 16:25:17 +00:00
Daniel Ruggeri
47cf15b852 Modify SSLProxyMachineCertificateChainFile to use X509 instead of X509_INFO and use openssl to construct the chain 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1170833 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-14 20:16:02 +00:00
Kaspar Brand
63e02b35ac Properly fill in the SSL_{CLIENT,SERVER}_V_{START,END} and 
SSL_CLIENT_V_REMAIN variables for certs whose notBefore or
notAfter fields use GeneralizedTime encodings.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1170631 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-14 14:02:28 +00:00
Kaspar Brand
6231d5a0a7 ssl_callback_proxy_cert(): take advantage of ssl_log_cxerror() 
when logging proxy client cert information


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1170567 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-14 12:25:31 +00:00
Kaspar Brand
de33f8ce04 ssl_var_lookup_ssl_cert_dn_oneline(): properly deal with empty DNs 
(BIO_read might return -1 in such a case)


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1166181 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-07 13:47:07 +00:00
Ruediger Pluem
b4db4c2cdd * Silence compiler warning 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1165200 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-05 08:23:01 +00:00
Ruediger Pluem
e166fc0b9b * Fix compiler warning by removing unused variable 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1165198 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-05 08:13:47 +00:00
Kaspar Brand
036e37c4cb we might also see GeneralizedTimes in certs nowadays 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1165060 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-04 16:03:38 +00:00
Kaspar Brand
2c24630059 Revamp CRL checking for client and remote servers: 
- completely delegate CRL processing to OpenSSL
- introduce a new [Proxy]CARevocationCheck directive
- drop ssl_callback_SSLVerify_CRL from ssl_engine_kernel.c
- remove X509_STORE from modssl_ctx_t
- drop CRL store helper functions from ssl_util_ssl.c
- avoid sending "certificate_expired" SSL alerts to peers
  when the nextUpdate field of a CRL is in the past


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1165056 13f79535-47bb-0310-9956-ffa450edef68
 2011-09-04 15:57:03 +00:00
Kaspar Brand
ddcd7b615d Better safe than sorry: with OpenSSL 1.0, X509_STORE_CTX_get_current_cert() 
may not always return a cert.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162553 13f79535-47bb-0310-9956-ffa450edef68
 2011-08-28 16:50:12 +00:00
Kaspar Brand
10f5094a91 Fix the default OCSP responder timeout for client cert 
validation - 10 µsec is a tad too aggressive.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162552 13f79535-47bb-0310-9956-ffa450edef68
 2011-08-28 16:34:50 +00:00
Ruediger Pluem
e63cd2cc79 * Don't SEGFAULT if SSLProxyMachineCertificateChainFile is not set. Just skip the additional lookups in this case. 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1162103 13f79535-47bb-0310-9956-ffa450edef68
 2011-08-26 13:07:49 +00:00
Ruediger Pluem
9d6eb90c1e * Style fixes. No functional change. 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1161011 13f79535-47bb-0310-9956-ffa450edef68
 2011-08-24 08:45:18 +00:00
Ruediger Pluem
32f02f6e0a * Add missing prototype 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1161005 13f79535-47bb-0310-9956-ffa450edef68
 2011-08-24 08:41:12 +00:00
Ruediger Pluem
f953d427f3 * Add missing ; 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1161002 13f79535-47bb-0310-9956-ffa450edef68
 2011-08-24 08:36:39 +00:00
Daniel Ruggeri
e5df36d18a Add SSLProxyMachineCertificateChainFile directive and documentation for bug 50812 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1160863 13f79535-47bb-0310-9956-ffa450edef68
 2011-08-23 19:35:07 +00:00
Kaspar Brand
4011df375e Improve ssl_log_cxerror(): 
Fix logic of APLOG_IS_LEVEL check.
Use X509_NAME_print_ex() instead of deprecated X509_NAME_oneline().
Use i2a_ASN1_INTEGER for printing the serial number.
Add notBefore and notAfter dates to log line.
Check for null cert argument (addresses PR 47408).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1157712 13f79535-47bb-0310-9956-ffa450edef68
 2011-08-15 05:15:17 +00:00
Kaspar Brand
6a6c22af52 Enforce OpenSSL 0.9.7 or later at compile time (#error out otherwise). 
Remove some more unneeded defines from ssl_private.h.

At runtime, warn when mod_ssl is started with an OpenSSL version
older than the one it was originally compiled against.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1157575 13f79535-47bb-0310-9956-ffa450edef68
 2011-08-14 17:37:03 +00:00
Joe Orton
4e858e3859 * modules/ssl/ssl_engine_config.c (ssl_cmd_SSLCryptoDevice): Fix 
double-free (and segfault) with bad arg to SSLCryptoDevice.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1157105 13f79535-47bb-0310-9956-ffa450edef68
 2011-08-12 13:40:09 +00:00
Kaspar Brand
2453c22a1a Enforce OpenSSL 0.9.7 as a minimum requirement in configure, and 
remove #ifdef'ed code which was relevant for earlier versions only.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154688 13f79535-47bb-0310-9956-ffa450edef68
 2011-08-07 10:36:57 +00:00
Kaspar Brand
7bd59fd67a Remove the ssl_toolkit_compat layer, which is no longer needed 
after support for non-OpenSSL toolkits has been dropped.

Replace macros by their value proper where feasible, and keep
those definitions in ssl_private.h which depend on specific
OpenSSL versions.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154687 13f79535-47bb-0310-9956-ffa450edef68
 2011-08-07 10:34:31 +00:00
Kaspar Brand
1eb818742f Drop support for the RSA BSAFE SSL-C toolkit from configure, 
and remove #ifdef'ed code from mod_ssl and ab where applicable.

Consensus for dropping support for SSL/TLS toolkits other
than OpenSSL was reached on dev@httpd in June 2010 (message
with ID <20100602162310.GA11156@redhat.com> and follow-ups).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154683 13f79535-47bb-0310-9956-ffa450edef68
 2011-08-07 10:29:09 +00:00
Joe Orton
ab062bfbab * modules/ssl/ssl_engine_dh.c: Fix indent args so the code 
regeneration modifies the OpenSSL output correctly.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1153773 13f79535-47bb-0310-9956-ffa450edef68
 2011-08-04 08:04:20 +00:00
Stefan Fritsch
5dd473c6d4 enable mod_ssl at level 'most' 
Let's assume that if a system has the openssl dev headers installed in
the default location, it is very unlikely that crypto is forbidden in
the country that the system is located in.

If no ssl toolkit is found, disable mod_ssl instead of aborting.

The actual change is small, use 'diff -b' to review


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1150471 13f79535-47bb-0310-9956-ffa450edef68
 2011-07-24 19:06:59 +00:00
Stefan Fritsch
481fac5ce2 Make the SERVER_NAME variable include [ ] for literal IPv6 addresses, as 
mandated by RFC 3875

PR: 26005


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1147614 13f79535-47bb-0310-9956-ffa450edef68
 2011-07-17 13:56:28 +00:00