ssl_engine_io.c

Checkout Tools
  • last updated 1 hour ago
Constraints
Constraints: committers
 
Constraints: files
Constraints: dates

Changeset 1757669 is being indexed.

Merge r1756038 from trunk:

Fix spelling in comments and text files.

No functional change.

PR 59990

Submitted by: rjung

Reviewed/backported by: jim

  1. … 72 more files in changeset.
Correct the behavior and interaction between SSLProxyCheckPeer[CN|Name],

such that disabling either disables both, and that enabling either will

trigger the more comprehensive SSLProxyCheckPeerName behavior.

Only a single configuration remains to enable the legacy behavior, which

is to explicitly disable SSLProxyCheckPeerName and enable SSLProxyCheckPeerCN.

Changes to the proxy config directives leads us to a different 2.4 fix...

https://github.com/wrowe/patches/blob/master/fix_proxy_check_peer-2.4.x.patch

Backports: 1746647

Reviewed by: wrowe, icing, rpluem

  1. … 4 more files in changeset.
Revert 1746645, was sitting in the wrong tree, mea culpa...
  1. … 1 more file in changeset.
Correct the behavior and interaction between SSLProxyCheckPeer[CN|Name],

such that disabling either disables both, and that enabling either will

trigger the more comprehensive SSLProxyCheckPeerName behavior.

Only a single configuration remains to enable the legacy behavior, which

is to explicitly disable SSLProxyCheckPeerName and enable SSLProxyCheckPeerCN.

Major refactoring leads us to an alternate implementation for 2.4.21;

https://github.com/wrowe/patches/blob/master/fix_proxy_check_peer-2.4.x.patch

  1. … 1 more file in changeset.
Merge r1729208, r1735668, r1735931, r1735935, r1735942 from trunk:

let proxy handler forward ALPN protocol strings for ssl proxy connections

Remove leftover comment

APLOGNO update for mod_proxy_http2

fix APLOGNO at wrong place, me stupid

h2_proxy_session: fill in missing APLOGNO()s.

Submitted by: icing, jailletc36, icing, icing, ylavic

Reviewed/backported by: jim

  1. … 6 more files in changeset.
Merge r1587607, r1588868 from trunk:

mod_ssl: Add hooks to allow other modules to perform processing at

several stages of initialization and connection handling. See

mod_ssl_openssl.h.

This is enough to allow implementation of Certificate Transparency

outside of mod_ssl.

Initialize post_handshake_rc for case where a failure has

already occurred (doesn't change execution but avoids warning

with some levels of gcc).

Pointed out by: kbrand

Submitted by: trawick

Reviewed/backported by: jim

  1. … 12 more files in changeset.
Follow up to r1727393: add missing (voted) change from trunk's r1723284.
  1. … 1 more file in changeset.
Merge r1725485 from trunk:

Added many log numbers to log statements that

had none.

Those were not detected by the coccinelle script.

Submitted by: rjung

Reviewed/backported by: jim

  1. … 34 more files in changeset.
Merge r1725940 from trunk:

handling TIMEUP on SSL inputs by allowing later retries

Submitted by: icing

Reviewed/backported by: jim

  1. … 3 more files in changeset.
Merge r1726888 from trunk:

Fix some duplicate definitions

Submitted by: mrumph

Reviewed/backported by: jim

  1. … 2 more files in changeset.
backport of r1723122,1723143
  1. … 3 more files in changeset.
Merge r1719967 from trunk:

mod_ssl: fix build with openssl < 0.9.8m (missing semicolon).

Reported by: Petr Gajdos <pgajdos suse.cz>

Submitted by: ylavic

Reviewed/backported by: jim

  1. … 2 more files in changeset.
Merge r1708107, r1709587, r1709602, r1709995, r1710231, r1710419, r1710572, r1710583, r1715023 from trunk:

mod_ssl: performing protocol switch directly after ALPN selection, mod_http2: connection hook inits network filters to force TLS handshake, reads input only if H2Direct explicitly enabled, changes H2Direct default to off even for cleartext connections

new ap_is_allowed_protocol() for testing configured protocols, added H2Upgrade on/off directive, changed H2Direct default back to on when h2c is in Protocols

moved ssl handshake trigger from mod_http2 to new process_connection hook in mod_ssl

mod_ssl: check request-server for TLS settings compatible to handshake server, allow request if equal, renegotiation checks: remember last used cipher_suite for optimizations, deny any regnegotiation in presence of master connection

announce protocol choices on first request

fixing compilation issue for older platform

disabling protocol upgrades on slave connections

first request on master connection only reports more preferred protocols in Upgrade header

mod_ssl: follow up to r1709602.

