Jim Jagielski
on 02 Mar 14
Merge r1546804, r1553824, r1554192, r1555463, r1555467, r1563417, r1564760, r1565081 from trunk:

Throw away the myCtxVar{Set,Get} abominati… Show more
Merge r1546804, r1553824, r1554192, r1555463, r1555467, r1563417, r1564760, r1565081 from trunk:

Throw away the myCtxVar{Set,Get} abomination and introduce

a pphrase_cb_arg_t struct instead, for passing stuff between

ssl_pphrase_Handle and ssl_pphrase_Handle_CB. Prefer struct

members instead of using additional local variables, to make

the data flow more transparent. (Doesn't "vastly simplify"

the code yet, but hopefully we'll get there when further

stripping down ssl_pphrase_Handle.)

Remove the hardcoded algorithm-type dependency for the SSLCertificateFile

and SSLCertificateKeyFile directives, and deprecate SSLCertificateChainFile

Splitting the patch into smaller pieces turned out to be infeasible,

unfortunately, due to the heavily intertwined code in ssl_engine_config.c,

ssl_engine_init.c and ssl_engine_pphrase.c, which all depends on the

modssl_pk_server_t data structure. For better comprehensibility,

a detailed listing of the changes follows:


- drop the X509 certs and EVP_PKEY keys arrays from modssl_pk_server_t

- use apr_array_header_t for cert_files and key_files

- drop tPublicCert from SSLModConfigRec

- drop the ssl_algo_t struct and the SSL_ALGO_* and SSL_AIDX_* constants


- change to apr_array_header_t for SSLCertificate[Key]File

- drop ssl_cmd_check_aidx_max, i.e. allow an arbitrary number of certs

 and keys (in theory; currently OpenSSL does not support more than

 one cert/key per algorithm type)

- add deprecation warning for SSLCertificateChainFile


- configure server certs/keys in ssl_init_server_certs (no longer via

 ssl_pphrase_Handle in ssl_init_Module)

- in ssl_init_server_certs, read in certificates and keys with standard

 OpenSSL API functions (SSL_CTX_use_*_file), and only fall back to

 ssl_load_encrypted_pkey when encountering an encrypted private key

- drop ssl_server_import_cert, ssl_server_import_key, ssl_init_server_check,

 and ssl_init_ctx_cleanup_server

- move the "problematic re-initialization" check to ssl_init_server_ctx


- use servername:port:index as the key identifier, instead of the

 previously used servername:port:algorithm

- ssl_pphrase_Handle overhaul: remove all cert/public-key handling,

 make it only load a single (encrypted) private key, and rename

 to ssl_load_encrypted_pkey

- in the passphrase prompt message, show the private key file name

 instead of the vhost id and the algorithm name

- do no longer supply the algorithm name as an argument to "exec"-type

 passphrase prompting programs


- drop ssl_util_algotypeof, ssl_util_algotypestr, ssl_asn1_keystr,

 and ssl_asn1_table_keyfmt


- drop SSL_read_X509

- constify the filename arg for SSL_read_PrivateKey

CodeWarrior compiler doesnt allow vars as struct inits.

Remove per-certificate chain handling code (obsoleted by;a=commitdiff;h=b9fa413a08d436d6b522749b5e808fcd931fd943)

make the ppcb_arg initialization a bit more uniform and easier to read

Followup fix for r1553824:

also pass the file name to ssl_load_encrypted_pkey, to make sure that we

retry with the same filename we used for SSL_CTX_use_PrivateKey_file first

With OpenSSL 1.0.2 or later, enable OCSP stapling in a loop based on

SSL_CTX_set_current_cert(), near the end of ssl_init_server_ctx.

update APLOGNO for r1564760

Submitted by: kbrand, fuankg, kbrand, kbrand, kbrand, kbrand, kbrand

Reviewed/backported by: jim

Show less