Fix OpenSSL 4.0 compatibility and test that in CI.
CI: Update to test OpenSSL 4.0.0 explicitly.
CI: No longer disable deprecated-declaration warnings for OpenSSL 3.4 -Werror build.
* modules/ssl/ssl_engine_kernel.c (ssl_hook_UserCheck): Change name to
const X509_NAME *.
(ssl_callback_proxy_cert): Change ca_name, issuer, and ca_issuer to
const X509_NAME *.
* modules/ssl/ssl_engine_log.c (ssl_log_cert_error): Change cert
parameter to const X509 *. Use X509_get0_serialNumber,
X509_get0_notBefore, and X509_get0_notAfter instead of non-const
variants.
(ssl_log_xerror, ssl_log_cxerror, ssl_log_rxerror): Change cert
parameter to const X509 *.
* modules/ssl/ssl_engine_vars.c (ssl_var_lookup_ssl_cert_dn): Change
xsname parameter to const X509_NAME *.
(ssl_var_lookup_ssl_cert_dn_oneline): Change xsname parameter to
const X509_NAME *.
(ssl_var_lookup_ssl_cert): Change xsname to const X509_NAME *.
(ssl_var_lookup_ssl_cert_rfc4523_cea): Change issuer to const
X509_NAME *.
* modules/ssl/ssl_private.h (ssl_log_xerror, ssl_log_cxerror,
ssl_log_rxerror): Update declarations to use const X509 *.
* modules/ssl/ssl_util_ssl.c (modssl_X509_NAME_to_string): Change dn
parameter to const X509_NAME *.
(getIDs): Change subj to const X509_NAME *.
* modules/ssl/ssl_util_ssl.h (modssl_X509_NAME_to_string): Update
declaration to use const X509_NAME *.
* support/ab.c (ssl_print_cert_info): Change dn to const X509_NAME *.
mod_ssl: use ASN1_STRING accessor API in dump_extn_value:
* modules/ssl/ssl_engine_vars.c (dump_extn_value): Use
ASN1_STRING_get0_data() and ASN1_STRING_length() rather than
directly dereferencing the ASN1_OCTET_STRING structure, which is
opaque in OpenSSL 4.0.
* modules/ssl/ssl_private.h: Add compat macros for
ASN1_STRING_get0_data and ASN1_STRING_length for pre-1.1 API.
mod_ssl: constify ASN1_TIME pointers, use X509_get0_not{Before,After}:
* modules/ssl/ssl_engine_vars.c (ssl_var_lookup_ssl_cert_valid,
ssl_var_lookup_ssl_cert_remain): Constify ASN1_TIME * parameter.
(ssl_var_lookup_ssl_cert): Use X509_get0_notBefore() and
X509_get0_notAfter() which return const pointers.
(ssl_var_lookup_ssl_cert_remain): Use ASN1_TIME_check() directly
rather than INVALID_ASN1_TIME macro which dereferences the
ASN1_TIME structure.
(dump_extn_value): Constify ASN1_OCTET_STRING * parameter.
* modules/ssl/ssl_private.h: Add compat macros for
X509_get0_before and X509_get0_after for pre-1.1 API.
mod_ssl: constify X509_NAME_ENTRY and X509_EXTENSION pointers:
* modules/ssl/ssl_engine_vars.c (ssl_var_lookup_ssl_cert_dn,
extract_dn): Constify X509_NAME_ENTRY * variables, constify
X509_NAME * parameter of extract_dn, drop unnecessary casts
on X509_NAME_ENTRY_get_object() calls.
(ssl_ext_list): Use MODSSL_X509_EXT_CONST for X509_EXTENSION *
since X509_EXTENSION accessors are only constified in OpenSSL 4.
* modules/ssl/ssl_util_ssl.c, modules/ssl/ssl_util_ssl.h
(modssl_X509_NAME_ENTRY_to_string): Constify X509_NAME_ENTRY *
parameter.
* modules/ssl/ssl_private.h: Add MODSSL_X509_EXT_CONST, defined
as const for OpenSSL 4+ and empty otherwise.
* modules/ssl/ssl_util_ssl.c (asn1_string_convert): Constify
ASN1_STRING * argument.
* modules/ssl/ssl_engine_ocsp.c (extract_responder_uri): Use
modssl_ASN1_STRING_convert instead of directly accessing ASN1_STRING
data pointer.
* modules/ssl/ssl_util_ssl.c (modssl_ASN1_STRING_convert): Rename from
asn1_string_convert and export function.
