Add API to support TLS channel bindings with mod_ssl.
* modules/ssl/mod_ssl.h: Define ssl_get_tls_cb.
* modules/ssl/ssl_engine_vars.c (ssl_get_tls_cb): New function.
Submitted by: Simo Sorce <simo redhat.com>
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1620927 13f79535-47bb-0310-9956-ffa450edef68
Refactor some lines to keep APLOGNO on the same line as ap_log_error, when applicable.
Split lines longer than 80.
Improve alignment.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1612068 13f79535-47bb-0310-9956-ffa450edef68
No change in generated code because MODULE_MAGIC_NUMBER is defined as:
#define MODULE_MAGIC_NUMBER MODULE_MAGIC_NUMBER_MAJOR
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1611871 13f79535-47bb-0310-9956-ffa450edef68
if these checks detect a problem, the checks shouldn't return an
error again when processing an ErrorDocument redirect for the
original problem.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1609914 13f79535-47bb-0310-9956-ffa450edef68
and adjust selection logic to prefer use of larger not smaller keys.
(init_dh_params, free_dh_params, modssl_get_dh_params): Use array of
structs to store and initialize DH parameters up to 8192-bit.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1605827 13f79535-47bb-0310-9956-ffa450edef68
minor) race and leaks:
* modules/ssl/ssl_engine_init.c (make_dh_params): Moved/rejigged
variant of make_get_dh() macro.
(init_dh_params, free_dh_params): New functions.
(modssl_get_dh_params): Split out from ssl_callback_TmpDH.
(ssl_init_Module, ssl_init_ModuleKill): Use new init_/free_.
* modules/ssl/ssl_engine_kernel.c: Moved out DH parameter handling.
(ssl_callback_TmpDH): Use modssl_get_dh_params.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1598107 13f79535-47bb-0310-9956-ffa450edef68
SSL_CTX_set_tmp_dh_callback though once generated as we leak
memory otherwise and freeing the structure up after use would be
hard to track and in fact is not needed at all as it is safe to
use the same parameters over and over again security wise (in
contrast to the keys itself) and code safe as the returned structure
is duplicated by OpenSSL anyway. Hence no modification happens
to our copy.
Observed by: rjung
Reviewed by: kbrand
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1597349 13f79535-47bb-0310-9956-ffa450edef68
Transparency (RFC 6962) for httpd.
mod_ssl_ct requires OpenSSL 1.0.2 (in beta) and must be explicitly
enabled via configure.
Note that support/ctauditscts is purposefully not installed; it
does not properly function due to a dependency on a
certificate-transparency open source project tool which itself is
not sufficiently complete at this time.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1588987 13f79535-47bb-0310-9956-ffa450edef68
several stages of initialization and connection handling. See
mod_ssl_openssl.h.
This is enough to allow implementation of Certificate Transparency
outside of mod_ssl.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1587607 13f79535-47bb-0310-9956-ffa450edef68
Putting the vhost-level elements last allows overriding global settings
(for the deprecated SSLRequire directive, the order is irrelevant,
all of them must be met, cf. ssl_engine_kernel.c:ssl_hook_Access).
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1585919 13f79535-47bb-0310-9956-ffa450edef68
- no longer send a warning-level unrecognized_name(112) alert
when no matching vhost is found (PR 56241)
- at startup, only issue warnings about IP/port conflicts and name-based
SSL vhosts when running with an OpenSSL without TLS extension support
(almost 5 years after SNI was added to 2.2.x, the
"[...] only work for clients with TLS server name indication support"
warning feels obsolete)
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1585090 13f79535-47bb-0310-9956-ffa450edef68
New SSLOCSPUseRequestNonce directive's manual and CHANGES.
Non functional code changes (modssl_ctx_t's field ocsp_use_request_nonce
grouped with other OCSP ones, nested if turned to a single AND condition).
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1584098 13f79535-47bb-0310-9956-ffa450edef68
in SSL_get_certificate for servers where the certificate hasn't
been sent.
Workaround by setting the ssl structure to client mode which
bypasses the faulty code in OpenSSL. Normally setting a server
ssl structure to client mode would cause problems later on:
but we are freeing the structure immediately without attempting
to use it.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1576741 13f79535-47bb-0310-9956-ffa450edef68
also pass the file name to ssl_load_encrypted_pkey, to make sure that we
retry with the same filename we used for SSL_CTX_use_PrivateKey_file first
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1563417 13f79535-47bb-0310-9956-ffa450edef68
enabled *and* if OpenSSL does not make any compression methods
available. Tweak wording for failure without SSL_OP_NO_COMPRESSION.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1556473 13f79535-47bb-0310-9956-ffa450edef68
- add documentation
- clear the error queue before executing the next SSL_CONF_cmd
- if needed, configure OCSP stapling after a "Certificate" command
- ifdef ssl_cmd_SSLOpenSSLConfCmd in ssl_private.h
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1555464 13f79535-47bb-0310-9956-ffa450edef68