Fix "HTTP spoken on HTTPS port" broken by the SSL handshake trigger moved to

process_connection hook (r1709602) along with H2Direct speculative read.

Submitted by: icing, ylavic

Reviewed/backported by: jim

  1. … 11 more files in changeset.
Merge r1705194, r1705823, r1705826, r1705828, r1705833, r1706275, r1707230, r1707231 from trunk:

mod_ssl: forward EOR (only) brigades to the core_output_filter().

mod_ssl: don't FLUSH output (blocking) on read.

This defeats deferred write (and pipelining), eg. check_pipeline() is not

expecting the pipe to be flushed under it.

So let OpenSSL >= 0.9.8m issue the flush when necessary (earlier versions

are known to not handle all the cases, so we keep flushing with those).

mod_ssl: follow up to r1705823.

Oups, every #if needs a #endif...

mod_ssl: pass through metadata buckets untouched in ssl_io_filter_output(),

the core output filter needs them.

Proposed by: jorton

mod_ssl: follow up to r1705194, r1705823, r1705826 and r1705828.

Add CHANGES entry, and restore ap_process_request_after_handler()'s comment

as prior to r1705194 (the change makes no sense now).

mod_ssl: follow up to r1705823.

We still need to flush in the middle of a SSL/TLS handshake.

mod_ssl: follow up to r1705823.

Flush SSL/TLS handshake data when writing (instead of before reading),

and only when necessary (openssl < 0.9.8m or proxy/client side).

mod_ssl: follow up to r1707230: fix (inverted) logic for SSL_in_connect_init().

Submitted by: ylavic

Reviewed/backported by: jim

  1. … 3 more files in changeset.
merge r1703952 from trunk

Support compilation against libssl built with OPENSSL_NO_SSL3,

and change the compiled-in default for SSL[Proxy]Protocol to "all -SSLv3",

in accordance with RFC 7568. PR 58349, PR 57120.

Proposed by: kbrand

Reviewed by: ylavic, jorton

  1. … 8 more files in changeset.
merge r1674538, r1677143, r1677144, r1677145, r1677146, r1677149, r1677151,

r1677153, r1677154, r1677155, r1677156, r1677159, r1677830, r1677832,

r1677834, r1677835 from trunk

mod_ssl namespacing

Proposed by: kbrand

Reviewed by: ylavic, jorton

mod_ssl namespacing: Rename ssl_util_ssl.h macros from SSL_foo to MODSSL_foo.

For related discussion, see the dev@ thread starting at:

http://mail-archives.apache.org/mod_mbox/httpd-dev/201504.mbox/%3C20150415163613.GC15209%40fintan.stsp.name%3E

mod_ssl namespacing: Rename SSL_init_app_data2_idx, SSL_get_app_data2,

and SSL_set_app_data2 from SSL_* to modssl_*. Update references in

README.dsov.* files. Rename static variable SSL_app_data2_idx to just

app_data2_idx since the symbol is internal to ssl_util_ssl.c.

mod_ssl namespacing: SSL_read_PrivateKey -> modssl_read_privatekey

mod_ssl namespacing: SSL_smart_shutdown -> modssl_smart_shutdown

mod_ssl namespacing: SSL_X509_getBC -> modssl_X509_getBC

mod_ssl namespacing: Make SSL_ASN1_STRING_to_utf8 a static function inside

ssl_util_ssl.c (no callers outside this file). The new static function name

chosen is convert_asn1_to_utf8, based on the assumption that neither SSL_

nor ASN1_ are safe prefixes to use without potential future overlap.

mod_ssl namespacing: Rename SSL_X509_NAME_ENTRY_to_string to

modssl_X509_NAME_ENTRY_to_string.

mod_ssl namespacing: SSL_X509_NAME_to_string -> modssl_X509_NAME_to_string

mod_ssl namespacing: SSL_X509_getSAN -> modssl_X509_getSAN

mod_ssl namespacing: Make SSL_X509_getIDs a static function inside the

file ssl_util_ssl.c (no outside callers). Rename to just getIDs().

mod_ssl namespacing: SSL_X509_match_name -> modssl_X509_match_name

mod_ssl namespacing: SSL_X509_INFO_load_file -> modssl_X509_INFO_load_file

mod_ssl namespacing: Merge SSL_X509_INFO_load_path() into its only caller

ssl_init_proxy_certs() in ssl_engine_init.c. No functional change.

Review by: kbrand

mod_ssl namespacing: Move modssl_X509_INFO_load_file() into ssl_engine_init.c

and make it a static function called load_x509_info().

mod_ssl namespacing: Move SSL_CTX_use_certificate_chain() into ssl_engine_init.c

and make it a static function called use_certificate_chain().

mod_ssl namespacing: Rename SSL_SESSION_id2sz() to modssl_SSL_SESSION_id2sz().