(asn1_string_to_utf8): Update to use modssl_ASN1_STRING_convert.
(modssl_X509_NAME_ENTRY_to_string): Update to use
modssl_ASN1_STRING_convert.
* modules/ssl/ssl_util_ssl.h (modssl_ASN1_STRING_convert): Declare new
function.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
CI: Add OpenSSL 3.1 builds, including a no-engine build.
(attempt to use 3.2 failed, unsure why)
- add OpenSSL build binaries to $PATH
CI: add OpenSSL 3.2, test OpenSSL 3.x using Apache::Test
trunk to pick up r1916067.
CI: The OpenSSL no-engine config option is redundant as of 4.0, remove.
CI: Try to fix ab failures during OpenSSL ech job, set RPATH via LDFLAGS
CI: For OpenSSL branch builds, always build a fresh version of the
OpenSSL branch and cache the commit hash to allow checking for freshness.
Also clone with --depth=1 to save time+bandwidth.
Reviewed by: jorton, covener (skimmed+CI results), rpluem
Github: closes#642
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934973 13f79535-47bb-0310-9956-ffa450edef68
memchr() takes a char * as a first parameter, and 'buf' is a const char *.
This breaks build process at least with gcc 16.1.1 and maintainer-mode enabled.
Without maintainer-mode, only a warning is generated.
strchr() takes a char * as a first parameter, and in the cases a const char * is passed.
This breaks build process at least with gcc 16.1.1 and maintainer-mode enabled.
Without maintainer-mode, only a warning is generated.
Submitted by: jailletc36
Reviewed by: jailletc36, jim, jorton
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1934885 13f79535-47bb-0310-9956-ffa450edef68
* support/htcacheclean.c (list_urls): Continue rather than stopping
after listing a file for each subdirectory.
PR: 65091
Submitted by: Artem Egorenkov <aegorenkov.91 gmail.com>
Reviewed by: jorton, ylavic, jfclere
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1916131 13f79535-47bb-0310-9956-ffa450edef68
* support/htpasswd.c (usage): Document SHA-256/512 support.
Windows : do not include ap_config_auto.h
* support/htpasswd.c (usage): Fix typo.
Fix misleading crypt vs hash terminology in ht* and dbmmanage tools.
What the htpasswd, htdbm and dbmmanage tools do is hashing passwords, not
encrypting them, so fix the terminology in manpages, docs, --help, comments
and function names.
Submitted by: Michele Preziuso <mpreziuso kaosdynamics.com>, jorton, steffenal, ylavic
Github: closes#408
Reviewed by: jorton, ylavic, jfclere
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1916129 13f79535-47bb-0310-9956-ffa450edef68
Add support for SHA-2 crypt() algorithm in htpasswd.
* configure.in: Detect SHA-2 support in crypt().
* support/passwd_common.h: Define ALG_CRYPT_SHA256, ALG_CRYPT_SHA512,
include ap_config_auto.h.
* support/htpasswd.c (check_args): Allow -2, -5, -r arguments for
SHA-256, SHA-256 and rounds options respectively.
* support/passwd_common.c
(parse_common_options): Parse -2, -5, -r args.
(mkhash): Generate crypt hash for SHA256/SHA512 algorithms.
Update transform.
* support/htpasswd.c (usage): More usage fixes for SHA-2; describe
as "secure", leave bcrypt only algorithm described as "very secure".
* support/passwd_common.c (mkhash): Fix salt buffer size for SHA2
(caught by gcc 10).
configure: Assume crypt() does not support SHA-2 when cross-compiling.
Can be forced with "./configure ap_cv_crypt_sha2=yes ..." still.
* configure.in:
Give AC_RUN_IFELSE a cross-compiling action, otherwise it fails with:
configure: error: cannot run test program while cross compiling
Submitted by: jorton, ylavic
Reviewed by: minfrin, ylavic, jorton
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1915516 13f79535-47bb-0310-9956-ffa450edef68
* Makefile.in (build/config_vars.out): Rebuild if build/config_vars.sh
has changed.
sort safe_env_lst
bz 64371
mod_optional_hook_import: debug message at APLOG_DEBUG level.
*) de-duplicate ALOGNO from code copy.
ab: apr_base64_encode already NUL-terminate the output.
And returns the length including the trailing \0, so setting it at that
length is off by +1.
* Avoid an overflow on large inputs
PR: 66033
dav_get_liveprop_info() returns a long not an int.
