Checkout Tools
  • last updated 4 hours ago
Constraints: committers
Constraints: files
Constraints: dates
Backport fix for CAN-2004-0885:

* modules/ssl/ssl_engine_kernel.c (ssl_hook_Access): Ensure that a

correct cipher suite has been negotiated, else deny access.

* modules/ssl/ssl_engine_init.c (ssl_init_ctx_protocol): With OpenSSL

0.9.7, prevent session resumption during a renegotiation to force the

client to negotiate a new (and acceptable) cipher suite.

PR: 31505

Submitted by: Hartmut Keil <Hartmut.Keil>, Joe Orton

Reviewed by: jorton, pquerna, minfrin, wrowe

  1. … 1 more file in changeset.
Backport from HEAD: add "SSLUserName" directive to set r->user based

on a chosen SSL environment variable name.

* modules/ssl/mod_ssl.h (struct SSLDirConfigRec): Add

szUserName field.

* modules/ssl/ssl_engine_config.c (ssl_config_perdir_create,

ssl_config_perdir_merge): Initialize and merge szUserName field.

(ssl_cmd_SSLUserName): New function.

* modules/ssl/ssl_engine_kernel.c (ssl_hook_Fixup): Set r->user to

the value of the chosen SSL environment variable.

* modules/ssl/mod_ssl.c: Add SSLUserName config directive.

PR: 20957

Submitted by: Martin v. Loewis

Reviewed by: trawick, jorton, nd

  1. … 5 more files in changeset.
Backport from HEAD:

* modules/ssl/ssl_engine_kernel.c (ssl_hook_UserCheck): Fix buffer

overflow in FakeBasicAuth code if client's subject DN exceeds 6K in

length (CVE CAN-2004-0488); switch to using apr-util base64 encoder


* modules/ssl/ssl_engine_init.c (ssl_init_Engine): Log the OpenSSL

error stack contents if engine load/init fails.

* modules/ssl/ssl_engine_log.c (ssl_log_ssl_error): Use %lu to print

an unsigned long.

* modules/ssl/ssl_engine_log.c (ssl_log_annotate, ssl_log_annotation,

ssl_log_ssl_error): const-ify annotation strings and simplify


Reviewed by: Andr�� Malo, Jeff Trawick

  1. … 5 more files in changeset.
fix name of The Apache Software Foundation

  1. … 158 more files in changeset.
apply Apache License, Version 2.0

  1. … 38 more files in changeset.
update license to 2004.

  1. … 274 more files in changeset.
Backport from 2.1.

*) mod_ssl: Fix segfaults after renegotiation failure. PR 21370

[Hartmut Keil <>]

Reviewed by: Jeff Trawick, Joe Orton, Sander Striker

  1. … 3 more files in changeset.

* mod_ssl: Fix FakeBasicAuth for subrequests, by declining check_user_id.

Otherwise it would run into the check that was to protect from externally

fabricated Authorization headers, which would choke on the one added

by mod_ssl itself.

* mod_ssl: Add error msg for the case when FakeBasicAuth is tried to be

tricked. IOW, when someone tries to spoof his identity.

Reviewed by: Jeff Trawick, Greg Stein

  1. … 2 more files in changeset.
SECURITY [CAN-2003-0192]: Fixed a bug whereby certain sequences

of per-directory renegotiations and the SSLCipherSuite directive

being used to upgrade from a weak ciphersuite to a strong one

could result in the weak ciphersuite being used in place of the

strong one.

  1. … 1 more file in changeset.

Backport the RSA SSL-C compatibility changes. More work remains because

not all of the headers required for the 'openssl way' of doing things

are in the headers from the binary distribution. While the source distro

doesn't suffer as many problems, we should find ways to individually

cripple those features for the binary distro that most users will have


Mucho thanks to Trawick for his efforts in keeping the patch in sync.

  1. … 8 more files in changeset.

Reapply the fix *intended* by rev 1.79 in a safer manner. Prior to

all assignments and the final SSL_free(), free ssl_conn->client_cert

to avoid leaks of this refcounted X509*. Prereleasing refcounted

objects is unsafe programming; fix applied to both branches.

  1. … 1 more file in changeset.

EVP_PKEY_free() is refcounted on OpenSSL, but NOT under RSA SSL-C.

Eliminate a number of test failures by conditionally reverting rev 1.79

pubkey handling in ssl_engine_kernel.c, except under OpenSSL.

Also revert a rev 1.79 bogisity for all toolkits; it's entirely bogus

to release a refcount after setting aside the results in a persistant

structure, in this case sslconn->client_cert from SSL_get_peer_certificate()

mustn't be freed while sslconn is still in play. The proper patch (not

written yet) is to invoke the X509_free(sslconn->client_cert) when we

cleanup the sslconn structure.

A cosmetic change to 1.79 - a real X509 *cert is in play, don't use

that same variable to retrieve/release the quick lookup and discard

of the peercert.

update license to 2003.

  1. … 265 more files in changeset.

Fix a nasty segfault, that there's a stack buffer we are trying to free!

Revert this 'memory leak' patch from the 1.79 rev.