  1. … 13 more files in changeset.
Follow up to r1705672.

Backport changes that somehow missed the backport process.

  1. … 4 more files in changeset.
Merge r1697855, r1697339, r1696428, r1696266, r1696264, r1695874, r1695727, r1692516, r1692486, r1610674, r1685069, r1693918, r1698116, r1698133, r1694950, r1700968, r1701005, r1701145, r1701178 from trunk:

adding ap_get_protocol(c) which safeguards against NULL returns, for use instead of direct calling ap_run_protocol_get

changed Protocols to let vhosts override servers, removed old H2Engine example from readme

creating ap_array_index in util, forwarding scheme into request processing, enabling SSL vars only when scheme is not http:, delayed connection creation until task worker assignment

removed unnecessary lingering_close and sbh update on end of protocol upgrade handling

introducing ap_array_index in util, used in protocol and mod_h2

fixes existing protocol missing in selection if not explicitly proposed

new directive ProtocolsHonorOrder, added documentation for Protocols feature, changed preference selection and config merging

removed accidental code

new Protocols directive and core API changes to enable protocol switching on HTTP Upgrade or ALPN, implemented in mod_ssl and mod_h2

SECURITY (CVE-2014-0117): Fix a crash in mod_proxy. In a reverse

proxy configuration, a remote attacker could send a carefully crafted

request which could crash a server process, resulting in denial of

service.

Thanks to Marek Kroemeke working with HP's Zero Day Initiative for

reporting this issue.

* server/util.c (ap_parse_token_list_strict): New function.

* modules/proxy/proxy_util.c (find_conn_headers): Use it here.

* modules/proxy/mod_proxy_http.c (ap_proxy_http_process_response):

Send a 400 for a malformed Connection header.

Submitted by: Edward Lu, breser, covener

http, mod_ssl: Introduce and return the 421 (Misdirected Request) status code

for clients requesting a hostname on a reused connection whose SNI (from the

TLS handshake) does not match.

PR 5802.

This allows HTTP/2 clients to fall back to a new connection as per:

https://tools.ietf.org/html/rfc7540#section-9.1.2

Proposed by: Stefan Eissing <stefan eissing.org>

Reviewed by: ylavic

c89

Allowing protocol_propose hooks to be called with offers=NULL, clarifying semantics as proposed by chaosed0@gmail.com

giving ap_array_index a start parameter, adding ap_array_contains

ap_process_request needs exportation for use in mod_h2 on Windows

final final change to the new ap_array_str_* functions after review

changed Protocols default to http/1.1 only, updated documentation, changed ap_select_protocol() to return NULL when no protocol could be agreed upon

mod_ssl: fix compiler warning (bad cast).

improvements in ap_select_protocol(), supplied by yann ylavic

Submitted by: icing, jorton, ylavic, covener, icing, icing, gsmith, icing, icing, ylavic, icing

Reviewed/backported by: jim

  1. … 16 more files in changeset.
Backport r1690137.

Doc and comment fix only

  1. … 11 more files in changeset.
core, modules: Avoid error response/document handling by the core if some

handler or input filter already did it while reading the request (causing

a double response body).

Submitted by: ylavic

Backports: r1482522 (partial, ap_map_http_request_error() things only!),

r1529988, r1529991, r1643537, r1643543, r1657897, r1665625,

r1665721, r1674056

Reviewed by: ylavic, minfrin, wrowe

  1. … 26 more files in changeset.
Merge r1601919, r1650061 from trunk:

mod_ssl: dump SSL IO/state for the write side of the connection(s), like reads.

mod_ssl: follow up to r1601919.

Likewise when set from SNI callback.

Submitted by: ylavic

Reviewed/backported by: jim

  1. … 4 more files in changeset.
Merge r1533765, r1621419, r1638159, r1638188, r1601603, r1638412, r1418763 from trunk

ssl: Axe needless string duplication in setup for call to apr_proc_create()

Fix sscanf format spotted by cppcheck

fix indent.

fix style

Private function doesn't need ap_ prefix.

tab vs space

rename variables: s should be the server_rec

Submitted by: trawick, jailletc36, jailletc36, jailletc36, takashi, jailletc36, sf

Reviewed by: jailletc36, ylavic, covener

Backported by: jailletc36

  1. … 8 more files in changeset.
Merge r1633031, r1633522, r1633529, r1633530 from trunk

Style fix

Submitted by: jailletc36

Reviewed by: jailletc36, jim, ylavic

Backported by: jailletc36

  1. … 4 more files in changeset.
Merge r1526168, r1527291, r1527294, r1527295, r1527926 from trunk:

Streamline ephemeral key handling:

- drop support for ephemeral RSA keys (only allowed/needed

for export ciphers)

- drop pTmpKeys from the per-process SSLModConfigRec, and remove

the temp key generation at startup (unnecessary for DHE/ECDHE)

- unconditionally disable null and export-grade ciphers by always

prepending "!aNULL:!eNULL:!EXP:" to any cipher suite string

- do not configure per-connection SSL_tmp_*_callbacks, as it is

sufficient to set them for the SSL_CTX

- set default curve for ECDHE at startup, obviating the need

for a per-handshake callback, for the time being (and also

configure SSL_OP_SINGLE_ECDH_USE, previously left out)

For additional background, see

https://mail-archives.apache.org/mod_mbox/httpd-dev/201309.mbox/%3C52358ED1.2070704@velox.ch%3E

Follow-up fixes for r1526168:

- drop SSL_TMP_KEY_* constants from ssl_private.h, too

- make sure we also disable aNULL, eNULL and EXP ciphers

for per-directory SSLCipherSuite directives

- apply the same treatment to SSLProxyCipherSuite

Increase minimum required OpenSSL version to 0.9.8a (in preparation

for the next mod_ssl commit, which will rely on the get_rfcX_prime_Y

functions added in that release):

- remove obsolete #defines / macros

- in ssl_private.h, regroup definitions based on whether

they depend on TLS extension support or not

- for ECC and SRP support, set HAVE_X and change the rather awkward

#ifndef OPENSSL_NO_X lines accordingly

For the discussion prior to taking this step, see

https://mail-archives.apache.org/mod_mbox/httpd-dev/201309.mbox/%3C524275C7.9060408%40velox.ch%3E

Improve ephemeral key handling (companion to r1526168):

- allow to configure custom DHE or ECDHE parameters via the

SSLCertificateFile directive, and adapt its documentation

accordingly (addresses PR 49559)

- add standardized DH parameters from RFCs 2409 and 3526,

use them based on the length of the certificate's RSA/DSA key,

and add a FAQ entry for clients which limit DH support

to 1024 bits (such as Java 7 and earlier)

- move ssl_dh_GetParamFromFile() from ssl_engine_dh.c to

ssl_util_ssl.c, and add ssl_ec_GetParamFromFile()

- drop ssl_engine_dh.c from mod_ssl

For the standardized DH parameters, OpenSSL version 0.9.8a

or later is required, which was therefore made a new minimum

requirement in r1527294.

PR 55616 (add missing APLOGNO), part 2

Submitted by: kbrand

Reviewed/backported by: jim

  1. … 24 more files in changeset.
Merge r1470679, r1477094 from trunk:

core, mod_ssl: Lift the restriction that prevents mod_ssl taking

full advantage of the event MPM. Enable the ability for a module

to reverse the sense of a poll event from a read to a write or vice

versa.

Update the docs to note that SSL now works with the event MPM as per r1470679.

Submitted by: minfrin

Reviewed/backported by: jim

  1. … 11 more files in changeset.
Merge r1425874, r1426850 from trunk:

mod_ssl: add support for subjectAltName-based host name checking in proxy mode

(PR 54030)

factor out code from ssl_engine_init.c:ssl_check_public_cert()

to ssl_util_ssl.c:SSL_X509_match_name()

introduce new SSLProxyCheckPeerName directive, which should eventually

obsolete SSLProxyCheckPeerCN

ssl_engine_io.c:ssl_io_filter_handshake(): avoid code duplication

when aborting with HTTP_BAD_GATEWAY

Fix warning about discarding 'const' qualifier from pointer

Submitted by: kbrand, sf

Reviewed/backported by: jim

  1. … 12 more files in changeset.
Merge r1375584 from trunk:

* modules/ssl/ssl_engine_io.c (ssl_io_filter_handshake): Add a

wildcard common name match.

PR: 53006

Submitted by: jorton

Reviewed/backported by: jim

  1. … 2 more files in changeset.
Merge r1328325, r1328326:

When receiving http on https, send the error response with http 1.0

It is important that we send a proper error status, or search engines

may index the error message.

Remove the link in the speaking-http-on-https error message.

With SNI, the link will usually be wrong. So better send no link at all.

PR: 50823

Reviewed by: sf, jorton, trawick

  1. … 5 more files in changeset.
Backport r1209766, r1210252, r1210284:

Add lots of unique tags to error log messages

ssl_util.c: Downgrade some dynamic locking messages from level DEBUG

to TRACE1-3

  1. … 164 more files in changeset.
merge r1203491 from trunk:

drop SSLv2 support (set SSL_OP_NO_SSLv2 for any new SSL_CTX)

  1. … 6 more files in changeset.