Update the type of global_ns accordingly and update the format specifier when this variable is used in printf like functions.
This also aligns code with dav_core_insert_prop() in modules/dav/main/std_liveprop.c
Length computed by count_string() are accumulated in an apr_size_t, so be more consistent and use this data type also in this function.
Fix some typo
[skip ci]
Fix some typos
[skip ci]
Submitted by: jorton, gbechis, ylavic, icing, ylavic, rpluem, jailletc36, jailletc36, jailletc36, jailletc36
Reviewed by: jailletc36, rpluem, jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1903618 13f79535-47bb-0310-9956-ffa450edef68
When TLS1_3_VERSION is defined by the SSL library, bump the maximum TLS
protocol to that and use it for "-f ALL" or "-f TLSv1.3".
This mixes proposed patches from BZ 63594 and 64699.
BZ: 63594, 64699
Merge r1900157 from trunk:
Submitted by: abhilash <abhilash1232 gmail.com>
Submitted by: xiaolongx.jiang intel.com
Submitted by: ylavic
Reviewed by: ylavic, rpluem, jorton
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1901203 13f79535-47bb-0310-9956-ffa450edef68
Easy patches: synch 2.4.x and trunk
- core: Re-introduce check for sufficient PCRE version.
- core: Fix doc string for QualifyRedirectURL
- mod_proxy: really return an error message on invalid "flusher" value.
- mod_http2: Remove extra and un-needed ""
- mod_ldap: fix a (unlikely) memory leak
- ab: fix a typo
- suexec: Report error string after failure from setgid/initgroups or setuid
- mod_session_crypto: be less specific and don't echo passphrase
- mod_proxy_html: Fix proxy_html_conf.bufsz to have correct type, as
it is used with ap_set_int_slot.
- mod_md: update duplicated APLOGNOs.
Submitted by: fuankg, trawick, ylavic, jailletc36, jorton, jailletc36, jorton, covener, jorton, ylavic
Reviewed by: jailletc36, jim, ylavic
Backported by: jailletc36
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1879490 13f79535-47bb-0310-9956-ffa450edef68
PR64313 htcacheclean: Empty directories in CacheRoot are still present even after using "-t"
* Whitespace style fixes. No functional change.
Submitted by: jfclere, rpluem
Reviewed by: jailletc36, rpluem, jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1876887 13f79535-47bb-0310-9956-ffa450edef68
fix apxs for non-destdir builds
subtr(...,0, -1) chops off a character and leaves relative path.
(you will need to re-run configure)
Reviewed By: +1: covener, gbechis, rpluem
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1875475 13f79535-47bb-0310-9956-ffa450edef68
Add support for cross compiling to apxs. If apxs is being executed from somewhere
other than its target location, add that prefix to includes and library directories.
Without this, apxs would fail to find config_vars.mk and exit.
Allow instdso.sh to be found while cross compiling.
Submitted by: minfrin
Reviewed by: minfrin, jim, ylavic
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1874288 13f79535-47bb-0310-9956-ffa450edef68
Note that the function will be available in APR.
Silent a smatch warning:
mod_auth_form.c:626 get_form_auth() warn: variable dereferenced before check 'sent_user' (see line 616)
Use 'memcpy' instead of 'strcpy' when the size of the string has already been computed.
Fix compilation failure :
unixd.c: In function ‘ap_unixd_mpm_set_signals’:
unixd.c:579:5: error: implicit declaration of function ‘apr_signal’; did you mean ‘strsignal’? [-Werror=implicit-function-declaration]
apr_signal(SIGPIPE, SIG_IGN);
^~~~~~~~~~
strsignal
Not sure where it comes from, maybe related to r1812301.
mod_substitute: add runtime traces. PR 61132.
In verify_ocsp_status in ssl_engine_ocsp.c, the log message, "OCSP response not successful: %d" should print the value of r instead of rc.
The value of rc will always be 0.
PR 61876 [sam <sam.eastman.4114 gmail.com>]
Success of 'SHGetMalloc()' should be tested with the SUCCEEDED macro.
/!\ This commit is _NOT COMPILE TESTED_. (I don't have a windows build environment available)
See PR 60086.
Axe some dead code.
See PR 60086.
Fix typo
Fix a potential un-intialized variable usage warning.
This can not be a runtime ixsue, because, in such a case, we would assert and abort before.
PR 59819.
Submitted by: minfrin, jailletc36, jailletc36, jailletc36, ylavic, jailletc36, jailletc36, jailletc36, jailletc36, jailletc36
Reviewed by: jailletc36, ylavic, covener
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1832607 13f79535-47bb-0310-9956-ffa450edef68
suexec: Add support for logging to syslog as an alternative to a
logfile.
* support/suexec.c (err_output) [AP_LOG_SYSLOG]: Log to syslog.
(main): Close syslog fd if open, before execv. Add -V output
for AP_LOG_SYSLOG.
* configure.in: Add --with-suexec-syslog argument; allow
--without-suexec-logfile to omit definition of AP_LOG_EXEC.
suexec: Support use of setgid/setuid capability bits on Linux, a
weaker set of privileges than the full setuid/setgid root binary.
* configure.in: Add --enable-suexec-capabilites flag.
* Makefile.in: If configured, use setcap instead of chmod 7555 on
installed suexec binary.
* modules/arch/unix/mod_unixd.c (unixd_pre_config): Drop test for
setuid bit if capability bits are used.
* docs/manual/: Add docs.
* docs/manual/suexec.html.en: Update for syslog logging.
* configure.in: Correct handling of --with-suexec-logfile in r1341905,
thanks to rpluem.
* support/suexec.c: Define AP_LOG_FACILITY.
(err_output): Use AP_LOG_FACILITY for syslog facility.
Suggested by: kbrand
* configure.in: Fix help text for --with-suexec-syslog.
Submitted by: jorton
Reviewed by: jorton, ylavic, jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1832565 13f79535-47bb-0310-9956-ffa450edef68
rotatelogs: Use apr_psprintf() with %pm instead of a constant length buffer for
errors.
* support/rotatelogs.c
(post_rotate, doRotate): Switch to using apr_psprintf() with %pm.
Suggested by: rpluem
rotatelogs: Remove another use of a consant length buffer for errors.
* support/rotatelogs.c
(doRotate): Use apr_psprintf() and %pm. Move the destruction of the pool
after we're done with the error message so the error string stays allocated
long enough.
rotatelogs: Remove last constant length error buffer.
* support/rotatelogs.c
(ERRMSGSZ): Remove.
(rotate_status): Remove errbuff member.
(truncate_and_write_error): Accept the error message as an argument.
(doRotate): Shift the pool destruction slightly later and use it to generate
the error message to pass truncate_and_write_error().
(main): In case of write errors create a pool to generate the error message,
since the other pools available may never been freed. Adjust to pass
message directly to truncate_and_write_error().
Submitted by: breser
Reviewed by: rjung, ylavic, jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1828739 13f79535-47bb-0310-9956-ffa450edef68
Add an option to autocreate directories to rotatelogs.
* support/rotatelogs.c
(rotate_config): Remove const from szLogRoot since we'll be passing it to
apr_filepath_merge. Add create_path member.
(usage, dumpConfig): Update to reflect new -d option.
(doRotate): Add code that knows how to create the directories a log file
is going to go into.
(main): Add the -d option and canonicalize the incoming path with
apr_filepath_merge() so that the code in doRotate can work properly.
* docs/man/rotatelogs.8,
docs/manual/programs/rotatelogs.html.en: Update for -d option.
PR: 46669
Submitted by: Philippe Lantin <plantin cobaltgroup.com>
(which was actually a patch written by myself when I worked there)
Tweaked by: breser (ported to trunk and changed option from -p to -d)
Followup to r1533810: Put the rotatelogs docs in the right place.
* docs/man/rotatelogs.8,
docs/manual/programs/rotatelogs.html.en: Remove changes from r1533810.
* docs/manual/programs/rotatelogs.xml: Adjust docs for new -d option.
Choose "-D" instead of "-d" for the rotatelogs
option that creates the path to the log file.
I want to use "-d" for another directory related
option next where (I think) the "directory" "d"
makes more sense.
"-d" has not yet been backported, so changing
to "-D" is not a real compatibility issue.
Submitted by: breser, rjung
Reviewed by: rjung, ylavic, niq
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1828738 13f79535-47bb-0310-9956-ffa450edef68
Small changes to rotatelogs:
- add "-n num" to help text
- clarify in help text, that "program is invoked"
is the "-p" case
- prevent crash with "-v" (verbose) if no
"-p prog" is used
- add one space for formatting
rotatelogs: fix -n help text
this closes#24
Submitted By: Isaac Boukris <iboukris gmail.com>
Submitted by: rjung, covener
Reviewed by: rjung, ylavic, niq, jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1828736 13f79535-47bb-0310-9956-ffa450edef68
ab: try all destination socket addresses returned by apr_sockaddr_info_get
instead of failing on first one when not available.
Needed for instance if localhost resolves to both ::1 and 127.0.0.1
e.g. if both are in /etc/hosts.
ab: Use only one connection to determine working destination socket address.
Submitted by: rjung
Reviewed by: rjung, covener, ylavic
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1826891 13f79535-47bb-0310-9956-ffa450edef68
* support/ab.c: Fix crash caused by integer overflow when printing stats with
lot of requests (for example -n 500000000).
Submitted by: jkaluza
Reviewed by: jorton, jim, ylavic
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1826310 13f79535-47bb-0310-9956-ffa450edef68
* support/rotatelogs.c (get_now): Return the offset applied to the
Unix time as a parameter.
(doRotate): When exploding the time for strtfime formatting, iff in
-l mode, subtract the offset and explode the real Unix time as a
local time so %Z etc works correctly.
* support/rotatelogs.c (get_now): Fix the NULL ptr dereferences
added in r1532281.
* support/rotatelogs.c: Introduce an adjusted_time_t type to store the
weird "adjusted time since epoch" type returned by get_now().
Switch from int to long to fix an unnecessary Y2K38 issue. Adjust
use throughout and clean up other type issues. No functional change
intended apart from fixing Y2K38.
Submitted by: jorton
Reviewed by: jorton, jim, ylavic
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1826306 13f79535-47bb-0310-9956-ffa450edef68
* support/Makefile.in, acinclude.m4: Add OpenSSL libraries at the end of the
ab link line, not the start.
[too boring for CHANGES]
Submitted by: jorton
Reviewed by: jorton, jim, ylavic
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1823624 13f79535-47bb-0310-9956-ffa450edef68
Merged /httpd/httpd/trunk:r1811649,1811664,1814118
*) ab: Make the TLS layer aware that the underlying socket is nonblocking,
and use/handle POLLOUT where needed to avoid busy IOs and recover write
errors when appropriate. [Yann Ylavic]
*) ab: Keep reading nonblocking to exhaust TCP or SSL buffers when previous
read was incomplete (the SSL case can cause the next poll() to timeout
since data are buffered already). PR 61301 [Luca Toscano, Yann Ylavic]
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1814468 13f79535-47bb-0310-9956-ffa450edef68
mod_ssl: we can't use SSL_COMP_free_compression_methods() if OPENSSL_NO_COMP
is defined. PR 61206.
Submitted by: Michael Schlenker <msc contact.de>
mod_ssl, ab: compatibility with LibreSSL. PR 61184.
LibreSSL defines OPENSSL_VERSION_NUMBER = 2.0, but is not compatible with
all of the latest OpenSSL 1.1 API.
Address this by defining MODSSL_USE_OPENSSL_PRE_1_1_API which is true for
anything but OpenSSL >= 1.1 (for now).
Proposed by: Bernard Spil <brnrd freebsd.org>
Reviewed by: ylavic
Follow up to r1803396: CHANGES entry.
Reviewed by: ylavic, jim, covener
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1807734 13f79535-47bb-0310-9956-ffa450edef68
* Do not apply the strict permissions of the temporary file to a possibly
existing passwd file.
This long standing bug was triggered by fixing a bug in APR in r1791029.
PR: 61240
Submitted by: rpluem
Reviewed by: rpluem, ylavic, jim
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1800775 13f79535-47bb-0310-9956-ffa450edef68
ab: don't call malloc_init for OpenSSL 1.1.0
Patch by rjung.
The 1.1.0 compatibility macro for OpenSSL_malloc_init() causes problems
when mixed with procedure linkage stubs with some toolchains (e.g. GCC).
OpenSSL's malloc implementation doesn't recognize that the PLT stub
points back to it, which leads to infinite recursion.
Since the 1.1.0 documentation states that calling this function
explicitly is no longer necessary except "in certain shared-library
situations"(?), get rid of it.
Submitted by: jchampion
Reviewed by: jchampion, ylavic, gsmith
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1795907 13f79535-47bb-0310-9956-ffa450edef68
allow building with OpenSSL 1.1.0
ab.c (abs)
----------
applink.c has been moved in this version of OpenSSL
dsw/dsp
-------
use srclib\apr\build\cvtdsp.pl -ossl11
from apr-1.6.x
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1790999 13f79535-47bb-0310-9956-ffa450edef68
